DevOps for UK HealthTech — NHS DTAC Built In

IEC 62304 Traceability in CI/CD

IEC 62304 (Software Lifecycle for Medical Devices) requires traceability from software requirement → design → code → test. CI/CD implements IEC 62304 traceability automatically: (1) Git commit message links to Jira requirement ticket (PROJ-123: implements requirement SR-045), (2) PR description documents design decision (why this implementation approach), (3) automated tests (unit + integration) cover the requirement, (4) test report stored as CI/CD artefact (IEC 62304 V&V evidence), (5) deployment record (who deployed to production, when, what version). IEC 62304 auditor evidence: Git history + Jira tickets + CI/CD artefacts = complete requirement-to-deployment traceability. ClickMasters generates IEC 62304 traceability matrix from Git + Jira → PDF evidence document.

NHS DTAC Domain 3 DevSecOps Pipeline

NHS DTAC Domain 3 (Technical Security) CI/CD requirements: (1) SAST (Semgrep — blocks merge on high-severity findings — OWASP A01–A10 coverage), (2) SCA (Software Composition Analysis — Trivy — critical CVE blocks deployment), (3) DAST (OWASP ZAP weekly against staging — NHS DTAC Domain 3 quarterly penetration test equivalent), (4) container scanning (Trivy — zero critical CVEs in production images), (5) secrets scanning (Trufflehog — blocks commit with secrets), (6) NHS-specific check (FHIR R4 validation — HAPI FHIR validator in CI/CD, rejects non-compliant FHIR resources before deployment). DTAC Domain 3 evidence pack: ClickMasters generates from CI/CD artefacts — Semgrep/Trivy/ZAP reports dated and signed.

NHS DSP Toolkit Annex B and CI/CD Audit Trail

NHS DSP Toolkit (Data Security and Protection Toolkit): Standard 7 (Business Continuity Plan) and Standard 9 (Cyber Attack Response) require documented processes. CI/CD audit trail: (1) Standard 7 — deployment history proves business continuity (can redeploy previous version within 15 minutes — CloudFormation rollback), (2) Standard 9 — GitHub audit log proves who deployed what (cyber attack investigation: "was this code change malicious?" — Git history + GitHub audit log answers definitively), (3) Standard 10 (Data Quality) — dbt data quality tests in CI/CD pipeline evidence data quality controls. NHS DSP Toolkit submission: ClickMasters provides CI/CD evidence pack as NHS DSP Toolkit submission evidence for Standards 7, 9, and 10.

MHRA Post-Market Surveillance CI/CD Integration

IEC 62304 post-market surveillance: medical device software must be monitored in production — defects reported to MHRA via Yellow Card. CI/CD integration for post-market surveillance: (1) error monitoring (AWS CloudWatch → SNS alert → Jira bug ticket auto-created for any production exception), (2) MHRA Yellow Card threshold (if error rate > 0.1% of clinical transactions → automatic MHRA Yellow Card draft created for Medical Safety Officer review), (3) software version tracking (every deployment tagged with software version → MHRA can request specific version evidence), (4) post-market surveillance report (quarterly — automated from CloudWatch error metrics, user feedback, and support tickets). IEC 62304 postmarket surveillance plan: ClickMasters writes PMSP as part of project documentation.

NHS DTAC

DCB0129

MHRA

IEC 62304

UK GDPR Article 9

Cyber Essentials Plus

NHS DSP Toolkit