Order No. 1236n by the Ministry of Health of the Russian Federation

On the implementation of amendments to the requirements related to the contents of the technical and operational documentation of the producer (manufacturer) of the medical device, as approved by Order of the Ministry of Healthcare of the Russian Federation dated 19 January 2017, no. 11n.

 

In accordance with part 3 of article 38 of Federal Law dated 21 November 2011 no. 323-FZ “On the Fundamentals of Healthcare of the Citizens of Russian Federation” (Collection of Legislative Acts of the Russian Federation, 2011, no. 48, art. 6724) and subclause 5.2.192(1) of the Statute on the Ministry of Healthcare of the Russian Federation as approved by Decree of the Government of the Russian Federation dated 19 June 2012 no. 608 (Collection of Legislative Acts of the Russian Federation, 2014, no. 37, art. 4969), I hereby order:

1. Approve the following amendments to be implemented to the requirements for the contents of the technical and operational documentation of the producer (manufacturer) of the medical device, as approved by Order of the Ministry of Healthcare of the Russian Federation dated 19 January 2017, no. 11n. (registered by the Ministry of Justice of the Russian Federation on 10 March 2017, reg. no. 45896), as amended by Order of the Ministry of Healthcare of the Russian Federation dated 22 April 2019, no. 239n (registered by the Ministry of Justice of the Russian Federation on 25 June 2019, reg. no. 55026).

2. This Order enters into force on 1 January 2021.

 

Minister         

M.A. Murashko

 

APPROVED

By Order of the Ministry

of Healthcare

of the Russian Federation

dated 20 November 2020 no. 1236n

 

AMENDMENTS

to be implemented to the requirements for the contents of the technical and operational documentation of the producer (manufacturer) of the medical device, as approved by Order of the Ministry of Healthcare of the Russian Federation dated 19 January 2017, no. 11n.

 

 

1. In section II:

a) amend the nomenclature with the following wording: “except the software constituting the medical device itself, including the software using artificial intelligence technologies”;

b) in para. 4, after the words “registration dossier for the medical device”, add: “except the software constituting the medical device itself, including the software using artificial intelligence technologies (hereinafter: the software constituting the medical device)”.

2. Supplement section II ¹ as follows:

“II¹. requirements for the contents of the technical documentation

of the producer (manufacturer) of the software

constituting the medical device

5¹. The technical documentation of the producer (manufacturer) for the software constituting the medical device (hereinafter: the technical documentation for the software), provided by the producer (manufacturer) of the software constituting the medical device, or provided by its authorised representative as part of the registration dossier for the software constituting the medical device, shall contain the following:

1) name of the software constituting the medical device and any other information enabling identification of the software constituting the medical device, such as design variants, or a version of the software constituting the medical device.

This technical documentation for the software shall contain a detailed explanation of the numbering of its versions;

2) information about the intended use of the software constituting the medical device, and about its main operational principles;

3) information about the intended users (customers) of the software constituting the medical device;

4) information regarding the interpretative function, data source, hardware platform, and the deployment of the software constituting the medical device, and on access to it;

5) information regarding the classification of the software constituting the medical device, with regard to the class of potential risk associated with the use of the medical device, as per the Nomenclature Classification of Medical Devices1, including notification of the significance of interpretation of the results of the software constituting the medical device, and the conditions of use of the software constituting the medical device;

6) information regarding the presence (or absence) of AI technologies in the software constituting the medical device: and their description (if applicable);

7) description of the integral parts, units, modules of the software constituting the medical device, possibly accompanied with diagrams of the software architecture;

8) information regarding possible changes in the software constituting the medical device, which may (or may not) affect the stability of its functionality and|or operational principle (if applicable);

9) information on how to notify the user about the availability of the most up-to-date version of the software constituting the medical device, and on the related upgrading procedure;

10) characterisation of the accessories pertaining to the software constituting the medical device, other medical or non-medical devices intended for use in combination with the software constituting the medical device, as well as a description of any specific equipment and/or software or test databases developed by the producer (manufacturer) in order to use the software constituting the medical device (if applicable);

11) the list of risks identified during the Risk Analysis Process, and description of the method of risk management applicable in order to mitigate those risks down to an acceptable level;

12) specifications for the software constituting the medical device;

13) hardware and system requirements necessary for the proper operation of the software constituting the medical device (OS supported, hardware platforms, required RAM, disk space, additional software and hardware related requirements);

14) information regarding data communication protocols used for the software constituting the medical device, along with other medical devices and (or) accessories;

15) information regarding the installation/deinstallation procedure for the software constituting the medical device;

16) requirements regarding the training or skills necessary for the personnel performing the installation of the software constituting the medical device (if applicable);

17) data related to the marking or labelling of the software constituting the medical device (if applicable);

18) information regarding the verification and validation of the software constituting the medical device, including test reports for the software constituting the medical device, and results of testing of the software constituting the medical device using test databases;

19) information related to the life cycle processes of the software constituting the medical device, including information about basic development steps of the software constituting the medical device; this may be supported by diagrams, photos and drawings and/or any other appropriate explanatory documentation;

20) information related to similar software constituting the medical device (if any), or about the absence of such information;

21) information regarding safety measures and access restriction techniques applied in relation to the software constituting the medical device, including cyber security measures;

a) information about all cyber security related risks (identification of assets, threats and vulnerabilities etc.);

b) information regarding access restriction procedures for all possible levels, and description of implementation methods (only trusted user access, access with mandatory authentification, etc.);

c) possibilities that the threats and vulnerabilities detected may affect the functionality of the device and its potential customers (users), and the extent of such effect;

d) information regarding the use of automated synchronization methods for the termination of user sessions in the system, if it is necessary for the environment in which the software constituting the medical device is used;

e) information regarding the use of multi-level authorisation and differentiation of user privileges based on the user or device's role in the system;

f) information regarding technical and program security measures used in the software constituting the medical device;

g) procedure for the user authentification necessary before clearance of the software update for the software constituting the medical device, including updates to the OS and application itself;

h) information regarding the need for authorised users to follow routine procedures for the installation and update of the software constituting the medical device;

i) information regarding the need to use malware protection (anti-virus software) to be used in combination with the other software, when such tools are not provided by the producer (manufacturer) of the software constituting the medical device:

j) information related to the usage of cryptographic security tools (if applicable);

k) information regarding the need for the authorised users to use archiving and backup functions in order to back up data on the organization's servers;

l) information regarding protection from unauthorised distribution (if applicable);

22) information regarding clinical recommendations to be used by the algorithm implemented in the software constituting the medical device;

23) the list of standards (both local and international) used by the producer (manufacturer) of the software constituting the medical device as a reference;

24) information regarding the initial release or the most current review of the technical documentation for the software;

3. In section III:

a) amend the name with the following wording: “except the software constituting the medical device”;

b) in paragraph 6, after the words: “registration dossier for the medical device”, add: “except the software constituting the medical device”.

4. Amend section IV as follows:

“IV. Requirements for the contents of the operational documentation

of the producer (manufacturer) of the software

constituting the medical device

9. The operational documentation of the producer (manufacturer) for the software constituting the medical device (hereinafter: the operational documentation for the software), which is provided by the producer (manufacturer) of the software constituting the medical device, or by its authorised representative, as part of the registration dossier for the software constituting the medical device, shall contain the following items:

1) name of the software constituting the medical device and any other information enabling identification of the software constituting the medical device, such as design variants, or a version of the software constituting the medical device.

This operational documentation for the software shall contain a detailed explanation of the numbering of its versions;

2) with respect to the developer of the software constituting the medical device, the full and (if applicable) abbreviated name, including the business name and the legal form of the legal entity, the address of the location or surname, name and patronymic (if applicable), details of the identification document, address of the place of residence of the individual entrepreneur, as well as the phone numbers and e-mail address of the legal entity or individual entrepreneur (if applicable);

3) with respect to the producer (manufacturer) of the software constituting the medical device, the full and (if applicable) abbreviated name, including the business name and the legal form of the legal entity, the address of the location or surname, name and patronymic (if applicable), details of the identification document, address of the place of residence of the individual entrepreneur, as well as the phone numbers and e-mail address of the legal entity or individual entrepreneur (if applicable);

4) with respect to the authorised representative of the manufacturer of the software constituting the medical device, the full and (if applicable) abbreviated name, including the business name and the legal form of the legal entity, the address of the location or surname, name and patronymic (if applicable), details of the identification document, address of the place of residence of the individual entrepreneur, as well as the phone numbers and e-mail address of the legal entity or individual entrepreneur (if applicable);

5) information about the intended use of the software constituting the medical device, and about the main principles of its operation;

6) information about the intended users (customers) of the software constituting the medical device;

7) information regarding the interpretative function, data source, hardware platform, and the deployment of the software constituting the medical device, and on access to it;

8) information regarding the classification of the software constituting the medical device, with regard to the class of the potential risk associated with the use of the medical device, as per the nomenclature classification of medical devices, including notification of the significance of the interpretation results of the software constituting the medical device, and the conditions of use of the software constituting the medical device;

9) information regarding the presence (or absence) of AI technologies in the software constituting the medical device: and their description (if applicable);

10) description of the main parts, units, and modules of the software constituting the medical device;

11) information regarding possible changes in the software constituting the medical device, which may (or may not) affect the stability of its functionality and/or operational principle (if applicable);

12) information regarding how to notify the user about the availability of the most updated version of the software constituting the medical device, and about the related upgrading procedure;

13) characterisation of the accessories pertaining to the software constituting the medical device, other medical or non-medical devices intended for use in combination with the software constituting the medical device, as well as a description of any specific equipment and/or software, test databases developed by the manufacturer (producer) in order to use the software constituting the medical device (if applicable);

14) list of risks for the user, as identified during the Risk Analysis process;

15) specifications for the software constituting the medical device;

16) hardware and system requirements necessary for the appropriate operation of the software constituting the medical device (OS and hardware platforms supported, required RAM, disk space, additional software and hardware related requirements);

17) information regarding data communication protocols used for the software constituting the medical device, along with other medical devices and/or accessories;

18) information regarding the installation/deinstallation procedure for the software constituting the medical device;

19) requirements regarding the training or skills necessary for the personnel performing the installation of the software constituting the medical device (if applicable);

20) data related to the marking or labelling of the software constituting the medical device (if applicable);

21) information which is required for identification of the software constituting the medical device in order to obtain a safe combination, and information regarding known limitations of the combined use of the software constituting the medical device (when the software is intended for combined use with other medical devices and/or accessories);

22) information regarding precautions to be applied in the event of possible errors or failures of the software constituting the medical device;

23) information regarding any circumstances (or consequences thereupon) occurring during the use of the software constituting the medical device, whereupon the user shall seek advice from a healthcare professional or from the customer support service;

24) information about procedures related to the service and technical support of the software constituting the medical device;

25) information regarding safety measures and access restriction techniques applied in relation to the software constituting the medical device, including cyber security measures;

a) information about all cyber security related risks (identification of assets, threats and vulnerabilities etc.);

b) information regarding access restriction procedures for all possible levels, and description of implementation methods (only trusted user access, access with mandatory authentification, etc.);

c) possibilities that the threats and vulnerabilities detected may affect the functionality of the device and its potential customers (users), and the extent of such effect;

d) information regarding the use of automated synchronization methods for the termination of user sessions in the system, if it is necessary for the environment in which the software constituting the medical device is used;

e) information regarding the use of multi-level authorisation and differentiation of user privileges based on the user or device's role in the system;

f) information regarding technical and program security measures used in the software constituting the medical device;

g) procedure for the user authentification necessary before clearance of the software update for the software constituting the medical device, including updates to the OS and application itself;

h) information regarding the need for authorised users to follow routine procedures for the installation and update of the software constituting the medical device;

i) information regarding the need to use malware protection (anti-virus software) to be used in combination with the other software, when such tools are not provided by the producer (manufacturer) of the software constituting the medical device:

j) information related to the usage of cryptographic security tools in conjunction with the software constituting the medical device (if applicable);

k) information regarding the need for the authorised users to use archiving and backup functions in order to back up data on the organization's servers;

l) information regarding protection from unauthorised distribution (if applicable);

26) information regarding clinical recommendations to be used by the algorithm implemented in the software constituting the medical device;

27) the list of the standards (both local and international) used by the producer (manufacturer) of the software constituting the medical device as a reference;

28) information regarding the initial release or the most current review of the technical documentation for the software.

10. Operational documentation for the software has to be provided to the user for acknowledgement in paper form (together with the software constituting the medical device or separately), and/ or in the form of an electronic document posted on the Internet, and/or on electronic portable media.

It is possible to provide operational documentation to the user for acknowledgement in electronic document form by means of displaying it on the screen which is a part of the medical device”.

--------------------------------

1 Order of the Ministry of Healthcare of the Russian Federation dated 6 June 2012, no. 4n “On the approval of the nomenclature classification of medical devices” (registered by the Ministry of Justice of the Russian Federation on 9 July 2012, reg. no. 24852), as amended by Orders of the Ministry of Healthcare of the Russian Federation dated 25 September 2014, no. 557n (registered by the Ministry of Justice of the Russian Federation on 17 December 2014, reg. no. 35201), and dated 7 July 2020, no. 686n (registered by the Ministry of Justice of the Russian Federation on 10 august 2020, reg. no. 59225).