Consumer Mobile Health Application Functional Framework, Release 2
2.0.1 - CI build
Consumer Mobile Health Application Functional Framework, Release 2
2.0.1 - CI build
Consumer Mobile Health Application Functional Framework, Release 2, published by HL7 International / Mobile Health. This guide is not an authorized publication; it is the continuous build for version 2.0.1 built by the FHIR (HL7® FHIR® Standard) CI Build. This version is based on the current content of https://github.com/HL7/cmhaff-ig/ and changes regularly. See the Directory of published versions
| Page standards status: Informative |
<Requirements xmlns="http://hl7.org/fhir">
<id value="CMHAFFR2-PDS.2"/>
<meta>
<profile
value="http://hl7.org/fhir/uv/cmhaffr2/StructureDefinition/FMHeader"/>
</meta>
<text>
<status value="extensions"/>
<div xmlns="http://www.w3.org/1999/xhtml">
<span id="description"><b>Statement <a href="https://hl7.org/fhir/versions.html#std-process" title="Normative Content" class="normative-flag">N</a>:</b> <div><p>This category deals with process steps for risk assessment and mitigation for those
who are developing a new app, or an upgrade to an app, prior to its being deployed to
Consumers.</p>
</div></span>
<span id="purpose"><b>Description <a href="https://hl7.org/fhir/versions.html#std-process" title="Informative Content" class="informative-flag">I</a>:</b> <div><p>Degrees of risk should be assessed and mitigated according to the intended use
of the app. In general, risk management should manage security, privacy, safety, and other
types of risks such as potential app failure scenarios, events that could lead to undesirable
outcomes, probability and severity of risk, and mitigations or resolutions. One size does not fit
all. For example, if apps handle sensitive personal information or give health interpretation or
advice, higher degrees of risk are involved than for apps that do not collect personal information or do not interpret or advise. If some information identified during this step should be disclosed
to consumers, that is stated in the “Informing Consumers/Users” section</p>
</div></span>
<span id="requirements"><b>Criteria <a href="https://hl7.org/fhir/versions.html#std-process" title="Normative Content" class="normative-flag">N</a>:</b></span>
<table id="statements" class="grid dict">
<tr>
<td style="padding-left: 4px;">
<span>PDS.2#01</span>
</td>
<td style="padding-left: 4px;">
<span>SHALL</span>
</td>
<td style="padding-left: 4px;" class="requirement">
<span><div><p>The App SHALL conform to a product risk assessment and mitigation plan as outlined by the developer. This plan should explicitly determine what risk must be addressed through software coding, hardware adaptions, policy, and what residual risk will be accepted by the entity responsible for the app. The developer will need to maintain, review, and update organizational Risk Register to include risks associated with mobile application.</p>
</div></span>
</td>
</tr>
<tr>
<td style="padding-left: 4px;">
<span>PDS.2#02</span>
</td>
<td style="padding-left: 4px;">
<span>SHALL</span>
</td>
<td style="padding-left: 4px;" class="requirement">
<span><div><p>In development of the App, the developer SHALL follow secure coding and practices using an established risk assessment framework.</p>
</div></span>
</td>
</tr>
<tr>
<td style="padding-left: 4px;">
<span>PDS.2#03</span>
</td>
<td style="padding-left: 4px;">
<i>conditional</i>
<span>SHALL</span>
</td>
<td style="padding-left: 4px;" class="requirement">
<span><div><p>IF personally Identifiable Information is collected THEN in development the App SHALL be guided by risk assessment findings in terms of their potential effect on adequately securing an individual's personally identifiable information (PII) including any protected health information (PHI), and also information used to access an EHR/PHR (e.g., logon credentials).</p>
</div></span>
</td>
</tr>
<tr>
<td style="padding-left: 4px;">
<span>PDS.2#04</span>
</td>
<td style="padding-left: 4px;">
<i>conditional</i>
<span>SHALL</span>
</td>
<td style="padding-left: 4px;" class="requirement">
<span><div><p>IF the App transmits data to an EHR THEN the App SHALL document failure rates, measurement error rates, software bugs, and hardware risks of all types.</p>
</div></span>
</td>
</tr>
<tr>
<td style="padding-left: 4px;">
<span>PDS.2#05</span>
</td>
<td style="padding-left: 4px;">
<span>SHOULD</span>
</td>
<td style="padding-left: 4px;" class="requirement">
<span><div><p>Prior to product launch, the App SHOULD be approved in accordance with User Acceptance Testing (UAT) by testers who are not part of the formal development team.</p>
</div></span>
</td>
</tr>
<tr>
<td style="padding-left: 4px;">
<span>PDS.2#06</span>
</td>
<td style="padding-left: 4px;">
<span>SHOULD</span>
</td>
<td style="padding-left: 4px;" class="requirement">
<span><div><p>The App SHOULD be monitored and include documentation of conflicts or compatibility issues of the app with other apps, device features (e.g., camera), or connected devices.</p>
</div></span>
</td>
</tr>
<tr>
<td style="padding-left: 4px;">
<span>PDS.2#07</span>
</td>
<td style="padding-left: 4px;">
<i>conditional</i>
<span>SHOULD</span>
</td>
<td style="padding-left: 4px;" class="requirement">
<span><div><p>IF the App relies on external supporting infrastructure, (e.g., cloud-based servers) to operate, THEN the App SHOULD document measures to ensure the availability of that infrastructure.</p>
</div></span>
</td>
</tr>
<tr>
<td style="padding-left: 4px;">
<span>PDS.2#08</span>
</td>
<td style="padding-left: 4px;">
<span>MAY</span>
</td>
<td style="padding-left: 4px;" class="requirement">
<span><div><p>The App MAY provide documentation to show that the app publisher has adequate resources to continue to develop, maintain, and support the product (e.g., human resources, finances, IP rights, facilities, equipment, tools).</p>
</div></span>
</td>
</tr>
</table>
</div>
</text>
<extension
url="http://hl7.org/fhir/StructureDefinition/structuredefinition-wg">
<valueCode value="mobile"/>
</extension>
<url value="http://hl7.org/fhir/uv/cmhaffr2/Requirements/CMHAFFR2-PDS.2"/>
<version value="2.0.1"/>
<name value="PDS_2_Product_Risk_Assessment_and_Mitigation"/>
<title value="PDS.2 Product Risk Assessment and Mitigation (Header)"/>
<status value="active"/>
<date value="2025-05-28T08:01:49+00:00"/>
<publisher value="HL7 International / Mobile Health"/>
<contact>
<telecom>
<system value="url"/>
<value value="http://www.hl7.org/Special/committees/mobile"/>
</telecom>
</contact>
<description
value="This category deals with process steps for risk assessment and mitigation for those
who are developing a new app, or an upgrade to an app, prior to its being deployed to
Consumers."/>
<jurisdiction>
<coding>
<system value="http://unstats.un.org/unsd/methods/m49/m49.htm"/>
<code value="001"/>
<display value="World"/>
</coding>
</jurisdiction>
<purpose
value="Degrees of risk should be assessed and mitigated according to the intended use
of the app. In general, risk management should manage security, privacy, safety, and other
types of risks such as potential app failure scenarios, events that could lead to undesirable
outcomes, probability and severity of risk, and mitigations or resolutions. One size does not fit
all. For example, if apps handle sensitive personal information or give health interpretation or
advice, higher degrees of risk are involved than for apps that do not collect personal information or do not interpret or advise. If some information identified during this step should be disclosed
to consumers, that is stated in the “Informing Consumers/Users” section"/>
<statement>
<extension
url="http://hl7.org/fhir/uv/cmhaffr2/StructureDefinition/requirements-dependent">
<valueBoolean value="false"/>
</extension>
<key value="CMHAFFR2-PDS.2-01"/>
<label value="PDS.2#01"/>
<conformance value="SHALL"/>
<conditionality value="false"/>
<requirement
value="The App SHALL conform to a product risk assessment and mitigation plan as outlined by the developer. This plan should explicitly determine what risk must be addressed through software coding, hardware adaptions, policy, and what residual risk will be accepted by the entity responsible for the app. The developer will need to maintain, review, and update organizational Risk Register to include risks associated with mobile application."/>
</statement>
<statement>
<extension
url="http://hl7.org/fhir/uv/cmhaffr2/StructureDefinition/requirements-dependent">
<valueBoolean value="false"/>
</extension>
<key value="CMHAFFR2-PDS.2-02"/>
<label value="PDS.2#02"/>
<conformance value="SHALL"/>
<conditionality value="false"/>
<requirement
value="In development of the App, the developer SHALL follow secure coding and practices using an established risk assessment framework."/>
</statement>
<statement>
<extension
url="http://hl7.org/fhir/uv/cmhaffr2/StructureDefinition/requirements-dependent">
<valueBoolean value="false"/>
</extension>
<key value="CMHAFFR2-PDS.2-03"/>
<label value="PDS.2#03"/>
<conformance value="SHALL"/>
<conditionality value="true"/>
<requirement
value="IF personally Identifiable Information is collected THEN in development the App SHALL be guided by risk assessment findings in terms of their potential effect on adequately securing an individual's personally identifiable information (PII) including any protected health information (PHI), and also information used to access an EHR/PHR (e.g., logon credentials)."/>
</statement>
<statement>
<extension
url="http://hl7.org/fhir/uv/cmhaffr2/StructureDefinition/requirements-dependent">
<valueBoolean value="false"/>
</extension>
<key value="CMHAFFR2-PDS.2-04"/>
<label value="PDS.2#04"/>
<conformance value="SHALL"/>
<conditionality value="true"/>
<requirement
value="IF the App transmits data to an EHR THEN the App SHALL document failure rates, measurement error rates, software bugs, and hardware risks of all types."/>
</statement>
<statement>
<extension
url="http://hl7.org/fhir/uv/cmhaffr2/StructureDefinition/requirements-dependent">
<valueBoolean value="false"/>
</extension>
<key value="CMHAFFR2-PDS.2-05"/>
<label value="PDS.2#05"/>
<conformance value="SHOULD"/>
<conditionality value="false"/>
<requirement
value="Prior to product launch, the App SHOULD be approved in accordance with User Acceptance Testing (UAT) by testers who are not part of the formal development team."/>
</statement>
<statement>
<extension
url="http://hl7.org/fhir/uv/cmhaffr2/StructureDefinition/requirements-dependent">
<valueBoolean value="false"/>
</extension>
<key value="CMHAFFR2-PDS.2-06"/>
<label value="PDS.2#06"/>
<conformance value="SHOULD"/>
<conditionality value="false"/>
<requirement
value="The App SHOULD be monitored and include documentation of conflicts or compatibility issues of the app with other apps, device features (e.g., camera), or connected devices."/>
</statement>
<statement>
<extension
url="http://hl7.org/fhir/uv/cmhaffr2/StructureDefinition/requirements-dependent">
<valueBoolean value="false"/>
</extension>
<key value="CMHAFFR2-PDS.2-07"/>
<label value="PDS.2#07"/>
<conformance value="SHOULD"/>
<conditionality value="true"/>
<requirement
value="IF the App relies on external supporting infrastructure, (e.g., cloud-based servers) to operate, THEN the App SHOULD document measures to ensure the availability of that infrastructure."/>
</statement>
<statement>
<extension
url="http://hl7.org/fhir/uv/cmhaffr2/StructureDefinition/requirements-dependent">
<valueBoolean value="false"/>
</extension>
<key value="CMHAFFR2-PDS.2-08"/>
<label value="PDS.2#08"/>
<conformance value="MAY"/>
<conditionality value="false"/>
<requirement
value="The App MAY provide documentation to show that the app publisher has adequate resources to continue to develop, maintain, and support the product (e.g., human resources, finances, IP rights, facilities, equipment, tools)."/>
</statement>
</Requirements>
IG © 2025 HL7 International / Mobile Health. Package hl7.fhir.uv.cmhaffr2#2.0.1 based on FHIR 5.0.0. Generated 2025-05-28
Links: Table of Contents |
QA Report
| Version History |
|
Propose a change