Assessing a hospital's medical IT network risk management practice with 80001-1

Medical device interoperability has been identified as a key way of decreasing healthcare costs while improving patient care [1] . This has lead to a shift towards placing more medical devices onto IT networks. However, placing medical devices onto an IT network may lead to additional risks to safety, effectiveness and security of the devices, the network and the data. IEC 80001-1 addresses the roles, responsibilities and activities that need to be carried out when managing these risks. In this article, we describe an exercise undertaken to assess the Medical IT Network risk management practice implemented within a hospital to control risk associated with a Clinical Information System. The level of compliance with the IEC 80001-1 standard was determined using an assessment framework developed by the Regulated Software Research Centre (RSRC). The purpose of this exercise was, to test and inform the development of an assessment method that is part of the assessment framework for this standard, and also, to identify how the management of such an existing Clinical Information System (CIS) project meets the requirements of IEC 80001-1