How to Turn Confluence into a Compliant Document Management System for Medical Devices

WHY CONFLUENCE?

Most medical device companies need to have at least a compliant quality management system in place, not to mention the quality records that will always need to be generated during the lifecycle of the device. With your software development team using Jira, it is natural that your organisation would like to have everything on Atlassian stack including your quality management documents. With the fantastic integration features between Jira and Confluence where you can pull information easily from one to the other using built in queries and macros, it is best to go with a quality management system in Confluence.

HOW TO IMPLEMENT A COMPLIANT QMS IN CONFLUENCE?

Following is a description of two options how you can have a compliant quality management system in Confluence:

  1. For MDR/MDD (EU) compliance, you may opt to go with Confluence Cloud – affordable monthly payments are the best fit for medical device startups. Confluence cloud apps are also priced monthly and you could then add SoftComply eQMS with Comala Document Control apps for compliant quality management system and document approval workflows.

  2. In the USA you will have to deal with FDA 21 CFR 11, much more demanding than the EU regulations. In this case, you need to have Confluence on Server as you have to show that you are in full control of your Confluence instance and this cannot be achieved with Atlassian cloud platform because there are frequent changes pushed on cloud products that users are not aware of beforehand. In addition, the limits that Atlassian imposes on Confluence cloud have an impact on certain aspects of the compliance.

COMPLIANCE: CONFLUENCE CLOUD VS CONFLUENCE SERVER

Here is a list of regulatory requirements that you will meet only when using Confluence Server platform (not Cloud):

  1. The Cloud instance is not fully under your control. Atlassian will make changes to it without notice. That’s a real challenge for validation and you will need to validate software that manages your QMS (ISO 13485 and FDA 21 CFR 11.10 a).

  2. There is no enforcement (yet) of incorrect login attempts, account lockout, etc. (FDA 21 CFR 11.300 b)

  3. The available workflows do not have permission management triggers, meaning that it is difficult to ensure that people have access to the latest documents only, and don’t use draft or obsolete versions (FDA 21 CFR 11.10 k) 1)). This also poses some issues with ISO 13485 4.2.4 d) and h).

FDA 21 CFR 11 COMPLIANT QUALITY MANAGEMENT SYSTEM IN CONFLUENCE

For the implementation of Confluence Server you have 2 options:

  1. You set up your Confluence server instance yourself, or

  2. You have an Atlassian partner company who hosts and maintains your Confluence server and the required apps for you.

In both of these setup scenarios, Confluence is under your full control, i.e. only you can decide when to change/update anything and thereby meets this particular FDA 21 CFR 11 requirement.

MediCompli solution is catered for medical device companies who need to be FDA 21 CFR 11 compliant, i.e. wish to place their device on the US market.

MediCompli solution combines SoftComply eQMS with a bespoke configuration of Comala Document Management and Comala Publishing apps that together with access management with Atlassian Crowd meets all quality management system requirements of FDA and MDR/MDD.

MediCompli solution is implemented on your Confluence Server instance – the instance can be hosted and maintained by an Atlassian Partner on Server Park or the instance is managed by your own organisation, in which case the MediCompli configuration is remotely managed by the SoftComply team.

AN INCREMENTAL PROCESS OF COMPLIANCE

As a European medtech startup, you may opt to go for an incremental process of compliance:

The EU Market

If you plan to enter the EU market first, you can start with Confluence Cloud as its more affordable. You can then add SoftComply eQMS with Comala Document Control onto your Confluence Cloud instance.

The US Market

Once you’ve decided to place your device to the US market, you may migrate to either Confluence Server or get an Atlassian partner host your Confluence instance and migrate from Comala Document Control to Comala Document Management and add Comala Publishing and Atlassian Crowd for full FDA 21 CFR 11 compliance.

COMPARISON OF FEATURES SUPPORTED ON CONFLUENCE CLOUD VS CONFLUENCE SERVER

An overview of the features that are supported in Confluence Cloud vs Confluence Server are summarized in the table below:

THE MEDICOMPLI SOLUTION

For FDA 21 CFR 11 compliant QMS on Confluence, SoftComply together with Comalatech and Clearvision developed a turnkey solution called the MediCompli where SoftComply looks after regulatory compliance of Comala apps and Clearvision as an Atlassian Partner supports companies with hosting and maintenance of Confluence. To learn more about the solution, please read here – https://softcomply.com/medicompli/.

Leave a Reply

Your email address will not be published. Required fields are marked *

Back