Clinical information systems and their unintended consequences: how the record became a source of error

The electronic record was bought to remove a coordination problem: unreadable notes and orders lost between ward and pharmacy. A record any clinician could open was meant to make the plan travel. A record the clinician can open is not the same as a summary the patient can read at their reading level. The plan travelled as data, and the conversion introduced failure modes nobody had designed in.

The claim is not that the software was badly built. The record encodes communication as data entry, and a system that represents coordination as a field to be completed loses whatever the field cannot hold. The remedy lies in the fit between system and work, not in more software. This sixth of ten units applies the same lesson to a second safety system.

The record was bought as a fix, and it arrived as a task

Koppel and colleagues studied one widely used order-entry system at a tertiary teaching hospital between 2002 and 2004, surveying 261 house staff, 88 per cent of users, and running five focus groups, 32 interviews and shadowing (Koppel et al., 2005). The system facilitated 22 types of medication error risk, including fragmented displays that blocked a coherent view of a patient's medications and separated functions that made double dosing easy, and three quarters of the house staff saw each risk weekly or more often.

Of 2,522 medication error reports from a federal order-entry safety project, 1,308 were related to order entry, which facilitated 13.1 per cent of them and could have prevented 86.9 per cent (Amato et al., 2016).

Silent error: the failure mode the record introduced

Three researchers studied patient care information systems in three countries with the same methods, and they reached the same conclusion independently (Ash, Berg and Coiera, 2004). They describe silent errors, mistakes that leave no trace because the action which would have exposed them has been removed. Silent errors fall into two categories: entering and retrieving information, and the communication and coordination the system is meant to support. The second carries the argument: entering an order was once one act in a chain of spoken and written communication, and the record lets a clinician treat the entry as the whole communication, so when that assumption fails an order is missed.

Horsky and colleagues walked through an order-entry application, then had seven clinicians complete a simulated ordering task (Horsky et al., 2003). The application placed heavy cognitive demands on its users unevenly, falling hardest on those who lacked a working model of the system, and their ordering errors followed the distribution of the resources. The study locates that demand inside one product and seven users, so it shows the mechanism without estimating its harm.

A survey of 176 United States hospitals with inpatient order entry found all eight types of unintended adverse consequence (Ash et al., 2007).

The counts locate the problem in the design

In a large integrated health system, 100 closed investigations drawn from 344 reported record-related concerns were analysed against an eight-dimension sociotechnical model. Seventy-four involved unsafe technology and 25 unsafe use, and 70 per cent involved two or more dimensions, so causes were rarely confined to the software or the user (Meeks et al., 2014). Ninety-four per cent concerned display, upgrades, transmission or hidden dependencies, and persisted long after go-live.

Howe and colleagues counted the harm end across 1.735 million safety events reported in Pennsylvania and a mid-Atlantic academic health system (Howe et al., 2018). Of these, 1,956 named a major vendor together with possible harm, and 557, 0.03 per cent, explicitly tied the possible harm to a usability problem, most often data entry at 27 per cent or alerting at 22 per cent.

Usability is the mechanism, and the same task costs different amounts at different sites

Twelve to 15 emergency physicians at each of four health systems, two using each of two vendors, completed the same six scenarios while keystrokes, clicks and video were recorded (Ratwani et al., 2018). Physicians with time to spare are not the physicians finishing a shift. On some tasks the average time differed nine-fold and the average click count eight-fold. Error rates ran from zero to 10 per cent on one imaging task, and from 16.7 to 50 per cent on a medication taper. And a national survey of 1,933 physicians found 38 per cent of the variance in usability ratings between systems and 51 per cent at hospital level within a system (Schwappach et al., 2025).

What the record did to the work around it

Baysari and colleagues shadowed 14 speciality teams through ward rounds and interviewed 16 prescribers (Baysari et al., 2011). Senior doctors made the prescribing decisions but rarely used the order-entry system. The junior doctors who entered the orders ignored the alerts and never raised them with their seniors. Decision support reached people who were not deciding, so the coordination problem had reappeared inside the record. Sittig and Singh's model names eight interdependent dimensions, from hardware and software to external rules and measurement, which are not sequential or hierarchical and so make a single cause hard to isolate (Sittig and Singh, 2010). Hardware includes the connection itself, which a rural clinic loses, leaving entries to sync later.

The contested question: is the record hazardous by design, or hazardous in use?

One position holds that the hazard is a property of specific designs. Koppel reports 22 risk types (Koppel et al., 2005). Amato reports 13.1 per cent of errors facilitated by order entry (Amato et al., 2016). Meeks reports 94 per cent of concerns tracing to display, transmission or hidden dependencies (Meeks et al., 2014).

The opposing position holds that the hazard lies in use and implementation. Han and colleagues studied children admitted for specialised care: a commercial system was installed hospital-wide over six days, and mortality rose from 2.80 to 6.57 per cent, an adjusted odds ratio of 3.28 (Han et al., 2005). On this reading the harm belongs to how systems are put in, and identical systems yield different outcomes in different organisations (Ash, Berg and Coiera, 2016).

A third position distrusts the attribution: in the survey of 176 hospitals, respondents were confident about extra work and workflow disruption but uncertain whether the system had shifted power or become a new source of errors, so the field's counts are bounded by what gets recorded (Ash et al., 2007).

What would settle the question is a design-level test with implementation held constant, or a study following one system across organisations. Fallon and colleagues come closest in miniature (Fallon et al., 2023): they replaced a burdensome interruptive COVID alert with a passive order panel, alerts fell from 8,206 to 1,449 per week, an 80 per cent reduction, while precautions orders on symptomatic admitted patients rose from 23 to 61 per cent. A design change moved both the burden and the outcome, at one site and on one alert.

What to do while the dispute is open

The evidence on the two sides is unequal. That the hazard sits in the design rests on counts drawn from surveys and reports, which record what users noticed. That it sits in implementation rests on one before-and-after mortality comparison and on variation between sites running the same product. The strongest objection to this unit's thesis is that the counts are drawn from voluntary reports, so a count of design-related hazards is a floor rather than an estimate. While the dispute is open, a designer should hold the software constant and vary the site, and judge a change by burden and outcome together.

Where this is heading

Fallon's study is the shape of the remedy: change the design, measure burden and outcome together, and accept that the change is local. Ash, Berg and Coiera place the explanation in implementation science a decade after their first paper: variability between sites running identical systems is what needs explaining (Ash, Berg and Coiera, 2016). Carayon's work-system framing organises all of it, holding that performance emerges from the interaction of person, task, tools, organisation and environment, so redesign should balance the work system and treat workers as active and adaptive rather than as components (Carayon et al., 2014).

Sources

• Koppel, R., Metlay, J. P., Cohen, A., et al. (2005). Role of Computerized Physician Order Entry Systems in Facilitating Medication Errors. JAMA. doi:10.1001/jama.293.10.1197 Surveyed 261 house staff, ran focus groups, interviews and shadowing, and identified 22 types of medication error risks that three quarters of staff saw weekly or more often, making the facilitated error countable.
• Ash, J. S., Berg, M. and Coiera, E. (2004). Some Unintended Consequences of Information Technology in Health Care: The Nature of Patient Care Information System-related Errors. Journal of the American Medical Informatics Association. doi:10.1197/jamia.m1471 Describes silent errors in two categories, entering and retrieving information, and communication and coordination, from qualitative studies in three countries. The second carries the argument: the record licenses the assumption that an entry completes the communication.
• Ash, J. S., Sittig, D. F., Poon, E. G., et al. (2007). The Extent and Importance of Unintended Consequences Related to Computerized Provider Order Entry. Journal of the American Medical Informatics Association. doi:10.1197/jamia.m2373 Surveyed representatives of 176 hospitals with inpatient order entry on eight types of unintended adverse consequence, ranking new work, workflow and dependence on the technology most severe. These bore no relation to years of use, so they do not fade with familiarity.
• Amato, M. G., Salazar, A., Hickman, T. T. T., et al. (2016). Computerized prescriber order entry-related patient safety reports: analysis of 2522 medication errors. Journal of the American Medical Informatics Association. doi:10.1093/jamia/ocw125 Two pharmacists reviewed 2,522 reports from six sites; 1,308 (51.9 per cent) were related to order entry, which facilitated 171 (13.1 per cent) and could have prevented 1,137 (86.9 per cent), mostly delays, duplicates and excessive doses, so the record both prevents and causes error.
• Meeks, D. W., Smith, M. W., Taylor, L., et al. (2014). An analysis of electronic health record-related patient safety concerns. Journal of the American Medical Informatics Association. doi:10.1136/amiajnl-2013-002578 Analysed 100 closed investigations from 344 reported concerns against an eight-dimension sociotechnical model: 74 involved unsafe technology, 25 unsafe use, and 94 per cent concerned display, upgrades, transmission or hidden dependencies, which locates the causes in the system rather than the person.
• Howe, J. L., Adams, K. T., Hettinger, A. Z. and Ratwani, R. M. (2018). Electronic Health Record Usability Issues and Potential Contribution to Patient Harm. JAMA. doi:10.1001/jama.2018.1171 Screened 1.735 million safety reports from Pennsylvania and a mid-Atlantic academic system; 557, or 0.03 per cent, linked possible harm to a usability problem, most often data entry (27 per cent) or alerting (22 per cent). It is a floor.
• Schwappach, D., Hautz, W., Krummrey, G., Pfeiffer, Y. and Ratwani, R. M. (2025). EMR usability and patient safety: a national survey of physicians. npj Digital Medicine. doi:10.1038/s41746-025-01657-4 Surveyed 1,933 physicians. Multilevel modelling attributed 38 per cent of the variance in usability ratings to differences between systems and 51 per cent to hospital-level variation within a system, so most of the variation sits inside a product rather than between products.
• Ratwani, R. M., Savage, E., Will, A., et al. (2018). A usability and safety analysis of electronic health records: a multi-center study. Journal of the American Medical Informatics Association. doi:10.1093/jamia/ocy088 Twelve to 15 emergency physicians at each of four systems running one of two vendors completed six identical scenarios; time differed nine-fold and clicks eight-fold while error rates reached 50 per cent, so implementation as well as design shapes safety.
• Baysari, M. T., Westbrook, J. I., Richardson, K. L. and Day, R. O. (2011). The influence of computerized decision support on prescribing during ward-rounds: are the decision-makers targeted? Journal of the American Medical Informatics Association. doi:10.1136/amiajnl-2011-000135 Shadowed 14 speciality teams, 46 doctors, and interviewed 16 prescribers. Senior doctors rarely used the system while the juniors who entered orders ignored the alerts, so support reached clinicians who were not deciding.
• Sittig, D. F. and Singh, H. (2010). A new sociotechnical model for studying health information technology in complex adaptive healthcare systems. Quality and Safety in Health Care. doi:10.1136/qshc.2010.042085 Introduces an eight-dimension sociotechnical model: hardware and software, clinical content, the interface, people, workflow and communication, organisational features, external rules, and measurement and monitoring. Interdependent, they make a single cause hard to isolate.
• Han, Y. Y., Carcillo, J. A., Venkataraman, S. T., et al. (2005). Unexpected Increased Mortality After Implementation of a Commercially Sold Computerized Physician Order Entry System. Pediatrics. doi:10.1542/peds.2005-1287 Compared 1,942 children admitted for specialised care before and after a system was installed hospital-wide over six days; mortality rose from 2.80 to 6.57 per cent with an adjusted odds ratio of 3.28. The authors connect the rise to implementation circumstances rather than to the software alone.
• Ash, J., Berg, M. and Coiera, E. (2016). The Unintended Consequences of Health Information Technology Revisited. Yearbook of Medical Informatics. doi:10.15265/iy-2016-014 Revisits the literature and finds rich typologies but little data on frequency and impact. Identical systems produce different outcomes in different organisations, and implementation science is offered as the explanation.
• Fallon, A., Haralambides, K., Mazzillo, J. and Gleber, C. (2023). Addressing Alert Fatigue by Replacing a Burdensome Interruptive Alert with Passive Clinical Decision Support. Applied Clinical Informatics. doi:10.1055/a-2226-8144 Replaced a burdensome interruptive COVID alert with a passive order panel; alerts fell from 8,206 to 1,449 per week, an 80 per cent reduction, while precautions orders on symptomatic admitted patients rose from 23 to 61 per cent, so a design change can move burden and outcome together.
• Carayon, P., Wetterneck, T. B., Rivera-Rodriguez, A. J., et al. (2014). Human factors systems approach to healthcare quality and patient safety. Applied Ergonomics. doi:10.1016/j.apergo.2013.04.023 Sets out the SEIPS work-system model and its principles for redesigning health systems. Balancing the work system and treating workers as active and adaptive is the bridge to the work-system argument the next unit develops.
• Horsky, J., Kaufman, D. R., Oppenheim, M. I. and Patel, V. L. (2003). A framework for analyzing the cognitive complexity of computer-assisted clinical ordering. Journal of Biomedical Informatics. doi:10.1016/s1532-0464(03)00062-5 Combined an expert walkthrough of a commercial order-entry system with a simulated ordering task completed by seven clinicians. The configuration placed heavy cognitive demands on users, hardest on those without a working model of the system, so errors followed the distribution of the resources.