Medical PCB Assembly: From Device Risk to Evidence

The process of assembling Medical PCBs starts with the completed design of a board and generates a populated, programmed, inspected, and traceable PCBA for a Medical Device as defined by that manufacturer. The soldering processes for Medical PCBs may be identical to the processes for Industrial and Commercial Electronics. The difference for Medical Boards is the relationship between the Intended Use for a Device, Risk Associated with the Device, Configuration Identity, Process Controls Applied, Test Coverage Used, and the amount of Retained Evidence that defines the assembly for that specific device.

It is possible that a board may pass a visual solder inspection; however, the board may still contain the wrong BOM Revision, Firmware Image, Test Program, or approved Variant. Therefore, an acceptance record must clearly identify the Object Examined, Method of Evaluation, Applicable Limits, Configuration Tested, and Authorized Individual or Function to disposition the Result.

1. The Device Risk Determines the Controls; There is No One “Acceptable/Universal” Recipe for Assembling Medical Devices.
2. ISO 13485, ISO 14971, IEC 60601, J-STD-001, and IPC-A-610 each address Unique Responsibilities and Cannot Be Used Interchangeably.
3. Traceability Must Connect to All Elements Used to Produce the Device at the Level of Granularity Required by the Assigned Risk.
4. Inspection & Testing Only Support Claims Associated with the Means of Inspection, Test Program, Applied Limits, Tested Configuration, and Conditions of Testing.
5. Prototype results become repeatable production evidence only after the released baseline, test program, exceptions, and change rules are controlled.

What Makes a PCB Assembly Medical?

Simply being labelled as a “medical device” does not mean that a PCB assembly is a Medical Board—a Medical Board is defined by the role the assembly plays in a defined Medical Device. The requirements for a Medical Board and the corresponding evidence must be related to factors such as Intended Use, Users, Operating Environment, Hazard Assessment, Lifecycle Stage, and Approved Risk Assessment Controls. A Bare PCB becomes an assembled Medical PCB Assembly after components are assembled to the PCB. However, Medical Device PCB Assemblies require a high level of control over many other aspects, such as the relationship between Construction, Materials, Programming, Cleaning, Coating, Acceptance, and Records, for the assembly solution to be considered for a Medical Device.

Context dictates the level of control. A Home Monitoring Device will have very different requirements with respect to Power Distribution, Handling, Wireless Interference, and User Environment than hospital equipment. In addition, if a Board is subjected to Cleaning or Sterilization Procedures, the Laminates, Components, Coatings, Labels, and Adhesives used in the Board must be verified as compatible with the applicable Cleaning or Sterilization Procedures. The above will dictate Requirements prior to Layout and Material Release and not after assembly of the First Units.

The term “Medical Grade” is not an Acceptance Criterion. All Released Documents must identify the Applicable Standard Revision, the Applicable Workmanship Class, the Test Coverage, the Cleanliness or Coating Requirements, the Traceability Depth, Exceptions, and the Authorized Individual or Function to Approve.

Define Requirements Before Production

The Requirement Stack starts with the Context of the Device and ends with Evidence that can be tied back to the Released Configuration. Each Layer answers a different Question. A Certificate or Inspection Report cannot represent the Layers above or below it.

ISO 13485:2016 establishes a framework for the QMS of medical devices and related services. The standard does not specify that certification is mandatory; however, a certified or conforming QMS supports controlled processes and documentation at the organizational level. In the United States, the FDA’s Quality Management System Regulation became effective on February 2, 2026, and incorporates ISO 13485:2016 by reference; however, additional FDA requirements also apply.

ISO 14971:2019 provides for the identification, risk evaluation, control, and monitoring of hazards in the medical device manufacturer’s process. It includes a requirement to develop objective criteria for acceptable risks, but it does not require one level of acceptable risk across the board for all devices; the risk-driving elements of a device’s context should determine diagnostics, environmental verification, and retained evidence.

IEC 60601-1 Edition 3.2 defines the basic safety and essential performance of medical electrical equipment, while IEC 60601-1-2:2014+A1:2020 addresses electromagnetic disturbances at the equipment and system level. PCB layout, grounding, shielding, filtering, isolation features, and controlled impedance can support those requirements at board level, while equipment-level IEC 60601 compliance requires system testing beyond PCBA inspection.

J-STD-001J defines soldering materials and process requirements, and IPC-A-610J defines post-assembly acceptance criteria. The project documentation must identify the revision, Class, applicable criteria, and approved exceptions. Class 3 may be an appropriate designation for high-reliability products, but medical applications alone do not justify this designation by default.

Who Owns Each Requirement and Record?

The legal manufacturer or product owner normally retains authority over the intended use, risk, and compliance of the device. The engineer who translates the approved controls into PCB requirements implements those controls within the PCB. The assembler of the product implements the released product package. The test and quality control personnel maintain control of the manufacturing programs, specified limits, associated records, and final disposition in accordance with the defined QMS and contractual agreements.

Consider a Functional Test that is performed on Rev D hardware with firmware Version 2.4. The operator has confirmed that this test has been executed successfully, but the operator does not own the decision that firmware Version 2.5 does not need to be retested for Functional Test success. This decision requires an assessment of the impact of the changes made to firmware Version 2.5, identification of the configurations that will be impacted by the change, prior coverage of the configurations associated with the changed firmware, and release authority.

Design and Process Controls Before Assembly

Design for Manufacturability and Testability

DFM and DFT should help bridge the gap between a fabricated board and an assembled, inspected, programmed, tested, and reworked board in a controlled environment. Prior to formal layout release, identify the tests that will be performed and ensure that you have provided for the test methods you intend to use. After that, verify test access, fixture keep-outs, fiducials, programming headers, polarity and reference markings, inspection sightlines, diagnostic observables, etc., to ensure that you have met your coverage requirements before adding test points.

Selecting components is part of the same design and process control. If you are considering a proposed substitute for an existing component, then the substitute must go through the same process as the original component with regard to electrical characteristics, pin and package compatibility, temperature range, lifecycle status, availability, regulatory or material declarations where applicable, firmware interaction, and the impact on verification of previous versions of the product. Simply having a matching footprint is insufficient.

Assembly Route and In-Process Evidence

A medical PCBA does not necessitate a special assembly route based solely on being “medical”; the assembly route for the PCBA will depend upon both the type of board and the mix of components you are using. Each step of the assembly route should contain a released input and a recordable output.

1. Before releasing any materials, confirm the current PCB Data, BOM or AVL, Placement Files, Assembly Drawings, Firmware, Test Requirements, Deviations, and Quantity Info.
2. Authenticate Incoming PCBs and Components, such as manufacturer IDs and storage status, on arrival. Components that are considered moisture-sensitive are classified under IPC/JEDEC J-STD-020 and handled in accordance with J-STD-033. For example, MSL 1 represents effectively unlimited floor life at up to 30°C/85% RH, while MSL 3 represents 168 hours at up to 30°C/60% RH before bake-out is required. Ensure that approved substitutions have also been verified prior to acceptance.
3. Document the Solder Paste Printing Process through the use of the stencil, paste, program, and 3D SPI Data when SPI is included in your production plan.
4. Using an Approved Profile matched to the solder paste, PCB construction, and Component Thermal Limitations, Place and Reflow all Surface Mount Components.
5. Inspect visible features through visual inspection or AOI, and use X-ray where package geometry hides relevant joints.
6. Complete Through-Hole, Selective, Press-Fit, Hand-Soldered, or Mixed-Technology Construction per the released Instructions.
7. Program and Verify the Intended Firmware Image, along with running the designated Electrical or Functional Tests with Controlled Programs, Test Fixtures, Limit Conditions, and specified test conditions.
8. Complete Cleaning, Coating, Potting, Marking, Final Inspection, and record Linkage only when Specified; disposition exceptions before release.

Not every project uses every method. The released route should include only applicable stages and define the evidence retained at each one.

Cleaning, Coating, and Sterilization Compatibility

Cleaning must be compatible with the Flux, Component Construction, Labels, and Connectors, as well as with any future Coating Application. A common ionic contamination method is the ROSE method as indicated in IPC-TM-650 Method 2.3.25, historically referenced against an ionic contamination figure of 1.56 µg NaCl-equivalent/cm² based on older data using wider Trace Geometries. Many projects now provide a project-specific limit due to the continuing increase in density of modern assemblies and should not rely on the historical value alone. Ionic Contamination Measurements will only provide a Defined Attribute per an Established Method; they cannot identify all contaminants, prove Sterility, or establish Product Reliability without Acceptance Rules defined by the User and Manufacturer. A coating cannot correct poor cleanliness and may trap residues beneath an apparently acceptable surface.

If Your Project Requires Conformal Coating, Underfilling, or Potting, then All Related Released Documents Shall Identify the Approved Material, Application and Exclusion Areas for the Coating; What Areas of the Product Will Require Masking prior to Application; Curing, Inspection, and Repair Restrictions; as well as thickness or coverage criteria. These operations may affect Heat Transfer, High-Impedance Nodes, Connector Access, Rework, and Mechanical Stress.

Sterilization compatibility applies only if the PCBA or its materials are exposed to the specified sterilization process. There are different Validation and Material questions related to Steam, Ethylene Oxide, Radiation, Cleaning Materials, Temperature, Humidity, and Cycles during each sterilization exposure. An Item that Passed one Exposure to a Sterilization Process Does Not Pass all Future Exposures Across the Life Cycle of the Device unless Defined Conditions and Acceptance Criteria have been established.

How Should a Production Lot or Unit Be Identified and Traced?

The Traceability of a marketed device will be linked back to its identity through each Manufacturing Event. Traceability will be established based upon the documented requirements of the specified Risk and the contractual agreement between the parties involved. The purpose of Traceability is to reconstruct the hardware and software configuration to the state in which it was accepted based upon the documented manufacturing history, not to collect every Identifier available.

Illustrative Configuration-to-Evidence Chain

The example below demonstrates how one released configuration can link to additional configuration records without being subject to universal naming conventions or revision letter equivalences:

• PCB fabrication data: Rev D
  ● BOM: Rev D, including the approved manufacturer list and any approved deviation
  ● Placement/CPL: Rev C
  ● Assembly drawing: Rev D
  ● Firmware: v2.4, with the controlled image identity or hash recorded
  ● Functional-test procedure: TP-017 Rev B
  ● Test program and fixture: controlled revisions linked to TP-017 Rev B
  ● Unit result: PCBA serial or lot, test limits, measured result, operator, date, and disposition retained together

Should any revisions or changes be made, such as firmware v2.5, BOM Rev E, a new fixture, or revised limits, a change assessment is necessary to determine if TP-017 Rev B remains adequate, which configurations are affected, and which evidence needs to be repeated before final release.

A UDI and the internal board identity must remain separate from one another. FDA’s Device Identifier identifies a labeler and the specific device version or model; PI may include lot, serial, expiration, or manufacture information when applicable. The above requirement does not imply that each individual internal PCBA should have its own UDI. Internal labels, travelers, databases, or programming logs can provide the controlled relationships needed to maintain the configuration identity of the parts.

IPC-1782B establishes risk-based minimum requirements for electronics manufacturing and supply-chain traceability, from simple lot tracking to more detailed genealogical records. The project will need to determine the required depth of traceability, the relationships to retain, and the retention time frames based upon the device risk and quality agreement.

What Can Inspection and Test Evidence Prove?

An inspection or a test can prove the result of an object only under the method, coverage, limits, configuration, and conditions used at the time of testing. An inspection or test alone cannot conclusively prove that the device is completely safe, performs clinically, will survive its intended use, is sterile, or meets all regulatory requirements.

There always needs to be a named denominator for coverage. AOI coverage could mean the programmed visible features, ICT coverage could mean accessible nodes or components, and functional coverage could mean defined states and limits. Quoting a percentage of coverage without naming the denominator can artificially inflate the perceived completeness of that percentage.

Burn-in or accelerated stress techniques can be used to screen selected early failures under defined conditions, but they do not provide assurance of achieving the intended useful life of the product. To make a legitimate lifetime claim, an identified and substantiated stress model, representative samples, identified failure criteria, and a demonstrable correlation between accelerated conditions and actual usage must all be established.

How Application Risk Changes Assembly Evidence

Application names do not specify a singular technology for a board, inspection plan, or workmanship class. Instead, application names assist in identifying failure mechanisms, test states, environmental conditions, and the appropriate information needed to support a PCBA.

Wearable and Portable Monitoring Devices

Wearable and portable monitoring devices integrate sensing, battery power, communications, compact packaging, and repeated handling. Therefore, assembly evidence from an actual product should trace a link between the assembled board revision and sensor interfaces, battery and charging states, radio or wired communication states, firmware, and any mechanical configuration that was utilized for testing purposes. In cases where the device is to be used in a patient’s home rather than in a facility where there are staffing and environmental controls in place to ensure proper operation, IEC 60601-1-11 adds additional requirements beyond those of the base IEC 60601-1 standard for conditions that may be encountered during product use, such as untrained users and less controlled environmental and power conditions.

If a flex or rigid-flex construction method is utilized, IPC-2223 has established design criteria for flex and rigid-flex printed circuit boards, and IPC-6013 has developed the qualification and performance criteria for the constructed board. The fabrication drawings that are released must be clear about the applicable revision, product class, construction, bend conditions, and acceptance criteria. A design that repeatedly experiences dynamic bending requires an appropriate stack-up qualified for the given copper thickness, bend direction, number of cycles, and specified bend radius. This duty is often served through the use of RA or other qualified high-ductility copper; however, RA copper does not replace the need to verify fatigue. In testing, fixtures must support the circuit without damaging the bend or rigid-flex transition regions.

Environmental or mechanical conditions that may not be revealed by a room-temperature bench test include moisture, sweat, cleaning agents, connector cycling, and repeated flexing. Therefore, the project must establish what environmental or mechanical conditions are verified at the board level and what conditions remain as part of the verification of the finished device.

Diagnostic and Imaging Electronics

Diagnostic electronics and imaging electronics may contain low-noise analog paths, high-speed data conversion, RF sections, power conversion, and multiple interfaces. While a PCBA may pass continuity tests, under representative loading it may still produce noise, timing errors, or image artifacts. Test evidence should capture the source of inputs, load, bandwidth, calibration state, grounding, shielding, firmware, and interface conditions. Control of component placement and controlled impedance can help support signal integrity; however, electromagnetic compatibility requirements established by IEC 60601-1-2:2014+A1:2020 apply to the complete equipment and system level, not just to a single PCBA. The linkage of hardware revision, calibration data, test program, and fixture is often as important as solder inspection for these assemblies.

Therapeutic and Life-Support Equipment

Boards used to control pumps, valves, motors, energy delivery, alarms, or safety interlocks require evidence regarding both normal operation and defined fault responses. In addition, where the board drives an alarm function, alarm priority categories, signal patterns, and related requirements are defined in IEC 60601-1-8:2006+A1:2012+A2:2020 for the finished device; therefore, the PCBA’s test plan must exercise the alarm conditions and priority logic that the board is responsible for generating. A functional test must demonstrate which loads, feedback signals, alarm paths, watchdogs, power states, and firmware conditions were tested. A visual inspection may confirm the released assembly, but it cannot confirm that the assembly has met the required device-level safety architecture. If an alarm or protective path is intended to remain available after another fault, the test plan must demonstrate the required independence and fault conditions as stated in the product requirements. The results of these tests must remain linked to the exact PCBA and firmware configuration that received approval for release.

Implantable or Sterilization-Exposed Electronics

Having an implantable function does not mean that all PCB materials within a product are patient-contacting. The design of the device must define the enclosure, barriers, exposure pathway, and supporting validation. When any material or assembly makes contact with the patient, biological evaluation follows the applicable ISO 10993 series within the device risk-management process. ISO 10993-1:2025 provides the current risk-based framework. ISO 10993-6:2026 addresses local effects after implantation where that evaluation is applicable. ISO 10993-10:2021 addresses skin sensitization; irritation is addressed by ISO 10993-23:2021 and its 2025 amendment.

The USA provides a transition period during which the FDA continues to accept declarations of conformity to ISO 10993-1:2018 for specified premarket submissions; therefore, the regulatory strategy must identify the specific edition and specific market rather than provide a mixture of requirements from these different editions.

To complete the testing of the PCBA’s performance in these instances, PCBA teams may need tighter controls of the materials and material residues used to manufacture the PCBA, cleaning processes, coatings, package integrity, thermal history, and long-term configuration traceability. If the electronics are sterilized, the required sterilization method, dose or cycle, number of repetitions, packaging state, and post-sterilization acceptance criteria must be understood before selecting a material and declaring it compatible. Collection of specific X-ray, cleanliness, and coating records can provide supporting documentation for selected PCBA questions; however, they do not provide evidence of biocompatibility, sterility, or implant lifetime.

Controlled Design Transfer from Prototype to Repeat Production

Controlled design transfer takes the approved design, process, test requirements, and evidence rules and uses them to develop a repeatable production baseline. The prototype can expose access, programming, fixture, handling, or record-linking issues; the pilot test determines whether the provided controls operate correctly under representative production conditions.

Consider changing one component while keeping the PCB artwork the same. However, this may affect electrical margin, temperature behaviour, firmware timing, test limits, sourcing traceability, or previous verification. The review of such a change must determine the affected requirements and units, determine which inspection or test must be repeated, and retain approval of the revised baseline.

A prototype is not ready for repetition until ownership, configuration identity, test coverage, unresolved exceptions, and change disposition are clearly defined.

Final Release Questions

1. Is the PCBA part number, revision, variant, BOM, and firmware identity clearly defined?
2. Are the applicable standard revision, workmanship class, project criteria, and exceptions included in the released package?
3. Are assembly routing, programs, fixtures, limits, environmental conditions, and evidence-retention requirements controlled?
4. Can every inspection or test result be linked to the unit or lot and to the configuration actually examined?
5. Are cleaning, coating, potting, sterilization exposure, marking, packaging, and rework requirements defined where applicable?
6. Have substitutions, deviations, failures, rework, and open risks been dispositioned by the correct authority?
7. Does the change process state when inspections, tests, validations, or regulatory reviews must be repeated?

For project-submission files, sourcing inputs, quantities, lead-time questions, and quotation scope, use the SUGA-PCBA medical electronics resource.