ISO 15189:2022 · Section 7 · Process requirements
Clause 7.6: Control of data and information management
Check the exact requirement in your licensed copy of the standard.
Last reviewed
What this clause is about
Laboratory information must remain accurate, accessible to authorized people and protected throughout its journey. This includes handwritten worksheets, instrument files, middleware, the laboratory information system, spreadsheets and reports sent to clinical services. Start by mapping where patient identifiers, requests, results and amendments enter, move through and leave each system. Name the people responsible for technical support, clinical authorization and information governance so that problems do not fall between departments.
Before introducing a system or changing an important function, demonstrate that it works for its intended laboratory use. Test realistic scenarios such as duplicate identifiers, units, reference intervals, critical flags, calculated results and corrected reports. Check interfaces at both ends: a successful transmission message does not prove that the receiving screen displays the correct result. Keep the test expectations, actual outcomes, approval and unresolved limitations together. Assess supplier changes before routine use rather than assuming an update cannot affect reporting.
Access should reflect current duties, with individual accounts where appropriate and prompt changes when roles change. Protect information against unauthorized alteration or disclosure, and establish practical recovery arrangements. A backup is useful only when staff can restore the necessary information within an acceptable period. Include paper workarounds and reconciliation after downtime in staff training.
Review incidents, access changes and system performance alongside laboratory risks. When external organizations host or support systems, agree responsibilities for security, availability, change notification and recovery. LabToolkit Pro can support controlled procedures, forms and approval records, but each laboratory remains responsible for validating its own information workflows and confirming that connected systems preserve patient information.
What assessors typically ask to see
- Can staff trace one result from instrument output through interfaces to the final clinical display, including units and patient identity?
- Who approves information-system changes, and what evidence establishes that affected reporting functions remain suitable before release?
- How are user permissions assigned, reviewed and removed when someone leaves or changes laboratory responsibilities?
- What happens when the main system is unavailable, and how are temporary records reconciled without losing or duplicating results?
- How does the laboratory oversee externally managed systems while retaining responsibility for the integrity of its information?
Documents and records that usually provide evidence
- Information-management procedure identifying system owners, support contacts and responsibilities across the complete reporting pathway.
- Validation records with approved scenarios, expected outcomes, actual results and authorization for intended laboratory use.
- Interface verification records covering identifiers, units, flags, calculations, reference intervals and amended result transmission.
- Access register documenting role permissions, periodic reviews and timely removal of accounts no longer required.
- Backup restoration exercise records showing what was recovered, elapsed time and any corrective follow-up.
- Downtime worksheets and reconciliation logs connecting temporary identifiers with the permanent patient result record.
Ready-made forms mapped to clause 7.6: LIMS Verification Plan, LIMS Verification Report.
Common findings to avoid
- Treating supplier installation checks as complete evidence that local clinical reporting workflows function correctly.
- Sharing privileged accounts so that changes cannot be reliably attributed to an individual authorized user.
- Keeping backup success messages without demonstrating that essential laboratory information can actually be restored.
- Changing reference intervals or calculation rules without checking interfaces, reports and downstream clinical displays.
How LabToolkit Pro maps documents to this clause
Each SOP, form and record in LabToolkit Pro can carry clause tags. When a document tagged 7.6 becomes effective, it counts as direct evidence on the readiness dashboard for ISO 15189:2022; links from other standards through the crosswalk are shown separately as indicative coverage. Gaps appear clause by clause, so you can see which parts of 7.6 still need a controlled document or a current record. Readiness is a planning aid — only an accreditation body confirms conformity.
Frequently asked questions
Do laboratory spreadsheets need checks?
Yes, when they affect laboratory work. Check formulas, protected cells, inputs, rounding and output interpretation against known examples. Control the approved version and reassess changes according to their potential effect on patient results.
Does outsourcing hosting transfer responsibility?
No. The laboratory still needs assurance that its information requirements are met. Define provider obligations and escalation routes, obtain suitable evidence and test the laboratory actions needed during interruptions or recovery.
How extensive should change testing be?
Match testing to the functions affected and the possible clinical consequences. Document the reasoning, include relevant end-to-end scenarios and approve release only after significant defects are resolved or safely controlled.
Check the exact requirement in your licensed copy of the standard.
Put it into practice
Draft, approve and e-sign your SOPs with version control, or get the complete template pack.