FHIR IG analytics

Resources that use this resource

No resources found

Resources that this resource uses

No resources found

Narrative

Note: links and images are rebased to the (stated) source

Source1

{
  "resourceType": "Requirements",
  "id": "CMHAFFR2-PDS.2",
  "meta": {
    "profile": [
      "http://hl7.org/ehrs/uv/cmhaffr2/StructureDefinition/FMHeader"
    ]
  },
  "text": {
    "status": "extensions",
    "div": "<!-- snip (see above) -->"
  },
  "extension": [
    {
      "url": "http://hl7.org/fhir/StructureDefinition/structuredefinition-wg",
      "valueCode": "mobile"
    }
  ],
  "url": "http://hl7.org/ehrs/uv/cmhaffr2/Requirements/CMHAFFR2-PDS.2",
  "version": "2.0.1",
  "name": "PDS_2_Product_Risk_Assessment_and_Mitigation",
  "title": "PDS.2 Product Risk Assessment and Mitigation (Header)",
  "status": "active",
  "date": "2026-08-27T10:32:57+00:00",
  "publisher": "HL7 International / Mobile Health",
  "contact": [
    {
      "telecom": [
        {
          "system": "url",
          "value": "http://www.hl7.org/Special/committees/mobile"
        }
      ]
    }
  ],
  "description": "This category deals with process steps for risk assessment and mitigation for those\nwho are developing a new app, or an upgrade to an app, prior to its being deployed to\nConsumers.",
  "jurisdiction": [
    {
      "coding": [
        {
          "system": "http://unstats.un.org/unsd/methods/m49/m49.htm",
          "code": "001",
          "display": "World"
        }
      ]
    }
  ],
  "purpose": "Degrees of risk should be assessed and mitigated according to the intended use\nof the app. In general, risk management should manage security, privacy, safety, and other\ntypes of risks such as potential app failure scenarios, events that could lead to undesirable\noutcomes, probability and severity of risk, and mitigations or resolutions. One size does not fit\nall. For example, if apps handle sensitive personal information or give health interpretation or\nadvice, higher degrees of risk are involved than for apps that do not collect personal information or do not interpret or advise. If some information identified during this step should be disclosed\nto consumers, that is stated in the “Informing Consumers/Users” section",
  "statement": [
    {
      "extension": [
        {
          "url": "http://hl7.org/ehrs/uv/cmhaffr2/StructureDefinition/requirements-dependent",
          "valueBoolean": false
        }
      ],
      "key": "CMHAFFR2-PDS.2-01",
      "label": "PDS.2#01",
      "conformance": [
        "SHALL"
      ],
      "conditionality": false,
      "requirement": "The app SHALL conform to a product risk assessment and mitigation plan as outlined by the developer, which explicitly determines what risk must be addressed through software coding, hardware adaptions, policy, and what residual risk will be accepted by the entity responsible for the app, with an organizational Risk Register maintained, reviewed, and updated to include risks associated with the mobile application."
    },
    {
      "extension": [
        {
          "url": "http://hl7.org/ehrs/uv/cmhaffr2/StructureDefinition/requirements-dependent",
          "valueBoolean": false
        }
      ],
      "key": "CMHAFFR2-PDS.2-02",
      "label": "PDS.2#02",
      "conformance": [
        "SHALL"
      ],
      "conditionality": false,
      "requirement": "The app SHALL be developed following secure coding and practices using an established risk assessment framework."
    },
    {
      "extension": [
        {
          "url": "http://hl7.org/ehrs/uv/cmhaffr2/StructureDefinition/requirements-dependent",
          "valueBoolean": false
        }
      ],
      "key": "CMHAFFR2-PDS.2-03",
      "label": "PDS.2#03",
      "conformance": [
        "SHALL"
      ],
      "conditionality": true,
      "requirement": "IF personally identifiable information is collected THEN the app SHALL be guided in development by risk assessment findings in terms of their potential effect on adequately securing an individual's personally identifiable information (PII) including any protected health information (PHI), and also information used to access an EHR/PHR (e.g., logon credentials)."
    },
    {
      "extension": [
        {
          "url": "http://hl7.org/ehrs/uv/cmhaffr2/StructureDefinition/requirements-dependent",
          "valueBoolean": false
        }
      ],
      "key": "CMHAFFR2-PDS.2-04",
      "label": "PDS.2#04",
      "conformance": [
        "SHALL"
      ],
      "conditionality": true,
      "requirement": "IF the app transmits data to an EHR THEN the app SHALL document failure rates, measurement error rates, software bugs, and hardware risks of all types."
    },
    {
      "extension": [
        {
          "url": "http://hl7.org/ehrs/uv/cmhaffr2/StructureDefinition/requirements-dependent",
          "valueBoolean": false
        }
      ],
      "key": "CMHAFFR2-PDS.2-05",
      "label": "PDS.2#05",
      "conformance": [
        "SHOULD"
      ],
      "conditionality": false,
      "requirement": "The app SHOULD be approved prior to product launch in accordance with User Acceptance Testing (UAT) by testers who are not part of the formal development team."
    },
    {
      "extension": [
        {
          "url": "http://hl7.org/ehrs/uv/cmhaffr2/StructureDefinition/requirements-dependent",
          "valueBoolean": false
        }
      ],
      "key": "CMHAFFR2-PDS.2-06",
      "label": "PDS.2#06",
      "conformance": [
        "SHOULD"
      ],
      "conditionality": false,
      "requirement": "The app SHOULD be monitored and include documentation of conflicts or compatibility issues of the app with other apps, device features (e.g., camera), or connected devices."
    },
    {
      "extension": [
        {
          "url": "http://hl7.org/ehrs/uv/cmhaffr2/StructureDefinition/requirements-dependent",
          "valueBoolean": false
        }
      ],
      "key": "CMHAFFR2-PDS.2-07",
      "label": "PDS.2#07",
      "conformance": [
        "SHOULD"
      ],
      "conditionality": true,
      "requirement": "IF the app relies on external supporting infrastructure (e.g., cloud-based servers) to operate THEN the app SHOULD document measures to ensure the availability of that infrastructure."
    },
    {
      "extension": [
        {
          "url": "http://hl7.org/ehrs/uv/cmhaffr2/StructureDefinition/requirements-dependent",
          "valueBoolean": false
        }
      ],
      "key": "CMHAFFR2-PDS.2-08",
      "label": "PDS.2#08",
      "conformance": [
        "MAY"
      ],
      "conditionality": false,
      "requirement": "The app MAY provide documentation to show that the app publisher has adequate resources to continue to develop, maintain, and support the product (e.g., human resources, finances, IP rights, facilities, equipment, tools)."
    }
  ]
}