Exposure and the Population at Risk

A more straight-forward factor in evaluating a hazard is an estimation of the number of patients potentially exposed to a particular issue, in other words, the scale of the problem. The greater the exposure to a potential fault or design flaw makes it more likely that this wiU trigger a hazard and thus the risk is raised. 

Systems which are deployed nationally often contain the records of entire populations. Not only are databases large but the number of transactions each day may reach many thousands or even millions. In these goliath applications hazards which are considered incredible for individual transactions may be triggered several times a day when that likelihood is multiplied by real-world volumes. At the other end of the scale, small departmental clinical systems may only contain the records of a few hundred patients perhaps with a few dozen transactions per day. Whilst this somewhat over-simplified contributor to risk evaluation takes no account of the potential clinical impact of those systems, it still provides a starting point for establishing a high-level assessment. 

Examination of the population at risk can also be applied at a more granular level. The functions of a system are not typically used (or at least relied upon) to the same extent across the application. Indeed should one be inclined, it might be 

Whilst it is not inevitable that complex systems are associated with increased risk they almost always present new challenges both in their design and live operation. Where a complex system is also relied upon by healthcare professionals, a 

Where the potential impact of a hazard is clinically significant one might be required to overestimate the likelihood component of risk purely to accommodate the unknowns embedded within the complexity. System testing and defect resolution will of course go some way towards nutigating risk but again one is only able to test those scenarios which can be reasonably foreseen. In some cases one may need to rely on live service and operational experience to truly ascertain the risk associated with complex systans. This is one example where revisiting a risk evaluation over time incorporating lessons learned can pay dividends. 

---