What requirements apply to software in the medical field?

The crucial question: the intended purpose

Whether software is considered a medical device depends not on the technology but on the manufacturer's intended use. Software that evaluates findings, suggests a diagnosis, or controls therapy is a medical device under Regulation (EU) 2017/745 (MDR).

Software that manages appointments, structures documentation, or organizes workflows in a team is generally not considered a medical device.

This distinction determines the overall effort involved – and it must be clarified before the project begins, not afterward.

If it is a medical device

Then the following apply, among others:

• MDR (EU) 2017/745 – Classification, conformity assessment, CE marking, clinical evaluation
• IEC 62304 – Lifecycle for medical device software
• ISO 13485 – Manufacturer's quality management system
• ISO 14971 – Risk management

This is not a minor effort. It fundamentally changes the way of development.

Data protection always applies

Health data are special categories of personal data under Art. 9 GDPR. Processing is only permitted under strict conditions; encryption, access restrictions, and logging are mandatory – even for pure administrative software. Additionally, there is the medical confidentiality obligation under § 203 StGB, which also binds service providers.

Where we stand

Our practice software HealthFusion is a research and development project. It is not an approved medical device and is not offered as a diagnostic or therapeutic system. As long as no corresponding conformity assessment is available, its use is limited to administrative and documentation tasks.

We state this explicitly because the boundary in this area is often blurred – to the detriment of those who rely on it.