Performing Hazard Analysis & Risk Assessment

Introduction

In common language, “hazard” and “risk” are often used as synonyms. In Life Sciences safety engineering, however, they have distinct, technical definitions that are critical for ISO 14971 Hazard Identification:

• Hazard: A potential source of harm (e.g., high-voltage electricity, sharp edges, toxic chemicals, or data corruption).
• Risk: The combination of the probability of occurrence of harm and the severity of that harm.

Performing a hazard analysis for MedTech involves identifying these sources and determining the sequence of events that could turn a latent hazard into an actual injury.

The Core Logic: Hazard to Harm

To comply with global standards, a Risk Assessment for medical devices must follow a structured logical flow. You cannot simply list “risks”; you must document the path they take:

1. Hazard: The source (e.g., Laser radiation).
2. Sequence of Events: What happens? (e.g., The safety interlocking fails + The technician enters the room without goggles).
3. Hazardous Situation: The specific circumstance where someone is exposed to the hazard (e.g., Eyes are exposed to an unshielded laser beam).
4. Harm: The physical injury (e.g., Permanent retinal damage).

Preliminary Hazard Analysis (PHA)

The Preliminary Hazard Analysis (PHA) is an essential tool used early in the development cycle. Its goal is to identify hazards when the product concept is still fluid.

By performing a PHA, engineers can make high-level design decisions—such as choosing a non-toxic material or a lower voltage—that eliminate risks entirely, rather than trying to “control” them later with warnings or shields. This “Safety by Design” approach is the most effective form of Risk Control.

Identifying Hazardous Situations in Healthcare Software

With the rise of SaMD (Software as a Medical Device), identifying hazardous situations in healthcare software has become a specialized skill. Unlike hardware, software doesn’t “break” due to wear and tear. Instead, hazards often stem from:

• Data Integrity: Incorrect dosage calculations displayed to a nurse.
• Connectivity: Loss of communication with a remote monitoring station.
• Usability: A user interface that leads to a “foreseeable misuse” (e.g., accidentally swiping to “Off” instead of “Mute”).

Risk Estimation & The Assessment Matrix

Once hazards and situations are identified, you must perform a Risk Estimation. This involves assigning a score to two key variables:

• Severity of Harm: Usually rated from Negligible to Catastrophic.
• Probability of Occurrence: The likelihood that the hazardous situation will lead to harm.

These values are plotted on a Risk Assessment Matrix. This matrix defines your “Acceptability Criteria”—essentially, a map that tells you which risks are “Broadly Acceptable” and which require immediate Risk Control measures.

Implementing Risk Controls

Every “unacceptable” risk must be mitigated. According to ISO 14971, you must follow a strict priority:

1. Inherent Safety by Design: Design out the hazard.
2. Protective Measures: Add sensors, alarms, or physical barriers.
3. Information for Safety: Use labels, training, or manuals (this is the weakest form of control).

A Pro-Tip: Every risk control is a requirement. If your mitigation is a “thermal fuse,” you must have a system requirement for that fuse, and you must verify it through testing.

Visure’s Role: Centralizing the Hazard Log

A Hazard Analysis managed in a document is a “dead” document. Visure Requirements ALM turns your hazard analysis into a living, breathing part of your engineering lifecycle:

• Hazard Libraries: Access and reuse standardized lists of hazards (based on ISO 14971 Annex C) to ensure your analysis is comprehensive.
• Direct Traceability: Link a Hazardous Situation directly to a Risk Control Requirement and then to a Verification Test. This ensures no hazard is left unmitigated.
• Impact Analysis: If a design requirement changes, Visure immediately shows you which hazardous situations are affected, preventing “safety regressions.”
• Vivia AI Assistant: Vivia can review your Risk Assessment templates for medical devices to find gaps in your logic or suggest missing hazardous situations based on industry data.

Conclusion

Performing Hazard Analysis & Risk Assessment is the most critical “sanity check” in the Life Sciences. It forces us to look beyond how a device should work and focus on how it could fail the patient.

When you move from a basic list of dangers to a rigorous, traceable Hazard Analysis, you are doing more than just filling out a regulatory form—you are building a culture of safety. In the end, the success of a medical device isn’t just measured by its innovation, but by the harms that were successfully foreseen and prevented.

Check out the free trial at Visure and experience how AI-driven change control can help you manage changes faster, safer, and with full audit readiness.