Zum Inhalt

ISO 14971:2019 Risk Management Plan — EPPA

Risk file is a regulatory deliverable

Pursuant to ISO 14971:2019 §4, the risk management file is the authoritative record of risk-related activities. EU MDR Annex I §3 requires manufacturers to "establish, implement, document and maintain a risk management system" — this document is the seed of that system for EPPA. It is not yet signed off and must be completed before EPPA is placed on any market.

1. Document identity

Field Value
Document title EPPA Risk Management Plan and Hazard Register
Document ID EPPA-RMP-001
Version 0.1 (draft)
Status Draft — not approved
Effective date n/a
Top management approval Pending
Owner LABIS UCA — Quality lead (pending)
Linked documents 01-intended-use-statement.md, 10-eu-mdr-saMD-classification.md, 11-iec-62304-lifecycle.md, 30-gdpr-dpia.md, 50-secdev-checklist.md

2. Scope (ISO 14971 §4.2)

This risk management file covers EPPA in its current research-use phase and contemplates the foreseeable evolution to a Class IIa SaMD (see 10-eu-mdr-saMD-classification.md).

The intended use, intended user, target population and reasonably foreseeable misuse are documented in 01-intended-use-statement.md and are inputs to this risk file per ISO 14971 §4.2 and §5.2.

3. Risk management process (ISO 14971 §4, §5, §6, §7, §8, §9, §10)

Clause Activity Owner Status
§4.1 Risk management process established Quality lead DRAFT
§4.2 Management responsibilities Top management Pending sign-off
§4.3 Competence of personnel HR + Quality Pending
§4.4 Risk management plan This document DRAFT
§4.5 Risk management file This document + linked artefacts DRAFT
§5 Risk analysis: identification of hazards and hazardous situations This document §7 DRAFT
§6 Risk evaluation This document §6 (matrix) DRAFT
§7 Risk control This document §7 (per hazard) DRAFT
§8 Evaluation of overall residual risk This document §8 DRAFT
§9 Risk management review Annual Not yet performed
§10 Production and post-production activities Linked to PMS plan Missing

4. Risk acceptability policy (ISO 14971 §4.4(c))

Top management must approve the risk acceptability criteria before the hazard analysis is performed. The criteria proposed for EPPA, pending sign-off, are below.

4.1 Severity scale (S)

S Label Definition (EPPA-specific)
S1 Negligible Inconvenience, no harm; e.g. clinician re-takes a photograph.
S2 Minor Temporary discomfort or transient non-medical inconvenience; no clinical consequence.
S3 Serious Reversible clinical consequence; e.g. inappropriate corrective-exercise prescription that the patient tolerates without lasting effect.
S4 Critical Irreversible or significant clinical consequence requiring intervention; e.g. mis-prescribed orthotic that causes prolonged musculoskeletal pain.
S5 Catastrophic Life-threatening or fatal. Not credible for EPPA given intended use; included for completeness.

4.2 Probability scale (P)

P Label Frequency (per use occasion)
P1 Improbable < 1 in 10 000
P2 Remote 1 in 1 000 to 1 in 10 000
P3 Occasional 1 in 100 to 1 in 1 000
P4 Probable 1 in 10 to 1 in 100
P5 Frequent > 1 in 10

4.3 Risk matrix

P1 P2 P3 P4 P5
S5 M H H UA UA
S4 L M H H UA
S3 L L M H H
S2 A L L M M
S1 A A A L L

Legend: A = acceptable, L = low (acceptable with control), M = medium (requires control + residual review), H = high (must be reduced as far as possible — AFAP), UA = unacceptable (must be reduced before release).

ISO 14971:2019 deliberately moves away from the "As Low As Reasonably Practicable" (ALARP) formulation of the 2007 edition. The 2019 edition requires that risks be reduced "as far as possible" (AFAP) without contradicting the benefit-risk balance — see ISO 14971:2019 Annex A.2 for the rationale.

5. Risk control hierarchy (ISO 14971 §7.1)

Per §7.1, risk control options are applied in priority order:

  1. Inherent safety by design — eliminate the hazard.
  2. Protective measures in the medical device or manufacturing process — guards, alarms.
  3. Information for safety — labels, warnings, IFU, training.

The non-device disclaimer in 91-non-device-disclaimer.md is a §7.1(c) information-for-safety control. Account-gated access (planned in Epic E3) is a §7.1(b) protective measure. Refusal to compute on contraindicated images (e.g. paediatric DOB block) would be §7.1(a) — inherent safety.

6. Hazard register — seed (eight EPPA-specific hazards)

Each hazard below follows the structure of ISO 14971 §5.4: hazardous situation → sequence of events → harm. Severity × Probability is assessed twice — initial (without controls) and residual (with controls). Controls are categorised per the §7.1 hierarchy.

H1 — Wrong marker placement leading to wrong assessment

Field Content
Hazard Software-supported manual placement of anatomical markers in the wrong location on the image.
Cause Clinician error; misleading UI affordance; insufficient training; low-contrast image.
Sequence of events Clinician opens analysis page → places markers on incorrect landmark → analysis kernel computes geometry from wrong markers → output displayed as "alignment offset 4.2°" with no anomaly flag → clinician acts on output.
Harm Inappropriate corrective intervention based on incorrect geometric metrics. Could lead to musculoskeletal discomfort if applied to therapy.
Severity (initial) S3
Probability (initial) P3
Initial risk Medium
Controls (a) Inherent: snap-to-edge / visual landmarks overlay (planned). (b) Protective: confidence flag if marker disagrees with reference position; mandatory dual-rater confirmation in research deployments. (c) Information: User Manual marker-placement guide; mandatory training (5 supervised cases per 01-intended-use-statement.md §7); annual re-credentialing.
Severity (residual) S3
Probability (residual) P2
Residual risk Low

H2 — Image quality too low to support reliable analysis

Field Content
Hazard Blurred, occluded, mis-framed or non-orthogonally captured image is nevertheless processed and yields apparently confident output.
Cause Inadequate lighting; subject motion; clinician error in camera positioning; smartphone lens with high distortion.
Sequence of events Clinician captures image → uploads without quality check → backend processes → returns numeric values within "normal" appearance ranges → clinician acts.
Harm Same as H1 — inappropriate intervention based on degraded measurements.
Severity (initial) S3
Probability (initial) P4
Initial risk High
Controls (a) Inherent: image-quality preflight check (blur detection via Laplacian variance, exposure histogram, landmark visibility heuristic) — planned. (b) Protective: capture-page guidance overlay (head position, foot placement, distance) with go/no-go signal. (c) Information: User Manual section on capture conditions; contraindication C9 in 01-intended-use-statement.md.
Severity (residual) S3
Probability (residual) P2
Residual risk Low

H3 — API timeout or backend failure during analysis

Field Content
Hazard FastAPI backend times out or returns an error mid-analysis; client falls back to partial or stale data.
Cause Backend crash; network partition; long-running OpenCV operation; resource exhaustion.
Sequence of events Clinician submits image → backend runs out of memory → returns 500 → client displays previous session's cached numbers due to a bug → clinician interprets as new result.
Harm Decision based on wrong patient's data (a confounded case of H1).
Severity (initial) S4
Probability (initial) P2
Initial risk Medium
Controls (a) Inherent: idempotency keys per upload; per-session UUID stamped on every API response and verified client-side before rendering. (b) Protective: timeout banners; explicit "no data" state never falls back to cache without UI signal. (c) Information: User Manual + on-screen error wording.
Severity (residual) S4
Probability (residual) P1
Residual risk Low

H4 — User training gap (untrained user takes outputs at face value)

Field Content
Hazard A user without the training programme in 01-intended-use-statement.md §7 operates EPPA.
Cause Account sharing; informal trial; deployment outside the credentialing programme; intern operating under no supervision.
Sequence of events Untrained user runs EPPA → places markers without understanding landmark convention → reads qualitative classification ("right deviation") as a diagnosis → recommends action to patient.
Harm Mis-information given to patient; psychological harm; possible loss of confidence in legitimate clinical advice.
Severity (initial) S3
Probability (initial) P3
Initial risk Medium
Controls (a) Inherent: role-gated accounts (Epic E3); credentialing register check at login. (b) Protective: persistent non-device disclaimer ribbon (see 91-non-device-disclaimer.md) on every authenticated page. (c) Information: User Manual; intended use; non-device disclaimer; mandatory training.
Severity (residual) S3
Probability (residual) P2
Residual risk Low

H5 — Mis-calibration of cm/px ratio

Field Content
Hazard The image-natural cm-per-pixel scaling factor is computed from a reference object (e.g. a known-length marker pole) whose dimension has been mis-entered or whose appearance in the image has been mis-detected.
Cause Clinician enters wrong reference length; reference object partially occluded; lens distortion not corrected; subject closer/further than reference.
Sequence of events Clinician enters reference length 1.80 m instead of 1.78 m → analysis uses wrong scale → all linear metrics off by 1.1 % → clinical conclusion drawn that depends on absolute centimetres.
Harm Mild misallocation of clinical attention.
Severity (initial) S2
Probability (initial) P4
Initial risk Medium
Controls (a) Inherent: prefer dimensionless ratios (angle, ratio of segments) over absolute centimetres in clinical reasoning; only render absolute metrics when scale is explicitly verified. (b) Protective: scale-verification page; out-of-range warning if subject height implied by scale is outside [1.40 m, 2.10 m]. (c) Information: User Manual on reference-object handling.
Severity (residual) S2
Probability (residual) P2
Residual risk Low

H6 — Patient mis-identification across sessions

Field Content
Hazard A capture session is filed under the wrong patient's UUID; cross-session comparison contaminates Patient A's record with Patient B's data.
Cause Stale sessionStorage patient context; concurrent multi-tab use; clinician selects wrong patient from a list.
Sequence of events Clinician finishes patient A → opens a new tab for patient B without clearing context → uploads B's image under A's UUID → A's longitudinal track now includes B's data → future analysis for A is misleading.
Harm Same as H1, amplified by historical contamination of the record.
Severity (initial) S3
Probability (initial) P3
Initial risk Medium
Controls (a) Inherent: session-bound patient context, server-side enforcement (Epic E3); hard-clear sessionStorage on logout; patient context indicator persistently in the header with patient name + DOB. (b) Protective: face-match heuristic flags inconsistency between current image and prior session. (c) Information: User Manual on patient-context discipline.
Severity (residual) S3
Probability (residual) P2
Residual risk Low

H7 — Left/right confusion in lateral views

Field Content
Hazard The lateral-left view is filed (or interpreted) as lateral-right or vice versa, leading to mirrored interpretation of asymmetry.
Cause Capture order error; ambiguous camera position; image mirrored in software; data-entry error.
Sequence of events Clinician captures left-lateral but labels right-lateral → analysis attributes left-side findings to the right side → clinical reasoning mis-applied.
Harm Same as H1, with the additional risk of side-specific intervention being applied to the wrong side.
Severity (initial) S3
Probability (initial) P3
Initial risk Medium
Controls (a) Inherent: side marker requested in capture (e.g. clinician taps a hand on the side facing the camera; image checked for the marker). (b) Protective: side-flip prevention — frontend forbids EXIF mirroring; warn if landmark configuration is "improbable" for the labelled side. (c) Information: User Manual on lateral-capture protocol; on-screen labelling check.
Severity (residual) S3
Probability (residual) P2
Residual risk Low

H8 — AI-estimated markers accepted without clinician review

Field Content
Hazard If/when EPPA adds an ML/AI auto-marker proposal (roadmap), the clinician accepts the proposal without independent verification, propagating model errors.
Cause Automation bias; time pressure; degraded clinician attention; default UI behaviour ("Accept all" button).
Sequence of events AI proposes markers → clinician clicks "Accept all" → markers are systematically off in a confidently-presented way → analysis based on AI markers → clinician acts.
Harm Same as H1, with the additional risk of systemic bias (the same error repeated across many patients).
Severity (initial) S3
Probability (initial) P3
Initial risk Medium
Controls (a) Inherent: no global "Accept all" button — clinician must individually confirm each marker; per-marker confidence score; mandatory review delay (no immediate-accept on first analysis of a patient). (b) Protective: independent dual-rater workflow in research deployments; AI-vs-human discrepancy metric tracked in QA dashboard. (c) Information: User Manual section on AI assistance limitations; non-claim that AI markers are not a substitute for clinical judgement.
Severity (residual) S3
Probability (residual) P2
Residual risk Low

7. Risk control verification (ISO 14971 §7.2)

Each control identified in §6 must be verified to be implemented and effective. Verification methods:

Control type Verification
Inherent (design) Unit + integration test that fails closed without the control.
Protective E2E test that the protective UI / server check fires under the trigger condition.
Information Inspection of the IFU, User Manual and on-screen disclaimer text against the wording in 91-non-device-disclaimer.md.

A trace matrix linking hazards → controls → verifying tests is maintained in the V&V plan (see 11-iec-62304-lifecycle.md §8).

8. Overall residual risk evaluation (ISO 14971 §8)

After application of the controls in §6, all hazards reduce to Low. No hazards remain in Medium, High or Unacceptable on a per-hazard basis.

Cumulative residual risk — the aggregate over all hazards — must be evaluated against the overall benefit. EPPA's benefit (objective, reproducible postural documentation that supports clinical decision-making within a controlled research protocol) is judged to outweigh the cumulative residual risk, on the explicit precondition that the controls in §6 are operationally in place. If any control is removed or weakened, the cumulative assessment must be re-performed.

9. Production and post-production activities (ISO 14971 §10)

Post-market surveillance per EU MDR Art. 83 to 86 must feed back into this risk file:

Source Cadence Action
User complaints Continuous Triage; if safety-relevant, create change request and re-evaluate hazard.
Incident reports (Art. 87) On occurrence Mandatory notification to competent authority within 15 days (10 days for serious incidents); risk file updated.
Periodic safety review Annual Review hazard register, severity and probability against field data.
New literature / state of the art Annual Re-evaluate AFAP determination per ISO 14971:2019 §3.

10. Open questions for the regulatory and clinical leads

  1. Confirm severity / probability scales. Top management sign-off required before §6 is final.
  2. Confirm hazard completeness. This is a seed of 8 hazards; clinical workshops are required to extend it. Targets ≥ 25 distinct hazards in v1 of the file.
  3. Confirm dual-rater requirement in research deployments. This is a strong protective control; verify acceptability with clinical lead.
  4. Confirm post-market data sources. Specifically, complaint intake channel and definition of "incident" for EPPA.
  5. Confirm benefit-risk methodology. ISO 14971 Annex C and Annex E may be applied; choose one and document.

References