I'm also in the medical device industry, though we don't farm our V&V work out. The bugs are supposed to be caught in the verification phase; validation is all about making sure that the software is functioning correctly from a user perspective? Are you just conflating the terms here for the sake of simplicity?