The Dose That Was a Decimal Point#
In September 2006, a three-day-old infant at Christus Spohn Hospital in Corpus Christi, Texas, received a heparin dose of 10,000 units per millilitre — a thousand-fold overdose. A nurse, preparing to flush an IV catheter, had selected from a medication dispensing unit a vial that appeared on screen in the same format as the correct vial. The selection interface presented unit doses and high-concentration vials in identical visual formats; the only distinguishing information was a numeric concentration value in a small font. The infant survived. In November 2007, three premature infants at Cedars-Sinai Medical Center in Los Angeles died after receiving the same type of overdose — 10,000 units per millilitre instead of 10 units per millilitre — from a medication dispensing cabinet interface that presented both concentrations in an undifferentiated list format.
The Cedars-Sinai incident occurred two months after the same overdose error at Methodist Hospital in Indianapolis, where eighteen premature infants received 10,000 units/mL heparin doses instead of 10 units/mL and survived only because the error was discovered before the full haemorrhagic consequence manifested. The Indianapolis incident received national coverage because the victims included twins of an actor, Dennis Quaid. The technology that was supposed to prevent this class of error — electronic medication dispensing and electronic health record (EHR) dose-entry systems, introduced specifically to replace error-prone handwritten orders — was the proximate enabling factor. The decimal point had moved from a handwritten order into a dropdown menu, and the interface had made selecting the wrong entry no harder than selecting the right one.
The IEAF of the Electronic Health Record#
The transition from paper-based clinical records to electronic health record systems was one of the largest intentional redesigns of a high-stakes information management system in history. Between 2009 and 2015, US federal incentive payments under the HITECH Act drove hospital EHR adoption from approximately 16% of non-federal acute care hospitals to over 85%. The rationale was compelling: EHRs would eliminate illegible handwriting, generate automatic drug interaction alerts, create searchable patient records, and enable population-level data analysis. They have delivered on most of these promises at the aggregate level.
The clinical literature on EHR-mediated medication errors presents a more complicated picture. A 2016 systematic review published in the Journal of the American Medical Informatics Association identified 17 studies documenting EHR-related medication errors across US hospital systems. The studies found that EHR interfaces contributed to errors through dropdown menu selection of wrong-patient or wrong-dose options, copy-paste of outdated medication orders creating unintended order replication, alert fatigue from high-frequency low-specificity warnings desensitising clinicians to critical alerts, and fragmented display of medication information across multiple screens requiring navigation to identify the full medication context.
The IEAF of a clinical dose-entry interface can be calculated precisely: the consequence severity (potential death or serious harm from medication overdose) is constant across safe and unsafe dose selections. The minimum action complexity to reach the unsafe state — selecting a 10,000 unit/mL concentration from a dropdown that presents it adjacent to the 10 unit/mL option — may be one click or keystroke. The IEAF ratio is therefore maximum consequence over minimum friction, and for the specific case of a high-concentration/low-concentration presentation error, the IEAF can be measured in lives.
Inside the EHR Interface Failure Modes#
Alert Fatigue and the Erosion of Protective Friction#
The drug interaction alert system is the EHR's primary built-in friction mechanism — it inserts a warning screen between the clinician and the order confirmation, requiring an acknowledged override before a potentially dangerous drug combination is entered. In theory, this mechanism should function as a friction layer reducing the IEAF of dangerous prescribing. In practice, the mechanism has been rendered nearly useless by alert volume.
A 2017 study published in JAMA Internal Medicine found that physicians at a major academic medical centre overrode 96.9% of all drug-drug interaction alerts they received. The override rate for the highest-severity alert category — life-threatening drug combinations — was 90.1%. A 2019 analysis of alerts across 17 US hospitals found that alert firing rates ranged from 20 to 130 per 100 orders, meaning that a clinician writing 20 orders in a session might receive between 4 and 26 alert interruptions. The majority of these alerts fired on interactions of low clinical significance — theoretical drug-drug interactions that, given the patient's clinical context, renal function, or actual clinical state, posed no meaningful risk. The high false-positive rate conditioned clinicians to treat the alert mechanism as noise.
The safety engineering consequence of alert fatigue is a complete inversion of the IEAF correction the alert was intended to provide. A clinician who has been trained by experience to click through drug interaction alerts without reading them has effectively removed the friction layer. The IEAF of the system in this state is equivalent to having no alert mechanism at all — with the additional hazard that the presence of the non-functional alert mechanism creates a false assurance that safety checks are operating.
The Dropdown as Failure Mode#
The specific interface mechanism responsible for the most documented EHR-related serious medication errors is the dropdown selection menu. Dropdown menus reduce cognitive load in routine operation by presenting a constrained set of valid options rather than requiring free-text entry. They also, by presenting those options in close visual proximity, create the conditions for selection errors: choosing the option adjacent to the intended option, either through imprecise pointer positioning or cognitive automaticity.
Wrong-drug, wrong-dose, and wrong-patient errors attributable to dropdown selection failures appear consistently across the EHR-related error literature. The Joint Commission's Sentinel Event database includes a category specifically for errors initiated by electronic order entry, the majority of which involve selection from medication lists or dose concentration dropdown menus. A 2015 analysis of Pennsylvania Patient Safety Reporting System data found that EHR-related errors accounted for approximately 14% of all reported medication errors in participating hospitals, with wrong-patient order entry (selecting the wrong patient from a list) as the single most common category.
The wrong-patient error category is instructive about IEAF. In a paper-based medication order system, writing an order for the wrong patient required physically opening the wrong patient's chart, writing an order that would then be reviewed and verified by a pharmacist before dispensing. The minimum action complexity of a wrong-patient paper order was high: multiple steps, multiple record-handling operations, and a pharmacist verification barrier. In an EHR system, a wrong-patient order requires selecting the wrong patient from a recently-viewed list (a single click), entering a medication and dose (a few keystrokes), and confirming (a button press). The pharmacist verification step may still exist downstream, but the IEAF of the order entry interface itself is radically higher than its paper predecessor.
The Alarm System Problem in Critical Care#
The intensive care unit environment presents the medical IEAF problem in its most acute form. A typical ICU patient is connected to 8–12 monitoring devices generating continuous physiological data streams. Each device has audible alarm thresholds that, when exceeded, generate an alarm. Studies of alarm burden in US ICUs have found alarm rates of 150 to over 700 alarms per patient per day, with reported nuisance alarm rates — alarms that require no clinical intervention — exceeding 85% of total alarm volume.
The consequence for patient safety mirrors the EHR alert fatigue problem: ICU nurses, nurses' assistants, and pharmacists operating in environments with continuous high-volume auditory alarms show documented perceptual adaptation that reduces response sensitivity to all alarms, including critical ones. A 2015 Joint Commission Sentinel Event Alert on medical device alarm safety cited 98 deaths attributed to alarm-related issues over a four-year period, the majority representing delayed response to actionable alarms that were masked by high ambient alarm volume.
The IEAF of an alarm that fires 85% of the time on non-events is high: it trains the operator to treat the alarm as signal noise, effectively removing the protective friction of the alert mechanism. The minimum action complexity to miss a critical alarm is zero — it fires, the operator has been behaviorally conditioned to attribute it to a sensor artefact, and the critical event progresses unaddressed. Maximum consequence through minimum action. The next post examines how some domains have responded by deliberately engineering friction back into high-consequence interfaces.
