DCB0129 vs DCB0160: the complete guide for suppliers and NHS deployers

DCB0129 and DCB0160 are the two NHS clinical risk management standards for Health IT. They are mandatory under section 250 of the Health and Social Care Act 2012. DCB0129 applies to the manufacturer of the system. DCB0160 applies to the organisation deploying it into care.

The two standards have almost identical requirements. The difference is the question each one answers. DCB0129 asks whether the product is safe by design. DCB0160 asks whether it is safe here, in our workflows, with our patients.

Which standard applies to you?

• You build, sell or supply Health IT software: DCB0129
• You are an NHS trust, ICB, PCN, GP practice, federation or independent provider deploying software: DCB0160
• You build software and also run it in your own clinical service: both
• You configure or significantly modify a supplier's system: speak to a CSO, you may take on manufacturer duties

Side by side

• Named Clinical Safety Officer: the supplier's CSO for DCB0129, the deployer's CSO for DCB0160
• Clinical Risk Management System: both need one, scaled to the organisation
• Clinical Risk Management Plan: product focused for DCB0129, deployment focused for DCB0160
• Hazard Log: product hazards for DCB0129; workflow, configuration, environment and population hazards for DCB0160
• Clinical Safety Case Report: signed by the supplier CSO for DCB0129 and the deployer CSO for DCB0160
• After go live: both keep the safety case current through changes, releases and incidents

How the two fit together

The supplier shares its DCB0129 Safety Case and Hazard Log with the deployer. The deployer reviews them, adds the hazards that come from local configuration, training, integration and workflow, and produces its own DCB0160 Safety Case. A supplier file never replaces the deployer file, and the deployer cannot sign off safely without the supplier file.

Good deployments run joint hazard workshops so both CSOs see the same risks and agree who owns each control.

What NHS buyers check before go live

• A current, signed DCB0129 Clinical Safety Case Report and Hazard Log from the supplier
• The supplier's named CSO and their professional registration
• The clinical safety section of DTAC completed and evidenced
• A DCB0160 Safety Case signed by the deploying organisation's CSO
• A clear process for reporting and reviewing safety incidents after go live

Common mistakes

• Writing the safety case at the end instead of during design
• Assuming the supplier's DCB0129 covers the deployer
• A Hazard Log that never changes after go live
• A CSO who signs off but is not involved in releases or incidents
• No CSO at all in smaller organisations such as PCNs and federations

How DigiSafe helps

We act as named CSO for suppliers under DCB0129 and for NHS and care organisations under DCB0160, run joint hazard workshops, and train in-house CSOs through the CSO Training Academy. Not sure which standard applies to you? Tell us what you need or book a free 20 minute call with an expert.