Skip to content

Resilience and degraded operation

Code: RES — resilience and degraded operation.

Scope

This finding concerns safe operation when the intended digital path is unavailable, delayed, incomplete or outside normal conditions. Degradation includes connectivity and system outage, but also after-hours staffing, cross-region access, delayed finalisation, individual-inbox dependency, manual fallback and later reconciliation.

What recurs in the current series

  • Critical-result delivery falls back to a fragile parallel channel. In Eric Thompson (representative case), electronic availability did not provide efficient delivery and telephone escalation remained important.
  • Transfer information is inaccessible without the expected access path. In Morris Reddington (representative case), separate credentials and unfamiliar navigation impaired routine retrieval of ambulance records.
  • Night-time and after-hours workflows differ from the nominal process. Michael Nye concerns delayed night-time result completion and notification; Jack Farrington concerns cross-region records unavailable out of hours alongside a missing paper handover.
  • Remote access failure can remove both reading and writing capability. In John Hazlewood, the on-call psychiatrist could neither retrieve the relevant record nor enter the assessment for subsequent teams, leaving no resilient path for documentation and escalation. The report does not assign the outcome to one system defect.
  • A low-bandwidth task channel can omit clinical context. Jennifer Trigger concerns a bleep that conveyed neither task description nor urgency.
  • Fallback can fail across several channels at once. Paul Price concerns incompatible systems that required fax and post, together with an outage and lost callback; Steven Welch concerns printing and faxing radiology material across an incompatible cross-border pathway. The former was reported as a continuing risk without a causal digital finding, and the latter was considered unlikely to have caused the death.
  • Distributed transactions can leave conflicting live states. Oliver Billings concerns cancellation and reissue of a prescription after one endpoint had downloaded it.
  • A non-EHR service can expose a hidden single point of failure. The bounded telecare case of Mavis Reeves concerns an occupied analogue Careline connection blocking the entry call and delaying access information. The conclusion was natural causes and the report did not find that the delay caused the death.
  • Organisational transition can degrade the information system. The Anthony Binfield, David Richards and Rolandas Karbauskas clustered report describes risk information fragmented across paper, electronic records and individual email during prison and provider transitions.

These cases suggest that fallback is a clinical workflow requiring its own ownership, state model and reconciliation—not an informal instruction to “use paper” or “telephone instead.”

Variation and limits

  • The RES examples cover distinct forms of degradation, not a complete taxonomy of downtime or deployed operation.
  • Some cases involve no technical outage. The degradation is operational: missing access, delay, reduced staffing, unfamiliar workflow or a handover channel that strips context.
  • Manual and telephone routes can be appropriate controls when explicitly owned, recorded and reconciled. The evidence does not support eliminating them.
  • The clustered prison report combines severe staffing, culture, contract-transfer and information failures; the digital component cannot be assigned independent causal weight.

The current review counts show recurrence of RES coding only within the targeted case series. They are not an estimate of downtime risk, and overlap with INT, LOOP, VIS, HF and GOV is expected.

Defence implications — analytical translation

The following are analytical translations for Defence settings, not coronial findings about deployed care:

  • define minimum safe functionality for disconnection, low bandwidth, system unavailability, after-hours working and cross-domain transfer;
  • make queued, failed, duplicated and unreconciled transactions visible to an accountable team;
  • preserve enough clinical context, priority and provenance in every fallback channel;
  • rehearse restoration and reconciliation, including conflicts created while disconnected; and
  • test posting, embarkation, evacuation, provider change and loss of an individual staff member as degraded-mode scenarios.

See the DPHC and Programme CORTISONE analysis.

Evidence basis: included-case dataset, coding framework, and current review counts.