Regulatory & quality awareness

ISO 15189 sets the quality and competence requirements of medical laboratories. In France, COFRAC assesses laboratories against it; accreditation of the whole activity is mandatory for medical biology laboratories.

What an assessor looks for, built into the workflow: internal quality control with Westgard rules and holds, corrective actions recorded, non-conformities at reception, traceability of every action in an append-only audit trail, versioned rules.

In France a medical biology examination covers the pre-analytical, analytical and post-analytical phases, under the responsibility of a medical biologist. Biological validation — interpreting the results in the patient's context and releasing them — is the biologist's act. Expert systems may propose auto-validation, under rules the biologist has defined and remains responsible for.

Technical validation by a technician, then biological validation and a signed release by a biologist only; auto-validation shown as a proposal with its rule trace; batch signing still checked and audited file by file; critical values called and documented before release.

The EU regulation on in vitro diagnostic medical devices. Software intended to provide information from in vitro examinations for a medical purpose can itself be a device; a LIS whose rule engine decides or proposes results (auto-validation, critical value detection) may fall in scope, depending on its intended purpose.

Why the rule engine is declarative, versioned and hashed, and why every decision keeps its inputs, rule id, version and rule set: the traceability a qualification would start from.

Orders and reports travel between the hospital (HIS) and the laboratory as HPRIM Santé / HPRIM Net in France or HL7 v2 ORM / ORU messages; analytes are coded with LOINC; analyzers talk to the LIS over ASTM E1381 / E1394 (CLSI LIS1-A / LIS2-A2).

Simulated analyzers on ASTM framing with checksums and acknowledgements, an HIS simulator exchanging HL7 v2 orders and results, LOINC codes on every result.

In France, hosting personal health data on behalf of others requires an HDS-certified host (certification based on ISO 27001 plus health-specific requirements).

Nothing to host: every patient, sample and result is synthetic, generated by a seeded script.

Health data are a special category of personal data under the GDPR (article 9): processing needs a specific legal basis, minimisation, security and traceability of access.

Access traced by actor in the audit trail; no external call at runtime (fonts and code served from the same origin); synthetic identities only.