DRAFT FOR REVIEW BY APPOINTED CLINICAL SAFETY OFFICER — MUST BE REVIEWED, AMENDED AND SIGNED BY A GMC/NMC/HCPC-REGISTERED CLINICIAN WITH FORMAL DCB0129 CLINICAL SAFETY OFFICER TRAINING BEFORE USE.
CSO07 — Consolidated Hazard Log (All Five Solutions)
Document reference: BRITI-HAZLOG-001 Version: 0.9 (Draft for CSO review) Manufacturer: BritiAI Limited Applicable standard: DCB0129:2018 Status: Draft pending CSO sign-off
Scoring conventions
- Severity: Catastrophic (Cat) / Major (Maj) / Considerable (Con) / Minor (Min) / Negligible (Neg).
- Likelihood: Very High (VH) / High (H) / Medium (M) / Low (L) / Very Low (VL).
- Risk score (illustrative numeric): Severity 5..1 × Likelihood 5..1 (max 25).
- Acceptability: Unacceptable (U) / ALARP (A) / Acceptable (OK).
- Owner: R&D = BritiAI R&D Lead; CSO = BritiAI Clinical Safety Officer; PROD = Product Lead; ENG = Engineering Lead; SUB-V = Votee AI; SUB-B = Beever AI; TRUST = deploying trust CSO (joint).
All residual scores assume implementation of the listed controls. Acceptability is recommended; final acceptability sits with the CSO.
1. Scribe-On-Site (SCR-01 to SCR-10)
| ID | Hazard | Hazardous situation | Harm | Init Sev | Init Like | Init Score | Controls (Technical / Procedural / Training) | Res Sev | Res Like | Res Score | Accept | Owner |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| SCR-01 | Mis-transcription of drug name | Wrong drug recorded in signed note | Wrong prescription downstream; ADR | Maj | M | 12 | T: drug-lexicon biased ASR, drug-name confidence highlight, formulary lookup overlay. P: mandatory clinician sign-off; side-by-side transcript vs draft. Tr: drug-name verification module. | Maj | L | 8 | A | CSO/PROD |
| SCR-02 | Mis-transcription of dose/units | Wrong dose recorded | Over/under-dosing | Maj | M | 12 | T: numeric span detection and highlighting; unit normalisation. P: clinician sign-off. Tr: numeric verification module. | Maj | L | 8 | A | CSO/PROD |
| SCR-03 | Omission of clinically significant content | Symptom/finding missing from draft | Missed diagnosis / delayed care | Con | M | 9 | T: coverage indicator; transcript-to-draft anchor map. P: mandatory review of full transcript. Tr: omission-awareness module. | Con | L | 6 | A | CSO/PROD |
| SCR-04 | Fabrication (“hallucination”) in summary | Content in draft not in transcript | Wrong record; downstream error | Maj | M | 12 | T: grounded summarisation with span citations; fabrication probe in CI; ungrounded suppression. P: clinician sign-off. Tr: hallucination-awareness. | Maj | L | 8 | A | CSO/ENG |
| SCR-05 | Unauthorised / non-consented recording | Recording without consent | Privacy breach; loss of trust | Con | M | 9 | T: visible recording indicator; pre-record consent prompt. P: trust consent policy alignment. Tr: consent workflow. | Con | L | 6 | A | TRUST/PROD |
| SCR-06 | Speaker mis-attribution | Clinician statement attributed to patient | Wrong record of patient report | Con | M | 9 | T: diarisation with confidence; role tagging. P: clinician review of attribution. | Con | L | 6 | A | SUB-V/CSO |
| SCR-07 | Automation bias at sign-off | Clinician signs off plausible but flawed draft | Wrong record propagates | Maj | M | 12 | T: uncertainty surfacing; minimum-review-time prompt; required confirmation of safety-critical fields. P: edit-distance aggregate monitoring (not performance mgmt). Tr: human factors. | Maj | L | 8 | A | CSO |
| SCR-08 | Mis-routing of note to wrong patient | Note saved against wrong record | Wrong-patient documentation | Maj | L | 8 | T: patient-record confirmation step with two patient identifiers. P: EHR-side checks. Tr: identification SOP. | Maj | VL | 4 | OK | ENG/TRUST |
| SCR-09 | Loss/corruption of provenance audit | Inability to verify transcript/source | Investigation hampered | Con | L | 6 | T: immutable audit store; integrity hashing; replication. P: backup and DR. | Con | VL | 3 | OK | ENG |
| SCR-10 | Behavioural drift after model update | New version degrades safety-critical accuracy | Increased SCR-01/02/04 risk | Maj | M | 12 | T: pre-release evaluation; canary; rollback. P: CSO release sign-off. Tr: release notes. | Maj | L | 8 | A | CSO/ENG |
2. WardFlow Copilot (WF-01 to WF-10)
| ID | Hazard | Hazardous situation | Harm | Init Sev | Init Like | Init Score | Controls (T/P/Tr) | Res Sev | Res Like | Res Score | Accept | Owner |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| WF-01 | Erroneous TTO drug/dose/route/frequency | Pharmacist passes incorrect TTO | ADR; readmission | Maj | M | 12 | T: formulary-bound drafting; dose range guards; duplicate/interaction flags; reconciliation panel. P: pharmacist verification. Tr: reconciliation SOP. | Maj | L | 8 | A | CSO/ENG |
| WF-02 | Omission of allergy/alert in summary | Allergy not surfaced post-discharge | ADR; anaphylaxis | Cat | L | 10 | T: mandatory allergy field with active confirmation; EHR allergy join. P: consultant sign-off. Tr: allergy module. | Cat | VL | 5 | A | CSO |
| WF-03 | Premature discharge prompting | Patient flagged ready when criteria unmet | Unsafe discharge | Maj | M | 12 | T: signal-only, no auto action; criteria checklist; coordinator dashboard. P: MDT decision retained. Tr: coordinator SOP. | Maj | L | 8 | A | CSO/PROD |
| WF-04 | Wrong-patient/wrong-admission attribution | Summary built from wrong record | Wrong documentation; wrong care | Maj | L | 8 | T: patient/admission key checks; visible patient banner. P: clinician confirmation. | Maj | VL | 4 | OK | ENG/TRUST |
| WF-05 | Stale EHR data at draft time | Recent obs not reflected | Decision on stale data | Con | M | 9 | T: data-recency indicator; refresh on open; minimum-freshness gate for safety-critical fields. P: clinician review. | Con | L | 6 | A | ENG |
| WF-06 | Agent tool misuse (out-of-scope action) | Agent attempts action beyond allow-list | Unauthorised system change | Maj | L | 8 | T: hard tool allow-list; deterministic guards; sandbox; deny-by-default. P: audit review. | Maj | VL | 4 | OK | ENG/CSO |
| WF-07 | Mis-routing for sign-off | Sent to wrong consultant/delegate | Delay; sign-off by inappropriate clinician | Con | M | 9 | T: rota-aware routing; delegation rules; escalation timer. P: ward sign-off SOP. | Con | L | 6 | A | PROD/TRUST |
| WF-08 | Automation bias in pharmacist sign-off | Pharmacist passes plausible flawed TTO | ADR | Maj | M | 12 | T: change-highlighting vs inpatient chart; explicit confirm of high-risk drugs. P: two-person check for high-risk. Tr: pharmacist module. | Maj | L | 8 | A | CSO |
| WF-09 | Loss of audit trail | Cannot reconstruct agent steps | Investigation hampered | Con | L | 6 | T: immutable log; integrity hashing. P: DR. | Con | VL | 3 | OK | ENG |
| WF-10 | Behavioural drift after model update | Summary/TTO behaviour degrades | Increased WF-01..03 risk | Maj | M | 12 | T: pre-release eval; canary; rollback. P: CSO sign-off. | Maj | L | 8 | A | CSO/ENG |
3. Atlas for Trusts (ATL-01 to ATL-10)
| ID | Hazard | Hazardous situation | Harm | Init Sev | Init Like | Init Score | Controls (T/P/Tr) | Res Sev | Res Like | Res Score | Accept | Owner |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ATL-01 | Stale/superseded guidance retrieved | User acts on outdated policy | Wrong process; potential clinical harm | Con | M | 9 | T: supersession metadata; visual badges; suppression of superseded sources. P: knowledge-owner curation. Tr: induction banner. | Con | L | 6 | A | TRUST/CSO |
| ATL-02 | Incorrect attribution (citation to source not containing claim) | User trusts unfounded statement | Wrong action | Con | M | 9 | T: span-grounded composition; ungrounded suppression; citation validator. P: knowledge-owner audit. | Con | L | 6 | A | SUB-B/ENG |
| ATL-03 | Misuse for direct clinical decision-making | User queries patient-specific decision | Inappropriate decision support | Maj | M | 12 | T: query classifier with nudge/redirect; banner. P: trust SOP. Tr: scope module. | Maj | L | 8 | A | CSO/PROD |
| ATL-04 | Partial retrieval missing critical caveat | Caveat omitted from response | Unsafe action | Con | M | 9 | T: response-completeness checks; “consult source” banner. P: knowledge-owner review. | Con | L | 6 | A | ENG/CSO |
| ATL-05 | Role-access leakage (e.g. M&M to unauthorised role) | Restricted content surfaced | Confidentiality breach | Con | L | 6 | T: role-based access at retrieval; audit. P: trust role mgmt. | Con | VL | 3 | OK | ENG/TRUST |
| ATL-06 | Misleading composition across sources | Aggregated answer distorts meaning | Wrong action | Con | M | 9 | T: single-source preference; conflict surfacing. P: knowledge-owner review. | Con | L | 6 | A | ENG |
| ATL-07 | Loss of version awareness in response | User cannot tell effective date | Wrong action | Min | M | 6 | T: mandatory version + effective date in citation. | Min | L | 4 | OK | ENG |
| ATL-08 | Confidence overstatement | Response over-confident vs evidence | Reliance | Con | M | 9 | T: calibrated hedging language; “consult source” banner. | Con | L | 6 | A | CSO/ENG |
| ATL-09 | Prompt injection via ingested document | Malicious content alters behaviour | Misleading output | Con | L | 6 | T: ingestion sanitisation; instruction isolation; provenance gating. P: knowledge-owner vetting. | Con | VL | 3 | OK | ENG/CSO |
| ATL-10 | Drift after model update | Retrieval/composition behaviour changes | Quality degradation | Con | M | 9 | T: eval suite incl regression set; canary; rollback. P: CSO sign-off. | Con | L | 6 | A | CSO/ENG |
4. MAGIC-NHS (MAG-01 to MAG-10)
| ID | Hazard | Hazardous situation | Harm | Init Sev | Init Like | Init Score | Controls (T/P/Tr) | Res Sev | Res Like | Res Score | Accept | Owner |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| MAG-01 | Training data egress | Identifiable data leaves trust boundary | IG breach; patient harm | Maj | L | 8 | T: no-egress architecture; egress firewall; redact telemetry. P: IG sign-off. Tr: engineer module. | Maj | VL | 4 | OK | ENG/TRUST |
| MAG-02 | Insufficient de-identification | PII present in training corpus | IG breach | Maj | M | 12 | T: de-id pipeline; leakage scanner; held-out red-team set. P: trust IG sign-off. | Maj | L | 8 | A | SUB-V/TRUST |
| MAG-03 | Behavioural drift weakening refusal | Fine-tuned model answers out-of-scope queries unsafely | Downstream clinical harm | Maj | M | 12 | T: refusal eval suite; gating thresholds. P: CSO + trust CSO promotion review. | Maj | L | 8 | A | CSO |
| MAG-04 | Fabrication regression post-fine-tune | Model fabricates clinical content | Downstream harm via SCR-04/ATL-02 | Maj | M | 12 | T: fabrication eval suite; gating thresholds. P: promotion review. | Maj | L | 8 | A | CSO |
| MAG-05 | Evaluation gap | Eval fails to detect regression | Unsafe artefact promoted | Maj | M | 12 | T: layered eval (capability, safety, bias); periodic eval refresh. P: CSO review of eval scope. | Maj | L | 8 | A | CSO/ENG |
| MAG-06 | Inappropriate promotion | Artefact promoted without joint sign-off | Unsafe deployment | Maj | L | 8 | T: two-person rule; promotion record; signed model card. P: governance audit. | Maj | VL | 4 | OK | CSO/TRUST |
| MAG-07 | Reproducibility loss | Cannot reproduce run for investigation | Hampered incident response | Con | M | 9 | T: deterministic config; corpus + checkpoint hashing; logged seeds. P: artefact retention. | Con | L | 6 | A | ENG |
| MAG-08 | Bias amplification | Demographic bias amplified by fine-tune | Differential harm | Maj | M | 12 | T: bias probe suite; subgroup eval. P: promotion review. | Maj | L | 8 | A | CSO |
| MAG-09 | Supply-chain compromise of base model/deps | Tampered base/dependency | Compromised artefact | Maj | L | 8 | T: signed artefacts; SBOM; provenance checks. P: vendor mgmt. | Maj | VL | 4 | OK | ENG |
| MAG-10 | Model Card inaccuracy | Card misrepresents limitations | Unsafe downstream use | Con | M | 9 | T: card template auto-populated from eval; manual review. P: CSO sign-off of card. | Con | L | 6 | A | CSO |
5. Trial Concierge (TRI-01 to TRI-10)
| ID | Hazard | Hazardous situation | Harm | Init Sev | Init Like | Init Score | Controls (T/P/Tr) | Res Sev | Res Like | Res Score | Accept | Owner |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| TRI-01 | False-positive eligibility flag | Patient approached for ineligible trial | Distress; inappropriate approach; protocol deviation | Con | M | 9 | T: per-criterion evidence; conservative confidence threshold. P: mandatory clinician sign-off; PI oversight. Tr: GCP module. | Con | L | 6 | A | CSO/PROD |
| TRI-02 | False-negative eligibility flag | Eligible patient missed | Loss of access to investigational therapy | Con | M | 9 | T: transparent criteria mapping; broaden-search option; periodic recall audit. P: PI oversight. | Con | L | 6 | A | CSO/PROD |
| TRI-03 | Protocol Q&A misinterpretation | Clinician acts on incorrect Q&A | Protocol deviation; patient harm | Maj | M | 12 | T: citation-grounded responses; version pin; ungrounded suppression. P: protocol owner review. Tr: GCP module. | Maj | L | 8 | A | CSO/ENG |
| TRI-04 | Stale protocol version used | Screening against superseded protocol | Deviation; harm | Maj | M | 12 | T: version pin; supersession warnings; ingestion SLA. P: R&D office process. | Maj | L | 8 | A | TRUST/CSO |
| TRI-05 | EHR data drift / incompleteness | Screening on incomplete data | Wrong eligibility | Con | M | 9 | T: recency indicators; coverage report. P: clinician review. | Con | L | 6 | A | ENG |
| TRI-06 | Privacy escalation outside delegation log | Patient data to unauthorised staff | IG breach | Maj | L | 8 | T: delegation-log RBAC; audit. P: R&D governance. | Maj | VL | 4 | OK | ENG/TRUST |
| TRI-07 | Automation bias in clinician sign-off | Clinician approves flawed candidate | Inappropriate approach | Con | M | 9 | T: per-criterion evidence required; explicit confirm. Tr: bias module. | Con | L | 6 | A | CSO |
| TRI-08 | Wrong-patient evidence attribution | EHR evidence mis-bound to patient | Wrong eligibility decision | Maj | L | 8 | T: identity binding checks; banner. | Maj | VL | 4 | OK | ENG |
| TRI-09 | Cross-trial context contamination | Criteria from trial A influence trial B | Wrong decisions | Con | L | 6 | T: hard context isolation per trial; audit. | Con | VL | 3 | OK | ENG/CSO |
| TRI-10 | Behavioural drift after model update | Screening/Q&A degrade | Increased TRI-01..04 risk | Maj | M | 12 | T: pre-release eval; canary; rollback. P: CSO sign-off. | Maj | L | 8 | A | CSO/ENG |
Summary
- Total hazards logged: 50 (10 per solution).
- Initial risks predominantly Major × Medium or Considerable × Medium, reflecting the AI-mediated nature of the workflows.
- After designed controls, no residual risk remains in the Unacceptable band; the majority sit at ALARP, with a minority at Acceptable.
- ALARP entries require explicit CSO acceptance; rationale for acceptance is to be recorded in the CSCR sign-off.
Prepared by: BritiAI Quality and Clinical Safety function. To be reviewed, amended and signed by: Appointed Clinical Safety Officer.
CSO name: _________________________ Registration body and number: _________________________ Signature: _________________________ Date: _________________________