Right, but unless you fuck up pretty badly software is not going to kill a patient directly (barring, say, pacemaker software).

We had to do a risk analysis review recently, and figured that unless you physically dropped one of our servers onto a patient you couldn't directly cause harm.

Anyways, you'd be a lot less concerned with regulation if you knew how brainfucked and unscientific the whole field of medicine seems to be--it's not as far along as you might expect/hope.