Responsibility Agreements Ensure Accountability Under 80001

Abstract

Mike Papa, BS, CBET is the supervisor of biomedical engineering at St. Luke’s Health Network in Bethlehem, PA. E-mail: papam@slhn.org As traditionally isolated medical device networks migrate in design and functionality onto more converged enterprise IT networks, hospital-based clinical engineers and IT personnel are faced with managing an increase in associated risks. The newly approved voluntary standard IEC 80001-1: Application of risk management for IT-networks incorporating medical devices, addresses what healthcare delivery organizations (HDOs, or hospitals) can do to manage such risks. 80001 provides a structure for HDOs to manage the risk of converged network(s). A key part of this structure calls for the HDO to establish and manage the roles and responsibilities among all stakeholders that take part in the formation of the medical IT network. Stakeholders include the HDOs, the medical device manufacturers (MDMs), and the IT manufacturers. Within 80001, roles and responsibilities are established and managed in the form of a contractual agreement called a “responsibility agreement.” This article takes a closer look at the establishment of responsibility agreements and their importance to implementing 80001.