A hospital number identifies a person across every visit, admission, prescription and result. Everything here is built around keeping that true — because two people sharing one is not a duplicate row, it is one person's allergy list attached to another's bloodstream.
A failed sterile load whose packs are already on shelves. A ventilator overdue its check. A death waiting past its review window. Each of those is known by this system at the moment it becomes true, and in every hospital product they wait in the module that found them for somebody to open it. Here they reach the person whose job it is. There is no dismiss: an item goes when the thing behind it is fixed. You can record that you are on it, which names you, moves it below the things nobody has taken, and lapses after four hours. Nobody is shown what they cannot act on, because a nurse shown a broken cistern learns to ignore the indicator and the next thing it shows her is a potassium of seven. Nothing here decides what is wrong — every check calls the same function the module’s own screen calls, so the two can never disagree. And if a check cannot run, it says so rather than showing a short list that looks like a clean bill of health.
The register everything else keys off. Search by name, hospital number or phone and get the person before you have finished typing. Numbers are allocated by the server and never reused.
Drawn first, in red, above the demographics — because a clinician opening a record is often about to prescribe. “No history taken” and “recorded: none” are shown differently, since an empty field nobody filled in is not a statement.
The same person arrives without their card and is registered twice. Merging keeps both records, points the duplicate at the survivor, and combines the allergy lists — the duplicate may be the only place somebody wrote down the penicillin reaction.
Days under a month, months under two years, years after that. “0 years old” is not an age anybody doses on, and paediatric dosing is calculated from this number.
The Ayushman Bharat health account is recorded and checked for shape when a patient has one. A patient without one is not a lesser patient — refusing a registration for want of a national id is how the real record ends up on paper.
The appointment book and the waiting room on one screen. A slot belongs to one patient — the clash check runs on the server, because two receptionists both saw 10:15 free a second ago and only the server sees both.
Somebody already at the desk is not asked to invent a time. They take a token and join the queue, absorbed between booked patients rather than holding a slot that would clash.
Ordered by when people actually arrived, not by appointment time. A 10:00 who arrives at 11:20 is behind the 10:30 who arrived at 10:25 — anything else calls somebody who has not turned up.
The note, the vitals and the prescription. A signed note is final — corrections afterwards are addenda with their own author and time, because a record that can be altered later cannot be relied on by whoever reads it next week.
A drug matching a live allergy is flagged as it is typed and cannot be signed unless the line is explicitly acknowledged. The check runs again on the server against the patient as they are at that moment — a draft written this morning is refused if the allergy was added at lunchtime.
Systolic and diastolic held apart, ranges checked, and an alarming reading flagged rather than refused — a systolic of 210 is not a typing error, and software that argues with it gets it written on paper instead.
Batches with expiry dates, not a single stock number. Nothing expired leaves the shelf — refused, not warned about, because expiry is the one property where "the system let me" is not a defence anybody accepts.
Not oldest received. A pharmacy dispensing FIFO throws away the batch that was about to be used and keeps the one that will expire on the shelf. The allocation is worked out again on the server, because the other window may have emptied a batch since your screen drew.
Prescriber, patient, quantity and batch recorded for every H1 and X dispense, as the Drugs and Cosmetics Rules require. The requirement comes from the drug, so nobody skips it by leaving a box unticked.
Orders, samples and results. A sample number links a tube on a bench to a person in a bed and is never reused — two results sharing one is somebody else's potassium on your chart.
A haemoglobin of 12.5 is low for a man and normal for a woman. The sex and age are copied onto the order when it is placed, so a report reprinted next year interprets the number the way it was interpreted on the day.
A critical value blocks the report until the callback is logged with who was told. Every lab keeps that log because a potassium of 7.2 nobody telephoned through is the failure that kills people.
A board of tiles rather than a table, because a bed manager asked "have you got a bed" needs the answer in one glance. Free, occupied and out of service are three colours — a ward full of blocked beds is a different problem from one full of patients.
Checked on the server at the moment of writing. Two clerks admitting to the same free bed both saw it free a second ago; only the server sees both. A patient already admitted cannot be admitted again — one body cannot be in two beds.
A stay is billed in bed-nights, not days, and a patient moved to the ICU on the third night is three nights of one rate and the rest of the other. The rate is captured as it was on the day, so a tariff change next month cannot reprice a stay that has already happened.
A week as a grid, because “is she in on Thursday” is a question you answer by looking rather than by reading a list of dates. Three states a day, not two: on, away, and nothing recorded — a hospital that has never filled the roster in must not have every day read as “off”, or the board is a lie and everything it drives is noise.
Recorded once and read by the outpatient and theatre booking forms, from the same rule, so a consultant marked away cannot be quietly booked over. Nothing is refused: a hospital books over leave every week — leave is cancelled, a colleague covers, the patient is somebody’s own — and software that refused would be overruled by writing the appointment on paper, leaving no record at all.
Overlapping leave for the same person merges: two rows for one absence read as somebody away twice, and deleting one leaves the other quietly warning. Leave that begins the day after another ends stays separate, because a conference and annual leave are two facts and one of them may need accounting for.
Between the sum insured on the card and the amount a hospital receives sit four separate reductions, and every one of them produces the argument at the discharge counter. This works the number out on admission instead: non-payable items first, then the proportionate deduction, then the co-payment, then whatever is left of the sum insured after earlier claims this year — each with the sentence that explains it, on a sheet meant to be printed and handed over.
Take a ₹10,000 room on a policy that allows ₹5,000 and the associated medical expenses are payable at half. It is the reduction nobody expects and the one that produces the largest shortfalls. IRDAI settled what it does not touch — medicines and consumables, implants and devices, diagnostics — and getting that wrong overcharges the patient in one direction and underpays the hospital in the other, so the exemption is written down rather than remembered.
The moment a family dreads is the discharge counter: a bill that went past what the insurer approved, and nobody said so. An enhancement fixes that, and it can only be asked for while the patient is still in the bed. So every cashless admission is watched against its approval each day — what has been claimed, what is left, and where the stay is heading at the rate it is running — and the desk is told before the cover runs out rather than after. The family is told separately, and only once the bill has actually gone past, with the figure as it stands and the words that nothing has been decided. A patient under PM-JAY or Aarogyasri is never sent one: the difference between the package and the bill is the hospital’s, and asking the beneficiary for it is prohibited.
Requests carry the diagnosis and the estimate, because one without them comes back queried and costs three days. A query can still be approved; a denial is final and a fresh request is raised instead, because reopening a denial loses the reason — which is the document an appeal is built on. Emergencies are marked as emergencies, and do not queue behind next Tuesday’s elective.
It is the one figure an ambulance service is judged and funded on, and it is the easiest number in medicine to write down wrongly — not by lying, but by filling the form in at the end of the shift. The crew writes plausible times, everybody believes them, and the service reports eleven minutes for ever.
So a moment here is not a field. It is a button. Somebody presses it and the server writes the clock. There is nothing to type, which means there is nothing to round; the order is enforced, because you cannot reach a scene before you were sent to it; and a stamp is written once, because one that could be corrected is one that would be, at the end of the shift. The crew screen is a single strip of very large targets with exactly one of them pressable — it is used at night, in a road, with one hand on a stretcher.
And a form filled in afterwards leaves a signature. Nothing can stop a crew pressing every button in the ambulance bay when they get back. What it produces is seven moments arriving inside a minute for a journey that took an hour, and the board counts those trips and prints the proportion in words. That figure is deliberately not a target and the screen says so: a crew told to spread the presses out will produce times that are fabricated and look real, which is worse than what this measures. It is there to say whether the response times above it were measurements or recollections.
The clock starts when the telephone was answered, not when a vehicle was assigned. Every service in the world reports activation-to-scene, because it quietly excludes the minutes the call spent in a queue — and those are the minutes the patient was lying on the road for. Both are computed, the honest one is the headline, and the flattering one is printed beside it so nobody has to work it out in order to argue about it.
An ambulance is not available because it is parked. Crew signed on, oxygen changed, cleaned since the last patient, not in the workshop — four separate facts, each recorded by the person who did that thing. There is no single “mark it ready” button, because it would be pressed by somebody who did none of them. Each refusal names which of the four is missing, and they are four different people to go and find.
And a call needing advanced life support cannot be sent a vehicle that does not carry it. The types are the AIS-125 ones — the Indian construction standard — and registering a Type C without a defibrillator on its kit list is refused here rather than discovered on a roadside. So is dispatching one whose paramedic is on the other shift: a defibrillator nobody on board may use is a defibrillator in a cupboard.
This is the rule that is broken everywhere. The complaint about Dr Rao is handed to Dr Rao, who speaks to the family and marks it resolved. It is not malice — he is the only person who knows what happened. It is also exactly why no complaint register in the country has ever found anything. So the refusal is checked against the caller’s own identity from their sign-in rather than against anything the form says, and it fires on the name or on the account, whichever matches.
“Anonymous” is a promise the system has to be unable to break. A feedback form that asks for the bed number is not anonymous and everybody filling one in knows it. Here, when a patient asks for anonymity nothing identifying is written — not stored and hidden, not blanked, never written. There is no flag for a later version of this software, or a later owner of the hospital, to turn back on. The server checks the finished record against a named list of identifying fields before it saves, because the failure that matters is a field somebody adds to the form next year and forgets to add to the omission.
That costs something real, and the module says so instead of pretending otherwise: an anonymous complaint cannot be answered by letter. Its answer goes on the board in the waiting area, which is a worse channel and the only honest one.
A complaint alleging harm is not a complaint. It is an incident, it leaves this queue, and it cannot be closed with a response at all. The distinction matters because a feedback system will close anything with an apology, and “we are sorry you felt your father waited too long” is a sentence somebody writes about a death. Three questions decide it — was anybody hurt, did somebody die, was treatment delayed — asked in plain words rather than left as a severity dropdown, because a dropdown gets set to “minor” by the person the complaint is about.
And the score will not print itself. A satisfaction average of 4.8 from three per cent of discharges is not a good score; it is not a score. It is the opinion of the people a nurse stood beside while they filled the form in. The average is always computed — a hospital needs to know it — but it is publishable only above a response-rate floor, and below it the screen says what the number is and, in the same size type, why it must not go on a wall or into a tender. The denominator is counted from the discharges in the period rather than typed, because a response rate a hospital could enter is one it would enter, and it would be whatever made the score publishable.
The screen opens on the complaints, not the score. A dashboard leading with 4.6 out of 5 has told the hospital the one thing it cannot act on; the eleven sentences underneath it are the findings, and every one of them is kept and shown rather than averaged away.
Every records department in India runs on a shredding schedule. Files reach three years, a list is printed, and somebody with a trolley works down it. The schedule is not wrong — Regulation 1.3.1 of the Indian Medical Council (Professional Conduct, Etiquette and Ethics) Regulations 2002 puts the floor at three years, and a hospital that kept everything forever would need a second building.
What is wrong is treating the date as the whole question. The one file that must never go on that trolley is the file somebody is about to need in court, and on paper it looks exactly like every other file on the list. So a record here is destroyed by a date and the absence of every hold — litigation, an open medico-legal case, a pending claim, an inquiry, or a patient who has asked for their records under Regulation 1.3.2. A hold is a named thing with a person against it, and only a person can lift it: a hold that expired on its own would expire at exactly the moment nobody was watching.
A child’s record is not a three-year record. This is the rule no schedule implements, and it is not a detail. Limitation runs from majority, not from treatment: a person injured at four can bring a claim at twenty-one, by which time a three-year schedule destroyed the notes fourteen years earlier. For anybody under eighteen the period is computed from their eighteenth birthday, which is frequently twenty years of storage — and a records officer told “three years” will shred it.
The retention date is never stored. It is computed from the episode every time the screen loads, so marking a record medico-legal this morning moves its destruction date this afternoon; a stored date would keep the answer it was given when the file was opened.
Destruction leaves a stub. Who the patient was, what the episode was, when it was destroyed and on whose authority — because “we have no record of that patient” and “that record was destroyed on 3 March under the retention schedule, authorised by the medical superintendent” are answers a court treats very differently, and a hospital that deleted the row can only give the first. A file that is still out with somebody cannot be destroyed at all: the register would then disagree with the building.
And an unspecified code is a code nobody read the notes for. ICD-10 has an unspecified variant of almost everything — always available, always accepted, always wrong when a specific one existed. The proportion is computed and printed in words, with an explicit note that it is not a target: a coder told to reduce it will pick a specific code at random, and precise-looking statistics about the wrong diseases are worse than honest vague ones. Every coding is kept rather than overwritten, so a record recoded three weeks after an insurance query is visible as exactly that.
Alongside it, the part every register gets wrong: a file is with a named person or it is missing, and there is no third state. “In the rack” is what the register says about the file nobody can find — and the consequence is a second file opened for the same patient, at which point the allergy recorded in 2019 ceases to exist.
It is a question, and every referral register in the country stops asking it at exactly the point where the danger begins. The row is written, the patient goes out of the door, and nothing anywhere says whether they arrived. The patient who dies between two hospitals that each believe the other has them is not a clinical failure. It is a record-keeping one.
So a referral here has three states and only two of them are endings. It stays open until somebody says the patient arrived, came back, or could not be traced — and the window before it goes red is set by how ill they were when they left, not by office hours. Four hours for an emergency, because that is roughly the longest a transfer inside a district takes; past it, the honest description of the row is that we do not know where that person is.
A referral nobody accepted is not a referral. Sending a patient to a hospital that has not said it has a bed is sending them to a car park, so for anything but an emergency the acceptance is a name and a time or the referral is refused. For an emergency it goes ahead unaccepted — refusing to move an unstable patient while somebody keeps ringing is worse — but then it is recorded as unaccepted, with who decided and why, and it sits at the top of the board until they arrive.
The escort is computed from the chart, never chosen. Airway, oxygen, Glasgow score, systolic pressure, inotropes, active bleeding, and whether the patient is under a year old. All of it is already written down; left as a dropdown, the answer becomes whoever is free, and at two in the morning that is nobody. The server reads the observations from the patient’s own record rather than from the request — a browser that could post a Glasgow score of 15 could send an unconscious patient alone — and nothing in the request can lower the answer, only raise it.
And every drug given before transfer carries the clock time. A slip saying “antibiotics given” gets the patient a second dose an hour later, and for some drugs the second dose is the one that does the harm. An entry without a time is refused rather than stored.
The figure at the bottom is the one no other system produces: the proportion of referrals that come back. A hospital where one in five returns is not a hospital referring too readily — it is a district with nowhere to send anybody, and this is the only place that argument can be made with a number. Beside it, the proportion of closures written by the referring doctor on the day of referral, because a register closed that way is recording intentions rather than outcomes and the arrivals figure above it means very little.
Every equipment register in every hospital has a column called Status, and in every one of them it says Working against machines nobody has touched in two years. The word is not a lie. It was true when somebody typed it. It is a claim that outlived its truth — and a register full of those is worse than no register at all, because it is consulted.
So the status is not stored here. There is no status field. It is computed from the dates every time the register is read, which means it cannot say anything the dates do not support, nobody has to remember to change it, and no request can set it. A machine whose last check is older than its own interval is not working and not faulty. It is unverified — which is the honest description of what the hospital actually knows, and a word no other register has a column for.
And for life support, unverified is unavailable. A defibrillator whose last check is eight months old is not equipment; it is furniture that looks like equipment, which is worse than an empty wall, because the empty wall sends you to find a working one. There is no grace period, because a grace period is a negotiation and there is nobody to negotiate with at three in the morning. That refusal applies to exactly one class — a list where everything is critical is a list where somebody switches the refusal off by Friday, including on the defibrillator.
Calibration and maintenance are not the same question. Maintenance asks whether the machine works; calibration asks whether what it says is true. A blood pressure monitor reading twenty millimetres low passes every maintenance check ever written and does more harm than one that will not switch on — the broken one is replaced that morning, and the lying one is believed for a year. So calibration is tracked separately, and a calibration recorded as passed must carry the reading it was compared against: a pass with nothing to compare is somebody ticking a box, and it buys six months of silence on exactly the failure the check exists to find.
The AERB licence is a legal precondition, not a document. Every X-ray, CT and mammography unit in India runs under a licence from the Atomic Energy Regulatory Board under the Atomic Energy (Radiation Protection) Rules 2004. An expired one refuses the machine and names the date it lapsed — and says who is liable, which is the operator and the hospital, not the person who forgot to renew it. It is kept on its own row on the board because it is fixed by a regulator over weeks rather than by an engineer over an afternoon.
Uptime is computed and never typed. A percentage a hospital can enter is a percentage a hospital will enter, and it will be ninety-eight. Downtime is a span with a start; overlapping breakdowns count the days once rather than adding to a hundred and ten per cent; a fault still open counts every day including today, because a fault open for six weeks is the finding rather than the backlog. The longest single outage is printed beside the total, because ninety-five per cent spread over a year is one thing and the same figure as a fortnight in July is another.
And at the foot of the board, not the top: the proportion of machines in service checked inside their own interval — said in words, with an explicit note that it is not a target. A hospital could move it in an afternoon by entering a year of checks in one batch, and the machines would be exactly as they were. It is there to say whether the rest of the page describes the hospital or describes the last time anybody typed in it.
Section 8(1)(b) of the Registration of Births and Deaths Act 1969 puts the duty to report on the medical officer in charge, not on the family. A hospital that leaves it to a grieving relative has not discharged its duty, and the family finds that out at a registrar’s counter weeks later when they need the certificate for a bank.
Section 13 is the shape of the screen. Twenty-one days and it is free; twenty-two to thirty and it needs a late fee; a month to a year and it needs the prescribed authority’s written permission and an affidavit; beyond a year it takes a first-class magistrate’s order and months. So this counts days rather than showing a list, and sorts by how little time is left — the number it leads with is “three days”, not “reported: no”. The cost of a slipped week is not the hospital’s; it is a family standing in front of a magistrate to prove their own child was born.
A stillbirth is its own kind, not a birth followed by a death. Recorded as a birth it produces a certificate for a child who never breathed; as a death, one with no birth behind it. The gestation is required and checked against twenty-eight weeks in both directions — below it the event belongs in the case notes, at or above it a hospital that failed to report has broken the Act.
A mode of dying is not a cause. “Cardiac arrest” is how everybody dies, and a Form 4 whose Part I(a) is a mode is sent back by the registrar and tells the national mortality statistic nothing. The screen says so where somebody types it — and then accepts it once the underlying disease is given, because that is exactly how the form is meant to read, and refusing it outright would have doctors writing something less true.
The registration number comes back from the registrar rather than being allocated here, because a number the hospital invented will not match the register. Nothing is deleted: a correction keeps the original beside it with the reason, and it does not quietly mark a reported event unreported — the registrar’s copy still says what it says, and somebody would report it twice.
Almost everything in a dialysis unit is a judgement between competing risks. Two things are not, and this module treats them differently from everything else it does: it refuses.
A hepatitis B positive patient is dialysed on a machine used for nobody else. The virus survives a week on a dry surface and the viral load is enormous; every documented dialysis outbreak in the literature was caused by breaking this rule. So it is not a warning — a warning is dismissed at eleven at night by somebody who needs the bed. It is a refusal, and it fails in both directions: putting a seronegative patient on the dedicated machine is the machine quietly ceasing to be dedicated, which is the same failure arriving from the other side. Taking the dedication off a machine needs a reason typed, and the reason stays on the record, because the machine that used to be the hepatitis B machine and stopped being it is the outbreak nobody can trace.
Hepatitis C and HIV are handled by universal precautions on shared machines, and this is a deliberate refusal to segregate them. A unit needing four machine pools it does not have is a unit that starts making exceptions — and the exception it makes will be to the one rule that mattered.
Serology older than ninety days does not clear a session. The refusal names the date the last sample was taken, because “not allowed” sends somebody to argue and a date sends them to the laboratory. A pending result is not a negative one. Results expiring inside a fortnight are flagged before they expire, since the bloods take a day.
A reprocessed dialyser belongs to one named person, absolutely. Up to six uses, and the counter is incremented inside the same transaction that records the session — two nurses recording at the same moment is exactly how a dialyser reaches its seventh use with a six in the register. A dialyser with no label cannot be reused at all: the label is what makes reuse safe.
The sum nobody does. The ultrafiltration rate — litres removed, divided by dry weight, divided by hours — is computed as the weights are typed, before the session starts, because a rate discovered afterwards is one nobody could have done anything about. Over thirteen millilitres per kilogram per hour the patient drops their pressure during the session and the mortality association is consistent across large cohorts, so the screen says “4.2 litres over four hours on a 60 kg dry weight is 17.5 ml/kg/hr” and then says how many hours it would need instead. A ward told “too fast” argues; a ward told the arithmetic changes the hours. The urea reduction ratio is computed the same way and never typed.
And what the unit board deliberately does not print: the hepatitis C and HIV results beside a name. Neither changes which machine anybody sits at, and putting them on a board that people walk past is the disclosure section 8 of the HIV and AIDS (Prevention and Control) Act 2017 prohibits. The board says whether serology is current. The result goes to the person about to dialyse them, on the check, where it is being used for something.
A review that never finds anything preventable is a review nobody is doing. That is the one thing this module does that no other mortality system does: it audits the committee. The published rate of preventable in-hospital death sits between three and ten per cent, and a hospital classifying ninety-five per cent of its deaths as unpreventable is not a hospital with exceptional care — it is a committee that has learnt which answer costs least.
So the finding rate is printed beside the grades, in words, with the published range named. It says explicitly that it is not a target to move, because a number a hospital could improve by reclassifying deaths would be worse than having no number at all — it exists to say whether the rest of the table means what it appears to. And it stays silent below twenty reviews, because a fortnight’s arithmetic at a small hospital says nothing either way.
An action that names a person is not an action. “Counselled the registrar” is the commonest outcome of a mortality meeting in the world, and it is exactly why the same death happens again next year: the next registrar has not been counselled. An action has to name something about the system — a protocol, a pathway, a rota, an escalation rule, a piece of equipment, a checklist — and one that names only a person is refused with that said out loud. The check runs as the words are typed, because a chairman who is going to be refused should learn it while writing rather than after pressing save.
Naming a person and changing a protocol is fine. The person is not the problem; the person being all there is, is.
The triggers are computed, never requested. A death within twenty-four hours of admission, within forty-eight of an operation, after an unplanned return to theatre, a maternal death, a child’s death, one nobody expected. A box somebody ticks to ask for closer scrutiny is a box that does not get ticked, so these are worked out from the record — and “expected” has to be an explicit yes, because a death nobody recorded a view about is reviewed more closely rather than less. The committee can say afterwards that it was expected, which is not the same as having said so before.
The worst row on the board is a triggered death nobody reviewed: the system itself flagged it and nobody looked. Then the backlog, oldest first, because a mortality programme dies of backlog rather than of disagreement.
A review is written once. A grade that could be revised after somebody read the figures is a grade that will be, so a correction is a further review that names what it corrects and both stay on the record. And an action is closed with evidence rather than an assurance — one closed on somebody saying so is one nobody could check in six months, which is the same as an action nobody took.
“Nil by mouth from midnight” is the commonest instruction in a surgical ward and it is almost always wrong. Clear fluids are allowed until two hours before an anaesthetic, breast milk four, a light meal or formula six, a fatty meal eight. A patient starved from midnight for a four o’clock list has been fasting for sixteen hours: dehydrated, hypoglycaemic, and measurably more likely to have the operation cancelled.
So this works the times out from the operation rather than from a habit, and gives times rather than durations. “She may still drink water until 12:00” is a sentence a nurse acts on; “two hours before” is a sum somebody does wrong at four in the morning, always in the direction of starving them longer. Times that fall before midnight say so rather than rendering as a negative, because a ward reading “-02:00” decides to fast from teatime instead.
Prolonged fasting is invisible unless something counts it. Nothing anywhere else in a hospital says a patient has been nil by mouth for sixteen hours — the drug chart shows withheld doses, the theatre list shows a slot, and neither adds up. This does, and it says what the cost is and that clear fluids can start again if the list has moved.
Nil by mouth is a drug chart problem. A patient who cannot swallow cannot take an oral medicine, and the chart’s honest answer is “withheld” — which is also how a diabetic ends up with no food and a full dose of insulin. Insulin and the oral hypoglycaemics are pulled out into their own list with their own words, because a missed antibiotic is a conversation in the morning and a full dose on a patient who is not going to eat is a hypoglycaemia in two hours. An enteral feed conflicts differently again: the gut is being used, so the drug may go down the tube — and that is a decision somebody records rather than assumes.
Allergies are copied onto the diet order, not looked up. A kitchen has to know what not to send and must not need a clinical record to find out. That is a snapshot, and a snapshot has one failure mode — an allergy recorded after the diet was ordered is not on the tray card — so the ward round re-reads the patient record and names every card that has fallen behind. Having both honestly beats having either quietly.
The kitchen cooks to a number, and the number has a cut-off. Anything changed after it is a tray that will be wrong, and the list says how many rather than leaving the kitchen to guess: one that knows three trays are wrong can carry three, and one that suspects the list is stale carries twenty every day. Nil by mouth and parenteral nutrition are counted but are not trays — counting them is how a kitchen throws food away daily and stops believing the number at all.
A patient has one live diet at a time. Two active orders is two trays and two different answers about whether they may swallow, and the kitchen gets whichever the query returned first — so ordering a new one stops the old one in the same write.
Samira Kohli v Dr Prabha Manchanda (2008) 2 SCC 1 is the module. A surgeon removed a woman’s uterus and ovaries under anaesthesia, on her mother’s consent, for a condition found during a diagnostic laparoscopy. The operation was medically defensible and the mother had signed, and the surgeon was liable — because consent must be real, specific, and given by the patient.
A relative cannot consent for a capable adult. That refusal is the whole point, and it fires even when the relative is willing and the operation is sensible, because that is exactly the case the Supreme Court decided. The form does not offer a guardian field to a capable adult at all: a field that is there gets filled in, and the judgment is about a form that had one.
Consent to look is not consent to remove. Before the knife, the theatre asks the question a court would ask afterwards: does the consent on file cover what is about to be done? A consent for a diagnostic laparoscopy does not cover a hysterectomy, and the refusal quotes back the reasoning the court rejected — “she was on the table anyway” — and says to take a fresh consent or record why it could not be taken. Matching is one-directional on purpose: a consent for “laparoscopic cholecystectomy” covers a cholecystectomy, and a consent for “cholecystectomy” does not cover one converted to open with a duct exploration.
What she was told is five separate facts, not one checkbox. What the procedure is, what can go wrong, what else could be done — including doing nothing — what happens without it, and the anaesthetic. “The procedure was explained to the patient” is what every consent form in the country already says, and it is precisely what the court found insufficient. Each of these is something a patient can be asked afterwards whether they were told. The language it was taken in is recorded too: consent taken in a language the patient does not read is a signature.
And the MTP Act runs the other way from everything else. Section 3 of the Medical Termination of Pregnancy Act 1971 requires only the woman’s consent — her husband’s is irrelevant in law, and a hospital that asks for it is imposing a condition Parliament deliberately removed. It is the commonest single defect in Indian consent paperwork and it is unlawful. Where she is a minor, her guardian consents in addition to her, never instead of her, and a guardian’s signature alone is refused. Section 5A forbids revealing her name, so a termination appears on every list by reference rather than by name — absent from the data, not hidden in it. Sterilisation, HIV testing and living organ donation follow the same shape: only the person themselves, with the statute quoted.
A consent is never edited. It is withdrawn — which a patient may do at any time, including after signing and including on the table — and a fresh one is taken. A document whose date says one thing and whose contents say another is the first thing a court notices. The age comes from the patient record and never from the form, because everything about who may consent turns on it. Where the age is not known the system asks rather than guessing: a relative consenting for a capable adult is no consent, and a child consenting alone is no consent either.
The working screen is the list of tomorrow’s cases that have nothing covering them, with the reason on each row — because “no consent” and “the consent is for the other knee” need different people and different amounts of time. Side-specific operations must name a side, since that line is what the theatre’s site-marking stop is checked against.
Only the biological indicator proves sterility. A chemical indicator changes colour when the pack has been hot: it says the pack reached temperature, and nothing whatever about whether anything survived. Only the biological indicator — a vial of Geobacillus stearothermophilus spores incubated after the cycle — tests whether the process actually kills. A load can pass every physical parameter and every chemical strip and still be a load that must be recalled, and a system that collapsed both into “passed” is a system that releases on the wrong evidence. Most hospitals do exactly that.
A load that has not read yet is neither passed nor failed. It is its own state, and calling it either is the mistake: one direction releases what should be held, the other holds what a theatre is waiting for.
Early release is a recorded decision, not an error. The indicator takes hours; an emergency load released before it reads is standard practice everywhere. Refusing it would not produce a hospital that waits — it would produce a hospital with no record of not having waited. So it is allowed, with a name and a reason against it, and the load stays on a list of its own until the vial reads. Every pack in one of those is in a patient or on a shelf on the strength of a decision somebody made in a hurry, and that is worth being able to see.
A recall is patients, not packs. When an indicator fails, the patients who received a pack from that load are listed immediately — on the same screen, at the moment the failure is recorded, because the person entering the result is the person who has to act on it and sending them to find another screen is how twenty minutes goes past. Earliest exposure first, since the one furthest from the department is the hardest to reach. A patient who received two packs appears once; a list that named them twice is a list somebody telephones twice. The packs still on the shelf are counted separately, because that job goes to a different person.
A test result is written once. A hospital that could overwrite a failed indicator with a pass is a hospital where a recall goes away by being retyped, and the whole point of the record is that it survives somebody wanting it not to.
Cycle parameters are checked against the method rather than against one global number: four minutes is a valid hold at 134 °C and nowhere near a valid one at 121 °C, and a system with a single threshold under-processes every 121 load without ever saying so. Ethylene oxide carries its aeration time, because residual ethylene oxide is itself the hazard and a pack released before aeration is a burn. And a pack cannot be opened from a load nobody released — checked on the server, because a pack opened in a theatre at three in the morning is opened by whoever is holding it.
A catheter-associated urinary tract infection rate is infections divided by catheter-days, times a thousand. Not per admission, not per bed-day, not per patient — and every hospital that uses one of those reports a number that is roughly right when its length of stay is average and wildly wrong exactly when it is not, which is to say wrong in the months that matter.
A ward that catheterises ten people for one day each and a ward that catheterises one person for ten days have the same exposure and must produce the same denominator. That is the whole idea, and it is why the device is a record here rather than a checkbox on an admission: every line, catheter and ventilator has a start, an end, and a unit that owns its days. An episode that began in March contributes only its March days to March.
Each infection names the device it is divided by, so the two can never be crossed. It is not possible in this system to file a CAUTI against a central line, which means it is not possible for a CAUTI rate to come out divided by line-days. The server reads the stored episode rather than believing what the form says it was.
A rate on a small denominator is not a rate, and this refuses to print one. One infection in forty catheter-days is 25 per 1000 — both the worst intensive care unit in the country and what a small ward earns for one bad fortnight. Below the floor the count is shown and the rate is withheld with the reason printed in full: “three infections, 40 catheter-days, no rate because that would read as 75 per 1000” is a sentence somebody can take to a committee. A blank cell is a sentence somebody else fills in.
A device-day is a calendar day, not an hour. In at four in the afternoon and out at ten the next morning is two — the rule the national comparison uses, so a hospital counting hours would look worse than everybody it is measured against. Surgical sites are followed for thirty days, and ninety where an implant went in, because that is when the late prosthetic joint infections appear and they are the ones that cost a patient the joint. An infection outside the window is still recorded; it simply is not attributed to that operation, and saying so is more use than dropping it.
The device review list is the only part of the screen that changes anything. The rates describe last month. Asking every morning whether a catheter still needs to be in is the single most effective intervention against catheter infections ever measured, so the days are a trigger for that question rather than a deadline — there is no clinical rule that a catheter comes out on day three.
Hand hygiene is the WHO Five Moments: moments acted on over moments observed. Not litres of handrub issued, which a hospital improves by leaving a tap running. Each moment is reported separately, because the fifth — after touching the patient’s surroundings — is always the worst and averaging hides it. A moment nobody watched reads as nobody having watched, never as nought per cent: a unit accused of something it was never observed doing stops believing the whole board.
And the organisms come with it, because a count of infections says there is a problem and a count of carbapenem-resistant Klebsiella says which one. Resistance is recorded as the laboratory reported it and never inferred from a name — “MRSA” typed in a box is a guess, and an antibiogram is built from facts.
A cholera case notified a fortnight after it was diagnosed is not late paperwork; it is a fortnight of a well that nobody closed. So this board leads with hours and days remaining rather than with “notified: no”. A list of booleans is a list nobody sorts, and the failure mode here is always a case that sat.
Tuberculosis is criminal, not administrative. The Government of India’s 2012 notification, revised in 2018, makes TB notification mandatory for every healthcare provider including private ones, within seven days, to Nikshay — and failure is punishable under sections 269 and 270 of the Indian Penal Code. It gets its own list and its own words on the screen, because “overdue” persuades nobody and “section 269 IPC” persuades everybody. Nothing else on the list is marked criminal: if everything is, nothing reads as it.
The clock runs from the diagnosis, never from the day somebody opened the form. That sounds obvious and is the single commonest way a surveillance system lies — measuring from today reports every case as notified on time, which is the most comfortable wrong answer available.
A suspected case is notifiable, and confirming it does not restart the clock. IDSP has three forms for exactly this reason: the S form is what a health worker suspects, the P form what a medical officer presumes, the L form what a laboratory confirms — three because the first two are not supposed to wait for the third. The duty arose with the suspicion, so a correction records the new level beside the old one and leaves the diagnosis date exactly where it was.
HIV runs the other way, and is refused. Sections 8 and 9 of the HIV and AIDS (Prevention and Control) Act 2017 prohibit disclosing a person’s status without their informed consent, so a return carrying a name and that diagnosis is the disclosure — and “notify everything, it is a surveillance system” is the safe-looking default that commits the offence. It is refused at the point of entry rather than filtered out of the return later, because a row that exists is a row that leaks through an export somebody writes next year. The same applies to a termination of pregnancy under section 5A of the MTP Act and to a sexual assault under section 228A IPC, both of which are named and sent where they belong. The check reads the free-text and the notes as well as the disease field, because a field nobody checks is the field it ends up in.
Clusters, not totals. Three cases of one disease from one locality inside one epidemiological week. Forty dengue across a city is a season; four from one street is a breeding site somebody can go and empty, and a return carrying only the total hides it completely. The signal is said in words — “three dengue in Yousufguda” sends somebody to Yousufguda, where “two clusters” sends them to a list.
Weeks are Monday to Sunday, numbered the ISO way, which matters because the first of January is very often week 52 or 53 of the year before — the boundary every home-grown week number gets wrong, and a return filed against the wrong week is one the district cannot reconcile. The count is of cases diagnosed in the week and never of cases notified in it: counting notifications moves a case into whichever week somebody got round to the form, and the epidemic curve is the one thing a surveillance return exists to draw.
Nothing in the medico-legal half of this module can refuse anything in the clinical half. Parmanand Katara v Union of India (1989) settled that a doctor’s obligation to preserve life is paramount and that no hospital may delay treating an accident victim pending medico-legal formalities or a question of jurisdiction. So the MLC is a record the system requires and never a gate it imposes: a patient is triaged, seen and resuscitated with the register untouched, and the missing entry is chased afterwards on a list of its own. A design where the register blocks the trolley is one that kills somebody in a corridor and can cite a statute while doing it.
The board is never in arrival order. Untriaged first — a patient nobody has looked at has no category, and sorting an unknown category into the queue puts them at the bottom of it, which is the arithmetic version of leaving them in the corridor. Then red, yellow, green, and within a colour the longest wait at the top, because the alternative is that a quiet patient waits all afternoon.
The physiology can raise a category and nothing can lower one. A saturation below 90, a systolic below 90, a pulse outside 40 to 130, a Glasgow below 9 — each forces red, and a category below what the observations demand is refused rather than warned about, because a warning at that moment is dismissed by a nurse with four other patients. A nurse who looks at somebody and says red is never overruled by numbers that happen to be normal, and the record shows that was a judgement rather than a data-entry choice.
Re-triage goes up by anybody, immediately — deterioration in a waiting room is the classic casualty death. It goes down only with a doctor and a reason, because the commonest way a downgrade gets made is a queue that is too long, and the person managing the queue is exactly who must not make it. The first category is kept beside the second: a patient who went from green to red is the single most important row a review of the department will read.
Sexual assault is three rules, and they are not the same rule. Free treatment is mandatory and refusing it is itself an offence — section 357C CrPC, section 166B IPC — so it is never conditional on a police report. The identity may not be disclosed under section 228A, so a protected patient appears everywhere by case number: the name is not in the board, not in the register, and not in the data the screen receives. And where the survivor is a child, POCSO section 19 makes reporting mandatory whatever anybody wishes, with failure punishable under section 21 — while an adult may decline the report and must still be treated.
That last distinction is answered from the age, which is a fact. Where the age is not known the system refuses to guess, because both defaults are offences: not reporting a child, or reporting an adult against her will. It asks the question instead, and says in the same breath that treatment does not wait for the answer. An early draft of this had the bug that makes the point — Number(null) is zero, zero is a child, and an unidentified survivor would have been reported to the police against her wishes.
Times are the server’s: arrival, triage, first medical contact. Every target in the department is the gap between two of them, and a department that could type them is one whose breach figures mean nothing. A breach does not stop having happened when the doctor finally arrives, so the ones still waiting and the ones seen late are both counted — a department that tracked only the open ones would report a clean day every day. And the number it least wants to publish is on the same panel: how many walked out before being seen.
Expectant exists, and it is available only inside a declared major incident. A single patient in a working department is never expectant, and a category reachable by accident is a category that will be reached by accident.
The department knows a yellow patient is to be seen within a quarter of an hour. It has always known. What it did not do was fetch anybody: the category was recorded, the clock ran, and the first person to learn that somebody had waited fifty minutes was whoever read the month’s figures. At two in the morning there is one nurse, no spare pair of eyes, and nobody standing in front of a monitor — so a screen that goes red is a screen nobody is looking at.
The call goes before the deadline, not on it. Five minutes before, which is a walk from one end of a department to the other. A summons that fires at the target is an announcement that the target has been missed, and announcing a failure is not the same thing as preventing one.
A target of nought is not a clock. Red means resuscitation now, so red is sent for at the moment of triage and never on a timer. Subtracting a lead time from nought and waiting for a negative number is arithmetic that reads perfectly and leaves somebody in a chair.
Escalating widens; it never hands over. If nobody has come, the nurse in charge is added — and the doctor who was rung first is still rung. Two people each believing the other went is the commonest way a fetched doctor does not arrive. Five minutes after that it reaches whoever is running the hospital that night, because a department asked twice that has produced nobody needs somebody who can take a person off another task.
“I am on my way” buys five minutes, once. A registrar who says two minutes usually means it, and escalating over the top of them teaches the department to ignore the whole thing. But a promise that can be renewed is a snooze button, and an hour passes five minutes at a time with nobody having refused to go. It is never granted at all for a patient whose target is nought.
A patient nobody has looked at is a different call to a different person. Somebody uncategorised has no target, and is the most dangerous person in the room precisely because nobody has been to them. What is missing is the triage, so the triage nurse is fetched — sending a doctor asks them to do the nursing job and leaves the queue unsorted behind them. And a record with no arrival time on it summons immediately rather than sitting quiet, because something that cannot be timed must not be something that is therefore ignored.
Past four patients waiting with nobody fetched, one more call goes out and it is about the department rather than any of them. Ringing four people about four trolleys produces four people at four trolleys and nobody deciding what happens next. The individual calls all still stand.
None of it can be dismissed. A patient leaves the list when somebody has actually been to them, which is recorded at first contact from the server’s clock. Recording that you rang somebody does not remove them, and neither does recording that somebody promised to come. It reaches the indicator in the corner of every screen, addressed to the job of the person being sent for — so a doctor writing up a drug chart sees the patient who is theirs without having chosen to open casualty.
A hospital prescribes in one screen and dispenses from another, and in most systems there is nothing between them saying the patient actually received anything. That gap is where the harm lives: the dose nobody gave, the dose given twice at a handover, the round signed for at the start of a shift before it happened.
Six states, not two. Given, refused, withheld, not available — and two that are not events at all: due, and not recorded. A chart with a tick and a blank cannot tell a nurse coming on at eight whether the eight o’clock dose was skipped for a reason or simply forgotten, and those need opposite actions. Not recorded never reads as given and never reads as not given. It reads as nobody knowing, which is the truth and the thing worth chasing.
The chart never invents a missed dose. A twice-daily drug written up at two in the afternoon is due at eight in the evening and nothing else that day — generating from midnight would put a missed dose on every new chart in the hospital before anybody had done anything wrong. As-needed medicines generate no rounds at all, so a patient who did not need their painkiller does not finish the day with six red cells. A drug stopped at noon keeps its morning dose and loses the evening one. Every one of those teaches a ward that red means something, and a ward that believes the red is a ward that acts on it.
Three lists, not “overdue”. Due is a dose to give; late is one somebody can still give and should hurry to; missed is one whose window has closed and now needs the prescriber rather than a nurse. Ordinary medicines get an hour before they count as late. Levodopa, insulin, anticonvulsants and the antibiotics where the interval is the therapy get fifteen minutes, because a late dose of those is not a late dose — it is a patient who cannot walk to the toilet, or a seizure.
The time is the server’s, never the browser’s. A round signed for before it happened is the commonest falsification of a drug chart there is, and the one a coroner finds. It cannot be typed here. Yesterday’s round can still be written up, because a night shift doing its paperwork at seven in the morning is normal and refusing it loses the record entirely.
Allergies are checked again at the bedside. They were checked when the drug was prescribed; the allergy is very often recorded afterwards, because the patient reacted to something else and somebody wrote it down. The nurse holding the syringe is the last person who can stop it, and the refusal says the allergy is newer than the prescription — otherwise it reads as the prescriber having erred, and the nurse rings the wrong person.
High-alert medicines need a second person, and it has to be a different one. Insulin, heparin, concentrated potassium, opioids, neuromuscular blockers, chemotherapy, vasoactive infusions — the drugs whose errors are catastrophic rather than the drugs that cause the most errors, which is a different list and the one worth stopping for. A name, not a checkbox: a checkbox is ticked by the person holding the syringe. Ordinary medicines need nothing, because asking for a second check on everything means it is given for nothing.
As-needed medicines carry the two numbers that are their entire safety — how close together, and how many a day — and a refusal names the clock time the next dose is due rather than saying “too soon”. Doses are counted against what actually went in, never against what was scheduled: a patient whose morning paracetamol was withheld for a low blood pressure has had nothing, and a system counting the schedule would refuse them their evening dose on the strength of a tablet that went in the sharps bin.
Nothing is deletable. An order is stopped, never removed; a mistake is corrected by a further entry naming what it corrects. The drug chart is the document a coroner reads, and a row that can be deleted is a row that will be deleted by whoever most wants it gone.
The PC-PNDT Act 1994 is the reason an ultrasound department is regulated at all, and every part of it that has teeth is in the flow rather than in a policy document. Form F is asked for inside ordering, before the scan can be ordered — not on a tab of its own. The Act makes Form F the record of the indication that justified the procedure, and a form filled in afterwards is a document produced to fit what the scan found. The study and the form are written together in one transaction, so “before” is true rather than intended.
Section 4(3) lists the lawful indications and the list is offered as a list. There is no lawful indication of “the family asked”, so there is no free-text box that quietly becomes one; anything outside the five is written out in words under 4(3)(vi), which is what the Act itself requires. Rule 10 makes the centre tell her the sex will not be disclosed, in a language she understands — recorded as a thing that happened, not a checkbox pre-ticked on the form.
Section 5(2) is checked as the report is typed. A radiologist who is going to be refused should learn that while writing, not after pressing file — the second reads as the system losing their work, and the third time it happens they dictate somewhere else. The same check runs again on the server, because a report filed by any other route would skip it, and a filter that can be walked around is a comment. It watches for the signs as well as the words: the Act says “by words, signs, or in any other manner”, and the colour, the sweet and the phrase everybody in the room understands are the manner it is actually done in. It does not fire on an abdominal scan of a man, because a filter that blocks the word “male” in every report is one nobody can work with, and one nobody can work with gets turned off.
A machine with no AERB registration, or a lapsed one, or a licence number with no readable expiry beside it, goes on the list that stops work — the third case because a machine nobody can prove is licensed is precisely the one an inspector asks about. Licences expiring within a month are a separate, quieter list: a form to fill in, not a machine to switch off, and mixing the two teaches people to ignore both. An ultrasound with no PC-PNDT registration under Rule 3A cannot scan a pregnant woman at all.
The register is the question an inspection actually opens with — show me Form F for every prenatal scan in this period — so it is one button, worked out on the server where it can see everything rather than what a screen happened to load, and it says out loud when it hit a limit. Records are kept the two years Rule 9(4) requires. Nothing is deletable: a row that can be removed is a row that will be removed by whoever most wants it gone.
The Bio-Medical Waste Management Rules 2016 are the module. Four bins, and every category written into exactly one, because the list is the schedule and a hospital arguing with it is arguing with the law — which is not an argument a system should let anybody win at a bin at eleven at night.
There is no default bin. Yellow is incinerated and red is recycled, so a guess in either direction is either a placenta sent to a recycler or a plastic bottle burnt at eight hundred degrees. An unknown category answers with nothing and says to look it up. When a bag does go in the wrong bag, the refusal names the bin it belongs in and what the wrong stream would do to it: “wrong bin” persuades nobody at eleven at night, and “that goes to a recycler” persuades everybody.
Forty-eight hours is Schedule I, not a smell. Beyond it a hospital needs the prescribed authority’s permission in writing, which nobody obtains on a Sunday. The clock stops when a bag is handed over or treated — never when somebody moves it to the store, because a hospital counting the store as the end would report nothing overdue while a week of waste sat in a room. Overdue bags are listed with the ward they came from: told “three bags overdue” you go looking, told which wards you have already found them.
Every bag is weighed, for exactly one reason: Form IV is category weights. A hospital that does not weigh cannot file its annual return, and one that estimates is filing a number it cannot defend to an inspector holding the treatment facility’s own weighbridge slips. Grams stay integers and become kilograms at the last moment, because adding floats bag by bag is how a return ends up disagreeing with the weighbridge by a kilogram nobody can explain.
The return says in words whether it can be filed, and names what is stopping it — bags that never left, handovers with no manifest number. And pre-treatment of microbiology waste is recorded as a fact rather than assumed, because a laboratory that has quietly stopped autoclaving its cultures is exactly what an inspector finds by asking for that field.
For red cells, group O gives to everybody and AB receives from everybody. For plasma it is exactly the other way round: AB plasma goes to anybody and an O patient can take plasma from everybody but give it to nobody. Red cells carry the antigen; plasma carries the antibody, so the direction of the test reverses. Applying the red-cell table to plasma is the classic transfusion error and it fails both ways — it refuses AB plasma to a bleeding O patient that would have worked, and it allows O plasma to an A patient, which is a haemolytic reaction.
Both tables are written out pair by pair rather than derived, because a derivation is a rule and a rule can be misremembered by whoever edits it next. All sixteen rows are checked, and so is the fact that the two tables are not the same table — so a future tidy-up of one into the other fails loudly rather than quietly.
Schedule F Part XII-B of the Drugs and Cosmetics Rules 1945 requires five tests before release — HIV, hepatitis B, hepatitis C, syphilis and malaria — and a refusal names the missing one, because a technician told “HIV not done” goes to a bench and one told “not released” goes to find somebody. A result of “pending” is not a result. A reactive unit is discarded the moment the result is entered, never shelved: there is no state in which it becomes issuable, and “available pending review” is how one gets picked up in a hurry.
A compatible group is not a cross-match. Compatibility narrows the shelf; the cross-match is the test, it is scoped to this unit and this patient, it lapses after seventy-two hours because a patient transfused since may have new antibodies, and an incompatible cross-match refuses whatever the groups say. A compatible one holds the bag for that patient, so two people are never cross-matched against one unit.
The shelf counts what could actually be issued today. A bank with eleven O-negative bags of which nine are untested has two, and a screen reporting eleven is a screen somebody plans an operating list from. Units are offered closest to their expiry first — the difference between two per cent wastage and ten — and a bag out of the bank longer than thirty minutes has left the cold chain and is discarded rather than reshelved. There is no checkbox for that, because a checkbox gets ticked at the end of a shift by somebody who was not there when it left.
PM-JAY and Aarogyasri do not pay a share of a bill — they pay a fixed rate for the procedure, and the hospital is paid that whatever its own bill came to. So none of the four reductions applies: no room-rent proportion, no co-payment, no sum insured running down. The beneficiary pays nothing: not the difference, not the non-payable items, not a co-payment. Balance billing a beneficiary is prohibited, and software that computed a patient share would be producing the exact demand the scheme forbids.
Where the bill exceeds the package, the difference is the hospital’s. It is shown as its own figure on the estimate rather than folded into anybody’s column, because it is what a hospital actually uses to decide whether to stay empanelled — and because the one place it must never appear is on the beneficiary’s side of the sheet.
When a TPA settles less than it approved, that gap is a dispute with the payer, not automatically the patient’s debt. It sits visibly as undecided until somebody with the authority writes it off, bills it, or appeals it — and the record says who decided and when. Claims needing an answer are listed by how long they have waited rather than by how much they are worth, because a small query about to lapse needs attention and a large claim submitted yesterday does not.
A board of lists rather than a diary, one column per theatre, in the order a surgical day actually runs: emergency first, then urgent, then by the clock. Utilisation is measured against the staffed session, not against twenty-four hours — a theatre that was empty at three in the morning is not a theatre that was underused. The room cannot be double-booked and neither can the patient, and both are decided on the server, because two coordinators looking at the same free slot both saw it free a second ago.
Sign in before anaesthesia, time out before the incision, sign out before the patient leaves — in that order, enforced. A case with an incomplete sign in does not start; one whose time out was never taken cannot be closed. It fills the whole screen because a time out is read aloud with the team listening, and a checklist that fits beside a form gets tapped through by one person alone, which is the failure it was invented to prevent.
Every other answer on the checklist can be no and be recorded as no. The instrument, swab and needle count cannot: a count that does not reconcile means something is inside the patient, and the software refuses to close the case rather than documenting it. NABH asks accredited hospitals for this checklist; this is what asking for it looks like when it is not paperwork.
A completed case knows how long the room was occupied — wheels in to wheels out, not knife to close — charged in the hospital’s own blocks and rounded up, because a room booked ten minutes past the block was free to nobody. Implants come through as their own lines and follow the same composite-supply rule as medicines: exempt inside an admission, taxable outside one. The charges are offered to billing rather than posted by themselves, so a list finished at three in the morning does not create a bill nobody has read.
A manufacturer’s notice names a lot number. The question it asks is which of your patients has one inside them, and the register already knows — so one batch number produces the whole list at once: the boxes to quarantine, the patients to telephone, and the units that left the building years ago. Oldest implant first, because that one has had the longest to fail. There is no notify-all button, and that is deliberate. “The device implanted in you has been recalled” arriving by text at nine at night answers none of the three questions it provokes and leaves somebody alone with all of them until morning. What this produces is a call list and the brief for each call — batch and serial number in front of you, because the first thing you will be asked is whether theirs is the affected one.
Severity is declared from the notice, and accepted only where it is cautious enough. A coronary stent or a pacemaker lead cannot be filed as something to raise at the next routine appointment, whatever was typed — those fail as an event rather than a decline — so the device category sets a floor the form cannot go below, and the screen says which entry was raised and why. It can always be declared more serious: a notice is sometimes worse than the category implies and a hospital has to be able to say so. Nothing closes on a glance, either. A row closes on an outcome — spoken to, seen, device removed — and “could not trace” closes only with a written account of which numbers were rung and on what dates, because that is the row somebody will be asked about. A patient who has died stays on the list rather than dropping off it: nobody telephones the family, but a death in somebody carrying a recalled device may be the reportable one, so it goes to a medical officer to review.
Every implant tracked as a physical thing — by serial or UDI where the packet carries one, by lot where it does not — from the shelf to the patient it went into. When a manufacturer recalls a batch, the question is which of your patients has one inside them, and a description on a bill cannot answer it; this does, in seconds, with the ones still on the shelf listed separately because those are boxes to pull rather than phone calls to make. Coronary stents and knee implants carry their NPPA ceiling and the date it was notified, checked before GST because that is how the notification fixes it, and a price above the ceiling is refused where it is set rather than discovered on an audit.
The screen the day starts on: who is waiting and for how long, beds free, what is on the lab bench, what has expired on the pharmacy shelf, and what is owed — each figure produced by the same code as the screen it links to, so the board never disagrees with the module behind it. A figure that cannot be read says so; it never shows a reassuring zero.
The counter opens on who owes money, largest debt first, because that is what somebody at a cash window is doing. A stay’s bill is built from the record rather than re-keyed — the bed nights come off the admission’s own trail, the medicines off the dispenses, the tests off the lab orders. Nothing reaches a bill that is not already in the notes.
Healthcare is exempt, and that is where most systems stop. Room rent above ₹5,000 a day is not — but intensive care is exempt at any rate, so a ₹20,000 ICU bed carries no tax and a ₹6,000 private room does. Ten nights at ₹4,000 stays exempt, because the threshold is a daily rate and not a stay total. Every taxed line prints the reason beside it.
Dispensed to an admitted patient it is part of the treatment and exempt; sold across the counter it is an ordinary taxable sale. The server decides which from whether there is a real admission behind the bill, never from a box somebody ticked — a per-line exemption checkbox ends up ticked on everything by the end of the month.
A draft is editable; an issued bill is not, because the patient is holding it. A line comes off by being voided, with a reason, and stays visible struck through. Nothing derived is stored — the total, the tax and the balance are worked out from the lines every time, so a voided line cannot leave a total behind that disagrees with them.
A deposit on admission and the rest at discharge is the ordinary case. A payment larger than the balance is refused, and a bill settles itself the moment the balance reaches zero rather than waiting for somebody to mark it. Voiding a line below what has been paid surfaces a refund due rather than hiding it as a negative balance.
The group, for a hospital running several units: each one and the sum of them on a single screen. A unit that cannot be read is named rather than skipped — a consolidated figure missing a unit is a number an owner acts on without knowing it is short.
Three tiers, so a receptionist can register a patient without being able to change a clinical record, and a nurse can read the register without being able to close it.
Not for a demonstration. The screens below are the ones open for eight hours at a stretch, on whatever tablet the department had spare.
Grant an administrator once at the group and they reach every facility, including the ones opened next year. No re-inviting anybody when the fourth clinic joins.
Our support administrators, your administrators, and your desk and clinical staff scoped to what their job needs. Roles are data we can change, not code we have to deploy.
A hospital’s visitor policy is usually a notice on a wall. This is where it becomes a record: who came in, who they came to see, how many of them, and when they left. The kind of identification is recorded and never its number.
The account belongs to security and reaches the book and nothing else — not a patient list, not a ward, not a bill. Until responsibilities existed, a gate account was ordinary staff, which in a hospital means every patient’s name and diagnosis.
A visit still open after eight hours is raised, because somebody who left without signing out and somebody still in the building look identical in any book that only records arrivals.
A treatment room missed between two patients is an infection, not an untidy room. Each area carries the times it is owed by and its kind, and a clinical area missed is said first and by name — not folded into a completion figure that reads as good news.
Every entry is stamped with our clock; there is no field for a time. A run of entries written down in one sitting is shown to the person who runs the department in plain words, because the times in a log stop meaning anything once they are all the same minute.
Faults carry an age and repetition. No water in a sluice room, reported nine times in a fortnight, is a different fact from one reported this morning, and a list sorted by date says neither.
Hosted, backed up, monitored and updated by us. Certificates, upgrades and capacity are not on anybody's list at your end.
Your departments, your numbering, your consent forms. The system matches the hospital; the hospital does not rearrange itself around the system.
Structure, roles and branding. Configuration rather than a rewrite, which is why this takes weeks and not quarters.
Your existing register imported and reconciled with you — including the duplicates, which are merged deliberately rather than silently.
On your own address, with your staff trained on it, and us reachable when something is not obvious.
The patient register is in production: registering, amending, searching, merging duplicates and closing records, with hospital numbers allocated by the server under load — three desks registering at the same moment get three numbers, which is checked against the real system rather than asserted here.
The outpatient book is in production too: booked slots, walk-in tokens, the waiting queue and the day sheet, with the clash check and the token counter both running inside a transaction on the server. Three receptionists taking walk-ins at the same moment get three different tokens, which is checked against the real system rather than asserted here.
Consultations are in production too: notes, vitals, prescriptions, signing and addenda, with the allergy check enforced on the server at the moment a note is signed rather than only on the screen where it is typed.
The pharmacy is in production: formulary, batch receipts, expiry alerts, FEFO dispensing and the Schedule H1 register — with stock decremented inside the same transaction that records the dispense, so two windows drawing the last of one batch cannot both succeed. That is checked against the real system rather than asserted here.
The laboratory is in production: catalogue, orders, sample numbers allocated under load, results interpreted against the patient's own reference range, the critical-value callback log, and verification that releases the report. Three phlebotomists collecting at the same moment get three numbers, checked against the real system.
In-patient management is in production too: wards, beds, admissions, transfers that keep the episode and its bed trail, and discharge that frees the bed in the same write and prices the stay. Two clerks admitting to one bed at the same moment: exactly one succeeds, checked against the real system.
What it does not do yet, said plainly rather than left to be discovered after you have bought it. Beds, medicines, tests, consultations, theatre time, implants and package rates are all billable — implants follow the same inpatient exemption as medicines — and implants are tracked individually from the shelf to the patient by serial, UDI or lot, so a recall can be answered with the list of people affected rather than a search through two years of paper. Coronary stents and knee implants carry their NPPA ceiling and cannot be priced above it. Insurance is handled as far as the desk: payers, policies, pre-authorisations, the estimate and the claim ledger. What it does not do is talk to a payer’s portal — there is no electronic claim submission, so a request still goes out the way your desk sends it today and the reply is typed back in.
It keeps working when the connection does not. Screens stay readable from the last known state, and anything that would write to a record refuses out loud rather than appearing to succeed — because a note that silently fails is a note somebody believes they wrote.