Skip to content

Record integrity and provenance

Code: PROV — data quality, provenance and auditability.

Scope

This finding concerns whether a user can establish what was recorded, changed, copied, transferred or omitted; who performed the action; when it occurred; which representation is being viewed; and what prior state remains recoverable. A technically complete back-end audit trail does not necessarily make provenance visible in the clinical, printed, exported or transferred view that informs a decision.

What recurs in the current series

  • Amendment history differs by representation. In Alexander Braund (representative case), a retrospective amendment was not apparent on the printed summary examined at inquest, although later evidence described an underlying live audit trail.
  • Safety content is divided across paper and electronic records. In Audrey King (representative case), a recommendation remained on paper while medication state was managed electronically.
  • A paper instruction may not survive into the prescribing view. Michael Drewell concerns a six-week anticoagulation duration recorded by hand but absent from the electronic medication record used by the junior doctor. The coroner said it was not possible to determine whether the missed duration caused the death.
  • Patient-supplied information may never enter the longitudinal record. Stephen Stringer (representative case) concerns an administrative-stream enquiry that did not become part of the clinical record.
  • Transfer and transcription can omit or contradict medication state. John Fisher concerns omission of sodium valproate when handwritten information was transcribed into eMAR; Valerie Gibson and Jason Bayley concern conflicting dispensing or administration representations.
  • Post-finalisation change may lack visible attribution. Ethel Reed concerns an immediate discharge letter whose displayed and distributed representation did not automatically identify the author of a later change, even though respondent evidence described a fuller underlying audit trail.
  • Shared credentials can erase the true author or actor. Joan Lunt concerns agency staff recording through proxy or generic electronic identities because individual access was not available in time. The death was from natural causes; inclusion rests on the explicit prospective risk to accountability and investigation.
  • “Updated” or “validated” can obscure the original state. The redacted 2018 report concerns overwritten or obscured content and an unclear relationship between risk assessments and progress notes. The coroner expressly said the reported issues could not be said to have caused or contributed to that death, while identifying possible risk in other cases.
  • Late entry and source preservation can become contested. Elton Deutekom concerns retrospective transcription and destruction of contemporaneous handwritten notes; the Trust response said the note was accurately transcribed under policy and denied concealment.

These examples support provenance as a user-facing safety property, not merely a forensic database capability.

Variation and limits

  • The mechanism includes wrong-person attachment, missing content, inconsistent fields, manual transcription, retrospective entry, hidden amendment, scanned correspondence and divergence between live, printed and exported views.
  • A visible correction must not make the original error look current, but hiding correction history can also mislead. Both current truth and change history matter.
  • Respondent evidence can establish that an underlying audit trail existed while the coroner's concern remains valid for the representation actually used. The two statements are not contradictory if the views differ.
  • Several provenance concerns were framed as future risks and were not found causal in the individual death. The dataset cannot estimate the wider frequency of record-integrity defects.

The current review counts demonstrate recurrence of PROV coding in this targeted series, not prevalence. PROV commonly overlaps with VIS, INT, LOOP and HF, so its count is not an independent event total.

Defence implications — analytical translation

The following are analytical translations for DPHC and CORTISONE:

  • preserve author, role, event time, entry time, source, reason for change and prior content across clinical, print, export and transfer views;
  • make missing source periods, copied content and unresolved conflicts visible;
  • reconcile hybrid and delayed-entry workflows without destroying the evidential relationship to the original source; and
  • test provenance after migration, offline reconciliation, correction, merge, export and cross-organisation transfer.

These are review-derived requirements, not directions made by the coroners. See the DPHC and Programme CORTISONE analysis.

Evidence basis: included-case dataset, coding framework, and current review counts.