National foreword

This British Standard is the UK implementation of EN 82304‑1:2017. It is identical to IEC 82304‑1:2016. It supersedes BS IEC 82304‑1:2016, which is withdrawn.

The UK participation in its preparation was entrusted to Technical Committee CH/62/1, .

A list of organizations represented on this committee can be obtained on request to its secretary.

This publication does not purport to include all the necessary provisions of a contract. Users are responsible for its correct application.

Compliance with a British Standard cannot confer immunity from legal obligations.

This British Standard was published under the authority of the Standards Policy and Strategy Committee on 31 March 2017.

This European Standard was approved by CENELEC on 2016-12-01. CENELEC members are bound to comply with the CEN/CENELEC Internal Regulations which stipulate the conditions for giving this European Standard the status of a national standard without any alteration.

Up-to-date lists and bibliographical references concerning such national standards may be obtained on application to the CEN-CENELEC Management Centre or to any CENELEC member.

This European Standard exists in three official versions (English, French, German). A version in any other language made by translation under the responsibility of a CENELEC member into its own language and notified to the CEN-CENELEC Management Centre has the same status as the official versions.

CENELEC members are the national electrotechnical committees of Austria, Belgium, Bulgaria, Croatia, Cyprus, the Czech Republic, Denmark, Estonia, Finland, Former Yugoslav Republic of Macedonia, France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, the Netherlands, Norway, Poland, Portugal, Romania, Serbia, Slovakia, Slovenia, Spain, Sweden, Switzerland, Turkey and the United Kingdom.

European foreword

The text of document 62A/1140/FDIS, future edition 1 of IEC 82304‑1, prepared by IEC/SC 62A "Common aspects of electrical equipment used in medical practice" of IEC/TC 62 "Electrical equipment in medical practice" was submitted to the IEC-CENELEC parallel vote and approved by CENELEC as EN 82304‑1:2017.

The following dates are fixed:

Attention is drawn to the possibility that some of the elements of this document may be the subject of patent rights. CENELEC shall not be held responsible for identifying any or all such patent rights.

This document has been prepared under a mandate given to CENELEC by the European Commission and the European Free Trade Association.

Endorsement notice

The text of the International Standard IEC 82304‑1:2016 was approved by CENELEC as a European Standard without any modification.

In the official version, for Bibliography, the following notes have to be added for the standards indicated:

FOREWORD

1)	The International Electrotechnical Commission (IEC) is a worldwide organization for standardization comprising all national electrotechnical committees (IEC National Committees). The object of IEC is to promote international co-operation on all questions concerning standardization in the electrical and electronic fields. To this end and in addition to other activities, IEC publishes International Standards, Technical Specifications, Technical Reports, Publicly Available Specifications (PAS) and Guides (hereafter referred to as “IEC Publication(s)”). Their preparation is entrusted to technical committees; any IEC National Committee interested in the subject dealt with may participate in this preparatory work. International, governmental and non-governmental organizations liaising with the IEC also participate in this preparation. IEC collaborates closely with the International Organization for Standardization (ISO) in accordance with conditions determined by agreement between the two organizations.
2)	The formal decisions or agreements of IEC on technical matters express, as nearly as possible, an international consensus of opinion on the relevant subjects since each technical committee has representation from all interested IEC National Committees.
3)	IEC Publications have the form of recommendations for international use and are accepted by IEC National Committees in that sense. While all reasonable efforts are made to ensure that the technical content of IEC Publications is accurate, IEC cannot be held responsible for the way in which they are used or for any misinterpretation by any end user.
4)	In order to promote international uniformity, IEC National Committees undertake to apply IEC Publications transparently to the maximum extent possible in their national and regional publications. Any divergence between any IEC Publication and the corresponding national or regional publication shall be clearly indicated in the latter.
5)	IEC itself does not provide any attestation of conformity. Independent certification bodies provide conformity assessment services and, in some areas, access to IEC marks of conformity. IEC is not responsible for any services carried out by independent certification bodies.
6)	All users should ensure that they have the latest edition of this publication.
7)	No liability shall attach to IEC or its directors, employees, servants or agents including individual experts and members of its technical committees and IEC National Committees for any personal injury, property damage or other damage of any nature whatsoever, whether direct or indirect, or for costs (including legal fees) and expenses arising out of the publication, use of, or reliance upon, this IEC Publication or any other IEC Publications.
8)	Attention is drawn to the Normative references cited in this publication. Use of the referenced publications is indispensable for the correct application of this publication.
9)	Attention is drawn to the possibility that some of the elements of this IEC Publication may be the subject of patent rights. IEC shall not be held responsible for identifying any or all such patent rights.

International Standard IEC 82304‑1 has been prepared by subcommittee 62A: Common aspects of electrical equipment used in medical practice, of IEC technical committee 62: Electrical equipment in medical practice, and ISO technical committee 215: Health informatics.

It is published as a double logo standard.

The text of this standard is based on the following documents of IEC:

Full information on the voting for the approval of this part of this standard can be found in the report on voting indicated in the above table. In ISO, the standard has been approved by 21 P members out of 22 having cast a vote.

This publication has been drafted in accordance with the ISO/IEC Directives, Part 2.

Terms defined in Clause 3 of this standard are printed in small capitals.

For the purposes of this standard:

“shall” means that compliance with a requirement is mandatory for compliance with this standard;
“should” means that compliance with a requirement is recommended but is not mandatory for compliance with this standard;
“may” is used to describe a permissible way to achieve compliance with a requirement; and
“establish” means to define, document, and implement.

An asterisk (* ) as the first character of a title or at the beginning of a paragraph or table title indicates that there is guidance or rationale related to that item in Annex A.

The committee has decided that the contents of this publication will remain unchanged until the stability date indicated on the IEC website under "http://webstore.iec.ch" in the data related to the specific publication. At this date, the publication will be

reconfirmed,
withdrawn,
replaced by a revised edition, or
amended.

NOTE The attention of National Committees is drawn to the fact that manufacturers and testing organizations may need a transitional period following publication of a new, amended or revised IEC or ISO publication in which to make products in accordance with the new requirements and to equip themselves for conducting new or revised tests. It is the recommendation of the committee that the content of this publication be adopted for mandatory implementation nationally not earlier than 3 years from the date of publication.

INTRODUCTION

Health software products, within the context of this document, are software-only products. These products are intended to be used with computing equipment not explicitly developed for running the software. Health software products may require specified platforms.

Health software products are intended by their manufacturer for managing, maintaining or improving health of individual persons, or the delivery of care. Some health software can contribute to a hazardous situation. Accordingly, Clause 5 requires a risk management process for all health software. For health software that can contribute to a hazardous situation, risk control is needed to prevent harm or reduce the likelihood of harm occurring. Testing of the finished product is not, by itself, adequate to address the safety of health software. Therefore, requirements for the processes by which the health software is developed are necessary. This document relies heavily on IEC 62304:2006 and IEC 62304:2006/AMD1:2015 for the software development process which can be applied to health software products.

Whether a health software product has to meet regulatory requirements is a matter of national legislation. This document makes no attempt to determine whether a health software product is or should be regulated.

This document aims to provide requirements for the safety and security of health software products; it can only provide such requirements for software-only products. Situations where health software is a part of—or embedded in— a physical device are outside the scope of this document as these combined products are considered separately in, for example, IEC 60601‑1 and associated collateral and particular standards.

This document understands health in a meaning similar to the WHO definition: “Health is a state of complete physical, mental and social well-being and not merely the absence of disease or infirmity” (WHO, 1946). This definition appears not highly suitable for practical purposes: ”a state of complete well-being” or the inclusion of social well-being could be interpreted more widely than seems reasonable. For example dating software, games, or flight simulator software could be considered within the scope of the standard. That is clearly not the intent. However, a precise definition – or even delineation – of “health” for practical use in “health software” is not available.

Health software refers to software that contributes to the health of individual people as observed and/or demonstrated using measurable health parameters or clinical expertise. This is a subset of “health” as defined by the WHO. The requirements of the standard apply to the software that impacts such health parameters, and/or to software where security violations would undermine privacy or confidentiality of health and wellbeing information.

The reader is kindly referred to the Table A.1 for examples of what is in the scope and what is outside the scope of this document.

1 Scope

1.1 Purpose

This Part of 82304 applies to the safety and security of health software products designed to operate on general computing platforms and intended to be placed on the market without dedicated hardware, and its primary focus is on the requirements for manufacturers.

1.2 Field of application

This document covers the entire lifecycle including design, development, validation, installation, maintenance, and disposal of health software products.

In each referenced standard, the term “medical device” or “medical device software” is to be substituted by the term “health software” or “health software product”, as appropriate.

Where the term “patient” is used, either in this document or in a referenced standard, it refers to the person for whose health benefit the health software is used.

IEC 82304‑1 does not apply to health software which is intended to become part of a specific hardware designed for health use. Specifically, IEC 82304‑1 does not apply to:

medical electrical equipment or systems covered by the IEC 60601/IEC 80601 series;
in vitro diagnostic equipment covered by the IEC 61010 series; or
implantable devices covered by the ISO 14708 series.

NOTE This document also applies to health software products (e.g. medical apps, health apps) intended to be used in combination with mobile computing platforms.

1.3 Compliance

Compliance with this document is determined by inspection of all documentation required by this document.

Assessment of compliance is carried out and documented by the manufacturer. Where the health software product is subject to regulatory requirements, external assessment may take place.

Where this document normatively references parts or clauses of other standards focused on safety or security, the manufacturer may use alternative methods to demonstrate compliance with the requirements of this document. These alternative methods may be used if the process results of such alternative methods, including traceability, are demonstrably equivalent and the residual risk remains acceptable.

NOTE The term “conformance” is used in ISO/IEC 12207 where the term “compliance” is used in this document.

2 Normative references

3 Terms and definitions

4 * Health software product requirements

4.1 General requirements and initial risk assessment

4.2 Health software product use requirements

4.3 Verification of health software product use requirements

4.4 Updating health software product use requirements

4.5 System requirements

4.6 Verification of system requirements

4.7 Updating health software product system requirements

5 * Health software – Software life cycle processes

6 * Health software product validation

6.1 Validation plan

6.2 Performing validation

6.3 Validation report

7 Health software product identification and accompanying documents

7.1 * Identification

7.2 Accompanying documents

8 Post-market activities for the health software product

8.1 General

8.2 software maintenance

8.3 Re-validation

8.4 Post-market communication on the health software product

8.5 Decommissioning and disposal of the health software product

Bibliography

BS EN 82304-1:2017

Health Software - General requirements for product safety

Current

Published:

31 Dec 2017