Clinical Safety
DCB0160 Compliance - Clinical Risk Management in Health IT
What is DCB0160?
The DCB0160 standard mandates how clinical risk should be managed by healthcare organisations when deploying health IT systems from a manufacturer. It is published and maintained by NHS England under the Health and Social Care Act.
The standard focuses on:
- Safe configuration and implementation of systems
- Integration into local clinical workflows
- Ongoing clinical risk management during clinical use of the product
- Local governance, assurance and eventually decommissioning of the product
Who does DCB0160 apply to?
- NHS Trusts (and those individual hospitals)
- General Practices
- Integrated Care Boards (ICBs) (if they are managing clinical safety for their wider area)
- Any other healthcare organisations deploying clinical systems (e.g. private healthcare providers who treat NHS patients)
DCB0160 ensures that risks introduced by the local use and local configuration of a system are identified and managed, which builds on the existing DCB0129 safety case.
DCB0129 (Supplier responsibility)
- Applies to manufacturers and developers of health IT systems
- Focuses on risks relating to system design, functionality and internal process controls
- Requires a named Clinical Safety Officer (CSO) to oversee the process
- Requires the production of the core DCB0129 clinical safety documentation (Hazard Log, Clinical Safety Case Report, Clinical Risk Management Plan).
Learn more about DCB0129 compliance.
DCB0160 (Deployment responsibility)
- Applies to healthcare organisations that are deploying the systems
- Focuses more on risks arising from local configuration and use
- Requires local clinical safety governance processes
- Also requires a named Clinical Safety Officer
- Produces deployment-level safety documentation
Both standards are required to ensure end-to-end clinical safety, from system design through to real-world use.
How DCB0129 and DCB0160 work together in practice
In practice:
- DCB0129 addresses risks inherent in how the system itself is manufactured
- DCB0160 addresses risks introduced by how the system is deployed and used
DCB0129 Clinical safety documentation is usually sent from the supplier to the healthcare organisation for review, including:
- Clinical Safety Case Reports
- Hazard logs
- Assumptions, limitations, and intended use statements
A clear understanding of this handover is critical to avoid gaps or duplication. There is frequently a ‘handshake’ at some point where the DCB0129 material is handed to the deploying organisation to review and add their own local configurations and/or risk assessment. The CSOs on both sides may play a part in expediting this.
Common misconceptions about DCB0160
“Suppliers need to be DCB0160 compliant”
Incorrect. Suppliers can support DCB0160 but are not legally responsible for compliance, that is the deploying organisation’s responsibility. The only caveat to that statement is suppliers who are also the deploying organisation (e.g. a healthcare service provider who has developed and deployed their own IT system). In that case a hybrid approach can be taken to encompass both the DCB0129 and DCB0160 requirements such that all aspects of clinical risk are covered.
“DCB0160 replaces DCB0129”
This is not the case. The standards are different albeit complementary and both are required to be completed by the respective parties (as outlined above) for end-to-end deployment of a solution.
“DCB0160 is a nice to have”
DCB0160 is a legally mandatory standard for organisations deploying clinical systems. It should not be considered voluntary as part of any deployment.
- 1
Providing the initial DCB0129 documentation they’ve created
- 2
Explaining the system’s intended use, limitations, and risks
- 3
Supporting local clinical safety assessments as required
- 4
Responding to assurance and governance queries that arise throughout go-live
Suppliers with well-structured and easy to read DCB0129 documents make DCB0160 compliance significantly easier for their customers. We also provide DCB0160 guidance documentation for your end-customers, removing as many hurdles as possible to deploying your technology and streamlining procurements.
Where can DCB0160 cause challenges for suppliers?
Suppliers often encounter issues where:
- The responsibility boundaries are unclear
- NHS organisations request supplier-led DCB0160 activities
- Clinical safety expectations and output quality differ between organisations
- Documentation requirements are poorly defined
Understanding DCB0160 helps suppliers respond confidently and appropriately to questions that may arise. We have deployed our DCB0129-compliant technologies in hundreds of different NHS scenarios, so we understand the market inside out.
How AbedGraham supports clarity around DCB0160
While our primary focus is DCB0129 and supplier clinical safety, we support clients by:
- Clarifying DCB0129 vs DCB0160 responsibilities and what needs to be done
- Ensuring DCB0129 documents support NHS deployment needs and expectations
- Supporting discussions with NHS organisations where required to assist
Our approach reduces friction and helps deployments progress more smoothly. Our aim is for clinical safety to be done to the highest standard, while also never becoming the rate-limiting step in any procurement process.
Explore our DCB0129 compliance services.
Clinical Safety
Talk to a DCB0160 specialist
If your organisation needs incident response support, or wants to test its DCB0160 compliance readiness, contact our consultants today.
Interested in Other Services?
DCB0129 Overview
An introduction to DCB0129 clinical risk management for health IT suppliers, explaining when the standard applies, what compliance involves, and how suppliers meet NHS clinical safety requirements.
Clinical Safety Officer (CSO)
Independent Clinical Safety Officer services providing clinical oversight, governance, and sign-off required under DCB0129 for NHS-deployed digital health systems.
Frequently asked questions
Yes, organisations who are deploying healthcare technology will need to cover off all aspects of DCB0160 compliance.
In general, no. DCB0160 is the responsibility of the deploying organisation. However, if the entity is both the manufacturer and deployer of the technology, they may need to complete documentation which covers both standards.
Generally speaking this will be the Clinical Safety Case Report and Hazard Log, but providers can also ask for safety incident logs and other evidence (testing etc.) in more detail. We provide a comprehensive DCB0160 handover as standard for our DCB0129 clients which alleviates a number of internal hurdles.
This should be the deploying organisation’s CSO. If you are asked to sign off the DCB0160 documentation as well, we would strongly advise against doing so to avoid conflict of interest or any liability issues arising down the line.
DCB0160 should ideally be reviewed whenever the core DCB0129 documentation changes (updates or incidents from the supplier) or when the deployment type of methodology changes (different departments, new functionality etc.).
It depends on your role. If you manufacture or supply a health IT system, DCB0129 is your responsibility. If you are an NHS organisation deploying that system, DCB0160 is yours. Most projects involve both - DCB0129 from the supplier and DCB0160 from the deploying organisation - to achieve end-to-end clinical safety. If you both build and deploy your own technology, you may need to satisfy both standards yourself.
In practice, DCB0160 compliance means the deploying organisation assesses and manages the clinical risks introduced by how a system is configured and used locally. This usually includes safe configuration and testing, integrating the system into clinical workflows, maintaining a local hazard log, putting governance and assurance processes in place, and having a named Clinical Safety Officer sign off the deployment.
There is no single official DCB0160 template that suits every deployment, because the clinical risks depend on your local configuration, workflows, and use of the system. Deploying organisations usually produce their own deployment-level safety documentation, such as a local Clinical Safety Case Report and Hazard Log. For our DCB0129 clients, we provide a comprehensive DCB0160 handover and guidance documentation to give your end-customers a clear starting point.
Related services
DCB0129 Compliance & Consultancy
The AbedGraham Group provides specialist DCB0129 (DCB 0129) consulting and compliance support for…
DCB0129 Support & Assurance
The AbedGraham Group provides specialist DCB0129 (DCB 0129) compliance consultancy for organisations…
Clinical Safety Officer (CSO) Services Provider
Experienced Clinical Safety Officer support for DCB0129 and NHS digital assurance The AbedGraham…