Trust, Ethics & Safety

Health software is used when people are unwell, rushed or worried, and what it shows can end up in a body: a medicine dose, a scan report, an order on a patient's chart. A confusing screen elsewhere costs a user time; here it can contribute to a wrong dose or a missed warning. This article covers how published guidance treats interface design as a matter of safety and trust, what commonly goes wrong, and who is accountable.

Why a screen can be a safety issue

Health information technology (health IT) is any software that stores, shows or acts on health information: a health record, a prescribing tool, a monitoring dashboard. A 2012 perspective on the US Patient Safety Network (PSNet) argued that such systems can introduce new hazards: results buried among irrelevant data, drop-down lists missing essential options, and sign-off buttons named end, finish or done that behave very differently. Not all health software is a regulated medical device; the US Food and Drug Administration (FDA) says its risk-based approach focuses on the subset of software functions that meet the device definition. For regulated products, its human factors guidance describes usability engineering as a way to reduce use errors and the harm that follows.

Where things go wrong

• Look-alike and unclear medication information. The Institute for Safe Medication Practices (ISMP) publishes guidelines for showing drug information on screens. They ask for capitals inside similar names (vinCRIStine and vinBLAStine), a space between drug name, dose and unit because a run-together 10Units has been read as 100 units, and the word units written out because a shortened U can be mistaken for a zero, causing a tenfold overdose.
• Wrong-patient errors. PSNet describes four identification incidents in four weeks at one hospital; a distracting department and label printing without clear separation between patients contributed. A randomised trial summarised by PSNet found that requiring staff to re-enter patient identifiers before submitting an order reduced wrong-patient orders.
• Alert fatigue. Staff who meet too many warnings begin to ignore them, including important ones. PSNet says the vast majority of alerts from computerised order-entry systems are clinically inconsequential, and cites a 2014 study in which physiologic monitors across 66 adult intensive care beds generated more than two million alerts in a month. The 2012 perspective reports override rates as high as 97 percent for decision-support alerts in some systems.
• Defaults and ambiguity. ISMP advises pre-selecting an order only if it suits at least 95 percent of patients and would not harm the rest, and records that the shorthand MTX for methotrexate has been mistaken for mitoxantrone.

Two situations

A prescriber types the first three letters of a drug into an order screen. ISMP's guidelines describe how the entry met has brought up six different medicines, including methylphenidate, methadone, metformin and metronidazole, and list controls: at least five letters before a shortcut works, capitals on the differing letters in look-alike names, and a consistent order.

In a case PSNet describes, imaging results for two young trauma patients were mixed up. The authors blame the environment and labelling process rather than one careless person, and propose barcode scanning, record flags for patients awaiting transport and uninterrupted verification pauses, while noting that human vigilance remains essential.

Trust, consent and transparency

People act on what health software tells them and share sensitive information with it, so trust matters, but trust the evidence does not support is a risk. The World Health Organization's 2021 guidance on the ethics and governance of artificial intelligence (AI) for health sets six principles, among them autonomy, transparency and accountability. Its summary links autonomy to privacy and consent and names risks such as unethical collection and use of health data, algorithmic bias and commercial interests placed above patient rights. The questions of what is collected, who sees it and how a person can say no apply to any health product. This area rests mostly on guidance and expert consensus, not on measured design outcomes.

Privacy as a design problem

Privacy becomes a design matter wherever a screen decides what is shown, stored and shared. Places to look: what appears on a lock screen or in a notification where others can read it; who else can act on an account, such as a carer (in England, NHS family and carer access needs the person's agreement and the GP practice's approval); and what consent choices exist and what happens if someone declines.

Law frames those choices and differs by country. In Australia, health service providers must follow the Australian Privacy Principles, which govern how personal information is handled, according to business.gov.au. In the EU, the General Data Protection Regulation treats data concerning health as a special category (Article 9). In the United States, the HIPAA Privacy Rule applies to covered entities such as health care providers and plans; the Federal Trade Commission's Health Breach Notification Rule covers many health apps outside HIPAA and counts sharing health information without authorisation, even by accident, as a breach.

Deceptive design patterns

Deceptive design patterns, also called dark patterns, are interface choices that steer people into decisions they might not otherwise make. A 2022 staff report from the US Federal Trade Commission describes privacy versions: choices that cannot be firmly declined, defaults that maximise data sharing, hard-to-find settings, and an accept option that stands out while the alternative is greyed out or several screens away. The European Data Protection Board's 2023 guidelines, written for social media, sort such patterns into six groups, including overloading and obstructing. A 2024 review of digital health apps in a German journal names repeated interruptions that cannot be dismissed and deliberately difficult account deletion, and warns of users left insufficiently informed.

Who is accountable

In England, two national information standards set expectations for clinical risk management of health IT: DCB0129 for the manufacturers who build the software, DCB0160 for the health and care organisations that deploy and use it. Both are published under section 250 of the Health and Social Care Act 2012 and, by their own text, cover all health IT, including software that is also a regulated medical device. A national review of both ran as a public consultation from 29 June to 11 September 2026, with AI supporting clinical decisions among its concerns. In the United States, the Office of the National Coordinator for Health IT publishes eight SAFER self-assessment guides, including ones on patient identification and on order entry with decision support. In both countries responsibility is shared between the maker and the organisation using the product, and screen design feeds into both.

Clinical safety roles

Both standards require a named Clinical Safety Officer: a suitably qualified clinician with current professional registration and knowledge of risk management, who makes sure the process is followed and approves key documents. A hazard is a potential source of harm to a patient; the hazard log is the running record of hazards found and how each was resolved. A clinical safety case report sets out the argument and evidence that a system is safe for a given use at a defined point in its life; the officer approves each one, and the hazard log accompanies it. Risk analysis is advised to involve a multi-disciplinary group that includes the officer. The versions read are from 2018; the review may change them.

Related Showcase card

• Consent, not coercion - a consent screen audited against UK GDPR's definition of valid consent.