ISO 81001-1:2021

Health software and health IT systems safety, effectiveness and security - Part 1: Principles and concepts

This document provides the principles, concepts, terms and definitions for health software and health IT systems, key properties of safety, effectiveness and security, across the full life cycle, from concept to decommissioning, as represented in Figure 1. It also identifies the transition points in the life cycle where transfers of responsibility occur, and the types of multi-lateral communication that are necessary at these transition points. This document also establishes a coherent concepts and terminology for other standards that address specific aspects of the safety, effectiveness, and security (including privacy) of health software and health IT systems.
This document is applicable to all parties involved in the health software and health IT systems life cycle including the following:
a) Organizations, health informatics professionals and clinical leaders designing, developing, integrating, implementing and operating health software and health IT systems – for example health software developers and medical device manufacturers, system integrators, system administrators (including cloud and other IT service providers);
b) Healthcare service delivery organizations, healthcare providers and others who use health software and health IT systems in providing health services;
c) Governments, health system funders, monitoring agencies, professional organizations and customers seeking confidence in an organization’s ability to consistently provide safe, effective and secure health software, health IT systems and services;
d) Organizations and interested parties seeking to improve communication in managing safety, effectiveness and security risks through a common understanding of the concepts and terminology used in safety, effectiveness and security management;
e) Providers of training, assessment or advice in safety, effectiveness and security risk management for health software and health IT systems;
f) Developers of related safety, effectiveness and security standards.

General Information

• Status: Published
• Publication Date: 30-Mar-2021
• ICS: 35.240.80 - IT applications in health care technology
• Technical Committee: SC 62A - Common aspects of medical equipment, software, and systems
• Drafting Committee: JWG 7 - TC 62/SC 62A/JWG 7
• Current Stage: PPUB - Publication issued
• Start Date: 07-Jun-2021
• Completion Date: 06-Apr-2021

Standards Content (Sample)

INTERNATIONAL ISO
STANDARD 81001-1
First edition
2021-03
Health software and health IT systems
safety, effectiveness and security —
Part 1:
Principles and concepts
Sécurité, efficacité et sûreté des logiciels de santé et des systèmes TI
de santé —
Partie 1: Principes et concepts
Reference number
©
ISO 2021
© ISO 2021
All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication may
be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting
on the internet or an intranet, without prior written permission. Permission can be requested from either ISO at the address
below or ISO’s member body in the country of the requester.
ISO copyright office
CP 401 • Ch. de Blandonnet 8
CH-1214 Vernier, Geneva
Phone: [phone]
Email: [e-mail]
Website: www.iso.org
Published in Switzerland
ii © ISO 2021 – All rights reserved

Contents Page
Foreword .iv
Introduction .v
1 Scope . 1
2 Normative references . 1
3 Terms and definitions . 1
3.1 Organizations, people, and roles . 2
3.2 Key properties and processes . 3
3.3 Health information and technology . 5
3.4 Risk management . 8
4 Core themes .11
4.1 General .11
4.2 Sociotechnical ecosystem .12
4.3 System of systems .13
4.4 Life cycle of health software and health IT systems .14
4.5 Roles and responsibilities .17
4.6 Communication .18
4.7 Interdependence of safety, effectiveness and security .20
5 Foundational elements .21
5.1 General .21
5.2 Governance (intra organization focus) .22
5.2.1 General.22
5.2.2 Organization culture, roles and competencies .22
5.2.3 Quality management .24
5.2.4 Information management .25
5.2.5 Human factors and usability .26
5.3 Knowledge transfer (inter- and intra- organization collaboration) .28
5.3.1 General.28
5.3.2 Risk management .28
5.3.3 Safety management .30
5.3.4 Security management .33
5.3.5 Privacy management . .36
Annex A (informative) Rationale .39
Annex B (informative) Concept diagrams .43
Annex C (informative) Use of assurance cases for knowledge transfer .48
Bibliography .59
Foreword
ISO (the International Organization for Standardization) and IEC (the International Electrotechnical
Commission) form the specialized system for worldwide standardization. National bodies that
are members of ISO or IEC participate in the development of International Standards through
technical committees established by the respective organization to deal with particular fields of
technical activity. ISO and IEC technical committees collaborate in fields of mutual interest. Other
international organizations, governmental and non-governmental, in liaison with ISO and IEC, also
take part in the work.
The procedures used to develop this document and those intended for its further maintenance are
described in the ISO/IEC Directives, Part 1. In particular, the different approval criteria needed for
the different types of document should be noted. This document was drafted in accordance with the
editorial rules of the ISO/IEC Directives, Part 2 (see www .iso .org/ directives).
Attention is drawn to the possibility that some of the elements of this document may be the subject
of patent rights. ISO and IEC shall not be held responsible for identifying any or all such patent
rights. Details of any patent rights identified during the development of the document will be in the
Introduction and/or on the ISO list of patent declarations received (see www .iso .org/ patents) or the IEC
list of patent declarations received (see http:// patents .iec .ch).
Any trade name used in this document is information given for the convenience of users and does not
constitute an endorsement.
For an explanation of the voluntary nature of standards, the meaning of ISO specific terms and
expressions related to conformity assessment, as well as information about ISO's adherence to the
World Trade Organization (WTO) principles in the Technical Barriers to Trade (TBT) see www .iso .org/
iso/ foreword .html.
This document was prepared jointly by Technical Committee ISO/TC 215, Health informatics, and
Technical Committee IEC/TC 62, Electrical equipment in medical practice, Subcommittee SC 62A,
Common aspects of electrical equipment used in medical practice.
A list of all parts in the ISO 81001 and IEC 81001 series can be found on the ISO and IEC websites.
Any feedback or questions on this document should be directed to the user’s national standards body. A
complete listing of these bodies can be found at www .iso .org/ members .html.
iv © ISO 2021 – All rights reserved

Introduction
While the benefits of digital health are widely accepted, the potential for inadvertent and adverse
impacts on safety, effectiveness and security caused by health software and health IT systems is also
becoming more apparent. Today’s sophisticated health software and health IT systems provide advanced
levels of decision support and integrate patient data between systems, across organizational lines, and
across the continuum of care. In addition to the patient and healthcare system benefits this creates,
there is also increased likelihood of software-induced adverse events causing harm to both patients and
healthcare organizations. Design flaws, coding errors, incorrect implementation or configuration, data
integrity issues, faults in decision support tools, poor alignment with clinical workflows and improper
maintenance and use of health software and health IT systems are examples of events with the potential
to cause harm.
Managing safety, effectiveness and security for health software and health IT systems (including medical
devices), requires a comprehensive and coordinated approach to optimizing these three properties.
Many organizations and roles are involved throughout the life cycle of health software and health IT
systems (see Figure 1). Therefore, a common understanding of the concepts, principles and terminology
is important in standardizing the processes and inter-organizational communications to support a
coordinated approach to managing safety, effectiveness and security. This document takes into account
the evolving complex internal and external context in healthcare, including people, technology
(hardware/software), organizations, processes, and external environment.
Annex A provides further information on the rationale for this document, the terms and definitions
being used and their relationship to other standards addressing various aspects of health software and
health IT systems safety, effectiveness and security.
In addition to a common set of terms, definitions and concepts, this document describes eight
foundational elements in Clause 5, which support the overarching themes articulated in Clause 4. For
each foundational element, there is a “statement” describing each element; a “rationale” explaining why
it is important; “key concepts and principles” pertinent for managing safety, effectiveness and security;
and high-level guidance on the “approach” organizations can take to apply the concepts and principles.
Given the importance of communication between the various organizations, roles and responsibilities
involved across the life cycle of health software and health IT systems for the four foundational cross-
organizational elements, additional sub-clauses on communication and information sharing at major
transition points are also included for 5.3.2, 5.3.3, 5.3.4 and 5.3.5.
Figure 1 — Life cycle framework addressing safety, effectiveness and security of health software
and health IT systems
vi © ISO 2021 – All rights reserved

INTERNATIONAL STANDARD ISO 81001-1:2021(E)
Health software and health IT systems safety, effectiveness
and security —
Part 1:
Principles and concepts
1 Scope
This document provides the principles, concepts, terms and definitions for health software and health
IT systems, key properties of safety, effectiveness and security, across the full life cycle, from concept to
decommissioning, as represented in Figure 1. It also identifies the transition points in the life cycle where
transfers of responsibility occur, and the types of multi-lateral communication that are necessary at
these transition points. This document also establishes a coherent concepts and terminology for other
standards that address specific aspects of the safety, effectiveness, and security (including privacy) of
health software and health IT systems.
This document is applicable to all parties involved in the health software and health IT systems life cycle
including the following:
a) Organizations, health informatics professionals and clinical leaders designing, developing,
integrating, implementing and operating health software and health IT systems – for example health
software developers and medical device manufacturers, system integrators, system administrators
(including cloud and other IT servic
...