how to validate cloud-based software tools Before we go to validation of software validation let us understand that what is cloud based software and what the guidance and regulation applicable for that. One good point is that FDA states that you need to prepare document wherein you will list out all testing requirement in specific software. FDA requirement is therefore not specific for normal software or cloud-based software. Cloud software is totally in control of its maker and even changes are also in continuous mode and they are also in their control. So, the question arises how you monitor changes with respect to revalidation when initially you validated the cloud-based software. Assuming that people involved in above activity are familiar with Software verification and Validation (Both different aspect), we go further in explaining this concept. Regarding validation, there are three distinct areas wherever validation is required once building a medical device: 1. validating software that is whole a medical device or is an element of a medical device 2. validating software that is used to build/test/deploy medical device software 3. validating software that is utilized in maintaining records associated with the medical device Let us first deal with 2nd and third type activity. In general (not specific to medical device) now many clod-based software’s are available and are popular also like Microsoft azure, Google cloud. So, using a locally installed tools software and then validating with cloud-based software tool is cumbersome exercise and time consuming. If you want to switch to cloud based version then you also need to understand Continuous validation which has to happen automatically (Trigger testing need on every update of software so it becomes easy and quick to validate the changed part) This happens in short time frame usually in hours or some time less than hour. While in case of periodic validation may become necessary in cloud software tool when significant change happens in software. So, both elements are essential for validation. For example, if medical device software is built using cloud computing, then it is not sufficient to only periodically (re-)validate, as cloud software version changes can occur at any time and such changes. If not validated immediately, this could have an adverse effect on the medical device’s behaviour if a breaking change in the cloud software occurred. (Typical case 1 situation described above) Likewise, if the cloud software under validation is responsible for managing, recording, and keeping data about a medical device, an automated approach would be preferable to a periodic approach, so that there is never any risk of compromise to the integrity of the records due to a cloud software change. In handling both above cases you need to have an expert software developer who can design auto test or manual tests but generated automatically with cloud software change. If you do not have that resource, then Periodic validation is an answer.
One of the important aspects is consideration of cost. In general, initial cost is higher on cloud-based software but later changes involve hardly any significant cost on subsequent changes. In conclusion cloud computing in medical device is possible if risks are evaluated and they are mitigated using appropriate validation strategy.