> I'm struggling to understand the question - by testing for compliance like other software? Medical software is a different beast, compared to, say, your next

> I'm struggling to understand the question - by testing for compliance like other software? Medical software is a different beast, compared to, say, your next online shop or bloggin plattform. Bugs in medical software can (and will) kill people. My work takes me to medical software development courses on a regular base and they usually consist of looking at the ways, medical software can kill people; sadly often enough by example. One case for example was a PACS system where due to a bug in the way the database managed timestamps only the very first of a series of pictures was shown to the user. And since once could not navigate the pictures via "previous" and "next", but one always had to go through a purely text based menu (this was in the mid 1990-ies, where memory was scarse) it was not immediately apparent that only the first image in a time series was shown. Enter the patient with a tumor; when it was finally realized the images the medtech took were not the same the specialist saw it was already too late for the patient and tumor growth progression too far advanced. So your medical database software kills someone (prescription error due to wrong dataset shown or such), how do you determine whose liability it is/was? Medical software certification is in large part about identifying what harms to a patient could be done and which parts of the software may cause it. You don't even rule out in a "this can't happen" way, but it goes like: - patient dies: no matter how well it was tested, these are the possible offenders in the program - patient gets seriously harmed: no matter how well it was tested, these are the possible offenders in the program - patient gets injured: no matter how well it was tested, these are the possible offenders in the program The bottom line is you're ending up with something that is either close to or outright is waterfall. And even more important: These are the components a program uses, what possible failure modes are there that could harm patients. So they're using CouchDB? Well, is CouchDB medically certified (AFAIK not), so this is considered SOUP (Software Of Unknown Pedigree) which means that to legally use this in medical applications you have to certify the SOUP yourself. Oh and putting medical records into the Cloud? What could possibly go wrong…