Standards · Standard or regulation
IEC 80001-1
Application of risk management for IT networks incorporating medical devices, safety, effectiveness and security
In plain words
What it covers.
The standard for managing risk when medical devices are connected to hospital IT networks. It makes the healthcare organisation responsible for the connected system, with clear roles, a risk management process for every change and cooperation between clinical engineering, IT and manufacturers. The 2021 edition covers safety, effectiveness and cybersecurity.
Who uses it: Hospital IT and clinical engineering teams, risk managers and integrators.
A summary written by BMEssentia for learning, not the text of the standard. Always work from the current official edition and the manufacturer's instructions.
It covers
- Responsibilities of the healthcare delivery organisation
- Risk management for networked devices
- Change management
- Cooperation with manufacturers and IT
- Safety, effectiveness and security
- Documentation and reporting
Key points
What engineers need to know.
- Once a device is on a network, the hospital owns part of the risk of the whole system.
- Every network change, update or new connection needs a risk assessment.
- Clinical engineering and IT must work together with clear named roles.
- Manufacturers supply information such as network needs and security features (for example via MDS2).
- Interim controls, such as manual checks, keep patients safe while a network fault is fixed.
- Cybersecurity is part of safety, not a separate IT issue.
Medical City
Where you practise it.
- Clinical Engineer Campaign
- Equipment Procurement
- Installation and Commissioning
- Hospital Operations Manager
- S1-M059 The Network Drop
- S1-M083 cybersecurity incident
- S1-M144 network mapping
- S2-M046 and S2-M074 network sign-off and integration testing