We are doing development that is considered to be a medical device and falls under FDA guidelines and requirements. They require things like traceability (tying requirements to pieces of code to specific tests to bugs, etc.), electronic signatures/approvals, robust change and version mgmt, etc. Looking for advice on what tools/addons are best.
If I'm honest this will be more about implementation of your systems rather than addons that will help you to implement them, so the first thing is to consider your needs and imagine them in terms of a workflow and integration between the applications. Whilst their are addons that will facilitate the process of implementing that workflow, but you need to think about exactly what you want/need to achieve because the Atlassian Stack in its present form will do virtually everything you need and it's just a case of being clear in what you need to implement. Often implementing a stack is a big challenge and developing processes for departmental changes require some advice from outside professionals to smooth the transition, so you might find that instead of purchasing addons you find better value just purchasing implementation and training services from an Atlassian Expert as they can assit you in getting the most out of the Stack and ensuring you meet all your compliance requiremnets.
All the best,
Hello - We have been very happy using JIRA in FDA regulated medical environment for IT Testing and Change management with the following plugins and setup
Here is some detail on how we implemented the 21CFR11 compliant approvals
In order to allow multiple users to approve Tests and Test Executions, the following configuration has been established.
A “Required Approvers” multi-user select field has been created to allow users to indicate what approvers are required.
A “Pending Approvers” multi-user select field has been created to track the approvers that have not yet approved. This field is controlled by workflow and is not able to be modified by users.
Whenever an object is submitted for approval, the users identified in the “Required Approvers” field are copied to the “Pending Approvers” field (using JWT plug-in) and an email notification is sent to each user in the “Required Approvers” field (using JWT plug-in).
The JIRA electronic signature plug-in is leveraged to implement fields for re-authentication and electronic signature in compliance with 21CFR11.
If a user approves the object, the system is configured to remove their name is removed from the “Pending Approvers” field (using JWT plug-in). Once all names are removed from the Pending Approvers field, the system automatically moves the object to the “Approved” status (using JWT plug-in) and sends an email notification to the owner of the object to notify them of its approval (using JWT plug-in)
SoftComply has created two add-ons specifically for medical device software companies - SoftComply Risk Manager is based on ISO 14971 and supports the traceability between risks and software requirements (and test cases for verification of mitigation actions).
SoftComply eQMS (currently without workflows) provides a set of technical documentation based on the requirements of ISO 13485 and 21 CFR 820.
We have just released an eQMS plugin for Confluence with a full integrated quality system for Medical Devices.
It will contain answers to most of your doubts.
These answers are a bit dated, so I would like some fresh information.
I am currently looking for a test management tool for the develpment of a medical device (software). The company I work for has chosen JIRA to manage this project, so the tool I am looking for must have a great JIRA integration. But what is the most important for us is the traceability. To get the CE marking, we are audited and we need to be ISO 13485 compliant.
Which JIRA apps is the best solution for us ? From what I have read, JIRA+XRAY Test Management for JIRA + Confluence + SoftComply eQMS would be a good basis to meet our requirements. Am I right ?
We have a Risk Management plugin that can definitely help with the traceability between Risks and Requirements, then you can pull the data in Confluence. Look for "Risk Manager" in the Atlassian Markeplace.
A QMS is something that you will probably need to have, and our eQMS can do the job.
If you are planning to enter the US market too, then you have to make sure the system is 21 CFR 11 compliant. In this case things get a bit more complicated, as you will need compliant workflows (Comala workflows on Server is the only thing we can recommend). In addition you will need Crowd or similar to ensure password and user management are compliant too. We can offer a turnkey solution for all of this, just check https://www.clearvision-cm.com/medicompli/.
If you have other questions just let us know.
Hi @Sébastien CORSYN !
From test management perspective its easier to pick a tool that keeps test elements (cases, runs, results, plans, suits, etc) as jira issues. Then its easier to create traceability between items - you just link issues and can have nice working clickable traceability.
The issuelink based traceability is comfortable if you also use Confluence for example to create traceability reports and/or export traceability info directly from jira issue search results. Then you can easily just switch whichever side you like to see traceability (REQ -> TESTS or TESTS -> REQ) and you do not need any other tools to get it.
Thus XRay is qood for that , Zephyr also. But Test Rail not so much - since their tests are in external system, then the traceability reporting is not so good if you like to use Jiras own reporting system. It might have its own reports, but havent used it for a while and it must be then reviewed from that perspective.
Hope it helps in you context!
Hi @Margus Nael
Thanks for this reply. I have tested XRay, Deviniti RTM and Qmetry and I think XRay is the best choice. It offers good traceablity tools and allows automated tests. I have also tried Zephyr but my first opinion was not very good so I did not try Zephyr more than one hour.
Hi @Sébastien CORSYN ,
An exemplary setup that you can use to comply with 21CFR11 is:
The rest is proper configuration, translating the requirements into the tools. Something an Atlassian Platinum Partner company such as Deviniti can help you with. If you'd like to talk about it, feel free to contact us here.
We have recently launched a service to provide a fully 21 CFR 11 compliant turnkey solution based on Atlassian tools. Check this if you are interested.
We can also help you set it up yourself in your own server instance if you prefer.
Hello @Sébastien CORSYN ,
MediCompli is not an add-on per se, it is a collation of Confluence add-ons, on a Confluence Server instance on AWS, externally managed and configured to be fully 21 CFR 11 compliant.
It's for companies who don;t want the burden of managing a server and need this level of compliance.
Unfortunately Confluence Cloud has some major gaps against 21 CFR 11 and the choice of add-ons is more limited.
We can demo it to you if you are interested.
AppFusions has this plugin addressing this FDA compliance use case for JIRA ... we have a number of customers using this. It's been out for just over a year now.
Please also see related threads - search for FDA. Here's a couple:
There are corps out there (e.g., pharma, medical, food supply, etc.) that are using JIRA/Confluence in this way now - I know.
My email is firstname.lastname@example.org if you would like to discuss/vet more.
One particular issue with JIRA is that the audit history of what changes were made to each JIRA element are not robust enough. For instance, I can see when the last change was made to a workflow and who made it, however, there is not any automatic storage of the change that was made.
Hello, that's correct. But: you can do a copy of the workflow right before you publish your changes. Name it with a version number and generate an JIRA entry corresponding to that verison number or copy and describe your changes - that's it, I think.
Connect with like-minded Atlassian users at free events near you!Find an event
Connect with like-minded Atlassian users at free events near you!
Unfortunately there are no Community Events near you at the moment.Host an event
You're one step closer to meeting fellow Atlassian users at your local event. Learn more about Community Events