The standards behind clinical assurance, in plain language.
DCB0129, DCB0160 and DTAC come up in almost every digital health conversation. Here's what they actually mean, without the jargon.
What is DCB0129?
DCB0129 ("Clinical Risk Management: its Application in the Manufacture of Health IT Systems") is the UK standard that applies to organisations that design, build or manufacture health IT systems. It requires the manufacturer to operate a clinical risk management system, appoint a named Clinical Safety Officer, and produce a Clinical Safety Case Report and Hazard Log before a system is released for use.
What is DCB0160?
DCB0160 ("Clinical Risk Management: its Application in the Deployment and Use of Health IT Systems") is the companion standard for the healthcare organisation deploying or operating a health IT system. It requires the deploying organisation to have its own clinical risk management system and Clinical Safety Officer, so risk is actively managed in the specific clinical setting the system is used in — not just at the point of manufacture.
What is the Digital Technology Assessment Criteria (DTAC)?
DTAC is a baseline set of standards used by NHS and care organisations to assess digital health technologies before adoption. It brings together five areas — clinical safety, data protection, technical security, interoperability, and usability & accessibility — into a single assessment, giving buyers and suppliers a shared reference point for readiness.
What does a Clinical Safety Officer actually do?
A Clinical Safety Officer (CSO) is a registered clinician responsible for ensuring a health IT system is safe for its intended use. They lead hazard identification and risk assessment, own the Hazard Log, sign off the Clinical Safety Case Report, and act as the clinical safety voice inside a delivery or product team.
When should clinical assurance start?
As early as possible. Clinical risk decisions are effectively made at the point a service model, workflow, or system design is chosen — even if the paperwork isn't produced until later. Starting assurance at discovery, rather than at the point of go-live sign-off, is what keeps it from becoming a blocker.
Not sure where your programme stands against these standards?
An independent readiness review is often the fastest way to find out. Book a conversation and we'll give you an honest view.
Ready to bring clarity to your next assurance decision?
Share your programme context and we'll come back with a focused view of where clinical assurance should start.