Clinical safety is the one assurance discipline that cannot be repaired after the fact. A security gap can be closed. An accessibility failure can be remediated. A clinical hazard that reached a patient is an incident and no retrospective document turns it back into a control.
The three ways clinical safety shows up too late
- Retrofit at UAT. The hazard log is opened once the build is nearly done, so every entry is written to match what was built rather than to shape what should have been built.
- Retrofit at go-live. The safety case becomes a document produced to satisfy a gate, written under deadline by whoever is available.
- Retrofit at incident review. The cheapest version of this costs a serious incident investigation. The expensive version costs a patient.
Each is more expensive than the last.
What DCB0129 and DCB0160 actually require
[DCB0129](https://digital.nhs.uk/data-and-information/information-standards/information-standards-and-data-collections-including-extractions/publications-and-notifications/standards-and-collections/dcb0129-clinical-risk-management-its-application-in-the-manufacture-of-health-it-systems) is the manufacturer standard and [DCB0160](https://digital.nhs.uk/data-and-information/information-standards/information-standards-and-data-collections-including-extractions/publications-and-notifications/standards-and-collections/dcb0160-clinical-risk-management-its-application-in-the-deployment-and-use-of-health-it-systems) is the operator standard. They are written to be read together. A supplier that answers one and ignores the other has described half a system. The safety case travels with the deliverable, not with the supplier's document library.
The intake question that changes everything
Which clinical pathway does this touch, who owns the pathway, who signs off changes to it and who reads the incident log when it goes wrong. Four answers, all available at intake, all cheap to obtain then and expensive to obtain later.
The hazard log on day one
A named clinical safety officer. Opened at intake. One entry per identified hazard, each with a control and an owner. Closed only at the end of the warranty period, not at go-live.
What the buyer sees when this is done well
A named safety officer, a hazard log with dates, a rollback plan tested in staging and a rehearsal of the first clinical incident. Four artefacts, all producible before commercial close.
Strategist so-what
Claim. Clinical safety at intake costs a week; clinical safety at incident review costs the contract.
Implication. Open the hazard log before the build starts and the safety case becomes a byproduct of delivery rather than a deadline artefact.