Microservices Architecture for UK MedTech — MHRA Built In

MHRA SaMD Microservices Classification

MHRA SaMD classification for microservices: each microservice must be evaluated for SaMD status independently. A clinical decision support microservice (recommends diagnosis) is SaMD Class IIa. A data storage microservice (stores patient records without processing them clinically) is not SaMD. Microservices design for MHRA: (1) isolate SaMD logic into a dedicated Clinical Decision Service (CDS) microservice — clear boundary for MHRA regulation, (2) non-SaMD services (authentication, notifications, audit) operate under standard software governance, (3) SaMD boundary principle: if a microservice receives clinical data and produces output that influences clinical decisions, it is SaMD. IEC 62304 software safety classification applied per-microservice.

NHS FHIR R4 Inter-Service Communication

NHS MedTech microservices: patient data shared between services via FHIR R4 resources — not proprietary internal formats. FHIR-native service communication: Patient Service stores patient data as FHIR Patient resources, Clinical Decision Service receives FHIR Bundle (Patient + relevant Observations + MedicationStatements) for decision input. Benefits: (1) UK Core FHIR R4 validation can be applied at service boundaries (HAPI FHIR validator in CI/CD), (2) FHIR resource versioning for audit trail (each FHIR resource version immutable — IEC 62304 traceability), (3) NHS interoperability (FHIR resources composable with NHS Spine without transformation). Anti-pattern: proprietary internal formats between services that must be converted to FHIR only at the NHS integration boundary — conversion errors are a DCB0129 clinical safety risk.

DCB0129 Clinical Safety in Service Mesh

DCB0129 clinical safety for MedTech microservices: hazard log must cover service interaction failures. Specific hazards: (1) Clinical Decision Service receives stale patient data (cache not invalidated after patient record update) — wrong decision output. Mitigation: cache TTL < 5 minutes for active patient data, FHIR subscription webhook to invalidate cache on patient record change. (2) Notification Service fails to send urgent clinical alert — patient not alerted to critical result. Mitigation: AWS SQS dead letter queue for all clinical notifications — guaranteed delivery or engineer alert. (3) Network partition between services — Clinical Decision Service cannot query Patient Service. Mitigation: circuit breaker (AWS App Mesh Envoy) — degraded mode (surface alert to clinician: "data unavailable — verify patient record manually").

DTAC Multi-Service Evidence Pack

NHS DTAC (Digital Technology Assessment Criteria) for microservices architectures: DTAC assesses the product as a whole — not individual services. DTAC evidence pack for microservices: (1) Domain 1 (Data Flows): data flow diagram showing all microservices and patient data flows between them — each service labelled with data types processed, (2) Domain 2 (Data Protection): Article 30 ROPA covering all services (each service listed with personal data processed, legal basis, retention period), (3) Domain 3 (Technical Security): combined penetration test covering all services + inter-service mTLS evidence, (4) Domain 4 (Interoperability): FHIR R4 conformance statement covering all NHS integration points, (5) Domain 5 (Usability): WCAG 2.1 AA across all user-facing services. ClickMasters produces unified DTAC evidence pack regardless of microservices complexity.

MHRA

IEC 62304

DCB0129

DTAC

NHS DSP Toolkit

UK GDPR Article 9

Cyber Essentials Plus