Medical Imaging Software Development: 10 Questions Before Hiring a Partner

In September 2026, more than 1,600 AI-enabled medical devices had received FDA authorization. This indicates that merely claiming expertise in healthcare AI is insufficient to stand out as a partner for medical imaging software development. To make an informed decision, it is crucial to ask the right questions before hiring a partner.

Firstly, evaluate the vendor's experience with production DICOM and PACS systems. The engineering team should demonstrate their ability to handle various DICOM standards such as DICOM and DICOMweb QIDO-RS, WADO-RS, and STOW-RS, PACS/VNA integration, modality worklists, DICOM metadata transfer syntaxes, multi-frame studies, de-identification viewer interoperability, and DICOMweb.

They should also provide examples of how they have solved real DICOM interoperability issues, tested PACS integrations, managed failed transfers, and ensured compatibility across different imaging environments.

Secondly, understand how the vendor determines whether your software is classified as a medical device. The FDA's treatment of software depends on its intended use and function. If the software acquires, processes, or analyzes medical images, it may fall under medical-device oversight, necessitating compliance with FDA regulations. Ask about the ownership of intended-use definition, software classification, risk analysis, design controls, verification, evidence, and regulatory documentation.

Thirdly, assess the vendor's development process in relation to FDA and QMSR requirements. The FDA's Quality Management System Regulation became effective in February 2026, incorporating ISO 13485:2016. The vendor's process should incorporate traceability throughout development, including requirements, risks, architecture decisions, tests, defects, releases, and changes. A clear evidence chain should be established, as regulatory readiness cannot be added after engineering is complete.

Fourthly, inquire about the vendor's strategy for testing imaging performance at clinical scale. A brief demo of a few studies is not sufficient to assess the product's capabilities. Request measurable targets for viewer time, concurrent study ingestion, network performance, handling of large studies (e.g., CT/MRI series), and recovery mechanisms in case of transfer failures.

Fifthly, examine the vendor's interoperability strategy beyond DICOM. Medical images often require integration with RIS, EHR/EMR, identity, scheduling, reporting, billing, and clinical workflow systems using HL7 or FHIR. A robust healthcare custom software development approach should address data flow across these boundaries before accelerating feature development.

Sixthly, scrutinize the vendor's security measures. Encryption alone is not enough. Instead, ask about role-based access control (RBAC), multi-factor authentication (MFA), encryption in transit and at rest, audit trails, secrets management, vulnerability management, software bill of materials (SBOMs), secure updates, incident response, PHI-safe logging, and FDA's updated medical-device cybersecurity guidance. Security should be a lifecycle requirement, not just an infrastructure checkbox.

Seventhly, investigate the vendor's validation strategy for imaging AI. AI integration modifies the evaluation process. Request clarification on how they separate training, validation, and test data, model version from application version, inference failures from workflow failures, model performance from clinical usefulness, and automated output from human review.

The FDA's expanding AI-enabled device landscape emphasizes the importance of lifecycle control, including model evaluation, observability, rollback, and human oversight.

Lastly, establish ownership of critical components such as source code, infrastructure definitions, schemas, trained models, prompts, documentation, and integration adapters. Clarify who owns these assets to avoid potential complications if the project transitions to another engineering team.