SpiceQMS for healthcare
Quality, information security and NISG 2026 duties in one management system, for healthcare institutions, laboratories and medical device makers.
The starting point
Patient safety is also information security
Hospitals and primary care work around the clock and are highly digitised. If the hospital information system or the laboratory fails, operations are postponed and care runs in emergency mode. Under the General Data Protection Regulation, you may process health data only under an exception.
Since 1 October 2026, the NISG 2026 has transposed Directive (EU) 2022/2555, known as NIS2, in Austria. It counts healthcare providers among the sectors of high criticality. Whether an institution is covered also depends on its size.
Anyone who manufactures medical devices needs a quality management system under Regulation (EU) 2017/745. EN ISO 13485 is published as a harmonised standard for this. Laboratories of healthcare institutions that make their own in-vitro diagnostics are exempt only under conditions, for example with ISO 15189. The NISG 2026 also names medical device manufacturers, among the other critical sectors.
SpiceQMS brings these requirements together in one management system. One piece of evidence then serves several standards and laws at once.
Medical devices, laboratory and information security
SpiceQMS holds chapter templates for ISO 13485, for manufacturers of medical devices, and for ISO 15189, for medical laboratories. Templates for ISO 27001 add information security. Several standards run in parallel in one management system. You record the context of the organisation and interested parties per management system. You store audit questions for every chapter of a standard. Auditors can come from your own staff or from outside.
- Chapter templates for ISO 13485 and ISO 15189
- Context and interested parties
- Information security following ISO 27001
- Chapter structures only, not the full text of the standards
Cybersecurity
What the NISG 2026 requires in healthcare
The risk management duties have applied since 1 October 2026. Covered institutions must register within three months. Within twelve months after that, they report which measures they have implemented.
Healthcare institutions report significant security incidents to the Austrian HealthCERT. The Health Telematics Act provides for it as a dedicated competence team for the sector. The early warning must arrive within 24 hours, the notification within 72 hours.
Management must ensure and supervise implementation and take part in training itself. Employees must also be offered training regularly. In the end, it is not the measure alone that counts but its complete evidence.
In SpiceQMS, you add the requirements of the NISG 2026 as a separate rule set alongside ISO 27001. The risk register, training records from SpiceHCM and management review then serve the law and the standards at once.
Documents that stay under control
A work instruction is only as good as its valid version. In SpiceQMS, you edit procedures and work instructions as Word documents right in the browser. Whoever prefers the HTML editor or uploading finished files can do that too. Every revision runs through its own approval, from created to released. Headers and footers fill in automatically with number, version and approval along the way. The released revision is stored as a PDF beside the Word file. Laboratory, production and administration thus work with the same valid version. Outdated versions leave daily work but stay traceable.
Audits
Evidence that arises in daily work
When the system is used every day, evidence arises along the way. An inspection then finds a system in use, not a folder filled shortly beforehand.
Audits
Evidence that arises in daily work
When the system is used every day, evidence arises along the way. An inspection then finds a system in use, not a folder filled shortly beforehand.
Complaints and risks
Learning from every complaint
Complaints are recorded and assigned to the processes they concern. Patient complaints received in SpiceCRM can be linked to quality management. From the complaint, you start a root cause analysis directly.
You rate risks by impact and likelihood. Actions arise as tasks directly on the risk. Findings from audits and inspections run through the same process.
An effectiveness check confirms that the actions work. An incident becomes a lasting improvement.
Training you can evidence
You show competence, training and awareness with the same people data from SpiceHCM. With SpiceHCM, training runs from request through planning to completion. Position profiles in SpiceHCM show which competence a position requires. Qualifications are recorded in SpiceHCM with their validity dates. SpiceHCM for healthcare shows what this looks like in health institutions. Nobody has to collect lists before the audit.
- Training with SpiceHCM
- Position profiles with SpiceHCM
- Evidence from SpiceHCM
What changes
Ready for the next audit
Audits become plannable because evidence arises continuously. Every finding stays linked to its audit and report item. The next external audit does not start with a search.
The quality dashboard shows key figures per company and the process map. The Compliance page shows how you manage legal duties alongside the standard.
Tell us which standard is next for you. Together we look at which standards you map first.
Three products, one platform
What SpiceCRM and SpiceHCM add in healthcare
SpiceCRM, SpiceHCM and SpiceQMS run on the same platform. One licence for More opens all three, and anyone working in several is only billed once.
SpiceQMS: several standards side by side
ISO 13485, ISO 15189 and ISO 27001 sit in one management system.
SpiceCRM: the patients’ voice
With SpiceCRM, patient complaints arrive through every channel. Free appointments from the hospital information system can be published online with SpiceCRM.
SpiceHCM: who is on duty
With SpiceHCM, a simple duty roster shows who is scheduled when. During an absence, the deputy in SpiceHCM takes over notifications and system rights.
Talk to us.
What are you planning, and what is missing today? We reply personally and tell you plainly whether Spice is the right fit.
- You tell us what you have in mind.
- We get back to you personally by email.
- If you like, we show you Spice in a demonstration.
Prefer to talk directly? office@spicecrm.com+43 (1) 89083610