This paper details the expert review of a framework developed to implement a novel testing approach called taxonomy-based testing (TBT) for the medical device software domain. This framework proposes three approaches to implement TBT and has been validated by experts from the software testing industry and the medical device software domain. This paper details the results from the expert review. The expert review focused on validating the three approaches to TBT, the benefits of TBT to medical device software development, the accuracy of mappings of testing techniques from ISTQB and ISO/IEC/IEEE 29119-4:2015 to defects from a defect taxonomy, the integration of TBT into the standard test processes, ISTQB and ISO/IEC/IEEE 29119-2:2013 and the structure of the framework. The contribution of this paper is to reveal that (i) the framework is implementable in medical device software organisations that follow the IEC 62304:2006+A1:2015 software development process or that use standard test processes, (ii) using a defect taxonomy could standardise the application of experience-based approaches to software testing and (iii) considering potential defects before writing test cases could identify additional defects for test cases.

Health Information Technology Systems (HITS) are increasingly used to improve the quality of patient care while reducing costs. These systems have been developed in response to the changing models of care to an ongoing relationship between patient and care team, supported by the use of technology due to the increased instance of chronic disease. However, the use of HITS may increase the risk to patient safety and security. While standards can be used to address and manage these risks, significant communication problems exist between experts working in different departments. These departments operate in silos often leading to communication breakdowns. For example, risk management stakeholders who are not clinicians may struggle to understand, define and manage risks associated with these systems when talking to medical professionals as they do not understand medical terminology or the associated care processes. In order to overcome this communication problem, we propose the use of the “Three Amigos” approach together with the use of the SIMPLE tool that has been developed to assist patients in understanding medical terms. This paper examines how the “Three Amigos” approach and the SIMPLE tool can be used to improve estimation of severity of risk by non-clinical risk management stakeholders and provides a practical example of their use in a ten step risk management process.

Abstract Defect‐based testing is a powerful tool for finding errors in software. Many software manufacturers avoid this method because it requires a detailed defect taxonomy that is expensive to construct and difficult to validate. The Association for the Advancement of Medical Instrumentation is developing SW91, a defect taxonomy to be published as a standard for health software. This paper details three methods to validate SW91 for its comprehensiveness. The initial validations of SW91 were conducted via mapping vulnerabilities from the common weakness enumeration and a dataset from a medical device software development company in Ireland. Taxonomy‐based testing is another validation method proposed in this research, and its applicability was investigated using empirical data from a medical device software development company in Ireland. Finally, the paper details future plans to implement taxonomy‐based testing to improve software quality in medical device software and to validate SW91. This validation will focus on the efficiency, reliability, and ability to perform useful analyses and defect coverage of SW91.

Abstract The use of networked medical devices can provide a number of benefits such as improved patient safety, a reduction in adverse events and reduced costs of care. Today, medical devices are increasingly designed for incorporation into a hospital's general IT network, which allows devices to exchange critical information. However, connecting devices in this way can introduce risks potentially negating the benefits to patients. While the IEC 80001‐1 standard has been developed to aid Healthcare Delivery Organisations (HDOs) in addressing these risks, HDOs often struggle to understand and implement the requirements. The MedITNet framework has been developed to allow HDOs to assess the capability of their risk management processes against the requirements of IEC 80001‐1. MedITNet provides a flexible assessment framework enabling HDOs to gain a greater understanding of the requirements of the standard and to improve risk management processes by determining their current state and highlighting areas for improvement. This paper examines the challenges faced by HDOs in the risk management of medical IT networks and briefly explains the components of the MedITNet framework and how the framework addresses these challenges. The use of Action Design Research (ADR) in the development and validation of MedITNet is also discussed focusing on a pilot implementation of the assessment method and expert review of the overall framework. The changes to the framework and its components as a result of the validation process are also discussed. Copyright © 2016 John Wiley & Sons, Ltd.

The use of networked medical devices can provide a number of benefits such as improved patient safety, reduced costs of care and a reduction in adverse events. Traditionally, medical devices were placed onto a proprietary IT network provided by the manufacturer of the device. Today, medical devices are increasingly designed for incorporation into a hospital’s general IT network enabling devices to exchange critical information. However, this can introduce risks and negate the potential benefits to patients. While the IEC 80001-1 standard has been developed to aid Healthcare Delivery Organisations (HDOs) in addressing these risks, HDOs may struggle to understand and implement the requirements. The MedITNet framework has been developed to allow HDOs to assess the capability of their risk management processes against the requirements of IEC 80001-1. MedITNet provides a flexible assessment framework enabling HDOs to gain a greater understanding of the requirements of the standard and to improve risk management processes by determining their current state and highlighting areas for improvement. This paper examines the challenges faced by HDOs in the risk management of medical IT networks and briefly explains the components of the MedITNet framework and how the framework addresses these challenges. This paper also details how Action Design Research (ADR) was used in the development and validation of MedITNet.

The incorporation of a medical device into an IT network can introduce risks that may not have been addressed during the design and manufacture of the device. IEC 80001-1 is a lifecycle risk management standard which was developed to address these risks. This paper presents research which has been performed to date which has led to the development of a Process Reference Model (PRM) and Process Assessment Model (PAM) which can be used by Healthcare Delivery Organisations to assess themselves against IEC 80001-1. This paper also presents future work in this area which includes the development of an assessment method for IEC 80001-1 and the validation of the PRM, PAM and assessment method.