For changes in accordance with IEC 60601-1-2 or any other changes you should have a procedure that describes how you would handle changes to the design - this could/should be handles through your engineering change control procedure. The change procedure would require details of the change as well as who is approving (in your company) the changes.
I wouldn't get too caught up in trying to make a complicated system. Since you contract out the design process, your organization could have one procedure that addresses each of the elements of 7.3 Design and development:
7.3.1 Design and development planning - Could simply state, a plan will be created and approved by "X". The plan shall consist of "put any components you want here such as: input reviews, testing, validation, design reviews, and other misc. reviews as necessary."
7.3.4 Design and development review - Could simply state how often and at what points your organization would like to review the design. If it's only a change to an existing design as you described then these reviews could be stated as intital review and final sign-off. That is up to you and your business needs.
7.3.5 Design and development verification - Could state how the changes will be tested and validated as necessary. If a protocol needs to be written or not. Your company can describe at what level or point an protocol would even need to be completed, however, anything you cannot measure should be validated.
Risk management could be handled the same way. You could require a design
FMEA and a process FMEA as your risk plan. ISO is trending to a risk review before committing to a design or a change. But you would have to assess your level of need for risk assessment based on the type of product you have.