I am an employee of a contract employer being contracted out to a medical company writing software for medical devices. What is my liability or who shoulders the legal expenses if a product I wrote software for malfunctions or is involved in an injury or accident?
As an independent contractor you are responsible for your own torts.
If a third party suffers due to software you wrote in a way that was negligent you are responsible for their losses.
In practice, they would sue your principal who would join you as a defendant. Your professional indemnity insurer (you have one of course) would step in to settle the claim up to the limit of your policy cover and you would be responsible for anything in excess as well as the deductible.
I was once a contractor developing software for a medical device (outside the USA). Without seeking legal advice, I wrote into my contract with my employer that I was doing work-for-hire for them, and that it was their responsibility to test it (and to integrate it, deploy it, and to decide whether and how to use it).
I expect that something like that might be true if I were an employee (i.e. that it's the company's/employer's responsibility), and I didn't want additional liability from working as a contractor (as if I were supplying a finished/tested/certified product).
I also once (I don't remember if it was the same contract) pushed back on the wording of my employer's contract where it implied that I agreed I wouldn't be negligent -- I added the word gross.
Realistically, your exposure to liability is remote, unless you intentionally design the product defectively so as to foreseeably cause harm to others (a la a certain engineer in the movie Rouge One, whose own actions were arguably justifiable morally, if not legally).
Strict Liability Probably Doesn't Apply Because You Aren't A Manufacturer
Designers and manufacturers of defective products have strict liability for injuries caused by defective designs, failure to warn, and lack of quality control leading to a defect in a particular unit.
This liability is in addition to the warranties arising in the sales chain from manufacturer to wholesaler(s) (if separate), to the final retail sale to an end user (which in the medical device case is sort of the patient and sort of the treating medical professionals and health care provider businesses). Obviously, since you aren't selling the final goods to anyone you wouldn't have sale of goods liability to anyone.
Generally speaking, you only have quality control liability particular to an individual unit if you are producing individual units, which it doesn't sound like you would.
Then, it comes down to design defect liability and duty to warn liability. The question then comes down to whether you are the "manufacturer", and as a W-2 employee of a subcontractor of the primary manufacturer, you probably are not.
Therefore, you do not have strict liability in tort for defective products or a failure to warn and this is basically above your pay grade.
Personal Negligence Liability Is Still A Remote Possibility
You might have liability if your own personal negligent conduct caused harm via the product in a manner that was capable of being extricated from everyone else involved.
Your standard of care and the causation of the injury would be very difficult to show in a negligence case, since a reasonable manufacturer or contractor would have, at a minimum a primary programmer and somebody in charge of quality control (my brother is an IT quality control guy for medical device software for a company that contracts with manufacturers of other products). This is because both the programmer and the quality control guy would have had to have failed negligently and the management would have also had to have failed negligently to put good systems in place.
Furthermore, figuring out who did what is often not easily audited, so this is from a practical perspective something that is very hard to prove and rarely worth it given what can be collected from a W-2 employee at a software firm when a medical device firm.
Negligence Liability And Negligence Suit Litigation Are Probably Handled By Your Employer And/Or The Manufacturer And/Or Their Insurers
Also, even if you were found personally liable for unintentional negligence, your employer or the manufacturer would normally have a common law or express contractual duty to indemnify and defend you from the lawsuit that was funded by a very large insurance policy paid for by the manufacturer. So, unless somebody screwed up in failing to obtain the insurance policy or in failing to pay the premium, you would normally be completely covered for you unintentional acts causing injury in connection with the product by somebody unless the liability was so huge that it exceeded the policy limits. (You conceivably might just even be able to sue the person who screwed this up if they did in some far fetched fact pattern.)
They have a strong incentive to do this because they have full legal liability for any negligence you are found liable for in addition to your personal liability because you were personally negligent in a way that caused the arm.
Even then, the insurance company would at least pay for your attorney and for the first $XX million of damages awarded against you.
But, if the medical device blew up and killed a room full of neurosurgeons and other specialist physicians operating on a billionaire, for example (something along these lines actually happened within the last month or so), then the policy limits could be exceeded and you could theoretically have personal liability for the excess (although usually the plaintiffs would settle for the insurance policy limits before getting that far).
If worse came to worse, you could go bankrupt and wipe out the unintentional tort liability in excess of the value of your current assets which are not exempt from creditors claims, and would not even need to devote any future wages to this claims if you did so, under U.S. bankruptcy law. In Colorado, your exempt assets would include your pensions and IRAs and education accounts, significant equity in your home and a motor vehicle, and certain other tangible personal property. It would not include non-retirement investments, investment or vacation real estate, more than once vehicle, or expensive sports equipment or non-wedding band jewelry or art.
Tort And Criminal Intentional Act Liability Apply With Full Force
This said, you would still certainly have (civil and criminal) liability if your intentional actions in creating a design defect caused an injury (e.g. if you maliciously programmed the device to self-destruct on 9-11 in every patient it was implanted in, causing foreseeable death or injury to persons or property or even loss of economic value).
Intentional tort liability is not covered by insurance as a matter of both a contractual exclusion and a public policy exception to coverage. The insurance company or employer does not even have a duty to defend you once it is clear that there is only an intentional tort by you involved. No contractual arrangement can relieve you of this liability.
You also can't discharge this kind of liability in bankruptcy in the U.S.
Honestly a good thing. If you are a terrorist, the world needs every legal tool at its disposal to take you down and seek compensation from you.