DCB0129 FAQ

DCB0129 is a clinical risk management standard issued by NHS England and the UK Department of Health & Social Care that requires all Health IT system manufacturers to assess and manage clinical risks throughout the lifecycle of their product(s). It mandates the implementation of a Clinical Risk Management System, including thorough documentation and evidence of risk management activities through a Clinical Safety Case Report (CSCR) and an up-to-date Hazard Log. This mandate also includes the appointment of a Clinical Safety Officer or CSO to be actively involved in risk management activities.

Compliance with DCB0129 is the responsibility of organisations that develop digital health technologies. Suppliers are responsible for ensuring they maintain documentation such as a Clinical Safety Case Report and a Hazard Log, as an effective means of mitigating clinical risk in their product.

For health IT manufacturers aiming to comply with DCB0129 standards, establishing a robust clinical risk management process is essential. Effective clinical risk management requires four key components. A Clinical Risk Management Team or Clinical Safety Team is crucial for overseeing, identifying, assessing, mitigating, and reporting risks, ensuring compliance and communication. Secondly, top management must provide buy-in and resources, championing patient safety and allocating necessary financial, human, and technological support. Thirdly, comprehensive staff training, led by the Clinical Safety Officer (CSO), is vital, covering DCB0129 and DCB0160 roles, reporting procedures, tools, and continuous development. Finally, maintaining core technical documentation, including system specifications, requirements, risk assessments, hazard logs, clinical safety cases, and SOPs, is paramount.

DCB0129 is a key standard for digital health IT systems, focusing on patient safety, healthcare quality, and seamless technology integration. It mandates risk management, promotes reliable tools that can mitigate patient safety risks, and provides a common framework for all stakeholders to ensure safe and effective adoption of digital health solutions. The key documents developed as part of compliance with the standard are designed to be shared with NHS organisations to aid them in the completion of DCB0160.

DCB0129 applies to digital health technologies that provide direct patient care or support clinical decision-making. Initially, the DCB0129 standard, published in 2013 by NHS Digital, focused solely on clinical risk management for health IT systems, excluding medical devices. Updates expanded its scope to include medical devices with software or connections to health IT, aligning with evolving regulations. The 2018 update explicitly incorporated medical devices, reflecting changes in SaMD and interoperability. DCB0129 and ISO 14971 (the risk management standard for Medical Devices) share similarities in risk management, requiring senior management responsibility, staff competence, and documented plans, assessments, and reports. An existing ISO 14971 Risk Management File largely fulfils DCB0129 requirements, but awareness of key differences is crucial to avoid regulatory issues.

Non-compliance with DCB0129 will block organisations from deploying their technology into the NHS due to the stringent controls in place to ensure there is a robust clinical risk management plan in place by both the manufacturer of the health IT system and the deploying NHS organisation.

Organisations should review their DCB0129 compliance status regularly, depending on the pace at which new features are added, the technology changes or new integrations with third parties are brokered. The Clinical Risk Management system should align with the software development lifecycle and be continually updated. It should be a regular task managed by the Clinical Safety Team to ensure the latest version of the software is reflected in the documentation and the Clinical Safety Case Report is signed off by the named Clinical Safety Officer.

DCB0129 is a self-assessment that is only evaluated by an NHS organisation as part of an implementation. It is the responsibility of the health IT system manufacturer to ensure they retain up-to-date documentation as part of any contract with a deploying organisation.

Healthcare professionals are an important part of the Clinical Risk Management process, with many of them acting as Clinical Safety Officers - individuals trained in risk management for health IT systems or medical devices, who can independently and impartially sign off on clinical risk documentation. To be a Clinical Safety Officer, an individual must hold a valid and current professional registration with a healthcare professional body.