Clinical safety
Intended use, clinical safety officer, hazard analysis, safety case, release controls, training, incidents and benefit-risk monitoring.
Security, privacy and assurance
Build confidence with evidence, not broad claims.
This framework sets out the artefacts a provider should be able to inspect before Healing Process processes identifiable health images in a live pathway.
Current package status: this is an implementation specification and policy suite. It does not certify the production product. Controls must be implemented, independently tested where appropriate and evidenced in the procurement data room.
Assurance domains
One evidence index across the lifecycle
Data protection
Data map, purpose and minimisation, lawful conditions, DPIA, transparency, processor terms, retention and rights handling.
Cyber security
Secure development, architecture, encryption, secrets, access, logging, testing, vulnerability response, continuity and supplier assurance.
Technical
Availability, performance, capacity, compatibility, integration, observability, data quality, error handling and support.
Interoperability
Verified identifiers, terminology, APIs, structured export, authoritative record integration and reconciliation.
Usability and accessibility
User-centred design, WCAG 2.2 AA target, assistive-technology testing, accessible information and inclusive service pathways.
Data-flow principles
Health photographs need explicit controls
- Collect only for a stated episode and purpose. Avoid background access to the camera roll and unrelated metadata.
- Separate original, derivative and display data. Assign immutable identifiers and hashes to originals; label every transformation.
- Encrypt in transit and at rest. Manage keys, backups and support access under documented controls.
- Use least privilege. Separate patient, carer, clinician, administrator, support and auditor roles; review privileged access.
- Log meaningful events. Capture enrolment, consent, access, export, sharing, transformation, message, decision, deletion and configuration changes.
- Retain deliberately. Apply the provider’s approved retention schedule and legal holds; do not keep images “just in case”.
- Design for rights and correction. Do not overwrite clinical history; record correction and restrict or delete only under the applicable legal and records framework.
Security control set
Minimum production evidence
| Control area | Expected implementation | Evidence |
|---|---|---|
| Identity | Strong authentication, verified enrolment, session controls, recovery and appropriate multi-factor authentication. | Identity design, threat model, test results and access-review records. |
| Authorisation | Role- and tenant-based access, least privilege, separation of duties and emergency-access governance. | Permission matrix, automated tests, privileged-access logs. |
| Application security | Secure coding, peer review, dependency control, SAST/DAST, secrets scanning and release approval. | SDLC standard, scan reports, remediation records and software bill of materials. |
| Infrastructure | Hardened environments, network segmentation, managed configuration, patching and monitored cloud controls. | Architecture, configuration baseline, CSP evidence and monitoring reports. |
| Detection and response | Centralised logs, alerting, triage, incident playbooks, breach assessment and provider notification. | SIEM coverage, exercise records, incident metrics and contact matrix. |
| Resilience | Backups, restore tests, redundancy, defined RTO/RPO, downtime workflow and continuity exercises. | BCP/DR plans, restore evidence and exercise actions. |
AI and image processing
Traceability and human oversight are product requirements
Provenance
Record source image identifier, model or algorithm version, processing parameters, result and timestamp.
Limitations
Test across skin tones, devices, lighting, body sites, wound types and accessibility needs; publish known failure modes.
Human control
Show originals by default, permit override, explain uncertainty and prevent automation from closing or downgrading a concern without authorised review.
Use the evidence gates before go-live
The readiness checklist assigns owners, required evidence and approval decisions across product and service deployment.