Assessing a Hospital's Medical IT Network Risk Management Practice with 80001-1

Abstract

Medical device interoperability has been identified as a key way of decreasing healthcare costs while improving patient care. 1 This has led to a shift toward placing more medical devices onto information technology (IT) networks. However, placing medical devices onto an IT network may lead to additional risks to safety, effectiveness and security of the devices, the network, and the data. ANSI/AAMI/IEC 80001-1 addresses the roles, responsibilities, and activities that need to be carried out when managing these risks. In this article, we describe an exercise undertaken to assess the medical IT network risk management practice implemented within a hospital to control risk associated with a clinical information system (CIS). The level of compliance with the 80001-1 standard was determined using an assessment framework developed by the Regulated Software Research Centre. The purpose of this exercise was to test and inform the development of an assessment method that is part of the assessment framework for this standard. The exercise also sought to identify how the management of such an existing CIS project meets the requirements of 80001-1.

Revising IEC 80001-1: Risk management of health information technology systems

“…IT do not understand clinical workflows and BME do not understand complex networking concepts. This issue was also identified during pilot implementations of ISO TR 80001-2-7 [47]. Using a structure based on Annex SL and ISO 9001 may aid in providing a common language between BME and IT.…”

Improving ICU risk management and patient safety

“…Moreover, the person managing the project was only formally identified during the assessment. The IT-network risk manager role could be undertaken by personnel from clinical engineering (Hegarty et al, 2014) or clinical informatics; however neither have responsibility for the IT network. The author suggests that when there is no medical IT-network risk manager; this role should be undertaken by the IT person involved in the medical IT-network modification project.…”

“…The assessment showed that there was no documented risk list with corresponding risk control measures, risk relevant assets were not described and there was no system architecture diagram showing data flow. A deficit in formal risk management processes with inadequate documentation was identified by Hegarty et al (2014). The analysers and IT-network interface validation processes were formally documented.…”

“…Ahlbrandt and Röhrig (2013) incorporated medical devices on the IT-network using the Standard. Hegarty et al (2014) note experiences and challenges when assessing hospital IT-network risk management processes against the Standard's requirements. A possible reason for low implementation is poor awareness among healthcare personnel.…”

The MedITNet assessment framework: development and validation of a framework for improving risk management of medical IT networks

“…The standard outlines the roles, responsibilities and activities to be carried out in the management of these risks. However, HDOs face challenges when implementing the requirements of this standard . These challenges include the following: HDOs vary in size and in terms of the capability of their risk management processes HDOs provide care in different regulatory environments meaning that the implementation of the requirements of the standard will vary depending on the regulation of the region in which the HDO provides care. Effective performance of risk management activities requires interaction between different stakeholder groups to understand the context of the HDO and manage identified risks accordingly . HDOs may be unprepared for the organisational changes that are required to facilitate this level of interaction among stakeholders who typically operate in silos . …”