Cloud Technology: A new and rapidly growing technology, cloud computing is changing how medical device developers think about data and computational costs. However, for medical devices and quality systems, the benefits of cloud computing come with a new set of risks. That’s why experts from industry, regulatory consulting, and academia recently pooled their knowledge to develop a new consensus report (CR) with the Association for the Advancement of Medical Instrumentation (AAMI)®.
Titled CR510, Appropriate use of public cloud computing for quality systems and medical devices, the new document provides guidance regarding the appropriate use of public cloud computing both as a component of medical devices and in support of quality systems.
“Cloud technology providers, medical device manufacturers, regulatory professionals and regulators alike should be able to refer to this document to identify known best practices for ensuring that the public cloud computing component of any medical device (or quality system component) works both within the spirit and the letter of regulations designed to ensure that medical devices improve patient outcomes and/or help manage healthcare costs, while also being safe and effective,” wrote the document’s authors, members of a task group developed under the auspices of the AAMI QM-WG01 Application of Quality Systems to Medical Devices Working Group.
The Trouble with Change
“When medical devices are approved, they are under strict change control. Any change they undergo must be assessed to determine if it requires resubmission for approval by regulators like the U.S. FDA,” explained Joe Lewelling, senior advisor on content & strategy at AAMI. “That’s fine when you control everything, but when you are using cloud computing, you’re working with a service provider and your computing/functions could be affected by changes in their software protocol.”
“So, how do you do this safely and effectively? How do you account for this?” Lewelling asked. “This is the first document really addressing this question in terms of medical devices.”
“Cloud computing has made it that the traditional notion of control in a validated state—that I control every aspect of this device or system—is gone. Your medical device is living in a new, semi-chaotic world,” added Randy Horton, Vice President of Solutions and Partnerships at Orthogonal, who co-chaired the CR510’s task group. “And that’s OK… so long as you acknowledge what has changed, gather the necessary knowledge, and incorporate that into your risk analysis.”
Following the success of CR510, the AAMI Standards Board has approved development of a new technical information report (TIR) that will further explore best practices on this important subject by providing additional conceptual and practical guidance. Parties interested in participating in the TIR subcommittee should contact standards@aami.org.