Identify your intended function of cloud computing.
Determine whether cloud computing is a good fit for you with a risk-based approach.
Identify how frequently your cloud computing resource updates and criteria for revalidation.
Determine how your cloud computing vendor could adversely impact your process or device.
Establish a contingency plan for cloud computing-based adverse events.
Develop a process to detect cloud computing resource updates and/or resulting adverse events.
The task group, including co-chair Pat Baird, head of global software standards at Philips, assembled a team of industry experts to determine how cloud computing is different than other technologies that have made their way into regulated medical devices over the last several decades.
“The key insight we arrived at was that public cloud computing has challenged the traditional notion of control in a validated state—that I as a medical device manufacturer control every aspect of this device or system,” Horton said. “By introducing a modern, distributed, and abstracted model of computing, you’re trading away some control for increased reliability, richer feature sets, enhanced security, and a far more flexible model for infrastructure scaling.”
“The bottom line is that with the cloud, your medical device is living in a wonderful, but more chaotic world,” he added. “And that’s OK, so long as you understand and explicitly acknowledge this change, gather the necessary knowledge, incorporate that into your risk analysis, and then make thoughtful design decisions.”
Following the success of CR510, the AAMI Standards Board has approved development of a new technical information report (TIR) that will further explore best practices on this important subject by providing additional conceptual and practical guidance. Parties interested in participating in the TIR subcommittee should contact standards@aami.org.
Looking Beyond the Cloud
This CR and upcoming TIR are part of AAMI’s larger strategy to address the changing medical device landscape in the wake of sophisticated, disruptive technologies that bring new value to medical devices. Artificial intelligence in medical devices and programs, for instance, may change how they perform as their machine learning algorithms are exposed to new datasets, subverting premarket regulatory checks.
On Jan. 12, 2021, the U.S. FDA released its Artificial Intelligence/Machine Learning (AI/ML)-Based Software as a Medical Device (SaMD) Action Plan. The action plan describes a “multipronged approach to advance the agency’s oversight of AI/ML-based medical software.”
As part of the Action Plan, the FDA is having liaisons participate in the ongoing standardization efforts of the new AAMI AI Committee. The committee is currently collaborating with BSI to create new risk management standards for AI/ML use in medical devices–specifically addressing the problems posed by changing algorithms and subverted human expectations.
Back to HCB News
