It does happen. I refer you to the Therac-25.
http://sunnyday.mit.edu/papers/therac.pdf
http://courses.cs.vt.edu/professionalism/Therac_25/Therac_1....
plenty of other reading: https://www.google.com/#q=therac-25
http://sunnyday.mit.edu/papers/therac.pdf
http://courses.cs.vt.edu/professionalism/Therac_25/Therac_1....
plenty of other reading: https://www.google.com/#q=therac-25
There is a difference between embedded systems or devices (pacemakers, imaging devices, etc.) and EMR/records/data mining software.
The regulations are all calibrated to defend against a Therac-25 (well, sort of) and seemingly not to deal with modern software development or deployment.