Systems validation according to Regulation (EU) 2017/746

[Manuel Navarro]

As part of the Regulatory department at a medical device manufacturing company and according to  Regulation (EU) 2017/746 we are required to validate the systems we daily use during the company's product development.

I wondered if besides the technical information I have found based on the cloud's security compliance of the cloud there would be any kind of information/documentation Atlassian would be able to share to facilitate the PQ/OQ/IQ validation we are planning on carrying out on our own.

Thank you!

[Jake _Ketryx_]

Hi @Manuel Navarro & @Jose Galvez

Altlassian generally not produce design control documentation that you would need to demonstrate that the application is validated.  And, unfortunately, for a long time companies have been stuck producing their own validation documentation like your organization did @Manuel Navarro

As an alternative, you could purchase a product like ours - Ketryx - that creates a validated connection to Jira and automatically configures it to be compliant.  We provide you with all of the documentation you would need to demonstrate validation. 

We think that self validating Jira is generally a bad idea for product focused organizations because it takes up resources better devoted to product development.  I wrote a blog post about that here. 

We created Ketryx to help organizations focus on the work that really matters.  If you'd like to learn more, check us out here. 

All the best,

Jake

[Bill Marriott]

We have not yet evaluated for EU 2017/746, however, we recently aligned our practices with HIPAA, which is a US medical data framework. It might be similar enough to help with your evaluation. Please see : https://www.atlassian.com/trust/compliance/resources/hipaa 

[Manuel Navarro]

Hello Bill,

Thank you very much for your answer!

Concerning the EU 2017/746 I only mentioned it to give context to my question. The validation of informatic systems is a pretty common process in many companies and countries as you probably already know.

While HIPPA is an excellent example of how different requirements or specifications of Jira has probably been adapted in order to comply with specific regulations, in this case, HIPPA is focused on data management and security of such information. This will be helpful concerning the validation of that aspect.

However, the validation of the whole process of how Jira works is what I'm struggling with. At this point, we are proceeding with doing such validation (performance/ operative and installation) on our own. But it becomes difficult as Jira does not share (as far as I am aware) any documentation concerning how the different requirements or specifications of the SW have been built.

Also, I found myself not being able to come across any specific information on how the Installation of the SW of Jira cloud has been validated. As a cloud system, this is information only the supplier would have access to.

[Jose Galvez]

Hi Manuel, Bill

I am looking for a guide or documentation to help us validate Jira Cloud as our main tool that we use to develop software as a medical device.
Any information that any of you can provide me with would be a great help.

Thank you very much.

Jose

[Manuel Navarro]

Hi Jose,

As we did not find any information that could be of real help concerning the validation of Jira as a development tool for Medical devicesat a OQ/PQ level, we validated the system following our own internal process.

We are confident of such a process but until an audit that reviews this specific validation is not carried out we will not be 100% sure is enough.

Concerning the IQ validation, we have used the information available on the Jira website concerning the norms with which Jira is compliant at a security and installation level.

Hope this helped,

Best Manuel

[Matteo Gubellini _SoftComply_]

Hi all,

I'm not sure how much information you'll be able to get from Atlassian, but the FDA has just released a new guidance document https://www.fda.gov/regulatory-information/search-fda-guidance-documents/computer-software-assurance-production-and-quality-system-software that may give you some directions.

Matteo