DevOps in Regulated Software Development: Case Medical Devices

TLDR

DevOps is popular in software, but its adoption in regulated medical device development is limited due to strict compliance, audit, and approval requirements, making research on the topic scarce. The paper examines how well DevOps fits into regulated medical device software development. The study analyzes IEC 62304 and IEC 82304‑1 to identify obstacles and benefits of applying DevOps to medical device software. The standards create obstacles to continuous delivery and integration, but appropriate development tools can support traceability and documentation requirements.

Abstract

DevOps and continuous development are getting popular in the software industry. Adopting these modern approaches in regulatory environments, such as medical device software, is not straightforward because of the demand for regulatory compliance. While DevOps relies on continuous deployment and integration, regulated environments require strict audits and approvals before releases. Therefore, the use of modern development approaches in regulatory environments is rare, as is the research on the topic. However, as software is more and more predominant in medical devices, modern software development approaches become attractive. This paper discusses the fit of DevOps for regulated medical device software development. We examine two related standards, IEC 62304 and IEC 82304-1, for obstacles and benefits of using DevOps for medical device software development. We found these standards to set obstacles for continuous delivery and integration. Respectively, development tools can help fulfilling the requirements of traceability and documentation of these standards.