And often the compliance also defined how the SW should have been developed.

For example, for devices : ISO IEC 62304 Medical device software – Software life cycle processes

I guess this kind to enforce on an Open Source projects with "open contributions".

Actually this has been transferred into the ISO 80xxx sections. Specifically 80001 and following.

possibly this has changed recently but I don't think medical records software is subject to the same standards as medical device software (in Europe, at least).

It's important to remember that EMRs are there to support healthcare professionals who are used to working with incomplete / incorrect information all the time. For example, a patient isn't going to have a drug dispensed to them without a pharmacist checking it (and, frequently, asking the prescribing doctor to clarify/amend questionable doses or instructions).

> possibly this has changed recently but I don't think medical records software is subject to the same standards as medical device software (in Europe, at least).

That is indeed the case (medical record software not being classified as a medical device software product in Europe). However medical record software has been added to also be covered some ISO 80xxx standard. However in the USA medical record software is considered a class B or even class C medical product by the FDA, depending on if the software is used just for record keeping or actively used for therapy planning.

So a) Class A, B, C in this context means safety class(=IEC62304?) b) I was under the impression that EHR is not FDA regulated in US? (There was been lots of discussion about this though)

I'd have to look into my most recent seminar materials (we did only tangent on medical record software since this was focused on diagnostics and treatment devices) but as far as I recall, there was a slide that EHR software falls under FDA regulation; in contrast to EU law. Let me have a look at it tomorrow, when I'm in the office, where I placed the seminar stuff.