Background

It has long been recognised that failures, flaws and unintentional misuse of 'Digital products' have the potential to introduce harm to 'Patients / Service users' when used to support health and social care services.  

To manage this risk, 2 standards, establishing a framework of 'Clinical risk management', were adopted by the NHS in 2009. Originally published as DSCN 14/2009 and DSCN 18/2009, they are now published as DCB 0129 and DCB 0160 respectively.

They were incorporated into English law through Section 250 of the Health and Social Care Act 2012 which states:

1. The Secretary of State or the National Health Service Commissioning Board (referred to in this Chapter as “the Board”) may prepare and publish an information standard.

2. For the purposes of this Part “an information standard” is a document containing standards in relation to the processing of information.

3. The Secretary of State may exercise the power under subsection (1) only in relation to information concerning, or connected with, the provision of health services or of adult social care in England.

4. The Board may exercise the power under subsection (1) only in relation to information concerning, or connected with, the provision of NHS services.

5. An information standard must include guidance about the implementation of the standard.

6. The following must have regard to an information standard published under this section:

• the Secretary of State
• the Board
• any public body which exercises functions in connection with the provision of health services or of adult social care in England
• any person (other than a public body) who provides health services, or adult social care in England, pursuant to arrangements made with a public body exercising functions in connection with the provision of such services or care

DCB 0129 and DCB 0160 are information standards managed and published pursuant to section (1) above by NHS Digital on behalf of the Secretary of State (as may be amended or replaced from time to time).

Propagation of this obligation into the supporting 'Manufacturer' community is established through requirement 2.5.1 of DCB 0160 which states: "In the procurement of a Health IT System the Health Organisation must ensure that the Manufacturer and the Health IT System complies with DCB0129."

The scope of DCB 0129 and DCB 0160 was extended in 2018 to include functionality classified as a 'Medical device', where that functionality is 'Implemented' in a 'Health IT system'.