Medical Device Firmware Safety & Compliance Review
Review medical device firmware for FDA/ISO compliance gaps and risks
What You Can Do
Conduct rapid, comprehensive safety and regulatory compliance reviews of medical device firmware. You provide source code, design documentation, or test results—Claude analyzes against FDA guidance, ISO 62304, IEC 61508, and industry best practices to identify compliance gaps, security vulnerabilities, and design risks. Get detailed findings reports with remediation priorities and regulatory mapping.
Features
validates electronic record controls, audit trails, and authentication requirements
maps firmware components to development, verification, and traceability requirements
identifies SIL/ASIL levels and validation evidence gaps
detects OWASP Top 10, input validation flaws, weak cryptography, and secure boot issues
generates failure mode analysis with safety impact ratings and mitigation strategies
assesses unit, integration, system, and acceptance test coverage against requirements
creates requirements-to-design-to-test mappings for submission evidence
Example Output
Example 1: Firmware Code Review Finding
- ⚠️ CRITICAL – IEC 61508 SIL2 Violation
Component: sensor_driver.c, line 145
Issue: Unvalidated ADC input directly used in safety-critical dose calculation
Risk: Rogue sensor value causes overdose or underdose
Remedy: Add range bounds validation with documented safe limits; implement exception handling
Standard: ISO 62304:2015 Section 7.2 (Software Design)
Effort: 4 hours to implement, 2 hours to test
Example 2: Compliance Gap
- ❌ MISSING – FDA Traceability Evidence
Gap: No documented link between design requirements and test cases
Impact: Cannot demonstrate verification completeness per FDA guidance
Evidence Needed: Requirements Traceability Matrix (RTM) with requirement-to-test cross-reference
Closure: 2-3 days to create RTM and close mapping gaps
Example 3: Security Risk
- 🔒 HIGH – Wireless Authentication Bypass
Component: wireless_comms.c, uart_receive()
Issue: No authentication on device configuration commands
Exposure: Proximity attacker can reconfigure safety parameters
Mitigation: Implement HMAC-SHA256 with device-specific key; add command audit logging
Standard: IEC 62304 Section 8 (Software Verification)
What's Included
- SKILL.md: Complete firmware review framework with regulatory decision trees and finding severity templates
- FDA Compliance Checklist: 50+ control points for 21 CFR Part 11 and predicate device strategy
- ISO 62304 Traceability Matrix Template: Map development activities to lifecycle processes and verification evidence
- Security Review Worksheet: Guided OWASP/embedded security assessment tailored for medical devices
- FMEA Severity Rating Guide: Failure mode impact analysis with IEC 61508 SIL correlation
- Test Coverage Rubric: Unit, integration, system, and acceptance test adequacy assessment
- FDA Finding Report Template: Severity tiers, regulatory citations, remediation tracking, and submission-readiness summary
Who It's For
- Firmware engineers — pre-QA safety review and design validation before submission
- Quality/Regulatory managers — compliance evidence collection and audit preparation
- FDA regulatory specialists — 510(k)/PMA submission strategy and readiness assessment
- Security architects — embedded system threat modeling and vulnerability prioritization
- Contract manufacturers — third-party vendor firmware qualification and OEM validation
Best For
- Pre-submission regulatory strategy and compliance gap identification
- Design review and architecture safety assessment before coding
- Firmware code security and safety vulnerability screening
- FDA/ISO compliance evidence compilation and traceability mapping
- Third-party vendor firmware audit and supplier qualification
You might also like
You can systematically diagnose database performance bottlenecks by sharing your schema, slow query logs, and execution plans with Claude. It identifies root causes—missing indexes, inefficient joins, lock contention—and provides prioritized recommendations with ready-to-implement SQL. Skip the manual log analysis and get tuning strategies tailored to your workload.
Use Claude to systematically analyze your database queries, execution plans, and schema to identify performance bottlenecks. The skill generates actionable optimization recommendations with SQL rewrites, index strategies, and configuration tuning. You'll receive detailed before-and-after performance analysis to validate improvements and prioritize work by impact.
This skill evaluates your research protocols against institutional review board requirements, identifies compliance gaps, and generates the documentation needed for IRB submission. You receive a detailed assessment report, risk analysis, and ready-to-use documentation templates tailored to your specific research design.
You can systematically evaluate cloud platforms, document architectural decisions with tradeoffs, and validate designs against security and compliance requirements. This skill accelerates architecture reviews, ensures consistency across teams, and reduces the cycles needed to reach approval on complex infrastructure decisions.
You'll design and implement mobile features with architectural rigor, cross-platform considerations, and edge-case handling built-in. This skill generates complete system designs, platform-specific implementation strategies, performance optimization approaches, and testing frameworks. The output is production-ready guidance spanning iOS and Android with security, offline resilience, and deployment strategies included.
Design and optimize injectable formulations by analyzing your active pharmaceutical ingredient (API), selecting compatible excipients, and predicting stability outcomes. You'll receive systematic workflows that guide you through API characterization, formulation architecture, and risk mitigation—enabling faster development cycles and regulatory-ready documentation.
You'll develop systematic approaches to injectable formulation design, from API selection through sterilization strategy. Claude helps you troubleshoot failed batches by analyzing root causes, recommends regulatory pathways (505(b)(2), ANDA, NDA), and provides science-backed solutions for stability, compatibility, and manufacturability challenges.
Analyze Solidity and other smart contract code for security vulnerabilities, gas inefficiencies, and best practice violations. Get detailed reports with risk scoring, remediation suggestions, and optimization recommendations. Whether you're auditing before deployment or reviewing third-party contracts, this skill identifies critical issues faster than manual review.