Risk management in health care
Connecting medical devices and IT networks
Managing risks is central to all health-care activities, not just for patients, but also for medical staff and the community in general. The IEC has been directly involved in developing standards for EMDs (Electric Medical Devices) for decades. In October 2010 it published IEC 80001-1, Application of risk management for IT-networks incorporating medical devices – Part 1: Roles, responsibilities and activities, further extending the scope of risk management in health care.
Electric devices first entered the medical environment well over a century ago, the most notable breakthrough in this domain being the discovery of X-rays by German physicist Wilhelm Röntgen in 1895. Likewise, awareness of the need for safety of EMDs for both staff and patients dates back to the same period. Conscious of the potential risk of radiation, Röntgen wore protective lead shields, much like those in use today. More recently, ICT (Information and Communication Technologies) applications have entered the medical environment and are also used to operate EMDs, bringing their own sets of safety and security concerns.
TC 62: Electrical equipment in medical practice
The medical sphere is probably one of the most challenging environments for risk management owing to its complexity and to the multiple stakes and large number of systems and individuals involved.
The IEC TC (Technical Committee) working on standards that ensure the safe operation of EMDs is TC 62: Electrical equipment in medical practice, established in 1968. However, many other TCs are also working on standards that ensure, directly or indirectly, the safe operation of electrical equipment used in the health-care environment.
EMDs cover a very wide and growing range of activities. Among countless other applications they are used for:
- diagnosis with, for example, X-rays and CT (computer tomography) machines, ultrasound or MRI (magnetic resonance imaging) scanners, the latter being employed also to guide minimally invasive surgery
- treatment, using ionizing radiation to treat tumours, and lasers or other devices for surgery
- monitoring patients for routine follow-up or in pre- and post-surgery situations
EMDs are used in many different environments. Initially deployed mostly in purely medical locations, such as hospitals, surgeries or health centres, they are now being increasingly found in private homes or workplaces to monitor patients or assist them in their daily activities.
Multiple uses multiply risks
The risks in the operation of EMDs cannot be underestimated. EMDs must be safe to operate and reliable, as any failure may have catastrophic effects, for patients in particular.
X-ray, CT machines or other ionizing radiation devices present specific risks as excessive levels of radiation resulting from human error or equipment failure can have serious adverse consequences for patients or medical staff operating them. The same applies to MRI equipment for which the presence of implants may endanger patients' lives.
Other issues, such as the Electromagnetic Compatibility (EMC) of these devices, also have to be taken into account.
In some countries and systems, where the legal liability of medical establishments and staff is high and where the level of financial compensation may be crippling, these safety risks are not minor considerations.
ICT in health care – networking devices, solutions and… risks
The relatively recent incorporation of ICT in the health-care environment has rapidly grown in importance and introduced an additional layer of specific risks that needs managing.
Problems resulting from this integration were first identified in Germany in the early 2000s when some EMDs manufacturers noted problems with their devices not working on hospital networks. The difficulty was traced to the network or to interactions with other devices on the network.
Following a 2001 standards meeting in Germany, a group of EMDs manufacturers and regulators was asked by medical practitioners to try to integrate all medical devices horizontally into existing IT (information technology) networks.
Having the IEC directives and other IEC resources made it much easier to bring the group to a common understanding of the work that was necessary to develop the standard.Sherman Eagles
"Typically, IT took care of networks and clinical engineering took care of medical devices," notes Steve Grimes, Chief Technology Officer of Linc Health, a US (United States) provider of health-care technology solutions.
At the same time, the US FDA (Food and Drug Administration) had received reports of injuries and fatalities caused by improperly connected networked devices.
According to Brian Fitzgerald, a senior FDA official, another important factor that drove the search for solutions to manage HIT (Health Information Technology) security risks, was a series of cyber attacks on hospitals in the western US, which led the FDA to begin developing guidelines on security for medical devices.
The integration of ICT solutions in health-care environments poses a number of specific challenges besides the safe operation of EMDs. They are the protection against malware, the integrity, protection and confidentiality of data, and its safe transmission.
The convergence of interests between regulators, EMDs manufacturers and providers of ITC solutions for the health-care environment in several countries led to the setting up of an IEC/ISO (International Organization for Standardization) JWG (Joint Working Group) 7 to prepare IEC 80001-1, Application of risk management for IT-networks incorporating medical devices, the first International Standard to address both networks and medical devices.
IEC key to positive outcome
According to JWG 7 Co-Convenor and project leader Sherman Eagles, the IEC's role in the development of IEC 80001-1 was absolutely central: "First, it brought an international community to the table," he explains, adding "its resources, especially the SC (Subcommittee) 62A Secretary and the IEC Technical Officer, were invaluable in answering questions and sorting out potential misunderstandings between experts with very different backgrounds."
Work on IEC 80001 is ongoing, with three technical reports due to be published in the summer of 2011. The first one is to provide guidance for its implementation. An example of risk control measure among many others it mentions is the clear and obvious identification through colour coding of IT data cables and switches for life-support equipment. The other two reports are about wireless networks and communication of security needs.
Closing the HIT gap
Publication of IEC 80001-1 is closing a significant – and growing – gap in health care. As the safety of EMDs has improved regularly over the years, owing in particular to the IEC 60601 family of standards (Medical electrical equipment) prepared by TC 62 and its SCs, new risks have emerged with the growing importance of HIT in the health-care and home-care environments. The publication of IEC 80001-1 has gone a long way in addressing these risks.
The significance of the new standard cannot be overstated for many reasons, among these:
- the constant increase in the use of software to extend and improve the operation of EMDs
- the growing introduction of EMDs in home-care environment. These need to be interconnected and frequently linked to a medical facility: the safe and secure exchange of medical information is vital
- HIT should improve efficiency and lower the costs of health care
- the vital importance of the integrity, confidentiality and protection of patients' details and information
The latter element can no longer be ignored. As the health-care community is expanding, so is the access to electronic medical records, even via mobile access. GE Healthcare, for instance, has recently demonstrated iPad applications it plans to roll out this year to access medical records remotely. Similar applications are being developed also for smartphones.
Furthermore, the need to combat health insurance fraud, which is on the rise in many countries, requires better control on the protection, integrity and transmission of medical data.
Such is the importance attached to IEC 80001-1 by the health-care community that a symposium centred on this recently released standard was organized in Brussels, Belgium, on 17-18 March 2011. This symposium brought together "decision-makers from hospitals and health-care delivery organizations," as well as "R&D, compliance- and product managers from medical device manufacturers and providers of IT-infrastructure and -services."
Progress in this fairly new yet critical domain was in great part made possible by all the work done since 2005 by SC 62A: Common aspects of electrical equipment used in medical practice.
As Sherman Eagles explains, "The group of people participating in this standard development effort was very unusual because they came from varying backgrounds and types of organizations. Having the IEC directives and other IEC resources made it much easier to bring the group to a common understanding of the work that was necessary to develop the standard."
Find out more
- IEC TC 62:Electrical equipment in medical practice
- IEC SC 62A:Common aspects of electrical equipment used in medical practice
- IEC 80001-1Application of risk management for IT-networks incorporating medical devices
- US FDAUS Food and Drug Administration
- ISOInternational Organization for Standardization