Risk Assessment for Data related Hazards in Healthcare Equipment and Infrastructure

Modern computer systems increasingly use data to make safety-critical decisions. Healthcare systems are particularly dependent on data, as they act on data flows between organisations, and between healthcare professionals and patients in the community. The rollout of healthcare further into the community introduces additional uncertainty about the quality of the data.

Tuus, the trustworthiness of the data itself, and the robustness of the equipment and the computerised infrastructure to incorrect or inappropriately used data, has become vital. The systems need to be designed in such as way as to prevent or reduce the likelihood of harm arising from the very data that is meant to improve clinical safety outcomes.

There have already been a number of accidents and incidents across all industrial sectors, including healthcare, where data, as distinct from purely software and hardware, has been a major contributory factor. This problem will get worse as our systems become more dependent on data from diverse sources, more inter-connected, and using data not collected by healthcare professionals.

This data might be fed into AI systems and even autonomous systems with wide-ranging consequences, which might not be easily traced back to the erroneous data.

The UK Safety Critical Systems Club has created a Data Safety Guidance document, which is widely regarded as describing the current best practice of Data Safety Assessment. This has led to its inclusion in NHS Digital's own guidance on Data Safety.

We have developed a proof-of-concept software demonstrator tool under a grant from the Lloyd's Register Foundation, that guides a practitioner through the Data Safety assessment process, and records the analysis and decisions made by the practitioner, to form the core of a Data Safety argument that could be given to a regulator or commissioning organisation.

Our current Data Safety tool is industry-agnostic. This project aims to evolve the tool to remove a current restriction, to validate it in the healthcare domain, and understand the customizations that would be needed to deploy it into this domain. We also plan to promote the issues and solutions to Data Safety at some workshops.