SaaS Development for UK MedTech — MHRA Built In

UK MedTech SaaS Market and Regulatory Context

UK MedTech SaaS has three distinct regulatory contexts: (1) Clinical SaaS (MHRA SaMD — aids diagnosis, treatment, or monitoring — Class I/IIa/IIb, IEC 62304 required), (2) Clinical Operations SaaS (NHS DTAC — used in clinical settings but not itself a medical device — e.g., ward management, e-rostering, clinical communication), (3) Consumer Health SaaS (ICO AADC if accessed by under-18s, not SaMD if wellness-only). UK MedTech SaaS pricing models: per-patient per-month (£0.50–£5 for NHS national deployments), per-clinician per-month (£30–£150 for clinical operations), per-organisation (NHS Trust or ICB — £10,000–£200,000/year enterprise licensing), G-Cloud 14 procurement (NHS Scotland, Welsh NHS, NHS England procurement framework).

NHS DTAC SaaS Architecture — Multi-Tenancy

NHS DTAC for multi-tenant MedTech SaaS: each NHS Trust or ICB is a separate tenant. Multi-tenancy with DTAC: (1) data isolation (PostgreSQL RLS — Trust A cannot see Trust B patient data), (2) NHS DTAC Domain 2 (each tenant has its own DPIA — processing activities differ per Trust), (3) DSP Toolkit (each NHS organisation must submit their own annual DSP Toolkit — SaaS provider's DSP Toolkit covers their own processing, not the Trusts'), (4) domain data residency (all NHS tenant data in eu-west-2 — cannot be in us-east-1 even if non-UK tenant is added), (5) audit trail per tenant (CloudTrail log per-tenant resource — each Trust can audit their own data access). ClickMasters NHS multi-tenant SaaS: RLS + per-tenant audit + eu-west-2 fixed for all NHS tenants.

MHRA SaMD SaaS — Regulatory Pathway

MHRA SaMD SaaS (Software as a Medical Device delivered as SaaS): MHRA MDR 2002 UK — SaaS clinical AI or clinical decision support = SaMD. SaaS SaMD regulatory pathway: (1) MHRA SaMD classification (Class I/IIa/IIb based on intended purpose and patient risk), (2) DESH registration (Device Equipment and Software Hub — MHRA registration portal), (3) UK Responsible Person (entity responsible for MHRA compliance), (4) Notified Body (for Class IIa+): UKCA marking from MHRA-approved UK Notified Body, (5) Post-Market Surveillance (ongoing performance monitoring — MHRA Yellow Card for adverse events). SaaS SaMD update strategy: IEC 62304 change management — every SaaS update assessed for clinical safety impact (major feature change = new clinical safety review).

NHS Procurement — G-Cloud 14 for MedTech SaaS

G-Cloud 14 (RM1557.14): NHS organisations can procure SaaS from G-Cloud 14 without competitive tender (below £122,976 per year). MedTech SaaS G-Cloud listing requirements: (1) G-Cloud 14 service definition document (what the SaaS does, pricing, support), (2) DTAC compliance statement (all 5 domains), (3) NHS DSP Toolkit alignment (or equivalent security assurance), (4) WCAG 2.1 AA accessibility statement, (5) data processing agreement (DPA — Article 28 compliant). NHS procurement advantage: G-Cloud procurement typically 4–8 weeks vs competitive tender 6–18 months. ClickMasters supports G-Cloud 14 listing for MedTech SaaS clients — service definition document, DTAC statement, pricing model design.

MHRA

IEC 62304

DCB0129

DTAC

NHS DSP Toolkit

UK GDPR Article 9

Cyber Essentials Plus