Curriculum
Information security, LIS downtime, backup and data protection [L-10]
Start here
0/1
Course pre-test
0/1
Part I — Laboratory information system requirements
0/2
Part II — Data integrity and security
0/2
Part III — LIS downtime procedures
0/2
Part IV — Backup, recovery, and data retention
0/2
Course post-test
0/1
Resources
0/4
Capstone & certificate
0/3
Text lesson
Chapter 1 · Laboratory information system requirements
The LIS must be validated before use and after any significant update. Validation confirms the system correctly receives, processes, stores, and transmits data. The LIS must have access controls — each user must have a unique login with access only to functions required for their role. Audit trails must be enabled so any change to a result can be traced. The LIS must not be the sole repository for quality records.
Chapter 1 · Practical example
LIS requirements — what ISO 15189 actually mandates
ISO 15189:2022 sets specific requirements for the laboratory information system — access control, audit trail, validation, and result integrity. These are not IT preferences.
▲ The situation
A laboratory is implementing a new LIS. The IT department has configured a single shared login for all scientists: username LABSTAFF, password shared by email. The installation is complete and goes live next week.
Reference: ISO 15189:2022 Clause 7.8.6
|
✓
Good practice The quality manager identifies this as a nonconformity before go-live: ISO 15189 requires individual user identification so that the audit trail — who entered, authorised, or amended every result — is attributable to a named individual. Individual accounts with role-appropriate permissions are created. The shared account is disabled. Go-live is delayed by three days.
|
✗
Poor practice The shared login goes live. Six months later, a result is found to have been amended after release with no explanation. Investigation cannot proceed — the audit trail shows LABSTAFF for every action on that patient’s record. A patient safety event cannot be fully investigated because individual accountability is impossible to establish.
|
● What this means for your practice
Individual user accounts are not an IT preference — they are a quality requirement. Every action in the LIS must be attributable to a named individual. Shared logins make quality investigations impossible and are a direct nonconformity under ISO 15189:2022.