Sr.

Questions Identified risk Severity Probability RPN

What is the intended use and how is the medical device to be used?Factors that should be considered include:
— what is the medical device’s role relative to:
— diagnosis, prevention, monitoring, treatment or alleviation of disease,
— diagnosis, monitoring, treatment or alleviation of or compensation for an injury,
— investigation, replacement, modification or support of anatomy or a physiological process, or
— control of conception?
— what are the indications for use (e.g. patient population, user profile, use environment)?
— what are the contra-indications?
— does the medical device sustain or support life?
— is special intervention necessary in the case of failure of the medical device?
— can the performance of the medical device be impacted in the event of a security breach (performance
degradation or loss of availability)?
— can unauthorized access, unauthorized activities, or loss of data affect the medical device safety?Factors that should
be considered include:
— what is the medical device’s role relative to:
— diagnosis, prevention, monitoring, treatment or alleviation of disease,
— diagnosis, monitoring, treatment or alleviation of or compensation for an injury,
— investigation, replacement, modification or support of anatomy or a physiological process, or
— control of conception?
— what are the indications for use (e.g. patient population, user profile, use environment)?
— what are the contra-indications?
— does the medical device sustain or support life?
— is special intervention necessary in the case of failure of the medical device?
— can the performance of the medical device be impacted in the event of a security breach (performance
degradation or loss of availability)?
— can unauthorized access, unauthorized activities, or loss of data affect the medical device safety?

Is the medical device intended to be implanted? Factors that should be

considered include the location of implantation, the characteristics of the patient population, age, weight, physical
activity, the effect of ageing on implant performance, the expected lifetime of the implant, the reversibility of the
implantation, whether the implant can be modified or configured while implanted and the access connection to
perform this modification or configuration
(e.g. physical access point or wireless connection to the implanted medical device).

Is the medical device intended to be in contact with the patient or other persons? Factors that should
be considered include the nature of the intended contact, i.e. surface contact,
invasive contact, or implantation and, for each, the period and frequency of contact.

What materials or components are utilized in the medical device or are used with,
or are in contact with, the medical device? Factors that should be
considered include:
— compatibility with relevant substances;
— compatibility with tissues or body fluids;
— whether characteristics relevant to safety are known;
— is the medical device manufactured utilizing materials of animal origin?

Is the medical device intended to be routinely cleaned and disinfected by the user?
Factors that should be considered include the types of cleaning or disinfecting agents to be used and any limitations on
the number of cleaning cycles. The design of the medical device can influence the effectiveness of routine cleaning and
disinfection. In addition, consideration should be given to the effect of cleaning and disinfecting agents on the safety or
performance of the medical device.

Are measurements taken?

Factors that should be considered include the variables measured and the accuracy and the precision of
the measurement results, as well as whether the measurement apparatus or data can be compromised.
In addition, the need for calibration and maintenance should be considered

Is the medical device interpretative?

Factors that should be considered include whether conclusions are presented by the medical device from input or
acquired data, the algorithms used, and confidence limits. Special attention should be given to unintended applications
of the data or algorithm, as well as unauthorized manipulation or changes to algorithms and data.

Is the medical device susceptible to environmental influences?

Factors that should be considered include the operational, transport and storage environments. These
include light, temperature, humidity, vibrations, spillage, susceptibility to variations in power and
cooling supplies, and electromagnetic interference.

Does the medical device influence the environment?

Factors that should be considered include:
— the effects on power and cooling supplies;
— emission of toxic materials;
— the generation of electromagnetic disturbance.

Is maintenance or calibration necessary?

Factors that should be considered include:
— whether maintenance or calibration are to be carried out by the user or by a specialist;
— whether special substances or equipment are needed for proper maintenance or calibration;
— traceability of the calibrator values to a higher order reference;
— how to determine when maintenance or recalibration is needed;
— how to verify that calibration is (still) acceptable.

Does the medical device contain software?

Factors that should be considered include whether software is intended to be installed, verified,
modified or exchanged by the user or by a specialist, and the authenticity of a software update.

Does the medical device allow access to information?

Factors that should be considered include accessible Ethernet ports, USB ports, serial ports, and
removable hard drives.

Does the medical device store data critical to patient care?

Factors that should be considered include the possibility of the data being modified or corrupted,
unauthorized access to the data, and the consequences for the patients.

Are there any delayed or long-term use effects?

Factors that should be considered include ergonomic and cumulative effects. Examples could include
pumps for saline that corrode over time, mechanical fatigue, loosening of straps and attachments,
vibration effects, labels that wear or fall off, long-term material degradation.

To what mechanical forces will the medical device be subjected?

Factors that should be considered include whether the forces to which the medical device will be
subjected are under the control of the user or controlled by interaction with other persons.

What determines the lifetime of the medical device?

Factors that should be considered include battery depletion, deterioration of materials and failure
of components due to ageing, wear, fatigue or repeated use. The availability of spare parts should be
considered as well.

Does installation or use of the medical device require special training or

special skills?
Factors that should be considered include the complexity and novelty of the medical device and the
knowledge, skills and ability of the persons installing, maintaining or using the medical device. This can
include training, education, competence assessment, certification or qualification.
How will information for safety be provided?
Factors that should be considered include:
— whether information will be provided directly to the end user by the manufacturer or will it involve
the participation of third parties such as installers, care providers, health care professionals,
laboratory directors or pharmacists and whether this will have implications for training;
— commissioning and transferring to the end user and whether it is likely/possible that installation
can be carried out by people without the necessary skills;
— based on the type and expected lifetime of the medical device, whether re-training or re-certification
of users or service personnel would be appropriate.

Can the user interface design features contribute to use error?

Factors that should be considered include: control and indicators, symbols used, ergonomic features,
physical design and layout, hierarchy of operation, menus for software-driven medical devices, visibility
of warnings, audibility of alarms, standardisation of colour coding. See IEC 62366-1[16] for additional
information on usability and IEC 60601-1-8[7] for alarms.
Is the medical device used in an environment where distractions can cause use error?
Factors that should be considered include:
— the consequence of use error;
— whether the distractions are commonplace;
— whether the user can be disturbed by an infrequent distraction;
— whether repetitive stress can reduce the user’s awareness or attention.

Does the medical device have connecting parts or accessories?

Factors that should be considered include the possibility of wrong connections, similarity to other
products’ connections, connection force, feedback on connection integrity, and over- and undertightening.

Does the medical device display information?

Factors that should be considered include visibility in various environments, orientation, the visual
capabilities of the user, populations and perspectives, clarity of the presented information, units, colour
coding, and the accessibility of critical information.
Is the medical device controlled by a menu?
Factors that should be considered include complexity and number of layers, awareness of state,
location of settings, navigation method, number of steps per action, sequence clarity and memorization
problems, and importance of control function relative to its accessibility and the impact of deviating
from specified operating procedures.

Is the successful use of the medical device dependent on a user’s knowledge, skills and
abilities?
Factors that should be considered include:
— the (intended) users, their mental and physical abilities, skill and training;
— the use environment, ergonomic aspects, installation requirements;
— the capability of intended users to control or influence the use of the medical device; and
Can the user interface be used to initiate unauthorised actions?
Factors that should be considered include whether the user interface allows the user to enter an
operation mode with restricted access (e.g. for maintenance or special use), which increases the
possibility of use error and thereby the associated risks, and whether the user becomes aware of having
entered such operation mode.
Does the medical device include an alarm system?
Factors that should be considered are the risk of false alarms, missing alarms, disconnected alarm
systems, unreliable remote alarm systems, and the user’s ability of understanding how the alarm
system works. Guidance for alarm systems is given in IEC 60601-1-8[7].

In what ways might the medical device be misused (deliberately or not)?

Factors that should be considered are incorrect use of connectors, disabling safety features or alarms,
neglect of manufacturer’s recommended maintenance, unauthorized access to the medical device or to
medical device functions.

Does the medical device have a degree of autonomy?

Factors that should be considered include:
— awareness of the user when the medical device with a degree of autonomy generates an error, alarm
or failure;
— awareness of the user when intervention in an autonomously performed action is required;
— the ability of the user to intervene in or to abort an action that is performed autonomously; and
— the ability of the user to select and perform proper corrective actions.
See IEC TR 60601-4-1[9] for further guidance on medical devices with a degree of autonomy.

Has the pressure equipments been designed,

manufactured & installed in such a way as to
ensure its safety?
Has the hazard been eliminated or reduced as
far as it’s reasonably practicable?

Has the design incorporated appropriate safety

co-efficient using comprehensive methods
which are known to incorporate adequate
safety measures against all relevant failure
modes in a consistent manner?