Redesigning Medical Device Assurance: Separating Technological and Clinical Assurance Cases

The safety and clinical effectiveness of medical devices depend on their use in specific clinical treatments. Due to the variability in physiology and genetics, different people react differently to exactly the same treatment. High-intensity focused ultrasound systems and radiation therapy machines are examples of systems where this needs to be taken into account. If we use a conventional monolithic assurance case for such systems, the inherent complexity affects our ability to construct an argument so that manufacturers and regulators are sufficiently confident that the device is safe and effective for a given treatment. We propose separating the assurance of these types of systems into two linked assurance cases. The first assurance case demonstrates the safety of the medical system independent of its clinical effect. The second demonstrates the safety and clinical effectiveness of the system when it is used within specific clinical treatments. Based on our experience in the ongoing development of a high-intensity focused ultrasound system, we introduce these separate assurance cases, and show how to structure them. We present definitions that are useful in determining boundaries, interfaces and dependencies between the two assurance cases, and include observations related to the effectiveness of this approach.