Method
How a Lenticula safety case is made.
Six steps in a workspace built for them. The instrument we use inside it proposes and, where the officer asks it to, drafts. Every rating and every disposition is a clinician’s decision, and the record shows what the instrument drafted, what the clinician changed, and who signed.
From your documentation we produce a structured description of the product: what it does, for whom, in which workflow, with which data and integrations, and any AI component with its model documentation. You confirm it before anything else happens.
For each function, hazards are proposed through three lenses: a library of hazards seen in comparable systems, seeded from NHS England’s own generic hazard log; a fixed set of questions about what happens when information is wrong, missing, late, attributed to the wrong patient, unavailable, misread, or acted on without the check the workflow assumes; and, for AI features, the hazards particular to them, hallucination, drift, bias, explainability, automation bias and data provenance. Every proposal cites the passage of your documentation it came from.
Proposals are generated twice by independent means, and disagreements are shown, not hidden.
Proposals are grouped into hazards, one harm to one person, with the failures that lead to it listed as its causes across every function. A clinician confirms, splits or merges every group before it becomes a line in the log.
A clinician sets severity and likelihood for every hazard with a written justification, states the controls and the evidence that each is in place, and records the residual risk. The instrument may draft a disposition; the clinician adopts or amends every field, and the log records which.
The safety case report is generated from the disposed log on NHS England’s template, reviewed by the officer, and signed. Every later change is a recorded difference, and release reviews are triggered by what changed, not by a model’s opinion.
Confidentiality
Your documentation is never used to train anything. It is stored encrypted in London, and the analysis runs through two model providers under commercial terms that exclude its use for training, each of which deletes what it receives within thirty days. We delete an enquiry that does not become an engagement ninety days after our reply. The privacy notice names every processor. The results of our own validation of the method are published as they accrue.
What the standards require
DCB0129 applies to the manufacturer of a health IT system and DCB0160 to the organisation that deploys it. Both are mandated under section 250 of the Health and Social Care Act 2012, and both require a Clinical Safety Officer who is a registered clinician trained in clinical risk management, a hazard log, and a clinical safety case report signed by that officer. Deploying organisations can ask a supplier for its DCB0129 documentation and should be given it. The standards are under national review, with artificial intelligence within scope.