The Three-Layer Quality Model: Device Clearance, Organizational Governance, and Clinical Validation

Healthcare quality assurance operates through a layered system. Each layer serves a different function, evaluates different things, and is governed by different institutions. Understanding where the layers overlap, and where they don't, reveals a gap that is becoming more consequential as clinical technology grows more complex.

Layer 1: Device Clearance

The FDA evaluates whether medical devices, including AI/ML-enabled software, are safe and effective for their intended use. This evaluation happens at the manufacturer level. The agency reviews clinical evidence, bench testing, and algorithmic validation data submitted by the company that built the device.

Layer 1 answers the question: Does this device work as claimed?

This layer is well-established, well-funded, and well-understood. It has clear regulatory authority, defined pathways (510(k), De Novo, PMA), and post-market surveillance mechanisms. Whatever its imperfections, Layer 1 exists and functions.

Layer 2: Organizational Governance

Accreditation bodies evaluate whether healthcare facilities meet operational standards for quality, safety, and performance. This includes personnel credentialing, equipment maintenance, quality improvement programs, documentation practices, and clinical workflow design.

Layer 2 answers the question: Does this facility operate according to recognized quality standards?

This layer is also well-established, though it varies by clinical domain, geography, and whether participation is mandatory or voluntary. Major standards organizations evaluate thousands of facilities across dozens of clinical specialties.

Layer 2 evaluates the organization. It does not evaluate individual clinical encounters, specific device deployments, or case-level outcomes.

Layer 3: Clinical Validation at the Facility Level

Here is where the model breaks down.

Layer 3 would answer the question: Is this specific facility achieving good clinical outcomes with the devices and protocols it has deployed?

This is distinct from Layer 1 (which evaluates the device in general, not at a specific site) and Layer 2 (which evaluates organizational processes, not clinical results at the case level).

Consider a concrete example. A facility deploys an FDA-cleared AI tool for cardiac imaging analysis. The device passed Layer 1, the FDA reviewed the manufacturer's validation data. The facility passed Layer 2, its accrediting body confirmed that it has qualified personnel, maintained equipment, and a quality improvement program.

But nobody is systematically validating whether the AI tool performs as expected on this facility's specific patient population, with this facility's imaging equipment, interpreted by this facility's clinical staff.

Nobody is tracking whether the tool's accuracy has degraded since deployment. Nobody is comparing the tool's outputs against the facility's clinical outcomes. Nobody is evaluating whether the facility's override protocols are working, whether clinicians are appropriately overriding incorrect AI outputs and appropriately deferring to correct ones.

Why Layer 3 doesn't exist yet

The absence of Layer 3 is not an oversight. It reflects genuine structural challenges:

Data infrastructure. Case-level clinical validation requires structured data from the facility's clinical systems, imaging results, AI outputs, clinical decisions, patient outcomes. This data exists in EHR systems but is not currently aggregated, structured, or accessible for external evaluation in most facilities.

Evaluation complexity. Layer 1 evaluates a product. Layer 2 evaluates an organization. Layer 3 would evaluate the intersection of products, organizations, and clinical practice, a much more complex domain that requires clinical expertise embedded in the evaluation methodology.

Institutional authority. The FDA has clear authority over device manufacturers. Accreditation bodies have established authority over facility operations. Nobody has claimed authority over facility-level clinical validation as an ongoing, systematic process.

Economic model. Layer 1 is funded by manufacturer fees. Layer 2 is funded by facility accreditation fees. Layer 3 would require a new economic model that justifies the cost of ongoing clinical validation at every accredited facility.

Why Layer 3 is becoming necessary

Three trends are converging to make Layer 3 unavoidable:

AI device proliferation. With over 1,000 AI/ML devices cleared by the FDA, facilities are deploying algorithmic tools whose performance varies by site, population, and workflow. Layer 1 clearance provides a baseline, but it does not guarantee site-specific performance.

Outcome measurement expectations. Payers, regulators, and patients increasingly expect quality measurement based on outcomes, not just processes. Layer 2 evaluates whether a facility has a quality improvement program. Layer 3 would evaluate whether that program is actually improving quality.

Data availability. The interoperability mandates driving FHIR adoption are creating the data infrastructure that Layer 3 requires. When clinical data flows in structured formats from EHR systems, the technical barrier to case-level quality evaluation drops significantly.

Who builds Layer 3?

The most natural home for Layer 3 is within the accreditation system, as an extension of Layer 2, not a replacement for it.

Accreditation bodies already have facility relationships, clinical expertise, and quality governance frameworks. Adding clinical validation capabilities requires new infrastructure, data pipelines, deterministic evaluation engines, outcome tracking systems, but it does not require building institutional authority from scratch.

The alternative is that Layer 3 emerges outside the accreditation system, through payer requirements, government mandates, or market-driven quality transparency platforms. This is possible but less desirable, because it fragments quality governance rather than integrating it.

The accreditation bodies that invest in Layer 3 capabilities will expand their role from organizational governance to comprehensive quality assurance. Those that don't will find that others fill the gap, and that Layer 2 alone becomes insufficient to justify the accreditation credential.

---

Regain Accreditation provides continuous compliance monitoring infrastructure for accreditation bodies worldwide. Request a demo →