Electronic Health Record Goes on Trial: Negligent Design That Resulted in Brain Damage

On November 20, 2020, Ruby L. Lowe appeared before a court in Virginia on behalf of her grandson, Michael Taylor, in a lawsuit against Cerner Health Services, Inc. The grandson, a 25-year-old man with a history of sleep apnea and morbid obesity, underwent gallbladder surgery and suffered brain damage resulting in physical impairments after failing to receive continuous pulse oximetry as intended by his surgeon and anesthesiologist.1,2 The plaintiff alleged that Cerner's electronic health record (EHR) software was negligently designed and that Cerner failed to warn users of the software about the design defects.1,2 Lowe further asserted that the negligent design and the failure to warn of the design defects caused a failure to properly monitor Taylor's oxygen level, which could have prevented his injuries.1,2Negligent design is defined by Quimbee, an online educational resource for law students and legal professionals, as "a theory of negligence stating that a given product was designed in such a way that it could foreseeably have led to an injury."3 Court documents state that, under Virginia law, a product may be deemed "unreasonably dangerous if it is defectively manufactured, defectively designed, or unaccompanied by adequate warnings."1(p9,10) According to court documents, for a plaintiff to prevail in a negligent design claim, they must show that the defendant, in this case Cerner, had a legally recognized duty to design their EHR software in a manner that ensured it was "reasonably safe for the purpose for which it was intended."2 (p10) This required evidence that the EHR software failed to satisfy: (1) governmental safety standards, (2) industry standards, or (3) reasonable consumer expectations.2This case is important for nurses to examine for 3 reasons. One, it illustrates the impact health care technology can have on clinical practice and patient outcomes. Two, the alleged EHR design and safety failures at the center of the case have been known for decades and continue today. Three, the lawsuit bypasses what is known as "hold harmless" clauses found in contracts between EHR vendors and health care systems, hospitals, clinics, and other purchasers of EHRs that absolve vendors of any harm to patients that may be related to the technology. There are no agreements between patients and EHR vendors.This column of Technology Today provides background on the case and 2 specific EHR design weaknesses. I obtained information on the case from publicly available online court documents.1,2 It is important to note that these design weaknesses are not exclusive to EHRs or Cerner. The case is a reminder that nurses must remain diligent when using technology in clinical practice.On April 5, 2016, 25-year-old Michael Taylor underwent gallbladder surgery.1 Both the surgeon and the anesthesiologist intended for the patient to have continuous pulse oximetry monitoring following surgery due to his history of sleep apnea and morbid obesity.1 After the operation, while the patient was in the postanesthesia care unit, the surgeon entered an order into the EHR for continuous pulse oximetry monitoring, intending it to be effective from the time the order was entered on April 5 until the patient's expected discharge the following day.1At 5:01 am the following day, April 6, 2016, a staff nurse checked the patient's vital signs and found them to be normal.2 The patient had still not received the continuous pulse oximetry ordered the day before, and in fact, the order was not implemented until 10:00 am on April 6, 2016.2 Approximately 30 minutes after the pulse oximetry was applied, the surgeon found the patient unresponsive and in respiratory distress.1,2 The patient suffered respiratory arrest, which caused hypoxia, resulting in brain damage that led to inability to walk, bathe, or use the bathroom independently.2 There was no dispute in the case that if the patient had received continuous pulse oximetry monitoring, the hypoxia and brain damage would not have occurred.1,2The case against Cerner alleged that the Cerner software was negligently designed and that Cerner failed to warn system users about the software design defects.2 It was specifically alleged that there were 2 design defects.2 The first defect was on the order entry screen and the second was on the unsigned orders list.2On the order entry screen, the start time for orders automatically defaulted to the date and time the order was entered into the computerized provider order entry (CPOE). In this case, the surgeon "chose a continuous order" for pulse oximetry, selected "daily" as the frequency and "once" as the recurrence in the ordering screen, and entered "as ordered" in the conditional information field.2(p6)Unknown to the surgeon, choosing the recurrence of "once" set the automatic start time to the next day, April 6, 2016, at 10 am, even though the order entry screen continued to display the start date as April 5, 2016, at 4:34 pm.2 This functionality was hardcoded into the software by Cerner,2 unmodifiable by the hospital.2 The underlying logic for "once" and "10:00 am" the following day was alluded to in court documents as being based on recommendations from the pharmacy team and when they filled medication orders.2The unsigned orders list displayed all orders entered by a provider, in this case, the surgeon.2 Providers were required to approve the list before orders took effect.2 After inputting orders on the order entry screen, the surgeon selected "add to order session," which electronically moved the orders to the unsigned orders list where the order for pulse oximetry was listed last out of 30 orders.2(p6)In contrast to the order entry screen, the unsigned orders list displayed the order as "Pulse oximetry: Continuous Once As Ordered; start on 4/6/2016 at 10:00."2(p6) The surgeon stated she thought the words "continuous once as ordered" were confusing but did not notice the start time, instead relying on the start time shown on the order entry screen, which she did not anticipate would change.1,2 The unsigned orders list was reportedly displayed in a stacked format whereby only the first few orders were visible and requiring the surgeon to scroll across multiple computer screens to review the details of each order.1,2 The design for electronically signing the orders as a group did not require a review by the provider entering the orders.1,2The surgeon stated that she wished she had been better trained on the hospital's version of CPOE.1 But is training the solution for negligent design? The answer is a resounding no. An appropriate design that is hardcoded into the technology is more reliable than dependence on the training and memory of busy health care professionals.In July 2016, 3 months after the incident, the hospital updated its CPOE "to default orders for continuous pulse oximetry to 'now.'"1(p4) This indicated that the hospital recognized the design defect. But was this the correct solution? To answer this question, I will review 2 design weaknesses identified in this case based on court documents, choice architecture and the use of defaults.The design weakness identified in the physician order involves choice architecture, the way choices are presented to the user, in this case, the surgeon using CPOE in the EHR. A designer is responsible for organizing the context in which people make decisions.4 The goal is to influence user behavior to make the right choices and prevent errors.On the CPOE order entry screen, the start time for orders appeared automatically as the date and time of entry.1,2 There were also dropdown menus for frequency and recurrence. The choices in this case presented to the surgeon after inputting the order for continuous pulse oximetry included (1) add nothing to the continuous pulse oximetry order, which would default to the order being automatically implemented now or (2) add the use of dropdown menus for frequency and/or recurrence to the order for continuous pulse oximetry. The surgeon chose option 2, selecting "daily" under frequency and "once" under recurrence.Unknown to the surgeon, by choosing "once" under recurrence, the order now defaulted to a start time of 10:00 am the following day.1,2 Had the surgeon not been allowed to choose "once," the order would have defaulted to her initial order for continuous pulse oximetry monitoring and started promptly.1The question in this scenario is, how does the user know whether to choose option 1 or option 2? What cues were provided to the user to influence the right choice and prevent errors? Publicly available court documents do not provide answers.Based on choices selected in the architecture provided, the order in the unsigned orders list read, "Pulse oximetry: Continuous Once as Ordered: start on 4/6/2016 at 10:00."1(p4),2(p6) The surgeon testified that she thought the words were confusing1,2 and did not make sense.2 Indeed, the words "continuous," "once," and "4/6/2016," indicating the next day, in one order is contradictory, and the surgeon chose these options because the design allowed her to do so.The use of defaults in the EHR can be problematic. They are often used in CPOE with the goal of making ordering more standardized and efficient for providers.5Defaults can be classified as a "default-on" or "default-off."6 A default-on is an order with predetermined or preselected parameters that apply whenever that order is chosen.5,6 In this case, the CPOE was designed so that all provider orders for continuous pulse oximetry were a default-on to "now," meaning the order for continuous pulse oximetry was to begin promptly. How or if users were reminded this was an automatic default is unclear.Default-off parameters are optional.6 An example would be the descriptor "once" listed in the dropdown menu for recurrence regarding the continuous pulse oximetry order. In this case, the CPOE was designed so that providers could choose a default-off option of "once," which overrode the original order for pulse oximetry and turned off the requirement for "continuous."The use of defaults in designs can be tricky. The design defect in this case involved a single order that allowed both default-on and default-off options. In other words, the surgeon was allowed to use the default setting on the order for "now" as well as choose the recurrence of "once" in the dropdown menu, which negated the default setting for "now." The logic behind this design was not discernible in court documents, although it may have been for standardization and efficiency. However, in this case, a design allowing both default-on and default-off settings resulted in contradictory words and actions, as well as undesired consequences.A better design solution would be to combine one order for a treatment, such as pulse oximetry, with choices placed within a drop-down menu for frequency such as "continuous," "3 times daily with vital signs," or "before and after ambulation." It is worth noting that orders on the order-entry screen should use the exact same terminology on the unsigned order list to avoid confusion.Cerner lost this legal case. The patient and his grandmother lost significantly more.Nursing practice is increasingly immersed in technology. It is imperative that health care organizations, large and small, have appropriate resources to support nurses and other clinicians when using technologies in their practice. Health care technologies are tools intended to provide clinicians with support. Like any tool, there should be a reliable strategy for routine evaluation and repair when needed. This includes contacting the vendor when design flaws are identified.Safety risks related to EHRs, specifically CPOE and dropdown menu design, have been well documented and known for years prior to the case examined here.7–10 Problems reported with the design of dropdown menus involved the incorrect selection of product, dose, or frequency. In one study, 2 of 6 major errors were related to CPOE default functions.10One study examined the manifestations, mechanisms, and rates of system-related errors in 2 major hospitals using CPOE.11 System-related errors were defined as "Errors where there was a high probability that the functionality or design of the e-PS [electronic prescribing system] contributed to the error and there was little possibility that another cause, such as lack of knowledge about the drug, produced the error."11(p1160) Incorrect selection from drop-down menus was identified as the most frequent mechanism for system-related errors (43.7%, 43/100 admissions). The researchers concluded that system-related errors are frequent yet rarely detected and suggested that fewer dropdown menus may reduce risk.A white paper by Brigham and Women's Hospital Center for Patient Safety Research and Practice published by the US Food and Drug Administration highlights CPOE safety risks related to design including recommendations for consideration.12Technology, whether it is a car or an EHR, influences people's decisions and behaviors, and this can have consequences. For example, although no speed limit is set at 190 miles per hour, consumers can drive that fast if the car they are driving is designed to allow them to. One of the basic tenets of good design is the prevention of errors.13 For that to occur, designers must reduce opportunities for error, as illustrated in this case. The health care industry, a safety-critical environment where lives are at stake, needs to move away from "negligent design" and toward "safe designs" of EHR software.