Using IEC80001-1 to assess a hospital’s Medical IT- Network risk management practice

Medical device interoperability has been identified as a key way of decreasing healthcare costs while improving patient care [1]. This has lead to a shift towards placing more medical devices onto IT networks. However, placing medical devices onto an IT network may lead to additional risks to the safety, effectiveness and security. IEC 80001-1 addresses the roles, responsibilities and activities that need to be carried out when managing these risks. In this article, we describe an exercise undertaken to assess a Clinical Information Systems level of compliance with the IEC 80001-1 standard using an assessment framework developed by the Regulated Software Research Centre (RSRC). The purpose of this exercise was, to test and inform the development of an assessment method which is part of the assessment framework for this standard, and also, to identify how the management of such an existing Clinical Information Systems (CIS) project meets the requirements of IEC 80001-1