IEC TR 80001-2-4:2012

IEC/TR 80001-2-4
Edition 1.0 2012-11
TECHNICAL
REPORT
colour
inside
Application of risk management for IT-networks incorporating medical devices –

Part 2-4: Application guidance – General implementation guidance for healthcare

delivery organizations
IEC/TR 80001-2-4:2012(E)
All rights reserved. Unless otherwise specified, no part of this publication may be reproduced or utilized in any form
or by any means, electronic or mechanical, including photocopying and microfilm, without permission in writing from
either IEC or IEC's member National Committee in the country of the requester.
If you have any questions about IEC copyright or have an enquiry about obtaining additional rights to this publication,
please contact the address below or your local IEC member National Committee for further information.

IEC Central Office Tel.: +41 22 919 02 11
3, rue de Varembé Fax: +41 22 919 03 00
CH-1211 Geneva 20 info@iec.ch
Switzerland www.iec.ch
About the IEC
The International Electrotechnical Commission (IEC) is the leading global organization that prepares and publishes
International Standards for all electrical, electronic and related technologies.

About IEC publications
The technical content of IEC publications is kept under constant review by the IEC. Please make sure that you have the
latest edition, a corrigenda or an amendment might have been published.

Useful links:
IEC publications search - www.iec.ch/searchpub Electropedia - www.electropedia.org
The advanced search enables you to find IEC publications The world's leading online dictionary of electronic and
by a variety of criteria (reference number, text, technical electrical terms containing more than 30 000 terms and
committee,…). definitions in English and French, with equivalent terms in
It also gives information on projects, replaced and additional languages. Also known as the International
withdrawn publications. Electrotechnical Vocabulary (IEV) on-line.

IEC Just Published - webstore.iec.ch/justpublished Customer Service Centre - webstore.iec.ch/csc
Stay up to date on all new IEC publications. Just Published If you wish to give us your feedback on this publication
details all new publications released. Available on-line and or need further assistance, please contact the
also once a month by email. Customer Service Centre: csc@iec.ch.

IEC/TR 80001-2-4
Edition 1.0 2012-11
TECHNICAL
REPORT
colour
inside
Application of risk management for IT-networks incorporating medical devices –

Part 2-4: Application guidance – General implementation guidance for healthcare

delivery organizations
INTERNATIONAL
ELECTROTECHNICAL
COMMISSION
PRICE CODE
T
ICS 11.040.01; 35.240.80 ISBN 978-2-83220-525-9

– 2 – TR 80001-2-4 © IEC:2012(E)
CONTENTS
FOREWORD . 3
INTRODUCTION . 5
1 Scope . 7
1.1 Purpose. 7
1.2 HEALTHCARE DELIVERY ORGANIZATION . 7
1.3 Field of application . 7
1.4 Prerequisites . 7
2 Normative references . 8
3 Terms and definitions . 8
4 RESPONSIBLE ORGANIZATION . 12
4.1 TOP MANAGEMENT responsibilities . 12
4.2 Small RESPONSIBLE ORGANIZATION – points to consider . 13
4.3 Large RESPONSIBLE ORGANIZATION – points to consider . 14
5 RISK MANAGEMENT implementation steps . 14
5.1 Overview . 14
5.2 Determine the clinical context within which the healthcare provision is made . 14
5.3 Establish underlying RISK framework . 14
5.4 Determining and understanding a MEDICAL IT-NETWORK. 15
5.4.1 Performing a RISK ASSESSMENT . 15
5.4.2 MEDICAL IT-NETWORK configuration . 16
5.4.3 Development status of MEDICAL IT-NETWORK . 18
5.4.4 Manufacturer identification . 18
5.4.5 External IT and bio-medical engineering support . 19
6 RESPONSIBILITY AGREEMENTS . 19
Annex A (informative) MEDICAL IT-NETWORK configuration examples . 20
Bibliography . 24

Figure A.1 – Standalone MEDICAL IT-NETWORK outside the scope of IEC 80001-1 . 21
Figure A.2 – Standalone MEDICAL IT-NETWORK . 22
Figure A.3 – Collaborative MEDICAL IT-NETWORK . 22
Figure A.4 – Centralized MEDICAL IT-NETWORK . 23

TR 80001-2-4 © IEC:2012(E) – 3 –
INTERNATIONAL ELECTROTECHNICAL COMMISSION
____________
APPLICATION OF RISK MANAGEMENT FOR
IT-NETWORKS INCORPORATING MEDICAL DEVICES –

Part 2-4: Application guidance – General implementation guidance
for healthcare delivery organizations

FOREWORD
1) The International Electrotechnical Commission (IEC) is a worldwide organization for standardization comprising
all national electrotechnical committees (IEC National Committees). The object of IEC is to promote
international co-operation on all questions concerning standardization in the electrical and electronic fields. To
this end and in addition to other activities, IEC publishes International Standards, Technical Specifications,
Technical Reports, Publicly Available Specifications (PAS) and Guides (hereafter referred to as “IEC
Publication(s)”). Their preparation is entrusted to technical committees; any IEC National Committee interested
in the subject dealt with may participate in this preparatory work. International, governmental and non-
governmental organizations liaising with the IEC also participate in this preparation. IEC collaborates closely
with the International Organization for Standardization (ISO) in accordance with conditions determined by
agreement between the two organizations.
2) The formal decisions or agreements of IEC on technical matters express, as nearly as possible, an international
consensus of opinion on the relevant subjects since each technical committee has representation from all
interested IEC National Committees.
3) IEC Publications have the form of recommendations for international use and are accepted by IEC National
Committees in that sense. While all reasonable efforts are made to ensure that the technical content of IEC
Publications is accurate, IEC cannot be held responsible for the way in which they are used or for any
misinterpretation by any end user.
4) In order to promote international uniformity, IEC National Committees undertake to apply IEC Publications
transparently to the maximum extent possible in their national and regional publications. Any divergence
between any IEC Publication and the corresponding national or regional publication shall be clearly indicated in
the latter.
5) IEC itself does not provide any attestation of conformity. Independent certification bodies provide conformity
assessment services and, in some areas, access to IEC marks of conformity. IEC is not responsible for any
services carried out by independent certification bodies.
6) All users should ensure that they have the latest edition of this publication.
7) No liability shall attach to IEC or its directors, employees, servants or agents including individual experts and
members of its technical committees and IEC National Committees for any personal injury, property damage or
other damage of any nature whatsoever, whether direct or indirect, or for costs (including legal fees) and
expenses arising out of the publication, use of, or reliance upon, this IEC Publication or any other IEC
Publications.
8) Attention is drawn to the Normative references cited in this publication. Use of the referenced publications is
indispensable for the correct application of this publication.
9) Attention is drawn to the possibility that some of the elements of this IEC Publication may be the subject of
patent rights. IEC shall not be held responsible for identifying any or all such patent rights.
The main task of IEC technical committees is to prepare International Standards. However, a
technical committee may propose the publication of a technical report when it has collected
data of a different kind from that which is normally published as an International Standard, for
example "state of the art".
IEC 80001-2-4, which is a technical report, has been prepared by a Joint Working Group of
subcommittee 62A: Common aspects of electrical equipment used in medical practice, of IEC
technical committee 62: Electrical equipment in medical practice and ISO technical committee
215: Health informatics.
The text of this technical report is based on the following documents:
Enquiry draft Report on voting
62A/818/DTR 62A/835/RVC
– 4 – TR 80001-2-4 © IEC:2012(E)
Full information on the voting for the approval of this technical report can be found in the
report on voting indicated in the above table. In ISO, the technical report has been approved
by 15 P-members out of 16 having cast a vote.
This publication has been drafted in accordance with the ISO/IEC Directives, Part 2.
Terms used throughout this technical report that have been defined in Clause 3 appear in
SMALL CAPITALS.
A list of all parts of the IEC 80001 series, published under the general title Application of risk
management for IT-networks incorporating medical devices, can be found on the IEC website.
The committee has decided that the contents of this publication will remain unchanged until
the stability date indicated on the IEC web site under "http://webstore.iec.ch" in the data
related to the specific publication. At this date, the publication will be
• reconfirmed,
• withdrawn,
• replaced by a revised edition, or
• amended.
A bilingual version of this publication may be issued at a later date.

IMPORTANT – The 'colour inside' logo on the cover page of this publication indicates
which are considered to be useful for the correct
that it contains colours
understanding of its contents. Users should therefore print this document using a
colour printer.
TR 80001-2-4 © IEC:2012(E) – 5 –
INTRODUCTION
This technical report is a guide to help a HEALTHCARE DELIVERY ORGANIZATION (see 1.2)
fulfilling its obligations as a RESPONSIBLE ORGANIZATION in the application of IEC 80001-1, in
conjunction with other technical reports in this series. Specifically, this guide helps the
HEALTHCARE DELIVERY ORGANIZATION assess the impact of the standard on the organization
and establish a series of business as usual PROCESSES to manage RISK in the creation,
maintenance and upkeep of its MEDICAL IT-NETWORKS. Whilst this document is aimed solely at
HEALTHCARE DELIVERY ORGANIZATIONS, the term RESPONSIBLE ORGANIZATION is used throughout
this document to ensure consistency with IEC 80001-1. In this respect the two terms are
synonymous.
This technical report will be useful to those responsible for establishing an IEC 80001-1
compliant RISK MANAGEMENT framework within a RESPONSIBLE ORGANIZATION that is expecting
to establish one or more MEDICAL IT-NETWORKS. In particular, the RISK MANAGEMENT framework
should address the KEY PROPERTIES – SAFETY, DATA AND SYSTEM SECURITY and EFFECTIVENESS –
as defined in IEC 80001-1. The purpose of the framework is to ensure that the potential
problems associated with the incorporation of MEDICAL DEVICES into IT-NETWORKS, identified in
IEC 80001-1, are avoided.
Defining and implementing the RISK MANAGEMENT framework and the business change that can
result, will require the RESPONSIBLE ORGANIZATION to draw upon a range of skills from within
the organization, managerial, clinical and technical. Where such skills are not available within
the RESPONSIBLE ORGANIZATION, consideration should be given to collaboration with similar
organizations or through experts in the field. It is important that the RESPONSIBLE
ORGANIZATION be able to draw upon expertise with respect to appropriate standards and their
corresponding technical reports.
In establishing a RISK MANAGEMENT framework, a RESPONSIBLE ORGANIZATION will need to take
account of:
– the size and capabilities of the organization;
– the extent of its IT operations and the complexity of its current infrastructure and systems;
and
– the cost of implementing IEC 80001-1.
It is expected that some of the above factors, for example size of IT operations and
compl
...