A failed device can be examined only once. Every step that follows power-on, disassembly, or a cut changes what the next step can find. The joint inspection is the way to take those steps in the right order, with every party watching, so the evidence is made once and shared by all.
This guide explains what a joint inspection protocol contains, how the examination is staged from non-destructive to destructive, what must be decided before the day, how the day runs, and the decisions that cannot be undone.
Who this guide is for
- Legal counsel who must negotiate the protocol and know what to insist on.
- Manufacturers — complaint, service, and engineering teams who attend the inspection and often bring the only service tool.
- Hospitals — clinical engineering and risk management staff who hold the device and may host the examination.
This guide is general technical information. It is not legal advice. The protocol for a specific device is written for that device, and the parties' agreement governs.
01One device, one chance
An inspection protocol is a written, agreed sequence of steps. It exists because the parties do not agree on what happened, and because the examination will destroy some of the evidence of it. The protocol decides, in advance, what will be done, in what order, by whom, and how each step is recorded.
To establish the condition of the device and record it, before any step that changes it. Not to decide the cause. Analysis follows the inspection, from the record it made.
Everyone with an interest: the facility, the manufacturer, the patient's representatives, and any component supplier the failure may reach. Each sends an engineer who can follow the steps and object to one.
From the outside in: receipt, external examination, non-destructive tests, functional tests, disassembly, destructive examination. Each phase is complete and recorded before the next begins.
Agreed points at which the inspection pauses for every party to confirm the record and consent to the next phase. Any party may call an unscheduled stop. A dispute stops the work; it does not change the protocol on the day.
Photographs, measurements, downloads, and a written log, all time-stamped, all copied to every party before anyone leaves. The record is the product of the inspection.
Guides 01 and 07 cover the time before the inspection: preservation of the device and of its data. The protocol assumes both have been done, and begins by checking.
Each phase ends at a stop point. The order is not negotiable in principle, only in detail: nothing that changes the device is done before everything that does not has been recorded.
02Writing the protocol
A protocol is a technical document agreed by lawyers. It is written by the engineers who will carry it out, and it answers the questions below in order.
Scope and objectives
Which device, accessories, consumables, and packaging; what the inspection is to establish; what it is not. Exemplar devices and the documents to have at hand: service manual, drawings, the log specification.
Place, equipment, people
The facility and its conditions; every instrument with its calibration; every attendee with a role. One person handles the device; the others observe and record.
The steps
Each step with its method, its instrument, the record it produces, and the person who performs it. Written so a stranger could repeat it. Nothing on the day that is not in the list.
Stop points and disputes
Where the inspection pauses; who confirms the record; what happens when a party objects. The rule is simple: an objection stops the step, the objection is recorded, and the work resumes only on agreement or reconvenes later.
What is not permitted
Service tools beyond read-only use; cleaning; repair; software update; removal of media; any step not listed. Stated, so that it does not have to be argued on the day.
Custody and copies
Who takes custody of the device and of every part removed; how parts are labelled and stored; how photographs, downloads, and logs are hashed and distributed before the session ends.
03Before the day
The device, as it is
Confirm the preservation record (guide 01): where the device has been, who has touched it, whether it has been powered, cleaned, or serviced. If it was contaminated in use, the protocol decides whether and how it is decontaminated: cleaning removes evidence, and biological hazard is real.
Exemplars and references
An exemplar of the same model, software version, and configuration, for comparison and for any step too risky to try first on the evidence. The service manual, the drawings, and the log specification, so disassembly follows the designer's sequence.
Photography
A standard for every photograph: scale, serial or part label in frame, orientation stated, consistent lighting, a numbered sequence. Photographs are the record most relied on and most often inadequate.
The tools and who brings them
The manufacturer usually has the only service tool. The protocol names the tool, its version, the functions to be used, the functions excluded, and the observer who watches the screen.
A device returned to the manufacturer for "evaluation" before a protocol is agreed is examined once, by one party, under no protocol. The regulation requires the evaluation; it does not require that it happen alone.
04On the day
The protocol is followed as written. The log is kept as it happens, by someone whose only job is the log.
Roll call and custody
Attendees recorded with roles; the device received against its custody record; seals and packaging photographed before they are opened.
Inventory as received
Every item, serial, label, and accessory listed and photographed before anything is moved. Discrepancies against the preservation record noted now.
Narrate and record
Each step announced before it is taken, its result stated aloud, both written in the log with the time. Photographs numbered against the log entry.
One pair of hands
One person handles the device for each step. Others observe, photograph, and ask for a step to be repeated or recorded differently.
Stops
At each stop point all parties review the log and photographs and agree the next phase. An unscheduled stop is called by saying so; work pauses until the objection is recorded.
Parts, data, and closing
Every part removed is labelled, photographed, bagged, and listed with its custodian. Every file is hashed and copied to each party. Then a final inventory against the opening one, signatures on the log, and the device resealed into custody.
05What cannot be undone
Six decisions in an inspection change the device permanently. Each belongs in the protocol with its conditions, and none is taken on the day without the stop point before it.
Writes to the log, may run a self-test, may change state. Only after the external and non-destructive phases, with the log download planned (guide 07) and the screen recorded from the first frame.
Removes residues, deposits, and marks that show what the device was exposed to. Sampled and photographed first, or not done.
Breaks seals, tamper labels, and the evidence of whether the device was opened before. Each seal photographed intact, then broken on camera.
Sectioning, pulling, and chemical analysis consume the part. On the exemplar first where possible; on the evidence only by agreement, at the end.
Any adjustment, replacement, or update, including by the manufacturer under a complaint investigation. Not part of an inspection; if it must happen, it happens after the record is complete.
Sending the device back to the manufacturer or to service. After the inspection, under a custody record, with the parties' agreement on what may be done with it.
After each of these, the earlier state exists only in the record. The record has to be good enough to stand in for the device.
06Where inspections go wrong
These are the failures an engineering reviewer sees most often in inspection records, and in the inspections themselves.
The manufacturer examined it first
The device went back under the complaint process and was opened, tested, or repaired before any protocol existed. The complaint file is the only record.
A step improvised
Something was tried on the day because it seemed useful. It was not in the protocol, not agreed, and not reversible.
Photographs without a reference
No scale, no serial, no orientation. A picture of a part that cannot be shown to be that part.
The tool did more than read
A service tool used without an observer, with write functions available, and no record of which were used.
No exemplar
A destructive step taken on the evidence without first learning, on an identical device, what it would show.
Data on one laptop
Downloads and photographs copied later, from one party, with no hash recorded at the time.
A party absent
An inspection that proceeds without a party who was entitled to attend, and whose expert now disputes the record.
A record with one of these gaps is still a record. The point is to know the gap before the other side points it out.
✓The joint inspection at a glance
- Preservation record reviewed: custody, power, cleaning, service since the event
- Protocol written by the engineers, agreed by every party, signed before the day
- Scope, device list, exemplar, and reference documents named
- Every step listed with method, instrument, record, and person
- Stop points before power-on, disassembly, and destructive steps
- Service tool named with version, permitted functions, and observer
- Decontamination decided in the protocol, with sampling first
- Photography standard: scale, serial, orientation, numbered sequence
- One handler per step; a dedicated log keeper; parts to a custodian as removed
- Files hashed and copied to every party; closing inventory and signatures
§Sources and further reading
- ASTM E860 — Standard Practice for Examining and Preparing Items That Are or May Become Involved in Criminal or Civil Litigationastm.org
- ASTM E1188 — Standard Practice for Collection and Preservation of Information and Physical Items by a Technical Investigator; ASTM E1459 — Standard Guide for Physical Evidence Labeling and Related Documentationastm.org
- Alpha Devices — Guide 01, A device failed. What happens next?; Guide 07, What the device recordedalphadevices.io
A–ZTerms used in this guide
- Joint inspection
- An examination of the evidence attended by every party, under one agreed protocol, with one shared record.
- Protocol
- The written, signed sequence of examination steps, with the method, instrument, record, and person for each, and the stop points between phases.
- Non-destructive
- A step that leaves the device as it was: looking, photographing, measuring, imaging. Can be repeated later by anyone.
- Destructive
- A step that consumes or permanently alters a part: sectioning, pulling, chemical analysis. The last phase of the inspection, taken by agreement.
- Stop point
- An agreed pause at which every party confirms the record so far and consents to the next phase.
- Custody
- Who holds the device or a part of it, recorded at every transfer, with seals where possible.
- Exemplar
- An identical device used for comparison and for any step too risky to perform first on the evidence.
- Phase
- One of the six stages of the inspection, from receipt to destructive examination, each closed by a stop point before the next begins.