Hospitals, clinics and medical device companies
A surveyor asks the facility for records that its contractors, its branches and its own departments each keep somewhere different.
For hospitals, CBAHI accreditation is tied to operating licence renewal, and clinics are surveyed under their own CBAHI programmes. Device companies answer to SFDA for an ISO 13485 system. In each case the non-clinical evidence is spread across contractors and departments. Six ITF divisions keep that evidence as one company, to one records standard.
The surveyor asks you, not your contractor
A hospital's generator load test log sits with the generator contractor. The night shift has no fire drill on record. A policy passed its review date while the obsolete copy stayed in a ward folder. A life-support certification lapsed during annual leave and surfaced when the survey team asked for the staff file. A clinic in a leased building finds its extinguisher records are held by the landlord's contractor. A device distributor holds a quality manual written for a factory, describing design work it does not do. Different buildings, one pattern: the evidence exists, somebody else keeps it, and the surveyor asks the facility.
- Fire, lift and power test records kept in each contractor's format and filed nowhere in yours
- Drills and fire training recorded for day shifts only
- Each branch editing its own copy of the policy manual until the copies disagree
- Professional licence and life-support expiries tracked by memory
- Lot numbers missing from a distributor's delivery notes, so a recall cannot reach the hospitals that received the lot
The divisions a healthcare site uses
We work the non-clinical side. Any clinical observation made on a walk goes to a referral list for your medical leadership.
Patient data, mapped
ITF Cyber, with ITF Health, maps where your patient data lives and who can reach it, writes the policies and agreements, and rehearses the breach response with you. You hold the data inventory, the access review and a breach response plan with its exercise record.
Read moreITF TrainingFire safety and first aid, per shift
ITF Training runs fire safety, including moving patients who cannot use stairs, and first aid with CPR and AED for the staff who reach an emergency first. Each person is assessed on the practical. You hold numbered ITF certificates of completion, valid one year, and a register split by shift.
Read moreITF FMBuilding services, recorded for the survey
ITF FM maintains water, air, fire and power in buildings that treat patients, and work in a clinical area starts after your infection control lead signs off. You hold a monthly record pack filed against your evidence index.
Read moreITF DigitalPolicy and credential registers
ITF Digital builds one policy register across your branches, with acknowledgements per revision, and a credential register that escalates to the department head before a licence lapses. You hold both registers and the survey index they feed.
Read moreITF HealthCBAHI readiness, or ISO 13485
ITF Health prepares the non-clinical evidence a CBAHI survey reads, against your survey date, or builds an ISO 13485 system sized to what your company does with devices. You hold a gap report and an evidence index, or a quality manual and a traceability register.
Read moreITF ConsultISO 9001 beside accreditation
ITF Consult scopes a quality system to the non-clinical and administrative processes, so its document control, internal audit and corrective action are the machinery the survey tests. You hold one controlled document set, an internal audit programme and a corrective action log.
Read moreWhat each kind of site is measured against
| Requirement | What it means on site |
|---|---|
| Hospitals | Surveyed against CBAHI's National Hospital Standards, third edition. For hospitals, accreditation is tied to renewal of the operating licence. |
| Clinics and polyclinics | Surveyed under CBAHI's separate programmes for primary healthcare centres, ambulatory medical centres and complexes, or dental centres. |
| Measurable elements | Each standard carries numbered measurable elements, assessed by document review, observation and staff interview. |
| Medical device companies | SFDA requires an ISO 13485 certificate of manufacturers, and of importers and distributors in establishment categories A and B. Categories C and D submit documented evidence of the system or obtain an SFDA inspection report. |
| Device storage and transport | Under MDS-REQ 12: instruments placed from mapping and calibrated, a separate labelled area for damaged, expired or recalled devices, traceability by lot, batch or serial number, and records kept at least three years. |
| Patient data | Health data is sensitive data under the Personal Data Protection Law, which SDAIA has enforced since 14 September 2024. |
What quality directors ask first
Which standards do you work on?
The non-clinical ones: facility management and safety, document control, quality records, staff files and information management. The measurable elements we treat as ours are listed in the gap report before work starts. Clinical observations go to a referral list addressed to the leader who owns them.
Our contractors keep the test records. Is that enough?
A contractor's record counts once it is in your file, current and consistent with your facility plan. We set up a monthly transfer from each contractor into your file, in one format. Where ITF FM maintains the system, its records arrive in that format already.
We distribute devices rather than make them. What do we need?
It depends on your SFDA establishment category: an ISO 13485 certificate in categories A and B, documented evidence of the system or an SFDA inspection report in C and D. Either way a distributor's system is smaller than a manufacturer's, and sharper on traceability, storage, complaints and reporting.
What does a typical engagement look like?
A polyclinic group in Khobar runs three branches from leased buildings, with a CBAHI survey coming and a quality team of two. The gap assessment finds extinguisher records held by the landlord's contractor, a fire training register for day staff only and three policy manuals that have drifted apart. ITF FM pulls the landlord's reports into the clinic's file each month, ITF Training runs fire safety for each shift at each branch, and ITF Digital builds one policy register. The group ends up holding the gap report, a clinical referral list for the medical director, the policy register with acknowledgements, a training register by branch and shift, and an evidence index.
Do you grant the accreditation or issue the ISO 13485 certificate?
No. CBAHI accredits after its own survey. ISO 13485 certificates come from conformity assessment bodies SFDA recognises, and you choose the body and approach it on your own schedule.
Part of one system
Every division keeps records to the same standard, so the second one you need works the way the first one did.
Send the survey date and the last report
The gap assessment is planned backwards from the date, and its report says what can be closed in the time. A device company sends what it does with devices and its SFDA category instead.