ISO 15189:2022 - Medical Laboratories Requirements for Quality and Competence
Clause 7: Process requirements – ISO 15189:2022 - Medical Laboratories Requirements for Quality and Competence
ISO 15189:2022 - Medical Laboratories Requirements for Quality and Competence 7.6.3: Information systems management
What does 7.6.3 require?
Any system used to collect, process, record, report, store or retrieve examination data shall be: validated by its supplier and checked by the laboratory to confirm it works before it is brought in, with every change, configuration and modification included, authorized, documented and validated before going live (interfaces too); documented, with the documentation available to users; set up with cybersecurity in mind so that data are protected from unauthorized access, tampering and loss; run in an environment that meets the supplier's specifications or, for manual systems, conditions that protect accurate recording and transcription; and maintained so data integrity is kept, with failures and the actions taken recorded. Calculations and transfers of data shall be checked in a systematic way.
This control maps to 3 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
1.08 Information governance: implement interoperable health information systems conformant with national digital health standards and legislation, monitor data quality, keep laboratory information systems lawful, secure and privacy-compliant, run an information security management system with role-based access, protection in transit and at rest, regular vulnerability assessment, reporting to the governing body and data breach response, orient and monitor the workforce, and mitigate patient safety risk from delayed adoption of new digital standards
2.04 Adaptable and resilient systems: manage software updates and system changes through a change control process, validate and test changes affecting regulated software before clinical use, communicate outages to staff and users, and keep systems reviewed and updated to industry standards
8.06 IVD software and AI governance and implementation: ensure commercial IVD software is on the ARTG and in-house IVD software including diagnostic AI is managed as an in-house IVD under NPAAC, TGA and best practice requirements; govern selection, implementation and use within the clinical governance and risk framework including privacy, cybersecurity and data integrity; undertake a privacy impact assessment covering third-party processing; confirm performance for intended use, population and context through acceptance testing and commissioning; evaluate AI performance before clinical use and monitor it over time; and evaluate performance on data relevant to the intended population where training data are not Australian