QA & Testing for UK HealthTech — MHRA Built In

IEC 62304 Test Documentation for MHRA

IEC 62304 V&V (Verification and Validation): all medical device software must have documented V&V activities. IEC 62304 test documentation: (1) Software Verification Plan (SVP — defines what will be tested and how), (2) Software Verification Report (SVR — records test results), (3) Unit test evidence (code coverage report — minimum 80% for IEC 62304 Class B software), (4) Integration test evidence (API integration tests — NHS FHIR R4, medical device sensor data), (5) System test evidence (end-to-end user journey tests), (6) User Acceptance Test (UAT — clinical user testing with real clinical scenarios). ClickMasters generates IEC 62304-compliant V&V documentation from CI/CD test artefacts automatically.

DCB0129 Clinical Risk Testing

DCB0129 Clinical Safety Testing: every change to clinical software must have a clinical risk assessment. Test approach for DCB0129: (1) hazard-based test design (test cases derived from hazard log — each hazard has at least one test case designed to verify the mitigation works), (2) clinical scenario testing (real clinical scenarios from the hazard review — e.g. "nurse incorrectly records medication as administered" → verify system prevents double administration), (3) boundary testing (medication dose calculation — test at maximum safe dose boundary, minimum dose, and zero dose). Clinical safety test report: each clinical safety test case documented with expected result, actual result, and pass/fail. DCB0129 auditors review test report — every hazard must have associated test evidence.

NHS FHIR R4 API Testing

NHS FHIR R4 API testing: (1) HAPI FHIR validator (validate all FHIR resources against UK Core profiles before submission — run in CI/CD), (2) NHS sandbox testing (NHS Digital provide sandbox environments for PDS, eRS, CSAS, NBS — all integrations tested against sandboxes), (3) FHIR conformance testing (CapabilityStatement — verify server supports required FHIR interactions for each NHS integration), (4) NHS SDS authentication testing (RBAC — test with different NHS SDS roles to verify access control). FHIR validation in CI/CD: HAPI FHIR validator runs on every PR — FHIR validation failure blocks merge.

NHS DTAC Domain 3 Security Testing Evidence

DTAC Domain 3 (Technical Security): evidence required for DTAC assessment. Security testing artefacts: (1) OWASP ZAP scan (automated DAST — run against staging environment, report generated), (2) Semgrep SAST scan (static analysis — run in CI/CD, zero high-severity findings required), (3) Trivy container scan (Docker image CVE scan — zero critical CVEs required), (4) Dependabot CVE alerts (zero unresolved critical CVEs in production), (5) annual penetration test (CREST-approved pen tester — for DTAC Domain 3 higher assurance). ClickMasters generates DTAC Domain 3 security evidence pack from CI/CD artefacts — submitted to DTAC assessor alongside DTAC questionnaire.

MHRA

IEC 62304

DCB0129

DTAC

NHS DSP Toolkit

UK GDPR Article 9

WCAG 2.1 AA

Cyber Essentials Plus