Operation Outside of the Intended Purpose

In each of these circumstances a deliberately malicious act would need to take place before harm would occur. The question is whether this should be managed under the scope of CRM or by some other means of assurance This is a controversial topic and even safety standards differ in their views. As with IG, the message is similar - security of HIT systems is vital and represents a source of risk. Whether or not this is managed under the CRM framework or by some other means of assurance should be decided. 

Finally note that on occasion, security measures can have a more direct relationship with safety. This typically occurs when security is overly restrictive and prevents a user from gaining access to the information he/she genuinely requires. This is discussed further in Sect. 6.5.5. 

Where extension of use is conducted as part of a controlled roll out it should be subject to the usual change management procedures which will have been established in the in SMS. Essentially a set of safety activities will need to take place on the product to determine whether the new operating environment introduces any new hazards and the safety case updated accordingly. The analysis will need to be able to justify operating the system outside of the intended purpose and set out the evidence to support the claim that the risk remains acceptable. 

The scenario one wants to avoid of course is where a system s purpose is expanded in an uncontrolled manner, without the knowledge of the project and CRM team. Preventing this is largely down to governance, leadership and diligence of stakeholders involved in the implementation and education of users in the system s boundaries. 

---