Technical Information Report

Transcription

1 Technical Information Report ANSI/AAMI/ IEC TIR :2014 Application of risk management for ITnetworks incorporating medical Application guidance Part 2-7: Guidance for Healthcare Delivery Organizations (HDOs) on how to selfassess their conformance with IEC

2

3 An ANSI Technical Report prepared by AAMI ANSI/AAMI/IEC TIR :2014 intended Application to allow potential of risk purchasers management to evaluate for the IT-networks content incorporating of the document medical before making Application a purchasing decision. guidance For a complete Part copy 2-7: of Guidance this AAMI document, for Healthcare contact AAMI at Delivery Organizations (HDOs) or visit on how to self-assess their conformance with IEC Approved 24 October 2014 by Association for the Advancement of Medical Instrumentation Approved 24 December 2014 by American National Standards Institute Abstract: The purpose of this technical report is to provide guidance to HDOs on self-assessment of their conformance against IEC The purpose of this Technical Report is to: 1) provide guidance to HDOs on self-assessment of their conformance against IEC ) provide an exemplar assessment method which can be used by HDOs in varying contexts to assess themselves against IEC ) define a PRM comprising a set of processes, described in terms of process purpose and outcomes that demonstrate coverage of the requirements of IEC ) define a PAM that meets the requirements of ISO/IEC and that supports the performance of an assessment by providing indicators for guidance on the interpretation of the process purposes and outcomes as defined in IEC (PRM) and the process attributes as defined in ISO/IEC This technical report does not introduce any requirements in addition to those expressed in IEC Keywords: risk management, IT-network, HDO, self-assessment

4 Published by Association for the Advancement of Medical Instrumentation 4301 N Fairfax Drive, Suite 301 Arlington, VA by the Association for the Advancement of Medical Instrumentation All Rights Reserved Publication, reproduction, photocopying, storage, or transmission, electronically or otherwise, of all or any part of this document without the prior written permission of the Association for the Advancement of Medical Instrumentation is strictly prohibited by law. It is illegal under federal law (17 U.S.C. 101, et seq.) to make copies of all or any part of this document (whether internally or externally) without the prior written permission of the Association for the Advancement of Medical Instrumentation. Violators risk legal action, including civil and criminal penalties, and damages of $100,000 per offense. For permission regarding the use of all or any part of this document, contact AAMI at 4301 N. Fairfax Drive, Suite 301, Arlington, VA Phone: (703) ; Fax: (703) Printed in the United States of America ISBN

5 AAMI Technical Information Report A technical information report (TIR) is a publication of the Association for the Advancement of Medical Instrumentation (AAMI) Standards Board that addresses a particular aspect of medical technology. Although the material presented in a TIR may need further evaluation by experts, releasing the information is valuable because the industry and the professions have an immediate need for it. A TIR differs markedly from a standard or recommended practice, and readers should understand the differences between these documents. Standards and recommended practices are subject to a formal process of committee approval, public review, and resolution of all comments. This process of consensus is supervised by the AAMI Standards Board and, in the case of American National Standards, by the American National Standards Institute. A TIR is not subject to the same formal approval process as a standard. However, a TIR is approved for distribution by a technical committee and the AAMI Standards Board. Another difference is that, although both standards and TIRs are periodically reviewed, a standard must be acted on reaffirmed, revised, or withdrawn and the action formally approved usually every five years but at least every 10 years. For a TIR, AAMI consults with a technical committee about five years after the publication date (and periodically thereafter) for guidance on whether the document is still useful that is, to check that the information is relevant or of historical value. If the information is not useful, the TIR is removed from circulation. A TIR may be developed because it is more responsive to underlying safety or performance issues than a standard or recommended practice, or because achieving consensus is extremely difficult or unlikely. Unlike a standard, a TIR permits the inclusion of differing viewpoints on technical issues. CAUTION NOTICE: This AAMI TIR may be revised or withdrawn at any time. Because it addresses a rapidly evolving field or technology, of the readers document are cautioned before to ensure making that a they purchasing have also considered decision. information that may be more recent than this document. All standards, recommended practices, technical information reports, and other types of technical documents developed by AAMI are voluntary, and their application is solely within the discretion and professional judgment of the user of the document. Occasionally, voluntary technical or visit documents are adopted by government regulatory agencies or procurement authorities, in which case the adopting agency is responsible for enforcement of its rules and regulations. Comments on this technical information report are invited and should be sent to AAMI, Attn: Standards Department, 4301 N. Fairfax Drive, Suite 301, Arlington, VA ANSI Technical Report This AAMI TIR has been registered by the American National Standards Institute as an ANSI Technical Report. Publication of this ANSI Technical Report has been approved by the accredited standards developer (AAMI). This document is registered as a Technical Report series of publications according to the Procedures for the Registration of Technical Reports with ANSI. This document is not an American National Standards and the material contained herein is not normative in nature. Comments on this technical information report are invited and should be sent to AAMI, Attn: Standards Department, 4301 N. Fairfax Drive, Suite 301, Arlington, VA

6 Contents Page Glossary of equivalent standards... v Committee representation... vi Background of AAMI adoption of ISO TR Ed.1... vii Foreword... viii Introduction... ix 1 Scope Normative References Terms and Definitions Assessment Method Prerequisites Assessment Method Overview Assessment Stages Process Attribute Rating Scale Capability Levels Tailoring the Assessment Method... 5 Annex A (informative) Assessment Method... 6 Annex B (informative) Process Reference Model Annex C (informative) Process Assessment Model Annex D (informative) Abbreviations and Process Identifiers Bibliography

7 Glossary of equivalent standards International Standards adopted in the United States may include normative references to other International Standards. AAMI maintains a current list of each International Standard that has been adopted by AAMI (and ANSI). Available on the AAMI website at the address below, this list gives the corresponding U.S. designation and level of equivalency to the International Standard Association for the Advancement of Medical Instrumentation ANSI/AAMI/IEC TIR :2014 v

8 Committee representation Association for the Advancement of Medical Instrumentation AAMI/SM/WG 02, Information Technology Networks Working Group The adoption of the ISO as a new AAMI/ISO Technical Information Report was initiated by the AAMI Information Technology Working Group. Committee approval of the standard does not necessarily imply that all committee members voted for its approval. At the time this document was published, the AAMI Information Technology Networks Working Group had the following members: Chair: Members: Bill Hintz, Medtronic Inc John Collins, American Hospital Association Todd Cooper Becky Crossley, Susquehanna Health Conor Curtin, Fresenius Medical Care Yadin David, Biomedical Engineering Consultants LLC Richard De La Cruz, Hospira Worldwide Inc Christina DeMur, Draeger Medical Systems Inc Sherman Eagles, SoftwareCPR Scott Eaton, Mindray DS USA Inc Kurt Elliason, Smiths Medical Jim Gabalski, Getinge USA George Gray, Ivenix Inc Thomas Grobaski, Belimed Inc Catherine Li, FDA/CDRH Yimin Li, St Jude Medical Inc Jared Mauldin, Integrated Medical Systems Mary Beth McDonald, Mary Beth McDonald Consulting Dave Osborn, Philips Electronics North America Geoff Pascoe Steven Rakitin, Software Quality Consulting Rick Schrenker, Massachusetts General Hospital Neal Seidl, GE Healthcare Xianyu Shea, Stryker Medical Division Ray Silkaitis, Amgen Inc Bob Steurer, Spacelabs Medical Inc Donna-Bea Tillman, Biologics Consulting Group Daidi Zhong, Chongqing University Alternates: Denise Adams, B Braun of America Inc James Dundon, Spacelabs Medical Inc Brian Fitzgerald, FDA/CDRH Rich Gardner, GE Healthcare Andrew Northup, Medical Imaging & Technology Alliance a Division of NEMA Phil Raymond, Philips Electronics North America Thomas Schultz, Medtronic Inc WHQ Campus Chandresh Thakur, CareFusion Fei Wang, Fresenius Medical Care NOTE Participation by federal agency representatives in the development of this document does not constitute endorsement by the federal government or any of its agencies. vi 2015 Association for the Advancement of Medical Instrumentation ANSI/AAMI/IEC TIR :2014

9 Background of AAMI adoption of ISO TR Ed.1 As indicated in the foreword to the main body of this document, the International Organization for Standardization (ISO) is a worldwide federation of national standards bodies. The United States is one of the ISO members that took an active role in the development of this technical report. International Technical Report ISO TR Ed.1 was developed jointly by Sub-Committee IEC/SC 62A, Common aspects of electrical equipment used in medical practice and ISO/TC 215, Health informatics, to define the roles, responsibilities and activities that are necessary for risk management of IT-networks incorporating medical devices to address safety, effectiveness and data and system security. U.S. participation in this IEC SC is organized through the U.S. Technical Advisory Group for IEC/SC 62A, administered by AAMI on behalf of the American National Standards Institute (ANSI). AAMI encourages its committees to harmonize their work with international documents as much as possible. The AAMI Information Technology Working Group, together with the U.S. Technical Advisory Group for IEC/SC 62A, reviewed ISO TR Ed.1 to formulate the U.S. position while the document was being developed. This close collaboration helped gain widespread U.S. consensus on the document. As the U.S. Technical Advisory Group for IEC/SC 62A, the AAMI Information Technology Networks Working Group voted to adopt the IEC Technical Report as written. AAMI (and ANSI) have adopted other ISO documents. See the Glossary of Equivalent Standards for a list of ISO standards adopted by AAMI, which gives the corresponding U.S. designation and the level of equivalency with the ISO standard. The concepts incorporated into this technical report should not be considered inflexible or static. This technical information report, like any other, must be reviewed and updated periodically to assimilate progressive technological developments. intended To remain relevant, to allow it must potential be modified purchasers as technological to advances evaluate are the made content and as new date comes to light. Suggestions for improving this TIR are invited. Comments and suggested revisions should be sent to Technical Programs, AAMI, 4301 N Fairfax Drive, Suite 301, Arlington VA NOTE Beginning with the ISO foreword on page viii, ANSI/AAMI/ISO TIR Ed.1, Application of risk management for IT-networks incorporating medical Application guidance Part 2-7: Guidance for Healthcare Delivery Organizations (HDOs) on how to self-assess their conformance with IEC is identical to ISO/TR Ed Association for the Advancement of Medical Instrumentation ANSI/AAMI/IEC TIR :2014 vii

10 Foreword ISO (the International Organization for Standardization) is a worldwide federation of national standards bodies (ISO member bodies). The work of preparing International Standards is normally carried out through ISO technical committees. Each member body interested in a subject for which a technical committee has been established has the right to be represented on that committee. International organizations, governmental and non-governmental, in liaison with ISO, also take part in the work. ISO collaborates closely with the International Electrotechnical Commission (IEC) on all matters of electrotechnical standardization. International Standards are drafted in accordance with the rules given in the ISO/IEC Directives, Part 2. The main task of technical committees is to prepare International Standards. Draft International Standards adopted by the technical committees are circulated to the member bodies for voting. Publication as an International Standard requires approval by at least 75 % of the member bodies casting a vote. In exceptional circumstances, when a technical committee has collected data of a different kind from that which is normally published as an International Standard ( state of the art, for example), it may decide by a simple majority vote of its participating members to publish a Technical Report. A Technical Report is entirely informative in nature and does not have to be reviewed until the data it provides are considered to be no longer valid or useful. Attention is drawn to the possibility that some of the elements of this document may be the subject of patent rights. ISO shall not be held responsible for identifying any or all such patent rights. ISO/IEC TR was prepared by Technical Committee ISO/TC 215, Heath informatics, Subcommittee SC,. ISO/IEC TR consists of the following parts, under the general title Application of risk management for ITnetworks incorporating medical devices. Part 1: Roles, responsibilities and activities Part 2-1: Step-by-step risk management of medical IT-networks Practical applications and examples Part 2-2: Guidance for the disclosure and communication of medical device security needs, risks and controls Part 2-3: Guidance for wireless networks Part 2-4: Application guidance General implementation guidance for Healthcare Delivery Organizations Part 2-5: Application guidance Guidance on distributed alarm systems Part 2-6: Application guidance Guidance for responsibility agreements Part 2-7: Application Guidance Guidance for Healthcare Delivery Organizations (HDOs) on how to self-assess their conformance with IEC Part 2-8: Application guidance - Guidance on standards for establishing the security capabilities identified in IEC (in development) viii 2015 Association for the Advancement of Medical Instrumentation ANSI/AAMI/IEC TIR :2014

11 Introduction This technical report provides guidance for a Healthcare Delivery Organization (HDO) that wishes to self-assess its implementation of the processes of IEC This technical report can be used to assess Medical IT-Network projects where IEC has been determined to be applicable. This technical report provides an exemplar assessment method which includes a set of questions which can be used to assess the performance of risk management of a Medical IT-Network incorporating a medical device. This assessment method can be used in its presented form or can be tailored to meet the needs of a specific HDO. A Process Reference Model (PRM) and an example Process Assessment Model (PAM) that meet the requirements of ISO/IEC are included in the Appendices of this technical report The PRM and PAM can be used to provide a standardized basis for tailoring the exemplar assessment method where required. This Technical Report can be used in a number of ways including: 1) The assessment method can be used to perform an assessment to determine conformance against IEC ) In instances where conformance has been established, the assessment method can also be used to assess risk management processes and determine the capability level at which these processes are being performed. 3) Based on the context of the HDO being assessed, the assessment method can be tailored to address the individual HDO use, needs and concerns. The results of the assessment will highlight any weaknesses within current risk management processes and can be used as a basis for the improvement of these processes. Where necessary, modification of the assessment method can be undertaken with reference to the PRM and PAM for IEC which are also included in this Technical Report. This approach allows for a lightweight assessment approach to which more rigour can be added if required. For example, a This re-assessment is a preview may be edition required of in instances an AAMI where guidance initial assessment document revealed and isweaknesses in the current risk intended management to allow processes potential and improvements purchasers have to subsequently evaluate been the content made which require reassessment to assess their impact on conformance. A re-assessment may also be performed in instances where confirmation is required of that document process improvement before measures making which a purchasing have been undertaken decision. have resulted in the achievement of a higher capability level. This technical report provides: guidance for a HDO to self-assess implementation of the processes of IEC an exemplar assessment method which includes a set of questions can be used to assess the performance of risk management of a Medical IT-Network incorporating a medical device can be used in its presented form can be tailored on a standardized basis using the included PRM and PAM a PRM that meet the requirements of ISO/IEC an example PAM that meet the requirements of ISO/IEC NOTE This document contains original material that is 2013, Dundalk Institute of Technology, Ireland. Permission is granted to ISO and IEC to reproduce and circulate this material, this being without prejudice to the rights of Dundalk Institute of Technology to exploit the original text elsewhere Association for the Advancement of Medical Instrumentation ANSI/AAMI/IEC TIR :2014 ix

12 x 2015 Association for the Advancement of Medical Instrumentation ANSI/AAMI/IEC TIR :2014

13 Technical Information Report ANSI/AAMI/IEC TIR :2014 Application of risk management for IT-networks incorporating medical Application guidance Part 2-7: Guidance for Healthcare Delivery Organizations (HDOs) on how to self-assess their conformance with IEC Scope The purpose of this technical report is to provide guidance to HDOs on self-assessment of their conformance against IEC The purpose of this Technical Report is to: 1) provide guidance to HDOs on self-assessment of their conformance against IEC ) provide an exemplar assessment method which can be used by HDOs in varying contexts to assess themselves against IEC ) define a PRM comprising a set of processes, described in terms of process purpose and outcomes that demonstrate coverage of the requirements of IEC ) define a PAM that meets the requirements of ISO/IEC and that supports the performance of an assessment of by the providing document indicators before guidance making on a the purchasing interpretation decision. of the process purposes and outcomes as defined in IEC (PRM) and the process attributes as defined in ISO/IEC Normative References This technical report does not introduce any requirements in addition to those expressed in IEC The following normative documents contain provisions which, through reference in this text, constitute provisions of this document. For dated references, subsequent amendments to, or revisions of, any of these publications do not apply. However, parties to agreements based on this document are encouraged to investigate the possibility of applying the most recent editions of the normative documents indicated below. For undated references, the latest edition of the normative document referred to applies. Members of ISO and IEC maintain registers of currently valid International Standards. IEC :2010, Application of Risk Management for IT-Networks incorporating Medical Devices Part 1: Roles, responsibilities and activities ISO/IEC :2004, Information technology - Process assessment Part 1: Concepts and Vocabulary ISO/IEC :2003, Information technology - Process assessment Part 2: Performing an Assessment 3 Terms and Definitions For the purposes of this technical report, the terms and definitions given in ISO/IEC and IEC apply Association for the Advancement of Medical Instrumentation ANSI/AAMI/IEC TIR :2014 1