|
The Central Drugs Standard Control Organisation (CDSCO) has mandated stringent quality management systems (QMS), supply chain cybersecurity controls, and continuous post-market surveillance obligations for all medical device software operating in India.
Detailed in the final guidance document released by the regulator, the standards align India’s medical software framework with international ISO/IEC quality and cybersecurity benchmarks.
A central feature of the new compliance rules is the requirement for manufacturers to maintain a comprehensive Software Bill of Materials (SBOM). The SBOM must inventory all third-party software components, open-source libraries, and commercial off-the-shelf (COTS) software integrated into the medical application. This measure is designed to facilitate rapid vulnerability identification and prevent supply-chain security risks in healthcare software.
The QMS requirements for medical device software are structured around three core standards, such as IS/IEC 62304 for software lifecycle processes, IS/ISO 14971 for risk management, and IS/IEC 82304-1 for health software safety. Manufacturers must establish documented procedures covering design controls, code verification, traceability matrices, defect tracking, and automated patch management to maintain software integrity throughout its operational life.
In terms of cybersecurity, the guidance requires robust data encryption protocols, secure user authentication, and protection against unauthorized access or data corruption. Software systems designed to integrate with electronic health record platforms must adhere to India’s evolving digital health ecosystem, ensuring standards-based interoperability and consent-driven health data exchange under privacy frameworks.
Post-market obligations have been significantly strengthened, with manufacturers mandated to establish mechanisms for continuous performance tracking using Real World Data (RWD) and Real World Evidence (RWE). Software developers must submit Periodic Safety Update Reports (PSUR) and establish reporting mechanisms for Suspected Unexpected Serious Adverse Events (SUSAR) or cybersecurity breaches affecting patient data safety.
The regulator specified that software updates designed to patch cybersecurity vulnerabilities must be executed promptly, with critical security fixes exempted from lengthy re-licensing protocols provided they do not alter the device's fundamental performance. However, documented risk analyses and verification logs (documented proof of testing and validation) for security patches must be retained for regulatory inspection.
The comprehensive focus on cybersecurity and QMS standards ensures that medical software deployed in Indian clinical settings meets international safety and security requirements. QA heads and digital health compliance officers have been advised to conduct immediate audits of their software lifecycle controls and supply chain inventories to ensure full compliance with the notified standards.
|