DRAFT FOR REVIEW BY APPOINTED CLINICAL SAFETY OFFICER — MUST BE REVIEWED, AMENDED AND SIGNED BY A GMC/NMC/HCPC-REGISTERED CLINICIAN WITH FORMAL DCB0129 CLINICAL SAFETY OFFICER TRAINING BEFORE USE.
CSO03 — Clinical Safety Case Report (CSCR): WardFlow Copilot
Document reference: BRITI-CSCR-WARDFLOW-001 Version: 0.9 (Draft for CSO review) Manufacturer: BritiAI Limited Applicable standard: DCB0129:2018 Status: Draft pending CSO sign-off
1. Executive Summary
WardFlow Copilot is an agentic discharge orchestration assistant that supports ward-based multidisciplinary teams to prepare safe, timely discharges. It assembles draft discharge summaries from EHR data, prepares draft TTO (To Take Out / medicines to take home) requests for pharmacist verification, flags blockers to discharge coordinators, and routes the discharge artefact to the responsible consultant or delegate for sign-off. WardFlow Copilot does not autonomously discharge a patient, does not autonomously prescribe, and does not bypass any existing pharmacist or clinician checks. Every safety-critical artefact requires identified human sign-off via existing trust workflows.
This CSCR documents the intended use, environment, claims, hazards (see CSO07 entries WF-01 to WF-10), and the basis on which release is proposed subject to CSO sign-off and trust DCB0160 assurance.
2. Solution Description
WardFlow Copilot integrates with the trust’s EHR (read access to clinical data; write access scoped to draft artefacts only, never to active medication orders) and with pharmacy and discharge coordination workflows where available. Components:
- Discharge summary drafter. Generates a structured discharge summary draft from inpatient EHR data using a clinical LLM hosted within the trust boundary.
- TTO drafting agent. Proposes a TTO list reconciled against the inpatient drug chart and admission medication, presented for pharmacist verification before any onward action.
- Blocker detection. Surfaces likely blockers (outstanding investigations, pending allied health input, social care arrangements) to the discharge coordinator dashboard.
- Routing and sign-off. Routes the draft summary to the responsible consultant or delegated clinician for review, edit and electronic sign-off via the EHR’s native sign-off mechanism.
- Audit trail. Immutable record of each agent action, the underlying evidence retrieved, and the human decision at each gate.
3. Intended Use
WardFlow Copilot is intended to support ward-based teams in preparing discharge artefacts. It is intended to reduce documentation burden, surface blockers earlier, and standardise the structure of discharge summaries. It is not intended to:
- Autonomously discharge any patient.
- Issue or authorise prescriptions or TTOs without pharmacist and clinician sign-off.
- Determine clinical readiness for discharge.
- Replace MDT decision-making.
4. Intended Users
- Registered medical clinicians (responsible consultant and delegated juniors) for review and sign-off of discharge summaries.
- Registered pharmacists for TTO verification.
- Discharge coordinators (registered nurses or band-equivalent staff) for blocker management.
- Ward clerks and administrators for non-clinical configuration only.
5. Environment of Use
UK NHS acute inpatient settings — adult and paediatric wards where the trust has confirmed integration with the local EHR and pharmacy systems and where local SOPs have been updated to reflect WardFlow involvement. Not intended for use in critical care, maternity intrapartum, or specialist mental health inpatient settings without bespoke configuration and additional clinical safety assessment.
6. Clinical Claims
BritiAI claims that WardFlow Copilot:
- Produces a structured draft discharge summary suitable for clinician review and edit.
- Produces a draft TTO list suitable for pharmacist verification.
- Surfaces candidate discharge blockers to support coordinator workflow.
- Maintains a complete audit trail of agent reasoning and human gates.
Explicit non-claims
WardFlow Copilot does not claim to:
- Be a medical device, nor to provide diagnosis, prognosis or treatment recommendation.
- Replace pharmacist verification of TTOs.
- Replace consultant or delegated clinician responsibility for discharge sign-off.
- Detect all clinically relevant blockers; coordinators retain full responsibility for their list.
- Operate safely in clinical settings outside those listed in §5.
7. Risk Envelope
Principal hazard categories (see CSO07, WF-01 to WF-10):
- Erroneous medication summary in the draft TTO or summary (wrong drug, dose, route, frequency, omission, duplication).
- Missed safety-critical information in the discharge summary (allergies, alerts, anticoagulation, safeguarding flags, outstanding results).
- Premature discharge prompting — surfacing a patient as ready for discharge when clinical or social criteria are unmet.
- Incorrect attribution of clinical events to the wrong admission or wrong patient.
- Stale data at the point of draft generation (e.g. recent observations not yet ingested).
- Agent tool misuse — an agent step taking an action outside its sanctioned scope.
- Mis-routing for sign-off (wrong consultant, wrong delegate).
- Automation bias in pharmacist or clinician sign-off due to plausible draft.
- Loss of audit trail affecting later verification or incident investigation.
- Behavioural drift following model update affecting summary structure or TTO logic.
8. Risk Control Strategy
By hierarchy:
- Elimination by design. No autonomous prescribing. No autonomous discharge. TTOs route to pharmacist verification using existing trust pharmacy workflow.
- Reduction by design. Hard schema constraints on TTO drafting (drug must match formulary entry; dose must fall within configured ranges; duplicates and interactions flagged). Reconciliation panel showing admission, inpatient and proposed TTO medications side-by-side. Allergy and alert fields prominently surfaced and require active confirmation. Agent tool calls confined to a sanctioned allow-list with deterministic guards.
- Protective measures. Confidence flagging on each summary field; provenance links from any summary statement to the underlying EHR record; mandatory “do not discharge” override available to any team member with audit; visible recency indicator on ingested data.
- Information for safety. Mandatory role-specific training; clear release notes; documented known limitations including any clinical settings outside §5 scope.
9. Residual Risks Summary
Subject to CSO judgement, after controls:
- Medication-related residual risks remain the highest priority. Despite reconciliation and pharmacist gating, plausible draft errors could increase automation bias. Residual risk is amber and ALARP justification is sought based on the unchanged role of the pharmacist verification step and the active reconciliation UI.
- Premature discharge prompting is reduced to a coordinator-facing signal only with no automated action. Residual risk amber.
- Stale data and agent tool misuse carry residual risks requiring CSO acceptance based on the audit and guard architecture.
10. Assumptions and Dependencies
- The trust operates a pharmacist-led TTO verification process.
- The EHR exposes a stable, timely interface for the data classes used by WardFlow Copilot.
- The trust has updated SOPs to reflect WardFlow involvement, including escalation paths.
- The trust CSO performs DCB0160 assessment reflecting local workflows.
11. Clinical Safety Verification
- Functional testing against safety-critical requirements.
- Medication reconciliation evaluation against curated test cases including known high-risk patterns (anticoagulants, insulin, opioids, antimicrobials, paediatric dosing where applicable).
- Adversarial evaluation including prompt-injection probes embedded in free-text EHR fields.
- Human factors testing of pharmacist and clinician sign-off flows.
- Penetration testing of EHR integration interfaces.
Evidence is held in the BritiAI QMS.
12. Post-Deployment Monitoring
- Rate and category of clinician edits to draft summaries.
- Rate and category of pharmacist amendments to draft TTOs.
- Coordinator override rate on blocker flags.
- Time-to-sign-off distribution; sign-offs under minimum review threshold.
- Any incident, near-miss or complaint relating to discharge documentation.
A safety review per deploying trust is conducted at three months post go-live and annually thereafter.
13. Change Control
Material changes that trigger re-assessment include: change to the discharge summary or TTO drafting model; change to the agent tool allow-list; change to the EHR integration surface; introduction of new clinical settings beyond §5; change to the sign-off workflow.
14. Statement of Conformance
Subject to CSO review and sign-off, BritiAI confirms that the clinical risk management activities undertaken for WardFlow Copilot have been performed in accordance with DCB0129:2018. The Hazard Log (CSO07), the Clinical Risk Management Plan, and this Clinical Safety Case Report together constitute the Clinical Safety Case for the release identified above.
Linked artefacts: CSO01, CSO07 (WF-01 to WF-10), CSO08, BRITI-CRMP-WARDFLOW-001, BRITI-IFU-WARDFLOW-001, BRITI-TRAIN-WARDFLOW-001.
CSO name: _________________________ Registration body and number: _________________________ Signature: _________________________ Date: _________________________