Somerset NHS
Foundation Trust

Parag Garg

I am a consultant foot and ankle surgeon at Somerset NHS Foundation Trust. The tools below are prototypes, built in my own time, for clinical problems I have myself. There is no company, no product, and nothing here is for sale.

Contents

The argument

Where the governance burden falls

The level of assurance a tool needs follows what it does, not what it is called.

A large model that drafts a letter for a clinician to read and correct carries less clinical risk than a lookup table that quietly reorders a waiting list. Sophistication and consequence are separate axes, and assurance should track the second.

This is inconvenient, because it means the classification cannot be read off a product description. Deciding which parts of a tool touch a decision — and how much of the decision has already been made by the time a person sees the output — requires knowing how the pathway actually runs. That is clinical work. It is not a question an information governance form can answer on its own, and it is not an engineering question either.

Each tool below is described the same way: the problem it addresses, what it does, what has and has not been built, and where each of its functions sits.

The tools

The tools

Prototypes. All of them run on synthetic data. None has been validated, approved or deployed for patient care.

Tier 1 as built.
Tier 3 if a severity
band is acted on.

Concord

Medicines reconciliation · runs against a synthetic corpus · open the demonstration

The problem
On admission a patient's drug list has to be reconciled against the documents it came from — GP record, discharge summaries, clinic letters, care-home MAR sheets. The discrepancies that matter are usually quiet ones. An anticoagulant that disappears between the care home and the ward. A clinic dose change that was never carried across.
What it does
A model reads each document one at a time and transcribes what that document says, attaching a verbatim quote to every value. Deterministic code, not the model, then compares those transcriptions and applies eleven discrepancy rules. The model is never asked whether something is a discrepancy. It only reports what each document contains, and anything whose quote cannot be located in the source is shown as unverified rather than asserted.
Built and not built
The comparison layer is complete and has been evaluated blind across 34 synthetic documents. The extraction step has been run against one model, once, untuned. Nothing has been near a real patient record, and there is no integration with any live system.
Governance position
As built, Tier 1: a pharmacist reads every finding, and nothing is written to any record. Reading a drug list from a live EPR would make the same tool Tier 2. Presenting a severity band that a pharmacist acts on without opening the sources would make that one function Tier 3, whatever the rest of the tool is doing.

Outside clinical use
as a viewer. Tier 3 if
a measurement is used.

CT Splicer

CT planning viewer · runs in the browser · open the demonstration

The problem
Planning an orthopaedic case from CT means moving between planes and holding the relationship between them in your head. The viewers available on a ward computer are not built for that, and the ones that are do not run there.
What it does
Loads a DICOM series in the browser and shows linked multiplanar views alongside a three-dimensional reconstruction, so that a point marked in one plane is marked in all of them.
Built and not built
Viewing, linking and marking work. Nothing is saved, nothing leaves the browser, and no measurement made in it has been checked against an accepted standard.
Governance position
Used as a viewer for my own study of a case, it sits outside clinical use. If a measurement taken in it were used to size an implant or set an osteotomy, that function would be Tier 3 — and would first require the measurement accuracy to be established against a reference method, which has not been done.

Assurance

Tiers of assurance

A simple interface can carry clinical consequence. A sophisticated model can stay low risk when its authority is tightly bounded and every output is read before it is used. The tier follows the consequence.

TierWhat it meansAssurance that follows
Tier 1
Human‑reviewed		 No integration with clinical systems. Every output is read by a person before it is used, and the person can see what it was derived from. Standard IG review
Trust AI-use policy
Tier 2
Operationally
integrated		 Connects to EPR, booking, theatre or diagnostic systems to carry out bounded workflow tasks. It moves work, not clinical decisions. DPIA and IG review per data flow
DCB0160 where outputs enter the record
Integration engineering and rollback
Tier 3
Clinically
influential		 Any function that informs a clinical decision, however simple the interface appears and however small the function is within the product. DCB0129 and DCB0160
Named clinical safety officer
Shadow-mode validation
DPIA and Caldicott review
DTAC
MHRA SaMD assessment where applicable

Function, not product

Classification is function-specific. One product can contain Tier 1, Tier 2 and Tier 3 functions at the same time, and each must be governed according to its own data flows, its own integration and its own clinical influence.

This is why a tier cannot be assigned from a product name or a procurement description. It has to be assigned function by function, by someone who can see where in the pathway each output lands.

Change

Changing a tool safely

Building locally means changing things often. The sequence below is what keeps that compatible with clinical safety: not slower change, but change where it is always clear what moved and how to stop it.

  1. Define the problem

    Name the clinical problem before naming the tool. If it cannot be stated as something that currently goes wrong, there is nothing to build.

  2. Bound the task

    Fix what the tool may do and what it must refuse. The boundary is the safety argument, not a limitation of it.

  3. Validate in shadow mode

    Run it alongside current practice with its output withheld from anyone making the decision, and measure it against what was actually done.

  4. Release with approval

    A named owner, a stated intended use, an evidence threshold that has been met, an audit trail, and a route to stop.

  5. Monitor and version

    Know what changed, when it changed, and what the change did to the measurements. A version whose behaviour cannot be reconstructed cannot be defended.

Evaluation

How these are evaluated

A separate page describes the evaluation method and gives one worked example in full, including the run where the first thing the harness caught was a fault in its own scoring rather than an error by the model.

Read the evaluation method