IEC_TR_80001-2-4-2012.pdf

IEC/TR 80001-2-4 Edition 1.0 2012-11 TECHNICAL REPORT Application of risk management for IT-networks incorporating medical devices Part 2-4:Application guidance General implementation guidance for healthcare delivery organizations IEC/TR 80001-2-4:2012(E)colourinsideCopyrighted material licensed to BR Demo by Thomson Reuters(Scientific),Inc.,,downloaded on Nov-27-2014 by James Madison.No further reproduction or distribution is permitted.Uncontrolled when printed.THIS PUBLICATION IS COPYRIGHT PROTECTED Copyright 2012 IEC,Geneva,Switzerland All rights reserved.Unless otherwise specified,no part of this publication may be reproduced or utilized in any form or by any means,electronic or mechanical,including photocopying and microfilm,without permission in writing from either IEC or IECs member National Committee in the country of the requester.If you have any questions about IEC copyright or have an enquiry about obtaining additional rights to this publication,please contact the address below or your local IEC member National Committee for further information.IEC Central Office Tel.:+41 22 919 02 11 3,rue de Varemb Fax:+41 22 919 03 00 CH-1211 Geneva 20 infoiec.ch Switzerland www.iec.ch About the IEC The International Electrotechnical Commission(IEC)is the leading global organization that prepares and publishes International Standards for all electrical,electronic and related technologies.About IEC publications The technical content of IEC publications is kept under constant review by the IEC.Please make sure that you have the latest edition,a corrigenda or an amendment might have been published.Useful links:IEC publications search-www.iec.ch/searchpub The advanced search enables you to find IEC publications by a variety of criteria(reference number,text,technical committee,).It also gives information on projects,replaced and withdrawn publications.IEC Just Published-webstore.iec.ch/justpublished Stay up to date on all new IEC publications.Just Published details all new publications released.Available on-line and also once a month by email.Electropedia-www.electropedia.org The worlds leading online dictionary of electronic and electrical terms containing more than 30 000 terms and definitions in English and French,with equivalent terms in additional languages.Also known as the International Electrotechnical Vocabulary(IEV)on-line.Customer Service Centre-webstore.iec.ch/csc If you wish to give us your feedback on this publication or need further assistance,please contact the Customer Service Centre:csciec.ch.Copyrighted material licensed to BR Demo by Thomson Reuters(Scientific),Inc.,,downloaded on Nov-27-2014 by James Madison.No further reproduction or distribution is permitted.Uncontrolled when printed.IEC/TR 80001-2-4 Edition 1.0 2012-11 TECHNICAL REPORT Application of risk management for IT-networks incorporating medical devices Part 2-4:Application guidance General implementation guidance for healthcare delivery organizations INTERNATIONAL ELECTROTECHNICAL COMMISSION T ICS 11.040.01;35.240.80 PRICE CODE ISBN 978-2-83220-525-9 Warning!Make sure that you obtained this publication from an authorized distributor.colourinsideCopyrighted material licensed to BR Demo by Thomson Reuters(Scientific),Inc.,,downloaded on Nov-27-2014 by James Madison.No further reproduction or distribution is permitted.Uncontrolled when printed.2 TR 80001-2-4 IEC:2012(E)CONTENTS FOREWORD.3 INTRODUCTION.5 1 Scope.7 1.1 Purpose.7 1.2 HEALTHCARE DELIVERY ORGANIZATION.7 1.3 Field of application.7 1.4 Prerequisites.7 2 Normative references.8 3 Terms and definitions.8 4 RESPONSIBLE ORGANIZATION.12 4.1 TOP MANAGEMENT responsibilities.12 4.2 Small RESPONSIBLE ORGANIZATION points to consider.13 4.3 Large RESPONSIBLE ORGANIZATION points to consider.14 5 RISK MANAGEMENT implementation steps.14 5.1 Overview.14 5.2 Determine the clinical context within which the healthcare provision is made.14 5.3 Establish underlying RISK framework.14 5.4 Determining and understanding a MEDICAL IT-NETWORK.15 5.4.1 Performing a RISK ASSESSMENT.15 5.4.2 MEDICAL IT-NETWORK configuration.16 5.4.3 Development status of MEDICAL IT-NETWORK.18 5.4.4 Manufacturer identification.18 5.4.5 External IT and bio-medical engineering support.19 6 RESPONSIBILITY AGREEMENTS.19 Annex A(informative)MEDICAL IT-NETWORK configuration examples.20 Bibliography.24 Figure A.1 Standalone MEDICAL IT-NETWORK outside the scope of IEC 80001-1.21 Figure A.2 Standalone MEDICAL IT-NETWORK.22 Figure A.3 Collaborative MEDICAL IT-NETWORK.22 Figure A.4 Centralized MEDICAL IT-NETWORK.23 Copyrighted material licensed to BR Demo by Thomson Reuters(Scientific),Inc.,,downloaded on Nov-27-2014 by James Madison.No further reproduction or distribution is permitted.Uncontrolled when printed.TR 80001-2-4 IEC:2012(E)3 INTERNATIONAL ELECTROTECHNICAL COMMISSION _ APPLICATION OF RISK MANAGEMENT FOR IT-NETWORKS INCORPORATING MEDICAL DEVICES Part 2-4:Application guidance General implementation guidance for healthcare