HospitalRoom.orgHospitalRoom.org

Devices

IEC 80001-1

IEC 80001-1:2021 — Application of risk management for IT-networks incorporating medical devices — Part 1: Safety, effectiveness and security in the implementation and use of connected medical devices or connected health software

International Electrotechnical Commission (IEC), published jointly with ISO (ISO/TC 215)Latest · Edition 2.0 (2021-09)Voluntary international standard. IEC lists a stability date of 2028; ISO lists it as 'to be revised'. Adoption is an organizational decision; it is not a product certification.

Edition last checked against publisher sources:

Scope

IEC 80001-1 is written for the organization that connects things, not the manufacturer that builds them. It sets general requirements for a healthcare delivery organization to apply risk management before, during, and after a health IT system — including connected medical devices and health software — is connected to its health IT infrastructure, addressing three key properties: safety, effectiveness, and security. The 2021 second edition replaced the 2010 first edition, restructured the standard to align with ISO 31000, and placed the requirements on the organization.

Where it applies in the room

  • Connecting bedside monitors, pumps, and other devices to the hospital network, middleware, or EHR
  • Changes to an already-connected system: network upgrades, software updates, new integrations, decommissioning
  • Shared responsibilities between the hospital, device manufacturers, and IT service providers
  • Wired, wireless, and cloud-hosted infrastructure that carries clinical traffic alongside non-clinical traffic

Key requirements at a glance

Who it bindsRequirements apply to the organization responsible for the health IT infrastructure, not to device manufacturers' product design.
Three key propertiesRisk management addresses safety, effectiveness, and security together rather than treating security as a separate track.
Lifecycle coverageRisk management applies before, during, and after connection — the 'implementation and clinical use' phase of the ISO 81001-1 health software lifecycle.
Alignment with ISO 31000The 2021 edition's structure follows ISO 31000 so an existing enterprise risk process can be used or adapted.
Stakeholder engagementAppropriate stakeholders (clinical, biomedical/clinical engineering, IT, and suppliers) are engaged in the risk management process.

Summarized for reference. Consult the source document for the definitive text.

Caveats

  • This is an orientation summary of the publicly available abstract and preview. The requirements themselves are in the paid official text.
  • The US FDA recognized-standards database lists the 2010 first edition (recognition 13-38) and several IEC TR 80001-2-x guidance documents, including TR 80001-2-5 on distributed alarm systems. At the time of checking, the 2021 edition did not appear in that search. FDA recognition concerns premarket submissions by manufacturers, while 80001-1 is aimed at the organizations that deploy devices.
  • Conformance is not a label a device can carry. A manufacturer can supply information that supports a hospital's 80001-1 process, but cannot make the hospital conformant.

Source & further reading

Related frameworks

Also known as

  • IEC 80001-1:2021
  • IEC 80001-1
  • 80001-1

Help us improve

Spotted something wrong, outdated, or unclear? Let the editors know.

Cited in

Guides that reference IEC 80001-1