Life cycle of health software and health IT systems
The document follows the system from concept to decommissioning and treats the whole life as the scope of assurance, not only development or go-live.
What the public record carries
The public abstract says the principles and concepts apply for the whole life of the system, from the first idea to retirement, and points to Figure 1. The public contents place the life cycle at 4.4. The stages shown in Figure 1 and the text of the sub-clause are not public. The first edition ran to 61 pages and the draft to 62.
Basis. The public abstract states the life cycle from concept to decommissioning and names Figure 1. The public contents carry the sub-clause title. The figure and the text are not public.
Why it matters in a health estate
The life cycle is the clock the rest of the register hangs on. Assurance activity is often concentrated at procurement and go-live, then thins out during operation and disappears at decommissioning, which is exactly when data migration and record retention create their own risks. A revision is the moment to check that every stage has an owner and an evidence set, including the stages no one is measured on.
What to do now
List every stage in the organisation's own life cycle and name the owner and the evidence for each. Mark the stages with no evidence. Pay particular attention to implementation, configuration, upgrade and decommissioning, where the public discussion of health software failures most often lands.
The evidence a reviewer will ask for
| Evidence | What it is |
|---|---|
| Stage map | Every life cycle stage, its owner and the evidence it produces |
| Gate list | The decision points between stages and who signs each |
| Operational evidence | Monitoring, incident and change records from the live period |
| Decommissioning plan | Data migration, retention, destruction and the record of each |
What a reviewer will ask
A reviewer will ask which stage the organisation is in and what evidence the earlier stages left. A go-live file with nothing after it is an incomplete life cycle.
Common gaps
- Assurance stops at go-live and the operational years carry no evidence
- Configuration changes are made without a record of the decision or the test
- Decommissioning has no owner, so data retention is decided by the supplier
- The life cycle is drawn for the supplier's product rather than for the system in use
Before the draft publishes
Mark the stages with no evidence on the stage map. The empty stages are the plan.
If the draft changes this row
The draft is edition 2 and 62 pages, one page more than the first edition. Its text and any change summary are not public as at 21 October 2026. This row follows the published first edition's structure, which is what your procedure should name today. The change watch emails you when the record changes or the draft text lands, and the row is re-read then. No one can tell you what moved before that, and this page does not guess.
Related rows
Who this binds. The system owner, the procurement lead and the decommissioning owner, because the life cycle runs from concept to decommissioning and every stage has evidence.