Healthcare software testing services for medtech and digital health
We test clinical and medical device software where it fails quietly: a unit dropped in an HL7 message, a weight rounded too early, a record another clinic can open. An independent QA team in the EU, certified to ISO 13485:2016 and ISO 27001:2022, working inside your sprints.
Written by Anamaria Strezoiu, QA engineer on an AI medical scribe used by clinicians.
What we check on every release
- Clinical dataHL7, FHIR, units and dose maths
- Patient journeysRecords, orders, results, prescribing
- TraceabilityRequirement to risk to test result
- Security and privacyPHI access at the API, logs, exports
What we test
Most teams start with the functions in their risk file and add the rest as the regression suite grows.
Clinical workflows
Patient records, scheduling, orders and results, prescribing, and the hand-offs between clinicians where a step gets skipped.
HL7, FHIR and integrations
HL7 v2 and FHIR mapping, EHR and lab interfaces, with units, codes and time stamps checked on real message samples. See API testing.
Calculations
Doses, scores and unit conversions checked against an independent reference calculation, at the boundaries where rounding matters.
Traceability
Requirements, risk controls and test results linked in BugBoard, so your technical documentation has the evidence behind it.
Security and privacy
Patient data access tested at the API, PHI scans on logs and exports, and our AI Security Toolkit, with an engineer reviewing every finding.
Accessibility
WCAG 2.2 AA with screen readers and keyboard on patient portals and apps. See accessibility testing.
Four places clinical software breaks
Illustrative examples built from defect patterns we test for.
The unit falls off the lab result
Failure: The interface maps OBX-5, the value, into a FHIR Observation and drops OBX-6, the unit, so a glucose of 5.3 mmol/L is shown as 5.3 mg/dL.
How we catch it: we round-trip real message samples and assert that value, unit and time arrive together. A value with no unit is rejected, never defaulted.
The weight is rounded before the dose
Failure: A premature baby's weight is converted to kilograms and rounded to a whole number before the dose per kilogram is calculated.
How we catch it: property-based tests over weights and units against an independent reference calculation, plus the boundary doses.
The test passes the wrong requirement
Failure: An alarm requirement is tightened from 10 seconds to 5. The test still asserts 10 and goes green, so the trace looks complete and verifies nothing current.
How we catch it: we check the trace itself: every requirement has a test against its current version, and every risk control a test that proves it works.
Any signed-in user can open any report
Failure: The API checks that the token is valid, not who owns the report. Report ids are sequential, so one changed number returns another clinic's patient.
How we catch it: we create a record as one clinic, request it as another and expect a 404, then scan the logs for patient identifiers.
HIPAA, EU MDR and IEC 62304 compliance testing
Where each requirement tends to break in the software, and the tests we run for it.
| Requirement | Where it breaks | What we test |
|---|---|---|
| HIPAA Security RuleUS, 45 CFR Part 164 | PHI reachable by changing an id, and identifiers written to logs and exports | Cross-tenant access tests at the API, PHI pattern scans on logs, exports and analytics |
| EU MDRRegulation (EU) 2017/745 | Verification evidence an assessor cannot follow back to a software version | Release test reports tied to the exact build and traced to requirements |
| FDA device softwarepremarket software documentation and 21 CFR Part 11 | Audit trails that overwrite instead of append, and test records with no version | Edit, delete and replay checks on electronic records, versioned test evidence |
| IEC 62304software life cycle | Tests that verify a requirement version that no longer exists | Trace checks per safety class, from requirement to test result |
| ISO 14971risk management | Risk controls with no test that proves they work | Test cases linked to each control in your risk file |
| GDPRhealth data, Article 9 | Real patient data copied into test environments | Synthetic or de-identified test data, access and deletion tests |
We test your software against these requirements and give you the evidence for your technical documentation. Our ISO 13485:2016 certificate covers our own quality management system. For US healthcare buyers, see how we test against the HIPAA Security Rule safeguards.
Tested inside regulated medical software
- Sully.ai, an AI medical scribe used by clinicians: a security and accessibility pass with 636 test cases.
- Radiology software classed as a medical device: 44 risks mapped in an ISO 14971 matrix and about 189 test cases.
- Clients include AdviNow Medical, CardiaSync and Owlet.
- A US e-prescribing integration, tested in 2024 and 2025.
The radiology client's name is withheld.
The bug I remember on a radiology platform: one clinic's fax sync could pull in another clinic's faxes, so a different practice's patient documents landed in the wrong inbox. Nothing errored. Since then I test every patient feature with two clinics side by side and try to reach one from the other.
With Tiberiu Onisor, Patricia Broscaru and Marian Lazar, who also test in this industry.
How we work
A 30-minute call
What the product does, how often you release, and what the last incident was.
NDA and DPA
Signed before anyone sees your code, environments or data.
Week one
We learn the product, map the clinical workflows and the risk file and agree what to test first.
Week two
Tests run in your pipeline and the first bugs land in your tracker.
Every release
Regression on core journeys and a release report from BugBoard that your team and your auditor can read.
Working with a team in Romania
Our engineers work from Cluj-Napoca, Romania, inside the EU, in English, in your Slack or Teams and your Jira.
UK, all year
Romania is two hours ahead of the UK in winter and in summer, and our team covers the full UK working day, 09:00 to 17:00 London time.
Afternoon overlap
Our afternoon is the start of the US East Coast day, so a US team gets a daily hand-over in its own morning.
Your data comes to the EU
We work under GDPR and our ISO 27001:2022 management system. UK GDPR treats the EU as adequate.
One published range
Invoiced in euros, from the same €20-45 range we publish for everyone.
Pricing and the trial
The rate depends on seniority, how long you commit for, and the mix of manual, automation and security work. BugBoard and the AI Security Toolkit are included at no licence cost.
- First month is a trial
- First two weeks complimentary if you are not happy
- 30 days notice after that
- NDA and DPA from day one
Healthcare software testing: common questions
What do healthcare software testing services cover?
Functional and regression testing of clinical and patient-facing software, HL7 and FHIR integration tests, calculation checks, security, privacy and accessibility testing, with a trace from requirement to test result. With us it runs inside your release cycle, not as a one-off audit.
Do you do medical device software testing?
Yes. We plan testing around your risk file under ISO 14971 and keep the trace from requirement to test that IEC 62304 expects. Classification, the technical file and the conformity assessment stay with you and your notified body.
How do you handle HIPAA requirements?
We sign a Business Associate Agreement (BAA) and test that your software protects PHI: access at the API, audit trails, logs and exports. We prefer synthetic or de-identified data, so PHI does not have to leave your environment.
What does your ISO 13485 certificate mean for us?
Our own quality management system is certified to ISO 13485:2016, valid until April 2027, so our test planning, records and reviews follow a medical-device quality system.
Can you help with FDA submissions?
Yes, with the testing evidence. We produce versioned test protocols, results and a trace your regulatory team can reference in the software documentation. A security tool can be wrong about who was logged in, which is why we disprove a finding before we report it: the browser export that nearly made us report a leak.
How do you handle patient data?
NDA and DPA from day one, and a Business Associate Agreement (BAA) where PHI is involved, under our ISO 27001:2022 management system. We prefer synthetic or de-identified test data, and the team works from Romania, inside the EU, under GDPR.
How much does healthcare software testing cost?
€20 to €45 per hour, depending on seniority, commitment length and the mix of manual, automation and security work, invoiced in euros. BugBoard and the AI Security Toolkit are included.
How do we start, and what if it does not work out?
After a 30-minute call. The first month is a trial, and if you are not happy with the first two weeks they are complimentary. After that either side can end it with 30 days notice.
Talk to us about your clinical software
Tell us what the software does, how it is classified and how often you release.
More industries: see how we test for each one.