Hazard vs hazardous situation vs harm: the three terms in a Hazard Analysis

These three words are often used as if they meant the same thing. Under ISO 14971, the International Organization for Standardization standard for applying risk management to medical devices, they mean three different things, and a Hazard Analysis row carries a separate column for each. Telling them apart is what shows you which part of the chain you can actually change.

Written for regulatory and quality engineers at medical device companies.

The three terms, one line each

• Hazard. A potential source of harm. Electrical energy is a hazard. It is a property of the device or its use, and it exists whether or not anyone is ever hurt.
• Hazardous situation. A circumstance in which a person is exposed to that hazard. An exposed conductor during defibrillation is a hazardous situation.
• Harm. The injury or damage itself. An electrical burn is a harm. So is an equipment fire, because harm covers damage to property as well as injury to a person.

The difference between a hazard and a hazardous situation is exposure. A hazard by itself has hurt nobody. It becomes a hazardous situation the moment a patient, a user, or a piece of property is standing in front of it. The difference between a hazardous situation and a harm is whether the injury actually happened.

Walking the chain on a real row

The row below is row HZ-0046 from a completed run on a coronary stent fixture, the same run the sample workbook excerpt on the home page is drawn from. Read it top to bottom and the three terms separate themselves.

Hazard

Potential or stored energy, specifically compression.

Foreseeable sequence of events

1. Neointimal hyperplasia develops within the stented segment over weeks to months. 2. Neointimal tissue compresses the stent lumen, progressively reducing coronary blood flow.

Hazardous situation

Patient coronary artery lumen progressively narrowed by neointimal tissue growth within the stented segment.

Harm

Myocardial ischemia.

That row is scored Severity 4, with a probability of harm occurrence of 3, which reads High on the four level table. Nothing along that path is multiplied.

Notice that no entry repeats another. The hazard names the energy. The sequence says how the patient came to meet it. The hazardous situation is the patient standing in front of it. The harm is what the patient suffers.

Why the difference decides what you can control

You cannot remove stored energy from a stent. Radial force against the vessel wall is what the device is for. The hazard stays for the life of the product.

What you can change is the sequence of events. A Risk Control Measure is a requirement, an implementation, and a verification that reduces the probability of occurrence, the severity, or both. P1 is the chance the hazardous situation arises at all. Interrupt or slow a step in the sequence and P1 falls.

That change then travels through the math. P1 and P2, the chance that the situation leads to harm once it exists, give Po by reading a fixed table. Severity and Po give the Risk Level by reading a second fixed table. There are four levels: Low, Medium, High, and Unacceptable.

It does not travel without limit. In the table rmForge uses, a harm rated Severity 4 or 5 never lands in Low. Push the probability on that stent row down to the lowest band and it still reads Medium, so the row still calls for a risk control. That is what separating the terms buys you. Severity belongs to the harm, and it does not move when you make the situation rarer.

A row that folds all three into one sentence hides this. Write only that stent compression causes ischemia and there is no sequence left to attack, no place to attach a control, and nothing to verify. The patient is no safer for the row existing.

The sequence of events is the link

Hazard and hazardous situation are joined by a foreseeable sequence of events. rmForge writes it as one to four steps, running from an initiating cause to the hazardous situation, stopping before any harm occurs. The cause is one of design, hardware, software, process, packaging, labeling, or the user.

Those steps are where a row earns its place. If the sequence simply restates the harm, the middle of the chain is missing and there is nothing in the row a design change can act on.

Normal condition and fault condition

The same hazard can reach a person by two different routes, and they are scored separately. A normal condition is the device operating as designed, with no component failures. A fault condition is a single component failure or single fault state. ISO 14971 requires both to be evaluated.

rmForge keeps a strict separation between the two. Every row is one or the other, never both. The stent compression row above is a normal condition row. Nothing broke. Tissue grew, as tissue does. A device that is safe when everything works can still injure someone when one part fails, and that case gets a row of its own.

Where the three sit in the workbook

Each term has its own column among the 32 in a delivered row. General Hazard and Specific Hazard are columns B and C. The Foreseeable Sequence of Events is column E. Normal or Fault is column F. The Hazardous Situation is column H, and the Harm is column K.

There is also a Revised Harm column, X. After a risk control is applied, the residual risk can correspond to a different harm than the original, for example when a fail-safe reverts the device to a lower-energy mode. That column records the harm after the control. It starts as the row's own harm, for your team to change when a control changes it.

Read the rest of the method

This page covers three definitions and the chain that connects them. The full guide to a medical device Hazard Analysis covers where hazards are enumerated from, how severity and probability become a Risk Level, what a risk control has to become before it counts, and what a finished analysis contains.

Whatever rmForge produces is a draft. It requires qualified cross functional review and approval by your team, and rmForge does not determine regulatory compliance or guarantee that a submission is accepted.