What Is Clinical Risk Management?
Clinical risk management is the structured process of identifying, assessing, controlling and monitoring risks of patient harm arising from health IT systems. Its purpose is to ensure that software, digital services and connected medical technologies support safe clinical care throughout their lifecycle.
Unlike cybersecurity or information governance, which potentially have a broader remit, clinical risk management focuses on protecting patients. It considers how software design, workflows, user interfaces, integrations and system failures could contribute to clinical harm, then implements appropriate controls to reduce those risks.
Across the NHS, clinical risk management is mandated through the DCB0129 and DCB0160 Clinical Risk Management Standards, published and maintained by NHS England. These standards require manufacturers and deploying organisations respectively to demonstrate that clinical risks have been systematically identified, assessed and managed.
This guide explains the key standards, roles, documentation and processes involved in clinical risk management for digital health systems, providing an introduction to the discipline and linking to more detailed guidance on specific topics.
Clinical Risk Management vs Clinical Governance
The terms clinical risk management and clinical governance are sometimes used interchangeably, but they describe different concepts.
Clinical governance is the broader framework through which healthcare organisations are accountable for continuously improving the quality and safety of patient care. It encompasses areas such as clinical effectiveness, patient experience, staff competence, audit, incident reporting and continuous improvement.
Clinical risk management for health IT sits within this wider governance framework. Its focus is much narrower: identifying and controlling risks that arise specifically from digital systems and software used in clinical settings.
This distinction is important because terms such as clinical governance risk management or clinical risk assessment often relate to wider hospital governance, patient safety investigations or organisational risk registers. While these are important disciplines, they are different from the structured clinical safety processes required under DCB0129 and DCB0160.
Digital clinical safety asks questions such as:
- Could this software display incorrect patient information?
- Could a system integration fail without being detected?
- Could an alert be missed because of interface design?
- Could users misunderstand clinical recommendations?
- What controls reduce the likelihood or severity of these hazards?
This guide focuses specifically on clinical risk management for health IT systems, rather than broader clinical governance or incident management processes.
DCB0129 and DCB0160 Explained
Clinical risk management within digital health is governed by two complementary information standards: DCB0129 and DCB0160.
DCB0129 applies to organisations that manufacture or develop health IT systems. It requires suppliers to embed clinical risk management throughout the design, development, testing, implementation and maintenance of their products.
DCB0160 applies to NHS organisations and other health and care providers deploying those systems into clinical environments. It requires deployers to assess how a product will be used locally, considering configuration, workflows, integrations and operational processes.
Although they apply to different organisations, the standards are designed to work together. Suppliers provide evidence demonstrating that clinical risks have been appropriately managed during development, while deploying organisations assess how those risks apply within their own environment when deploying.
Both standards are mandatory information standards published by NHS England (formerly NHS Digital) under Section 250 of the Health and Social Care Act 2012.
In practice, many of the key clinical safety artefacts such as Hazard Logs and Clinical Safety Case documentation support both manufacturer and deployer activities, although each organisation remains responsible for its own compliance.
The Clinical Risk Management Process
Clinical risk management is not a single assessment completed before release. It is a continuous process that spans the entire lifecycle of a digital health product. Although DCB0129 and DCB0160 define their own requirements, the overall approach aligns closely with the internationally recognised principles of ISO 14971, the medical device risk management standard.
A typical clinical risk management process includes the following stages.
1. Planning
Clinical safety activities begin by establishing how risks will be managed throughout the project. This includes defining responsibilities, governance arrangements, documentation and review processes within a Clinical Risk Management Plan.
2. Hazard Identification
Potential sources of patient harm are identified by examining clinical workflows, user interactions, system behaviour, integrations and foreseeable misuse. Examples may include things such as incorrect patient identification, missing clinical alerts, delayed information, incorrect calculations or failures during system integration.
3. Risk Analysis and Evaluation
Each hazard is assessed by considering:
- the potential severity of harm if the hazard occurs; and
- the likelihood of the hazardous situation occurring.
These assessments help prioritise risks requiring additional controls.
Risk management is guided by the principle of reducing risk As Low As Reasonably Practicable (ALARP). This means organisations should implement proportionate controls whenever it is reasonably practical to do so, balancing risk reduction against effort, cost and feasibility.
4. Risk Control
Appropriate mitigations are introduced to reduce either the likelihood or severity of clinical harm.
Risk controls may include:
- software design changes
- user interface improvements
- validation checks
- clinical workflows
- user training
- procedural controls
- monitoring and alerting
Residual risks are then reassessed to determine whether they remain acceptable, using the same scoring as before.
5. Clinical Safety Case Report
The Clinical Safety Case Report brings together evidence demonstrating that identified risks have been appropriately managed and that the product is considered sufficiently safe for its intended use. This evidence supports governance and decision-making throughout the product lifecycle.
6. Ongoing Maintenance
Clinical risk management must continue after deployment to ensure that the system is being used as intended but also that any subsequent updates to the product are captured appropriately. Hazard Logs and Clinical Safety Case Reports should be reviewed whenever products change, incidents occur, integrations are modified or new clinical evidence becomes available. Safety documentation should evolve alongside the software rather than remaining static after initial release.
Core Clinical Safety Artefacts
Clinical risk management produces several key documents that collectively demonstrate how patient safety has been considered throughout development and deployment.
Clinical Risk Management System (CRMS)
The Clinical Risk Management System describes the governance framework used to manage clinical safety across the organisation, including responsibilities, policies and processes (this is usually maintained within the Clinical Risk Management Plan document).
Clinical Risk Management Plan (CRMP)
The Clinical Risk Management Plan explains how clinical safety activities will be undertaken for a specific product or implementation. It defines responsibilities, review activities, documentation and governance arrangements.
Hazard Log
The Hazard Log records identified clinical hazards, associated risks, implemented controls and residual risks. Importantly, it is a living document. It should be reviewed and updated throughout development, deployment, post-market surveillance and whenever significant product changes occur.
Clinical Safety Case Report (CSCR)
The Clinical Safety Case Report summarises the overall clinical safety argument and supports formal approval of the system for its intended use. Finally mention is often made of a Clinical Risk Management File. While this is not necessarily a physical document, the term is commonly used to describe the collection of clinical safety documentation maintained for a product.
The Clinical Safety Officer's Role
The Clinical Safety Officer (CSO) is central to the clinical risk management process. Under both DCB0129 and DCB0160, organisations are expected to appoint a suitably qualified, registered clinician to oversee clinical risk management activities. The CSO provides clinical oversight, ensuring that patient safety remains a core consideration throughout the product lifecycle.
Typical responsibilities include:
- overseeing hazard identification and risk assessment
- reviewing clinical safety documentation
- challenging design decisions where clinical risks exist
- approving the Clinical Safety Case Report
- supporting governance and assurance activities
While software engineers, regulatory specialists and product teams all contribute to clinical safety, the CSO provides the clinical expertise needed to ensure risks are considered from a patient care perspective. For organisations without an in-house Clinical Safety Officer, outsourced CSO services can provide experienced clinical leadership while maintaining compliance with DCB0129 and DCB0160.
Where to Go Next
Effective clinical risk management brings together the responsibilities of software suppliers, deploying organisations and Clinical Safety Officers to ensure digital health technologies support safe patient care throughout their lifecycle. If you are developing a health IT system, our DCB0129 specialists can help you implement compliant clinical risk management processes and produce the documentation required for NHS customers. If you are deploying digital health software within an NHS or healthcare organisation, our DCB0160 consultants can support safe local implementation and governance.
If you need experienced clinical leadership, we also provide outsourced Clinical Safety Officer services, supporting organisations that require practical expertise without maintaining a full-time internal CSO. Whatever stage you're at, our clinical safety specialists can help you build proportionate, practical clinical risk management processes that meet NHS expectations while supporting the safe delivery of digital health technologies.