7.3 Safety, Quality, and Clinical Informatics Design
Key Takeaways
- Human-factors design for HIT assumes scarce attention, small working memory, look-alike identifiers, and mode errors from multiple open charts.
- Wrong-patient controls are persistent two-identifier display, limited multi-patient write modes, and re-identification before high-harm actions—not an “Are you sure?” modal on every click.
- Alert design at this level is right person, right moment, least interruptive mode that still prevents harm. Deep CDS types and knowledge maintenance are chapter 9.
- Downtime is a designed workflow: who declares it, analog identification, a downtime MAR, critical-value call trees, and a defined recovery backload.
- Safety-I counts failures; Safety-II studies how work-as-done usually succeeds. BCMA wall-sheets are design signals, not only noncompliance.
7.3 Safety, Quality, and Clinical Informatics Design
Quick Answer: Safe HIT is human-factors design. Prevent wrong-patient actions, keep alerts rare and useful (deep CDS is chapter 9), rehearse downtime, and treat workarounds as Safety-II information—not only Safety-I defect counts.
Sections 7.1 and 7.2 gave you functions and packages. This section asks how those functions fail when a tired human meets a noisy interface. Domain 2 task A.4 still applies: system functionality should optimize clinical effectiveness and efficiencies. A “safer” design that triples time-to-task will be worked around, and the workaround becomes the new unsafe normal.
Human factors in HIT
Human factors (ergonomics) studies how real people perform with tools under time pressure, interruption, and fatigue. In clinical informatics the “tool” is the EHR, BCMA hardware, pumps, printers, wireless, and the room layout.
Design implications you should be able to name:
- Attention is scarce. Interruptive alerts compete with the patient. Each hard stop must earn its interruption.
- Working memory is small. Do not require the user to remember the potassium from a result screen two clicks ago.
- Look-alike, sound-alike names and similar medical record numbers produce wrong-patient and wrong-medication events.
- Mode errors happen when two charts are open or when an unsigned note is still pointed at the previous patient.
- Proximity and grouping should match clinical meaning: identifiers together, dose-frequency-route together, alerts not buried in a banner farm.
You do not need to recite every ONC SAFER guide on the exam. You do need the habit: high-priority practices include patient identification, CPOE with restrained decision support, test-result follow-up, and downtime readiness.
Wrong-patient design
Wrong-patient orders, notes, and results review are among the most testable HIT safety failures. Two patients named John Smith, a second chart left in write mode, an interrupting phone call, and a potassium replacement written on the wrong record is a complete CPHIMS story.
Controls that match human factors:
- Two identifiers displayed persistently (name plus date of birth or medical record number), not lost in a crowded banner.
- Recent photo where the organization uses photos and identity is confirmed.
- Distinctive demographics (age, sex, location) next to look-alike names, plus an identity check on chart open.
- Limit multi-patient write access. If the vendor allows multiple charts, require a prominent patient switch and block sticky write-back to the hidden chart.
- Re-identification before high-harm actions: transfusion, chemotherapy, discharge medication reconciliation, BCMA.
- After interruptions, land on a confirmation for high-harm work, not on a half-finished order from the previous patient.
A blanket “Are you sure?” modal on every click trains users to dismiss. That is not a human-factors control. Save confirmation for actions that can harm, and make identity continuously visible so the confirmation is not the first time the user sees who owns the chart.
Alert design at a high level
Chapter 9 covers CDS types, knowledge lifecycle, and alert governance in depth. Here you only need the design constraints that affect effectiveness and safety.
- Fire for a decision that can still change, not after the antibiotic is already hanging.
- Speak to the person who can act (pharmacy versus nurse versus attending).
- Use the least interruptive mode that still prevents harm: inline hint, then soft stop, then hard stop.
- Include why and a safe alternative (the formulary equivalent), not only “contraindicated.”
- Measure override rate, time-to-task impact, and harm averted—not how many rules you turned on.
Alert fatigue is a human-factors outcome of too many low-value interrupts. A 90 percent override rate on a sepsis advisory is a design and content problem, not a “nursing culture” problem to solve with another reminder. If the advisory fires after the bundle is already on the eMAR, you have the wrong moment. If it fires for every fever, you have the wrong criteria. Fix those before you add a second interrupt.
Downtime procedures
Downtime is a designed workflow, not an afterthought. Planned (upgrade) and unplanned (outage, ransomware, interface failure) both need a written, drilled path:
- Who declares downtime and how users hear it (overhead, secure chat, unit champion).
- What still works (read-only viewer, last printed MAR, downtime computer, analog BCMA process).
- Paper or downtime-system orders that still use two identifiers.
- Who may give time-critical medications and how pharmacy verifies without CPOE.
- Results: how critical values are called when the interface is dead.
- Recovery / backload: which data must be entered after restore (administrations, new allergies, code events), who does it, and how you avoid double orders.
- BCMA and pumps: assume barcode and wireless fail together. Do not pretend a scan-rate policy survives a network outage.
An EHR that is “highly available” still needs a downtime drill. CPHIMS will punish “wait for IT to bring the system back, then catch up from memory.” Memory is not a medication administration record. Leadership that says “just remember what you gave and backload tomorrow if you have time” has no downtime design.
Safety-I and Safety-II thinking for HIT
Safety-I asks why things go wrong. It counts incidents, root-cause analyses, and deviations from policy. It is necessary: you still want fewer wrong-patient events and fewer missed sepsis antibiotics.
Safety-II asks why things usually go right. Care is variable. Nurses adapt when the scanner fails, when the wristband is under a dressing, when the sepsis set does not include the oncology antibiotic. Those adaptations keep the hospital running. If you only punish the workaround, you lose the information and the workaround goes underground.
For HIT:
| Lens | Question | Typical HIT move | Risk if used alone |
|---|---|---|---|
| Safety-I | What failed? | Ban workarounds, add a hard stop, retrain | Hidden workarounds, more clicks, slower care |
| Safety-II | How did the team succeed today? | Study BCMA wall-sheets as a signal of dead zones and missing wristbands | Romanticizing unsafe hacks with no redesign |
| Combined | What must we count, and what must we redesign? | Fix the environment so the safe scan is fastest; still count actual wrong-product events | — |
Putting design together on an exam stem
When a stem describes harm:
- Is it identification, interruption, default, required-field delay, open loop, or downtime?
- Would a human-factors change—visibility, fewer modes, better defaults—beat another alert?
- Is the workaround a Safety-II signal of work-as-done colliding with a bad environment?
- Save deep CDS type lists for chapter 9.
That sequence keeps Domain 2 task A.4 honest: optimize effectiveness and efficiency, or the “safe” design will not survive contact with the night shift.
Scenarios and exam traps
Scenario — two John Smiths. A resident has two charts open. After an interrupting call, a progress note and a potassium replacement land on the wrong patient. Adding “Are you sure?” to every save will be clicked away. Limit multi-patient write modes, keep two identifiers persistently visible, and require re-identification before high-harm orders.
Scenario — sepsis advisory after the fact. A BPA fires “start sepsis bundle” after cultures are collected and the antibiotic is already documented on the eMAR. Override rates are high. The problem is moment and criteria, not culture. Do not stack a second interrupt. Deep CDS inventory belongs in chapter 9; the 7.3 move is least-interruptive design at a decision that can still change.
Scenario — four-hour outage. Leadership tells nurses to remember what they gave and backload tomorrow if they have time. There is no downtime MAR, no critical-value call tree, and no rule for who enters administrations after restore. That is not resilience. Write the analog path and the recovery backload before the next outage.
Scenario — taped barcodes as “noncompliance.” Isolation rooms have no scanner coverage. Night staff tape product barcodes to the cabinet. Safety-I reports demand discipline. Safety-II reads the tape as a map of dead zones. Fix coverage and time-to-task; keep counting real wrong-product events.
Watch these traps:
- Another alert as the first fix for every harm story.
- Treating downtime as an IT-only restoration problem.
- Equating override rate with bad clinicians.
- Safety-I only: punish workarounds and miss the broken environment.
- Dumping chapter 9 CDS type lists into a human-factors question.
- Believing a required attestation restores a closed loop.
Task A.4 ends where the safe path is also the short path—even when the system is down, even when two patients share a name, even when the night shift is inventing a way to finish the work.
A resident has two charts open. After an interrupting call, a progress note and a potassium replacement order are written on the wrong John Smith. Which design direction best matches human-factors thinking?
After a four-hour unplanned EHR outage, leadership tells nurses to remember what they gave and backload tomorrow if they have time. What downtime design is missing?
Night staff tape medication barcodes to the cabinet because isolation rooms have no scanner coverage. Safety-I reports call this noncompliance. What is the better informatics stance?