Hazard scenarios and evidence challenges
Original hazard and evidence challenge set
The scenarios below are analytical examples designed for this pack. They are not a national generic hazard log, do not establish that a defect exists, and do not assign risk scores. Adapt each to the product's intended use, causes and local control environment. Search for equivalent meaning, not exact phrases.
| Scenario | Causal chain to investigate | Control/evidence challenge | Relevant GP controls |
|---|---|---|---|
| H01 Wrong patient | Similar identifiers or stale context → entry/retrieval for another person → inappropriate care | Test parallel patients, context switching, demographic conflicts and temporary identifiers. | GP-040, 116–119, 173 |
| H02 Hidden amendment | Committed fact changes → later user assumes original context → inappropriate treatment | Demonstrate old/new state, actor, entry/amendment times and protected history. Include UI, API and privileged routes. | GP-022–037 |
| H03 Attachment substitution | File replaced while metadata appears unchanged → clinician trusts earlier letter → wrong plan | Compare stored file identity/content with historical retrieval and audit. Test annotations and coded extracts separately. | GP-023, 026, 028, 110–115 |
| H04 Incomplete scanning | Page omitted/reordered or image unreadable → key instruction absent → delayed/incorrect care | Use multi-page, duplex, faint and rotated samples. Check page count, legibility and patient matching. | GP-110, 111, 138, 139 |
| H05 Coding meaning changes | Mapping or template selects wrong concept/negation → false clinical history → unsafe decision | Compare source concept, map version, display text, episode state and downstream interpretation. | GP-041–050, 120 |
| H06 Unit conversion | Numeric result preserved with wrong unit/precision → wrong threshold interpretation → harmful action | Test representative unit conversions, bounds, rounding, absent units and reference ranges. | GP-048–050, 141, 145 |
| H07 Allergy ambiguity | Blank/unknown treated as “no allergy” or import omits reaction → contraindicated treatment | Test unknown, none known, active allergy, intolerance, historic/resolved and conflicting imports. | GP-050, 124–129, 162 |
| H08 Medication state confusion | Historical/externally prescribed item appears active or cancellation fails → duplicate/omitted treatment | Follow item identity, author, status, quantity, issue/cancel and cross-system reconciliation. | GP-124–129, 166, 167 |
| H09 Authorisation failure | Wrong role or expired prescribing authority → inappropriate transaction → patient harm | Test least-privileged roles, changed organisations, revoked sessions and professional restrictions. | GP-020, 021, 125, 191 |
| H10 Stale shared view | Cache/API omits recent change → user acts on old information → harmful care | Display source and currency; measure propagation; simulate stale cache and partial source failure. | GP-103–105, 150, 151, 174 |
| H11 False completeness | Partial response looks like whole record → absent fact interpreted as absent condition → unsafe action | Inject missing sections, unsupported resources, pagination and timeouts; inspect user-visible completeness cues. | GP-049, 151, 163, 173 |
| H12 Wrong document coding | Summarised local code loses qualification → downstream alert/risk logic wrong → harmful decision | Trace code to source document and reviewer; test disagreement/correction of the summary. | GP-023, 112, 140, 141 |
| H13 Lost referral | Send succeeds at transport layer but referral rejected → no specialist care → deterioration | Trace delivery, business acceptance, rejection, responsible team and escalation. | GP-130–132, 172 |
| H14 Unreviewed result | Result received during absence or queue failure → no responsible reviewer → delayed diagnosis | Test amended/urgent results, absent staff, shared inboxes, reassignment and closure. | GP-135–137, 144, 145, 168, 169 |
| H15 Orphaned task | Staff move/leave or task is deleted → follow-up disappears → missed care | Exercise reassignment, deletion audit, overdue work and handover. Do not assume optional overdue alerts are nationally mandatory. | GP-135–137 |
| H16 Duplicate transaction | Timeout and retry create duplicate order/prescription/event → repeated intervention → harm | Prove idempotency/deduplication for the interface's actual semantics and recovery paths. | GP-105, 128, 172, 173 |
| H17 Out-of-order update | Older message overwrites newer fact → incorrect current record → unsafe decision | Simulate delayed, repeated, conflicting and amended messages; inspect ordering/conflict resolution. | GP-026–028, 105, 173 |
| H18 Migration degradation | Bulk transfer loses relationships, documents or work → false history or missed follow-up → harm | Reconcile record classes and clinically important patient samples, not merely row counts. | GP-060–067 |
| H19 GP2GP incompleteness | Transfer accepted but degraded/unintegrated content not reviewed → missing clinical history → harm | Examine attachment exceptions, medication/allergy handling, integration state and outstanding actions. | GP-160–162 |
| H20 Downtime backlog | Outage creates paper/local records or missed transactions → incomplete reconciliation → unsafe subsequent care | Exercise downtime capture, duplicate checking, restore, queue replay and named backlog clearance. | GP-070–074, 082 |
| H21 Restore inconsistency | Database restored without matching attachments/audit/events → misleading record → unsafe action | Restore coherent recovery points; reconcile document store, audit, queues and external transaction state. | GP-031, 072–078 |
| H22 Privileged alteration | Direct database/support change bypasses application audit → clinical fact changes invisibly → unsafe care | Seek support-access and change controls, detection and recovery evidence; do not assume the UI audit covers every path. | GP-030, 033, 077 |
| H23 Clock/chronology error | Incorrect time zone, DST or backdating confuses sequence → old data treated as current → unsafe action | Compare event, entry, receipt and audit times; simulate clock drift and cross-system ordering. | GP-026, 078, 123, 174 |
| H24 Proxy/safeguarding exposure | Wrong proxy scope or child transition discloses sensitive information → coercion/psychological harm | Test authority changes, expiry, per-person restrictions and exported views with IG/clinical review. | GP-118, 148, 149, 180–191 |
| H25 Inaccessible communication | Adjustment/communication needs not acted on → instruction not understood or care missed → harm | Exercise booking, letters, messages, referral and consultation with representative access needs. | GP-142, 143, 189, 190, 193 |
| H26 Incorrect decision support | Wrong rule/version, missing input or unit error → misleading recommendation → wrong treatment | Verify intended population, data age, exclusions, clinical validation, overrides and monitoring. | GP-140, 141, 187 |
| H27 Urgent online request delayed | Urgent submission joins routine queue or is abandoned → no timely response → deterioration | Test hours/closure, escalation, receipt confirmation, human responsibility and recovery. | GP-146, 147 |
| H28 Release/configuration change | New rule/API/template alters behaviour after safety approval → previously controlled cause recurs → harm | Link safety review to exact build, configuration, dependencies, regression evidence and rollback. | GP-008, 013, 090–105 |
| H29 Malicious file/cyber outage | Compromised attachment/account disrupts records → unavailable or corrupted care data → harm | Seek security testing and clinical continuity evidence; connect to actual clinical consequences. | GP-033, 070–078, 181, 186 |
| H30 Misleading summary/AI output | Generated text omits/changes important clinical facts → summary treated as authoritative → unsafe care | If feature exists, assess provenance, human verification, model/version changes and device status. | GP-023, 049, 140, 151, 187 |
| H31 Misapplied opt-out | Secondary-use setting suppresses direct-care information → incomplete care view → unsafe decision | Trace purpose-specific settings and outputs; obtain IG interpretation. | GP-184, 151 |
| H32 Exit/decommissioning loss | System retired before usable access/transfer established → records unavailable → missed care | Exercise retention, retrieval, export interpretation, support closure and accountable handover. | GP-013, 064–067, 106, 183 |
| H33 Adjustment state suppressed or stale | An access filter, mapping or unrevised flag hides a current communication/adjustment need or presents an obsolete one → staff use an unsuitable care or communication route → missed care, misunderstanding or distress. | Trace current needs through recording, flag display, sharing and review; test conflicts, changed needs and permitted restrictions using synthetic records. More specific extension of H25; combine if equivalent causes are already analysed. | GP-189, GP-190, GP-232 |
| H34 Disconnected clinical sources out of step | Where the clinical product supports disconnected use, a local record is paired with older medication/reference/rule data after a partial update → guidance appears current despite mismatched inputs → inappropriate prescribing or treatment. | Record the versions and freshness of each clinical source, test partial updates and reconnection, and demonstrate safe degradation, conflict handling and release/configuration checks. Conditional elaboration of H10, H26 and H28; it concerns the clinical product, not this Copilot reference pack. | GP-045, GP-046, GP-090, GP-104, GP-174, GP-187 |
| H35 Transferred safety control has no implementing owner | A supplier assigns urgent-event monitoring or follow-up to the receiving organisation, while local procedures assume the supplier performs it → neither acts on the event → delayed diagnosis or treatment. | Trace each transferred control to an accepting organisation, operating procedure, competent role and relevant verification; exercise absence and escalation paths. Cross-organisational cause that may extend H13/H14; avoid duplicate rows where already covered. | GP-001, GP-007, GP-012, GP-014, GP-015, GP-172 |
Deep challenge: “changes cannot happen without being known”
Break the claim into independently testable questions:
- Prevention: Who can amend a committed entry or stored attachment through each interface and support route?
- Historical content: What original content can an authorised investigator recover, including document bytes and clinically significant relationships?
- Attribution: Can the investigator identify the acting user/service, authority, organisation, affected item, chronology and action?
- Audit protection: What prevents the acting user or ordinary administrator from removing the evidence? How are database-level events covered?
- Visibility: Is the fact of amendment/deletion visible in the relevant clinical view, audit view or back-office tool? Identify which.
- Notification: Which specific events create alerts, to whom, within what governed process? Do not infer notification for every edit.
- Clinical acknowledgement: If an amended result or instruction affects an earlier decision, who checks the clinical implications and records action?
- Downstream propagation: What happens to previously sent documents, cached records, external coded extracts, patient access and prior printed copies?
The desired evidence is a demonstration on the relevant product baseline, with test inputs, expected results and actual results. Read-only views, PDFs, encryption, a hash, a backup, an audit entry and a digital signature provide different protections. None alone establishes all eight properties. A hash is an integrity check only within a trustworthy comparison/reference process; a signature's assurance depends on identity, keys and validation. These are engineering distinctions, not claims that DSIC universally mandates a particular cryptographic implementation.