La doctrine d'alerte

ehr-lab is about to start producing clinical advice: dose ceilings, drug interactions, contraindications, renal adjustments. This page fixes the rules before the first one ships, because the evidence says this decision cannot be revisited later.

The fact that forces the issue

Alert fatigue is a problem of redundancy, not of wear over time. Ancker et al. (BMC Med Inform Decis Mak 2017, 112 clinicians, 1.59 M alerts) found that raw workload does not predict overriding — repetition does. Each extra alert in an encounter cuts acceptance by 30 % (IRR 0.70), and once a clinician has overridden an alert a first time, 87.9 % of subsequent occurrences are overridden too — 99.9 % for medication alerts.

The anchoring is immediate and it does not wash out. So the volume of alerts is decided at deployment; a clean-up afterwards does not restore receptivity.

ehr-lab currently ships zero medication alerts. That is an asset every production EHR has already spent, and it cannot be bought back.

Which alerts actually deserve attention

Nanji et al. (JAMIA 2018, ~340 000 overrides in a hospital setting) broke overrides down by alert type, and the spread is the whole story:

Clinicians are not the failure. The duplicate/allergy/formulary alerts are, and by Ancker's mechanism they destroy receptivity to the 2.2 % that matters.

The three rules

Implemented in apps/ehr-lab/src/domain/advice.ts.

1. Attention budget. Advice that is not inline is capped (ATTENTION_BUDGET). Adding a noticeable one means removing another, or making it inline. The registry currently uses 5 of 6 — one slot left, so the next addition is an explicit trade-off rather than an accretion.
2. Tiering. Only blocking interrupts, and only codes in BLOCKING_ALLOWLIST may be blocking. There is exactly one: renal-dose-adjustment. Tiering by severity raised acceptance of severe alerts from 34 % to 100 % (Paterno, JAMIA 2009) — but only while the top tier stays credible.
3. Role routing. Every advice declares its audience. Routing to the right profession is the only alternative design that reliably increases acceptance (Powers, JAMIA 2019, systematic review). The modal interruption is the most common design and the least accepted.

inline is deliberately uncapped: information living in the context of the decision costs no attention. That is the doctrine's release valve — you may always add information, never an interruption.

How the rules are enforced

Not by this page. By doctrineViolations(), which the unit test (apps/ehr-lab/tests/advice.test.ts) requires to return an empty array. It fails, with a message naming the broken rule, when someone adds an interruption outside the allowlist, exceeds the budget, omits an audience, or ships a duplicate/unstable code.

And buildAdvice(code, …) throws for any code absent from ADVICE_REGISTRY, so an alert cannot reach a screen without passing through the registry — and therefore through this doctrine.

The one deviation we take knowingly

allergy-match is flagged, although the aggregate calls allergy alerts noise (96.5 % appropriate overrides). The aggregate measures production EHRs whose allergy lists are free-text and dirty. Here the allergen is coded and the match is made by the CE-marked device, not by string comparison. We accept the deviation, at flagged — never as an interruption — and record the reasoning in the registry entry itself so a future reviewer can overturn it on evidence rather than on taste.

What this does not claim

No isolated software tool has demonstrated a reduction in patient harm — not CDS, not dashboards. The realistic ceiling for clinical decision support is roughly 5–6 percentage points of improvement on care processes (Kwan, BMJ 2020, 115 randomised trials), and the only interaction mode with a demonstrated effect on harm is a sociotechnical bundle (I-PASS, NEJM 2014), where software is one brick among training and peer observation. This doctrine is about not destroying receptivity. It is not a safety claim.