Certification for hospitals and medical devices

The rules for a device or a healthcare service come from the countries and authorities where you operate or sell, and a certificate does not set them. Check the legal requirements that apply to you. What a management system can do is make sure you know which requirements apply, keep that list current and hold evidence that you meet them.

ISO 13485 puts regulatory requirements at the centre of a device quality system, so an auditor asks how you find out what applies, how complaints and incidents are reviewed and how changes are controlled. For a hospital, ISO 9001 asks for the same discipline over the requirements that apply to the service. Certification to either standard does not by itself give a licence or market approval anywhere.

ISO 9001 and ISO 13485 are international standards and are used in many countries. Whether a given buyer, tender or regulator accepts a certificate is for that party to say, so ask which standard, which edition and which kind of certification body they accept before you apply.

For a hospital or clinic, ISO 9001 is the usual quality standard. ISO 13485 is aimed at organizations in the medical device life cycle, such as designers, manufacturers, distributors, installers and service providers, not at care services. Choosing the wrong standard costs time and does not answer the request.

No. A certificate shows that a quality management system for medical devices has been audited against the standard. It does not by itself give approval to place a device on the market anywhere. Market approval comes from the authority or the process of the country where you sell, and it has requirements for the product itself.

Some regulators and buyers look for a certificate to ISO 13485 as part of what they ask for, so it can support that process. The product evidence and the technical file remain yours to prepare. Ask the authority in each market what it needs, and check the legal requirements that apply to you.

Hospitals expose staff to sharps, patient handling, chemicals and infectious material. Device plants have machinery, solvents and sterilization. An auditor looks for a register of hazards, reporting of incidents and near misses, and consultation with workers. For waste, they look at how it is separated, stored, moved and disposed of, and by whom.

ISO 45001 addresses health and safety, and ISO 14001 addresses the environment. Both ask for a register of the legal requirements that apply to you. Which ones those are depends on where you operate, so check them for your own case.