Clinical Safety (workflow slice)

The chart that catches what you're about to miss.

The clinical-safety module ships the *workflow-enforcement* layer of the full Accelerando Clinical README — the part that surfaces what the EHR failed to close. No clinical decision support. No allergy checkers, no drug-drug interaction database, no renal-dose adjustment engine, no USPSTF screening logic. Those are FDA-regulated territory; they belong to Epic + a 510(k). What ships here is the operational discipline that keeps things from silently rotting.

Three signals, one dashboard.

The safety dashboard

Four counters, four drill-down tables, one screen:

| Counter | What it counts | Rule | |---|---|---| | Overdue orders | ClinicalOrder records still ordered past their priority-specific SLA | STAT > 60 min, urgent > 4 h, routine > 24 h | | Unsigned notes | ClinicalNote records in draft state | Drafted > 24 hours ago | | Open criticals | CriticalFinding records (radiology, slice C) | No acknowledged_at timestamp | | Pending lab releases | LabResult records (patient portal, slice D) | Flag = critical, released_at still null |

Each counter shows red when > 0, green at zero. The drill-down tables show the top 10 offenders across each dimension. This is the "chart that catches" — one screen, in the provider's line of sight at every login.

STAT order SLAs

Placing a clinical order at STAT priority arms a 60-minute clock. orderSlaBand in src/clinical-safety.ts:

elapsed ≥ threshold    → overdue
elapsed ≥ 0.75 × thr   → warn
otherwise              → fresh

Thresholds: STAT = 60 min, urgent = 4 h, routine = 24 h. The band drives the pill color on the Clinical orders view; the *overdue* set is what the safety dashboard picks up.

Fulfilling an order (medication administered, lab result received, imaging completed) stops the clock. Cancelling does the same, with a reason on the record.

24-hour signature reminder

Every draft note in the audit log has a drafted_at timestamp. noteAgeBand runs the same three-band calc:

hours ≥ 24  → overdue
hours ≥ 18  → warn
otherwise   → fresh

Signing the note (sign_clinical_note) stops the clock and locks the note as immutable — further edits require a documented addendum. That's how the audit log stays honest: once signed, edits are visible as separate records with their own timestamps.

Cross-module rollup

The safety dashboard is the single place a hospital-shift provider looks to see everything hanging on their attention across every module:

• ClinicalOrder — this module
• ClinicalNote — this module
• CriticalFinding — radiology (slice C)
• LabResult (unreleased critical) — patient portal (slice D)

That's the whole benefit of the audit-log-as-DB thesis (doc 13): a single query across four entity tables gives you the definitive "what's still open" list. No inbox, no worklist, no unread indicator — just the git-log projection asking one question consistently.

What's wired

| Entity | Purpose | |---|---| | ClinicalOrder | Medication/lab/imaging/referral order with priority + SLA state | | ClinicalNote | Draft-then-sign documentation with 24h reminder |

Tools (8): list_clinical_orders, create_clinical_order, fulfill_clinical_order, cancel_clinical_order, list_clinical_notes, draft_clinical_note, sign_clinical_note, safety_dashboard.

What's NOT wired (and why)

Deliberately out of scope for this slice:

• Allergy conflict checker (RxNorm cross-sensitivity) — FDA-regulated CDS. Epic ships this; we don't compete with it.
• Drug-drug interaction database — same. Interruptive CDS is a regulated device.
• PDMP query enforcement — state-regulated (each state has its own PDMP with query API). Lives in the pharmacy workflow slice (slice G).
• Renal/hepatic dose adjustment — clinical CDS, SaMD territory.
• USPSTF screening engine — clinical judgment about which patients qualify.
• AI-drafted SOAP notes / differential diagnosis — separate slice (content generation, not workflow).

The pitch is unambiguous: we do the workflow the EHR fails at. We don't do the CDS the EHR was built for. That's the boundary that keeps the module shippable without a 510(k) trail and useful as the ops layer *above* a certified EHR.