HC-OPS-027 / HEALTHCARE
A telehealth platform learned to fail safely
A multi-specialty virtual-care operator consolidating intake, prescribing, messaging, escalation, and after-hours workflows.
Context
Rapid service growth created multiple rule paths, inconsistent escalation ownership, and operational workarounds that were invisible to the product backlog.
The problem beneath the brief
The platform could route normal visits, but it could not reliably explain which safety rule fired, who could override it, or what the on-call team should do when identity, pharmacy, or clinical context was incomplete.
- 6
- safety layersclinical safety architecture
- 18
- critical workflow scenariosrelease evidence matrix
- 1
- shared escalation clockoperations acceptance record
Risk constraints
What could not be traded away.
- clinical override authority
- prescribing safety
- state and specialty variation
- after-hours continuity
- complete audit rationale
Findings
What inspection changed.
- three override paths produced different records
- an asynchronous message could bypass the intended escalation clock
- support and clinical operations used different incident taxonomies
Architecture
The operating system we installed.
- 01deterministic safety-rule servicesix-layer safety review
- 02clinician override with rationalered-flag routing
- 03single escalation clockoverride sampling
- 04operational event streamon-call rehearsal
- 05case-linked audit recordincident taxonomy
Delivery sequence
Four gates. No ceremonial phase changes.
- 01
Frame
Define the decision, outcome, work products, authority, dependencies, exclusions, and acceptance evidence.
A named sponsor and principal approve the bounded charter. - 02
Inspect
Observe the operating reality, trace systems and records, test assumptions, and rank failure modes.
Critical unknowns have owners, evidence plans, and stop conditions. - 03
Build
Implement the smallest coherent change with versioned decisions, controls, and verification attached.
The integrated state meets the agreed evidence threshold. - 04
Transfer
Rehearse recovery, resolve exceptions, accept the work, remove temporary access, and transfer operating ownership.
The receiving owner signs the handoff with open limits visible.
Complications
Where the plan had to become more honest.
- A technically valid fallback created an unsafe operational delay.
- One specialty needed a stricter rule without forking the entire platform.
Outcomes
What changed—and what the record proves.
- Every safety intervention and override resolved to one traceable decision record.
- Clinical and support operations shared one severity and escalation model.
- The receiving team could rehearse a degraded identity scenario without bypassing clinical custody.
Lessons
What we would carry into the next system.
- A rule engine is incomplete without override authority and operations.
- The safest product behavior can still fail in the handoff around it.
- Clinical and support severity must describe the same event.
Handoff
The engagement ended with an operating owner.
- 01versioned rule inventory
- 02override-review cadence
- 03on-call scenario pack
- 04audit queries
- 05incident and correction owners
Start with the decision
Bring the priority. We will help bound the work.
If the decisions or constraints look familiar, start with the operating reality—not a preselected solution.
Start a conversation.