Towards Continuous Certification of Clinical Information Systems

Clinical information systems (CISs) play an increasingly pivotal role in modern health care delivery. They are safety-critical as well as sensitive with respect to security and privacy concerns. In the light of ongoing reports on CISs failures and technology-induced adverse events, policy-makers and regulators have been struggling to identify effective ways to ensure the quality of these systems. Existing regulatory frameworks and controls do not readily apply to CISs. This paper identifies the shortcomings of existing regulatory controls and proposes a new framework for regulating CIS, based on a notion of continuous certification. We exemplify the application of the proposed framework with a real-world case study of a perioperative CIS.