Yeah, I'm familiar with that--note again that that was a combination of hardware and software, and that the perhaps leading cause of actual damage was the omission of a mechanical safety interlock that existed on earlier models; with that interlock, the buggy software wouldn't have mattered.

There is a difference between embedded systems or devices (pacemakers, imaging devices, etc.) and EMR/records/data mining software.

The regulations are all calibrated to defend against a Therac-25 (well, sort of) and seemingly not to deal with modern software development or deployment.