Certification Requirements

Manufacturing standards in most countries include quality assurance (QA) systems among their requirements for the production, and testing, of all medical device classes. In the EU and now Canada this is covered by ISO 13485:2003, whereas in the United States manufacturers must follow good manufacturing practice / quality systems (GMP/QS) standards. National requirements are being compiled below.

Canada has moved ahead of European countries in having declared patient management software to be a medical device, but European countries could follow. Some of the issues resulting from this reclassification in Canada have been discussed in a free audio podcast at CanadianEMR blog.

It is not yet clear that regulatory agencies fully enough understand what is different about free (as in "liberated") open source software. In the main, that it may be "owned" by a community, and devoid of contractual relationship to the installed user base. While some FLOSS software is owned by for-profit or non-profit commercial entities, other models include that of the Linux Foundation, a nonprofit consortium which does not own Linux but is dedicated to fostering its growth. The Linux Foundation is incorporated as a "nonprofit mutual benefit corporation" which, in addition to managing the Linux trademark on behalf of its owner Linus Torvalds, "promotes, protects, and standardizes Linux and open source software."

A point of view on this is drafted here.

The specific situation of GNUmed is further described here.


Effective August 31, 2009 Canada regulatory authorities have declared patient management software ("software") to be a Class II Medical Device.

Enabling statute
Medical Device Regulations
Regulator's Notice of Classification
Reference Guide for industry
Introduction http://www.ic.gc.ca/eic/site/md-am.nsf/eng/hi00012.html
Reference Guide for industry
Canadian section http://www.ic.gc.ca/eic/site/md-am.nsf/eng/hi00038.html
Canadian Medical Devices Conformity Assessment System (CMDCAS)
Health Canada Inspection Strategy

Licensure requirements:
  • Before health-related software can be licensed in Canada, the applicability of the regulations is to be determined in compliance with the Regulator's Notice of Classification (above) with unofficial rules of thumb captured as software scenarios.
  • Class II-IV Medical Devices of which EMR software is now deemed Class II must be issued a quality management system certificate as conforming to ISO 13485:2003. The certificate must be issued by a Health Canada recognized registrar of which there were most recently 14 (three of which are a branch company) – see here for listings.
  • Health Canada advises that with respect to CMDCAS' own requirements:
    1. CMDCAS, from a QMS content standpoint, expects that the QMS procedures will incorporate the applicable sections of Canada's Medical Devices Regulations. Even had this not been mentioned in the CMDCAS guidance document GD210, it is already an interpretive requirement of ISO 13485. What this means is that over and above what the ISO 13485 may itself require, any country can elect to further define requirements for example in specific sections of the ISO standard. CMDCAS does this for Medical Devices.
    2. CMDCAS does not impose any format on manufacturers' quality management system (QMS) documentation. Accordingly, while various companies (not all of whom are registrars) offer templates to guide and assist documentation and quote total costs of USD $30,000 - $40,000, the standard is itself highly prescriptive, allowing organizations to work directly from the standard.
    3. The ITAC (Advisory Committee) to Health Canada has suggested that for most vendors, compliance would involve two major stages. The first stage would be to determine what changes each organization must make in order to obtain ISO certification, and then to undertake those changes. The second stage would involve certification by an authorized ISO registration agent on whose availability, time and resource constraints the vendor would depend. A realistic time frame for undertaking both stages was suggested to be in the range of 36 to 48 months.(Reference 1)
    4. Over and above medical device certification, some but not all registrars offer product certification. Various registrars' estimates for the costs they would charge for certifying an EMR have varied from USD $3,500 to $10,000 plus the travel and accommodation costs for the registrars' site visit. Product certification arises when an establishment would package components that include one or more medical devices, such as patient management software into a pre-configured server or other appliance. These may require product certification e.g. satisfying electrical standards. Note that in ISO 13485, the term "product" can also mean "service".
  • Health Canada additionally requires the completion and submission of an Application for a New Medical Device Licence, and levies fees (all prices quoted in Canadian dollars) as follows:
  • Once properly licensed, the software can be sold and distributed to any company that wishes to acquire it, contingent on their obtaining an Establishment License (below).
  • An amended licence application is required if a SIGNIFICANT CHANGE has been made to a licensed medical device. In this case, SIGNIFICANT CHANGE refers to any modification that results in an altered intended use. Most changes would apparently not be regarded significant, and will not trigger the need for an amended licence application.

Establishments requirements (Vendors and Software Support Organizations [SSOs]):
  • Pursuant to Section 44 of the Medical Devices Regulations, importers, distributors (and suppliers) of a properly licensed software each require an Establishment Licence as described here.
  • Medical Device Establishment Licence Fees of $2,120 must be paid initially, and annually thereafter, by establishments that import or distribute the software, however exemptions include retailers and health care facilities. A fee reduction provision caps charges at 1.0 per cent of the total annual gross revenue from sales in Canada. A ruling may be worth seeking as to whether support services around FLOSS (itself free) would be construed as sales in relation to a requirement for an Establishment Licence.
  • More information on how to get an Establishment Licence can be obtained from the Health Products and Food Branch (HPFB) Inspectorate website and by emailing MDEL_questions_LEPIM AT hc-sc.gc.ca.

United States

  • Relevant requirements include ISO 9001:2008 and the Food and Drug Administration's CFR 21 Part 820: Quality System Regulation – sample of a quality manual here.
  • CCHIT 2011 certifications (functional requirements) including EHR criteria and test scripts are here.

References: #Anchor1 1. ITAC blog OCTOBER 19, 2009 Item 7, bullet 3 – accessed Oct 29, 2009
Topic revision: 05 Nov 2009, JamesBusser
This site is powered by the TWiki collaboration platformCopyright © by the contributing authors. All material on this collaboration platform is the property of the contributing authors.
Ideas, requests, problems regarding Foswiki? Send feedback
Powered by Olark