ANSI AAMI 80001-1-2010 Application of risk management for IT Networks incorporating medical devices Part 1 Roles responsibilities and activities.pdf

1、Association for the Advancementof Medical InstrumentationANSI/AAMI/IEC 80001-1:2010Application of risk management for IT Networks incorporating medical devices Part 1: Roles, responsibilities and activitiesObjectives and uses of AAMI standards and recommended practices It is most important that the

2、objectives and potential uses of an AAMI product standard or recommended practice are clearly understood. The objectives of AAMIs technical development program derive from AAMIs overall mission: the advancement of medical instrumentation. Essential to such advancement are (1) a continued increase in

3、 the safe and effective application of current technologies to patient care, and (2) the encouragement of new technologies. It is AAMIs view that standards and recommended practices can contribute significantly to the advancement of medical instrumentation, provided that they are drafted with attent

4、ion to these objectives and provided that arbitrary and restrictive uses are avoided. A voluntary standard for a medical device recommends to the manufacturer the information that should be provided with or on the product, basic safety and performance criteria that should be considered in qualifying

5、 the device for clinical use, and the measurement techniques that can be used to determine whether the device conforms with the safety and performance criteria and/or to compare the performance characteristics of different products. Some standards emphasize the information that should be provided wi

6、th the device, including performance characteristics, instructions for use, warnings and precautions, and other data considered important in ensuring the safe and effective use of the device in the clinical environment. Recommending the disclosure of performance characteristics often necessitates th

7、e development of specialized test methods to facilitate uniformity in reporting; reaching consensus on these tests can represent a considerable part of committee work. When a drafting committee determines that clinical concerns warrant the establishment of minimum safety and performance criteria, re

8、feree tests must be provided and the reasons for establishing the criteria must be documented in the rationale. A recommended practice provides guidelines for the use, care, and/or processing of a medical device or system. A recommended practice does not address device performance per se, but rather

9、 procedures and practices that will help ensure that a device is used safely and effectively and that its performance will be maintained. Although a device standard is primarily directed to the manufacturer, it may also be of value to the potential purchaser or user of the device as a frame of refer

10、ence for device evaluation. Similarly, even though a recommended practice is usually oriented towards healthcare professionals, it may be useful to the manufacturer in better understanding the environment in which a medical device will be used. Also, some recommended practices, while not addressing

11、device performance criteria, provide guidelines to industrial personnel on such subjects as sterilization processing, methods of collecting data to establish safety and efficacy, human engineering, and other processing or evaluation techniques; such guidelines may be useful to health care profession

12、als in understanding industrial practices. In determining whether an AAMI standard or recommended practice is relevant to the specific needs of a potential user of the document, several important concepts must be recognized: All AAMI standards and recommended practices are voluntary (unless, of cour

13、se, they are adopted by government regulatory or procurement authorities). The application of a standard or recommended practice is solely within the discretion and professional judgment of the user of the document. Each AAMI standard or recommended practice reflects the collective expertise of a co

14、mmittee of health care professionals and industrial representatives, whose work has been reviewed nationally (and sometimes internationally). As such, the consensus recommendations embodied in a standard or recommended practice are intended to respond to clinical needs and, ultimately, to help ensur

15、e patient safety. A standard or recommended practice is limited, however, in the sense that it responds generally to perceived risks and conditions that may not always be relevant to specific situations. A standard or recommended practice is an important reference in responsible decision-making, but

16、 it should never replace responsible decision-making. Despite periodic review and revision (at least once every five years), a standard or recommended practice is necessarily a static document applied to a dynamic technology. Therefore, a standards user must carefully review the reasons why the docu

17、ment was initially developed and the specific rationale for each of its provisions. This review will reveal whether the document remains relevant to the specific needs of the user. Particular care should be taken in applying a product standard to existing devices and equipment, and in applying a rec

18、ommended practice to current procedures and practices. While observed or potential risks with existing equipment typically form the basis for the safety and performance criteria defined in a standard, professional judgment must be used in applying these criteria to existing equipment. No single sour

19、ce of information will serve to identify a particular product as “unsafe“. A voluntary standard can be used as one resource, but the ultimate decision as to product safety and efficacy must take into account the specifics of its utilization and, of course, cost-benefit considerations. Similarly, a r

20、ecommended practice should be analyzed in the context of the specific needs and resources of the individual institution or firm. Again, the rationale accompanying each AAMI standard and recommended practice is an excellent guide to the reasoning and data underlying its provision. In summary, a stand

21、ard or recommended practice is truly useful only when it is used in conjunction with other sources of information and policy guidance and in the context of professional experience and judgment. INTERPRETATIONS OF AAMI STANDARDS AND RECOMMENDED PRACTICES Requests for interpretations of AAMI standards

22、 and recommended practices must be made in writing, to the AAMI Vice President, Standards Policy and Programs. An official interpretation must be approved by letter ballot of the originating committee and subsequently reviewed and approved by the AAMI Standards Board. The interpretation will become

23、official and representation of the Association only upon exhaustion of any appeals and upon publication of notice of interpretation in the “Standards Monitor“ section of the AAMI News. The Association for the Advancement of Medical Instrumentation disclaims responsibility for any characterization or

24、 explanation of a standard or recommended practice which has not been developed and communicated in accordance with this procedure and which is not published, by appropriate notice, as an official interpretation in the AAMI News. American National Standard ANSI/AAMI/IEC 80001-1:2010 Application of r

25、isk management for IT Networks incorporating medical devices - Part 1: Roles, responsibilities and activities Approved 14 October 2010 by Association for the Advancement of Medical Instrumentation Approved 6 October 2010 by American National Standards Institute, Inc. Abstract: This standard defines

26、the roles, responsibilities and activities that are necessary for risk management of IT-networks incorporating medical devices to address safety, effectiveness, and data and system security. Keywords: medical device, risk management, information technology, interoperability AAMI Standard This Associ

27、ation for the Advancement of Medical Instrumentation (AAMI) standard implies a consensus of those substantially concerned with its scope and provisions. The existence of an AAMI standard does not in any respect preclude anyone, whether they have approved the standard or not, from manufacturing, mark

28、eting, purchasing, or using products, processes, or procedures not conforming to the standard. AAMI standards are subject to periodic review, and users are cautioned to obtain the latest editions. CAUTION NOTICE: This AAMI standard may be revised or withdrawn at any time. AAMI procedures require tha

29、t action be taken to reaffirm, revise, or withdraw this standard no later than five years from the date of publication. Interested parties may obtain current information on all AAMI standards by calling or writing AAMI, or by visiting the AAMI website at www.aami.org. All AAMI standards, recommended

30、 practices, technical information reports, and other types of technical documents developed by AAMI are voluntary, and their application is solely within the discretion and professional judgment of the user of the document. Occasionally, voluntary technical documents are adopted by government regula

31、tory agencies or procurement authorities, in which case the adopting agency is responsible for enforcement of its rules and regulations. Published by Association for the Advancement of Medical Instrumentation 4301 N. Fairfax Drive, Suite 301 Arlington, VA 22203-1633 www.aami.org 2010 by the Associat

32、ion for the Advancement of Medical Instrumentation All Rights Reserved This publication is subject to copyright claims of ISO, ANSI, and AAMI. No part of this publication may be reproduced or distributed in any form, including an electronic retrieval system, without the prior written permission of A

33、AMI. All requests pertaining to this document should be submitted to AAMI. It is illegal under federal law (17 U.S.C. 101, et seq.) to make copies of all or any part of this document (whether internally or externally) without the prior written permission of the Association for the Advancement of Med

34、ical Instrumentation. Violators risk legal action, including civil and criminal penalties, and damages of $100,000 per offense. For permission regarding the use of all or any part of this document, complete the reprint request form at www.aami.org or contact AAMI, 4301 N. Fairfax Drive, Suite 301, A

35、rlington, VA 22203-1633. Phone: (703) 525-4890; Fax: (703) 525-1067. Printed in the United States of America ISBN 157020400-4 Contents Page Glossary of equivalent standards .v Committee representationvii Background of AAMI adoption of IEC 80001-1:2010viii FOREWORD ix INTRODUCTION xi 1 Scope 1 2 Term

36、s and definitions . 2 3 Roles and responsibilities. 7 3.1 General. 7 3.2 RESPONSIBLE ORGANIZATION 7 3.3 TOP MANAGEMENT responsibilities . 7 3.4 MEDICAL IT-NETWORK RISK MANAGER 9 3.5 MEDICAL DEVICE manufacturer(s) .10 3.6 Providers of other information technology .11 4 Life cycle RISK MANAGEMENT in M

37、EDICAL IT-NETWORKS .12 4.1 Overview12 4.2 RESPONSIBLE ORGANIZATION RISK MANAGEMENT .14 4.2.1 POLICY FOR RISK MANAGEMENT for incorporating MEDICAL DEVICES 14 4.2.2 RISK MANAGEMENT PROCESS .14 4.3 MEDICAL IT-NETWORK RISK MANAGEMENT planning and documentation .14 4.3.1 Overview 14 4.3.2 RISK-relevant a

38、sset description .15 4.3.3 MEDICAL IT-NETWORK documentation15 4.3.4 RESPONSIBILITY AGREEMENT .16 4.3.5 RISK MANAGEMENT plan for the MEDICAL IT-NETWORK .17 4.4 MEDICAL IT-NETWORK RISK MANAGEMENT .17 4.4.1 Overview 17 4.4.2 RISK ANALYSIS .18 4.4.3 RISK EVALUATION .18 4.4.4 RISK CONTROL .18 4.4.5 RESID

39、UAL RISK evaluation and reporting .20 4.5 CHANGE-RELEASE MANAGEMENT and CONFIGURATION MANAGEMENT21 4.5.1 CHANGE-RELEASE MANAGEMENT PROCESS 21 4.5.2 Decision on how to apply RISK MANAGEMENT.21 4.5.3 Go-live .22 4.6 Live network RISK MANAGEMENT .23 4.6.1 Monitoring 23 4.6.2 EVENT MANAGEMENT.23 5 Docum

40、ent control 24 5.1 Document control procedure.24 5.2 MEDICAL IT-NETWORK RISK MANAGEMENT FILE 24 Annex A (informative) Rationale25 Annex B (informative) Overview of RISK MANAGEMENT relationships 29 Annex C (informative) Guidance on field of application30 Annex D (informative) Relationship with ISO/IE

41、C 20000-2:2005 Information technology Service management Part 2: Code of practice .32 Bibliography 36 Figure 1 Illustration of TOP MANAGEMENT responsibilities . 9 Figure 2 Overview of life cycle of MEDICAL IT-NETWORKS including RISK MANAGEMENT13 Figure B.1 Overview of roles and relationships29 Figur

42、e D.1 Service management processes.33 Table A.1 Relationship between ISO 14971 and IEC 80001-1 27 Table C.1 IT-NETWORK scenarios that can be encountered in a clinical environment .30 Table D.1 Relationship between IEC 80001-1 and ISO/IEC 20000-1:2005 or ISO/IEC 20000-2:2005.34 Glossary of equivalent

43、 standards International Standards adopted in the United States may include normative references to other International Standards. For each International Standard that has been adopted by AAMI (and ANSI), the table below gives the corresponding U.S. designation and level of equivalency to the Intern

44、ational Standard. NOTE: Documents are sorted by international designation. The code in the US column, “(R)20xx” indicates the year the document was officially reaffirmed by AAMI. E.g., ANSI/AAMI/ISO 10993-4:2002/(R)2009 indicates that 10993-4, originally approved and published in 2002, was reaffirme

45、d without change in 2009. Other normatively referenced International Standards may be under consideration for U.S. adoption by AAMI; therefore, this list should not be considered exhaustive. International designation U.S. designation Equivalency IEC 60601-1:2005 Technical Corrigendum 1 and 2 ANSI/AA

46、MI ES60601-1:2005 and ANSI/AAMI ES60601-1:2005/A2:2010 ANSI/AAMI ES60601-1:2005/C1:2009 (amdt) Major technical variations C1 Identical to Corrigendum 1 any IEC National Committee interested in the subject dealt with may participate in this preparatory work. International, governmental and non-govern

47、mental organizations liaising with the IEC also participate in this preparation. IEC collaborates closely with the International Organization for Standardization (ISO) in accordance with conditions determined by agreement between the two organizations. 2) The formal decisions or agreements of IEC on

48、 technical matters express, as nearly as possible, an international consensus of opinion on the relevant subjects since each technical committee has representation from all interested IEC National Committees. 3) IEC Publications have the form of recommendations for international use and are accepted

49、 by IEC National Committees in that sense. While all reasonable efforts are made to ensure that the technical content of IEC Publications is accurate, IEC cannot be held responsible for the way in which they are used or for any misinterpretation by any end user. 4) In order to promote international uniformity, IEC National Committees undertake to apply IEC Publications transparently to the maximum extent possible in their national and regional publications. Any divergence between any IEC Publication and the corresponding national or regional publication shall be cl