Clinical Safety
DCB0160 Compliance - Clinical Risk Management in Health IT
What is DCB0160?
DCB0160 defines how clinical risk should be managed by healthcare organisations when deploying and using health IT systems. It is an information standard published by NHS England under section 250 of the Health and Social Care Act 2012, and its full title is 'Clinical Risk Management: its Application in the Deployment and Use of Health IT Systems'.
The standard focuses on:
- Safe configuration and implementation of systems
- Integration into local clinical workflows
- Ongoing clinical risk management during use
- Local governance, oversight, and assurance
Who does DCB0160 apply to?
- NHS trusts and foundation trusts
- General Practices
- Integrated Care Boards (ICBs) (if they are managing clinical safety for their area)
- Any other healthcare organisations deploying clinical systems
DCB0160 ensures that risks introduced by the local use of a system are identified and managed, even where the system itself is supplied by a third party.
DCB0129 (Supplier responsibility)
- Applies to manufacturers and suppliers of health IT systems
- Focuses on risks inherent in system design and functionality
- Requires a named Clinical Safety Officer (CSO)
- Produces supplier-level clinical safety artefacts
Learn more about DCB0129 compliance.
DCB0160 (Deployment responsibility)
- Applies to healthcare organisations deploying systems
- Focuses more on risks arising from local configuration and use
- Requires local clinical safety governance processes
- Also requires a named Clinical Safety Officer
- Produces deployment-level safety documentation
Both standards are required to ensure end-to-end clinical safety, from system design through to real-world use.
How DCB0129 and DCB0160 work together in practice
In practice:
- DCB0129 addresses risks inherent in the system itself
- DCB0160 addresses risks introduced by how the system is deployed and used
Information typically flows from supplier to healthcare organisation, including:
- Clinical Safety Case Reports
- Hazard logs and known risks
- Assumptions, limitations, and intended use
Clear understanding of this handover is critical to avoid gaps or duplication. There is frequently a ‘handshake’ at some point where the DCB0129 material is handed to the deploying organisation to review and add their own configurations. The CSOs on both sides may play a part in expediting this.
Common misconceptions about DCB0160
“Suppliers need to be DCB0160 compliant”
Incorrect. Suppliers can support DCB0160 but are not responsible for compliance. The only caveat to that statement is suppliers who are also the deploying organisation (e.g. a healthcare service provider who has developed/deployed their own IT system). In that case a hybrid approach can be taken to encompass both the DCB0129 and DCB0160 requirements.
“DCB0160 replaces DCB0129”
No. The standards are complementary and both are required in their respective contexts for end-to-end deployment of a solution.
“DCB0160 is optional”
DCB0160 is a mandated NHS standard for organisations deploying clinical systems. Clarifying these points early helps prevent procurement delays and unnecessary time and resource expenditure.
- 1
Providing the initial DCB0129 clinical safety documentation
- 2
Explaining system assumptions, limitations, and risks
- 3
Supporting local clinical safety assessments
- 4
Responding to assurance and governance queries
Suppliers with well-structured DCB0129 artefacts make DCB0160 compliance significantly easier for their customers. We also provide DCB0160 guidance documentation for your end-customers, removing as many hurdles as possible to deploying your technology.
Where can DCB0160 cause challenges for suppliers?
Suppliers often encounter issues where:
- Responsibility boundaries are unclear
- NHS organisations request supplier-led DCB0160 activities
- Clinical safety expectations differ between organisations
- Documentation requirements are poorly defined
Understanding DCB0160 helps suppliers respond confidently and appropriately. We have deployed our DCB0129-compliant technologies in hundreds of different NHS scenarios, so we understand the market inside out.
How AbedGraham supports clarity around DCB0160
While our primary focus is DCB0129 and supplier clinical safety, we support clients by:
- Clarifying DCB0129 vs DCB0160 responsibilities
- Ensuring DCB0129 artefacts support NHS deployment needs
- Supporting discussions with NHS organisations where required
Our approach reduces friction and helps deployments progress smoothly. Our aim is for clinical safety to be done to the highest standard, while never becoming the rate-limiting step in any procurement process.
Explore our DCB0129 compliance services.
Clinical Safety
Talk to a DCB0160 specialist
If your organisation needs incident response support, or wants to test its DCB0160 compliance readiness, contact our consultants today.
Interested in Other Services?
DCB0129 Overview
An introduction to DCB0129 clinical risk management for health IT suppliers, explaining when the standard applies, what compliance involves, and how suppliers meet NHS clinical safety requirements.
Clinical Safety Officer (CSO)
Independent Clinical Safety Officer services providing clinical oversight, governance, and sign-off required under DCB0129 for NHS-deployed digital health systems.
Frequently asked questions
Yes, organisations who are deploying healthcare technology will need to cover off all aspects of DCB0160 compliance.
In general, no. DCB0160 is the responsibility of the deploying organisation. However, if the entity is both the manufacturer and deployer of the technology, they may need to complete documentation which covers both standards.
Generally speaking this will be the Clinical Safety Case Report and Hazard Log, but providers can also ask for safety incident logs and other evidence (testing etc.) in more detail. We provide a comprehensive DCB0160 handover as standard for our DCB0129 clients which alleviates a number of internal hurdles.
This should be the deploying organisation’s CSO. If you are asked to sign off the DCB0160 documentation as well, we would strongly advise against doing so to avoid conflict of interest or any liability issues arising down the line.
DCB0160 should ideally be reviewed whenever the core DCB0129 documentation changes (updates or incidents from the supplier) or when the deployment type of methodology changes (different departments, new functionality etc.).
It depends on your role. If you manufacture or supply a health IT system, DCB0129 is your responsibility. If you are an NHS organisation deploying that system, DCB0160 is yours. Most projects involve both - DCB0129 from the supplier and DCB0160 from the deploying organisation - to achieve end-to-end clinical safety. If you both build and deploy your own technology, you may need to satisfy both standards yourself.
In practice, DCB0160 compliance means the deploying organisation assesses and manages the clinical risks introduced by how a system is configured and used locally. This usually includes safe configuration and testing, integrating the system into clinical workflows, maintaining a local hazard log, putting governance and assurance processes in place, and having a named Clinical Safety Officer sign off the deployment.
There is no single official DCB0160 template that suits every deployment, because the clinical risks depend on your local configuration, workflows, and use of the system. Deploying organisations usually produce their own deployment-level safety documentation, such as a local Clinical Safety Case Report and Hazard Log. For our DCB0129 clients, we provide a comprehensive DCB0160 handover and guidance documentation to give your end-customers a clear starting point.
Related services
DCB0129 Compliance & Consultancy
The AbedGraham Group provides specialist DCB0129 (DCB 0129) consultancy and compliance support for…
DCB0129 Support & Assurance
The AbedGraham Group provides specialist DCB0129 (DCB 0129) compliance consultancy for organisations…
Clinical Safety Officer (CSO) Services Provider
Experienced Clinical Safety Officer support for DCB0129 and NHS digital assurance The AbedGraham…