Do we need to SPICE up the Medical Device Sector?

The recent preparation of Medical SPICE, bringing a process improvement model out in the German- speaking world, raises a few interesting questions. The most important of these is: do we need a process improvement model in the medical device sector?

This is not the first attempt to introduce a process improvement model to the medical device sector. A team at Dundalk Institute of Technology prepared a model 10 years ago. The second incarnation came from the VDI 5702 and has so far focused on software activities in IEC 62304. Although this is a good starting point, it needs to cover far more than this one area. This is similar to the situation with IEC 81001-5-1, which limited cyber security to being a software topic, but many other factors feed into these security vulnerabilities.

As a consultancy, active in both automotive and medical device sectors, we work with Automotive SPICE (Software Process Improvement Capability Determination) on a regular basis. So, we are fairly neutral on the topic.

The slightly tung-in-cheek picture is something we first used 4 years ago. The question is: can this type of model really work in the medical device sector?

The Advantages

SPICE is generally aimed at developers and primarily provides guidance on how to capture the key aspects of the activities that the processes address.

• The key activity of requirements management

• The consideration of alternatives when defining the architecture

• Bi-directional traceability between requirement levels and across to verification cases

• Guidance on the definition of architectural and detailed design

• From SPICE Level 2 upwards, proving continuous improvement

As an organization, we have presented SPICE to many medical device companies as part of our IEC 62304 Advanced course. This has created some interest among developers, but no great rush to adopt process improvement.

Automotive companies do accept Automotive SPICE with enthusiasm, hence the large increase in its use in Asia over the last few years.

The challenges

One major difference between the medical device sector and the automotive sector is the size of the organization. Many medical device companies have 50 or fewer employees. As a light-hearted example in Figure 1, consider the sheer number of documents the industry is burdened with. Over and above the number of documents, there are organizations such as the FDA and Notified Bodies that need to be convinced of the integrity of the development.

For these smaller organizations, there are already significant costs associated with regulation, and SPICE assessors don’t come for free. So, it would ultimately be a question of the value that SPICE might bring.

The rating of capability indicators in the automotive world has proved to be more complicated than perhaps it could be, which is another potential downside to SPICE.

Ultimately, the drive for SPICE in the medical device sector has come from Europe, but how would these things be viewed by the FDA? Medical device software development is already viewed differently on both sides of the Atlantic and there is no common approval process.

There has also been some concern in reliability circles about the value of Capability Maturity Model Integration (CMMI) in terms of improving software reliability. There is a good discussion in the Quanterion 217+ Reliability Prediction Models about the value of CMMI as a process improvement model, particularly above Level 3. So again back to the considering what value Medical SPICE might bring to organizations.

One of the biggest challenges in medical device standardization is keeping a given standard synchronized with other such documents. Therefore, Medical SPICE is another source that would need to be updated regularly to keep in line with the state of the art. IEC 60601-1 Amd2 from 2020 was pretty much a resynchronization activity.

As mentioned above, for all medical devices apart from the lowest class devices (Class I in the US and Europe) require an approval body to enable a market release. A quality management system such as 21 CFR 820 or ISO 13485 is also a must.

How willing will the large number of small medical device companies be to respond to the need to justify their processes, on top of the annual and unannounced audits?

Further Activities

Discussions will continue in 2023 on further activities to roll out Medical SPICE, waiting to see how successful process improvement is adopted in the industry. As mentioned above, there are both advantages and disadvantages, and this process improvement model may only appeal primarily to larger organizations.

If you would like to find out more about process improvement models join us on one of our IEC 62304 Advanced or ISO 26262 training courses.

By Alastair Walker, Consultant & Owner