We test electronic health records, telemedicine platforms, connected devices and software that is itself a medical device. The work is planned against the clauses your reviewer will cite, and it produces the traceability, the protocols and the defect records an audit asks to see. Compliance itself stays yours.
We test against the requirements in these standards and prepare the artefacts an auditor asks for. Compliance itself is held by the organisation that ships the product.
We sign a Business Associate Agreement before any engagement that touches PHI.
Regulatory
A reviewer picks a requirement and follows it to the test that covers it. Where the trail stops, the submission turns into a deficiency letter, and the launch date moves by however long the response cycle takes.
The trail is built while the work happens. Reconstructing it after the questions arrive costs more and convinces less.
Legal and reputational
Notification clocks start before anyone knows the scope. The people who have to be told include patients, regulators and the customers who trusted you with their own obligations.
Test environments that never hold real patient data remove most of the exposure before a test is ever written.
Product
A dose, an allergy flag or a result lands in the wrong field, and the person reading it has no reason to doubt it. The defect is found by the patient rather than by the release.
Clinical workflows get tested as workflows, with the data conditions that make them fail, rather than as screens.
It gets produced during the testing, because a reviewer picks a requirement and follows it to the test that covers it, then to the result and to any defect it raised. Assembling that trail afterwards means reading old tickets and reconstructing intent. IEC 62304 puts the trace inside the development process for that reason, and an auditor can tell which way round it was done.
No. Production records in a test environment turn every export, every screenshot and every debug log into an incident waiting for someone to notice. Synthetic records and de-identified extracts cover the same test cases and remove that class of incident before the first case is written.
The defects that reach patients are the ones that look correct on screen. A crash gets reported by the first person who sees it. A medication list that drops an entry after a patient merge, or an allergy flag that fails to survive an HL7 v2 to FHIR translation, is read as correct by the clinician acting on it. Those paths get tested as clinical workflows, with the data conditions that break them.
You do. IEC 62304 calls it SOUP, software of unknown provenance. Clause 5.3 wants functional and performance requirements for each item, and clause 7.1 wants the published anomaly lists evaluated against your own hazards. A dependency list generated from a package manifest answers neither question.
What breaks in medical billing software, why the defects pass every schema check, and which published artefact a claim has to be tested against.
HL7 v2, FHIR R4, ASC X12N 005010, ICD-10-CM, ICD-10-PCS
What breaks in an electronic health record under test, which certification and privacy rules a record system answers to, and where the interface and migration defects concentrate.
HL7 v2, FHIR R4, ICD-10
Why a connected medical device is tested against a network its manufacturer does not own, and why a vulnerability in a third party component becomes a design question instead of a ticket.
HL7 v2, DICOM, FHIR R4
What breaks in a patient portal driven by an untrained user, why HIPAA leaves proxy eligibility to state law, and what a suite has to cover on the identity, delegation and patient rights paths.
FHIR R4, HL7 v2
What breaks in EDC and randomisation systems, why the trial record has to stay readable after the software is switched off, and why a test that reveals a treatment assignment is a defect.
FHIR R4, DICOM, HL7 v2
What breaks when readings arrive continuously from outside the clinic: gaps, duplicates, readings out of order, clocks that disagree, and what the system does while nothing arrives.
HL7 v2, FHIR R4
Why SaMD test records sit inside the regulatory file, which classification decides how much testing binds, and what an assessor opens first when the software is the device.
What breaks in a telemedicine platform once the call leaves the office network, which standards reach it, and how the encounter record is checked after the consultation ends.
HL7 v2, FHIR R4, ICD-10
Answer four questions about your markets, your product type and its integrations. You get the standards that reach you, the artefacts each one asks you to produce, and which of them a test supplier delivers.