Interdependence of safety, effectiveness and security
Safety, effectiveness and security move together: a control that improves one can weaken another, and the document treats the interaction as the theme, not as an exception.
What the public record carries
Not stated in the public record beyond the title and the abstract's framing. The public abstract places safety, effectiveness and security together as key properties and includes privacy within security, and the introduction of the first edition says handling them well calls for a joined-up approach that optimises all three. The sub-clause text is not public.
Basis. The public contents carry the sub-clause title. The public abstract names all three properties and includes privacy within security. The draft text is not public.
Why it matters in a health estate
The interdependence is the most useful idea in the document for a CISO, because it explains why a security programme can reduce clinical safety. A new authentication step can lock a clinician out during an emergency. A logging control can capture patient data in a third system. A availability control can force a workaround onto paper. None of these is a security failure; each is a safety effect of a security decision. The theme asks for the trade to be recorded.
What to do now
For every material control, record the effect on the other two properties. Where a control is expected to reduce one and increase another, say so and name who accepted the trade. Add the trade to the risk register rather than leaving it in the project file.
The evidence a reviewer will ask for
| Evidence | What it is |
|---|---|
| Trade record | Each material control, its intended effect and its effect on the other two properties |
| Acceptance | The named person who accepted a trade and the date |
| Clinical review | Where a security or availability decision was reviewed with clinical staff |
| Monitoring | How the traded effect is watched once the control is live |
What a reviewer will ask
A reviewer will ask what a control did to the other two properties. A security control with no clinical reading is an unrecorded trade.
Common gaps
- A new authentication step is deployed with no review of emergency access
- A logging change captures patient data in a system outside the data map
- Availability is improved by a workaround that moves work onto paper and out of the record
- A trade is accepted in a project meeting and never enters the risk register
Before the draft publishes
Take the last five security changes and ask what each did to safety and effectiveness. Record the answers.
If the draft changes this row
The draft is edition 2 and 62 pages, one page more than the first edition. Its text and any change summary are not public as at 21 October 2026. This row follows the published first edition's structure, which is what your procedure should name today. The change watch emails you when the record changes or the draft text lands, and the row is re-read then. No one can tell you what moved before that, and this page does not guess.
Related rows
Who this binds. The CISO, the clinical safety officer and the quality lead together, because the three properties cannot be managed in separate columns.