Authorship & the record
A clinical record outlives the shift, the product and the company that made it. A reader years from now sees a paragraph and a name underneath it, and has no way to ask anyone what happened in between. Everything on this page exists so that reader is not misled about who wrote it.
Machine-composed text is marked as machine-composed everywhere it is displayed, stored, printed and exported, and the human who commits it is recorded as having accepted it — never as having written it.
What this covers
Three facts are true of every committed brief, and products routinely collapse all three into one signature line:
- What the machine produced. A specific version of a specific system emitted specific words at a specific time.
- What the human changed. Nothing, a phrase, or the whole thing — three very different acts.
- What the human is willing to stand behind. The only one of the three that anybody is actually asserting.
Collapse them and you get "Author: Dr Reyes" above nine paragraphs Dr Reyes did not write. The signature is not a lie exactly — someone did decide to let it stand — but the record now credits a person with clinical observations they may never have made, and there is no way for a later reader to recover the difference.
This page governs the provenance of composed text. Composed output governs whether the text was fit to show at all. They are separable: a perfectly grounded brief filed under the wrong author is still a corrupted record, and a well-attributed brief full of unbound assertions is still unsafe.
The mark that has to survive
Article 50 requires that AI-generated content be disclosed as such. Read as a UI requirement that is easy and nearly useless, because the disclosure that matters is not the one on screen while the composer is open — it is the one still attached to the text six systems later.
The test is blunt: if selecting the text and copying it removes the disclosure, there is no disclosure. A border does not survive copy. A colour does not survive print. A chip in the toolbar does not survive an HL7 message, a PDF export, or a paragraph pasted into a referral letter — and those are the journeys on which the reader has least context and most reason to assume a person is talking to them.
So the mark lives in the text payload, not only in the chrome:
Admitted 15 Aug with community-acquired pneumonia. Oxygen requirement fell from 4 L/min to 2 L/min over the shift obs 21:00. Antibiotics switched from intravenous to oral at 18:20 med 18:20.
Overnight: pain score rose to 7 at 02:15 and remains unaddressed in the record obs 02:15.
The wording of the header line and the footer line are governed strings. They are not shortened for space, not moved into a tooltip, not shown only on first use, and — the amendment this page forced — never composed by the system they describe. If the model writes its own disclosure, the disclosure is not a risk control; it is another output of the thing being disclosed.
Accepted is not authored
What the record stores, in words a system twenty years from now can still parse:
"Accepted by" is doing real accountability work. A person who accepts is answerable for the decision to let the text stand, which is a genuine clinical act with genuine consequences. It is simply not the same act as observing a patient and writing down what you saw, and the record should be able to tell them apart.
The degree of change is recorded because unchanged and rewritten are different events. A brief accepted with no edits at 06:58, seventeen seconds after it appeared, is a different object from one worked over for four minutes — not necessarily worse, but a post-market surveillance function that cannot see the difference is blind to the most informative signal it has.
The version the machine wrote
The composed text is retained alongside the committed text, for the retention period of the record.
The argument is not archival tidiness. It is that silent correction destroys the evidence that the model needs correcting. A clinician who quietly fixes a wrong drug dose in a draft has protected this patient and erased the only trace that the composer produced a wrong drug dose. Do that across a year and the performance data says the model is excellent, because every error it made was absorbed by a human being who was too busy to file a report about it.
Editing is a safety net. A safety net whose use is never measured is a safety net nobody knows is load-bearing.
- 06:41:07 NightBrief v4.2 composed a handover brief 9 assertions · 4 record items not carried
- 06:55:22 Sentence edited — "pain score 7" corrected to "pain score 7, analgesia given 02:40" A. Reyes · composed version retained
- 06:56:40 Sentence removed — no supporting entry found by the reviewer A. Reyes · composed version retained
- 06:58:03 Accepted and filed to the record A. Reyes, registrar
This is the same instinct as Clinician override: a disagreement is information about the model, and throwing it away is the expensive mistake. It is also what Article 12's logging obligation is for, and what Model version & change needs in order to say anything truthful about a version that has been superseded.
The reader who has never seen this product
The mark is written for someone with no access to the composer, no login, and no idea what NightBrief is. That imposes two things.
The version has to resolve to something. "Composed by NightBrief v4.2" is only useful if v4.2 is a real, published, findable thing with a description of what it did — see Labelling & identification. A version string that identifies a build nobody outside the company can look up is decoration.
The mark cannot depend on the product being open. A downstream reader is reading an exported document in a system this design system has no influence over. Whatever the mark needs to say, it says in the sentence, because that sentence is all that arrives.
States
| State | Rendering |
|---|---|
| Composed, untouched | Marked as composed, editable, not in the record. Nothing about it is presented as a finding. |
| Edited, not committed | Still marked as composed — editing a machine's text does not make it yours. The composed version is already retained at this point, not at commit. |
| Committed unchanged | In the record, marked as composed, attributed as accepted by. The zero-edit fact is stored, not hidden. |
| Committed with edits | As above, plus what changed. Both versions retained. |
| Discarded | Logged — the model did produce it, and post-market surveillance needs that — but it never enters the clinical record. A discard is not a failure and is not chased for a reason. |
| Expired unreviewed | Never silently committed. It becomes a stated absence in the receiving team's list, per Pending & unreviewed work. |
Who holds each rule
Authorship is about what a person is willing to stand behind, and the record of that is now something the package can hold. The editing surface is held too. The judgement is not.
| Rule | Held by | Where |
|---|---|---|
| What the machine produced and what the human changed are attributed separately | Event log | Two entries, two actors. A composed draft and a human edit are different facts with different authors, and the record cannot merge them. Asserted: EventLog: every entry names an actor, and says whether it was software |
| The composed version is retained beside the committed one | Event log | The commit supersedes the draft entry; the draft stays readable. Asserted: EventLog: a superseded entry stays, and says it was superseded |
| What the human changed is never silently lost | Textarea | No keystroke is dropped by the control. What survives navigation is yours — see the textarea’s own table. Asserted: Textarea: typing past the limit is kept, not swallowed |
| The commit control cannot be activated twice | Button | A pending button refuses a second activation and says what it is waiting for. Asserted: Button: pending names what it is waiting for |
| Targets are at least 44 px | Button | The touch floor is the default. Asserted: Button: the documented sizes exist and default to the touch floor |
| The mark precedes the text in DOM order | Composed text | The disclosure sentence is the article’s first content. Asserted: ComposedText: the disclosure is text, first in the document, naming composer and version |
| Composed status is never carried by the left rule alone; the disclosure is text, not chrome | Composed text | The disclosure is a sentence — composer, version, time, acceptance state — and its wording is a constant in the component, so neither the composer nor the caller writes it. Asserted: ComposedText: select-all carries the disclosure before the prose, and no withheld sentence |
| Edited and unedited are distinguished in words | The implementer | A diff is a view you build; the words that label it are yours. |
| The commit control is last in focus order | The implementer | Layout. |
| Attribution is “accepted by”, never “author” | Composed text | acceptedBy is the only attribution prop. There is no author.Asserted: ComposedText: attribution is accepted-by, and there is no author prop |
| What the human is willing to stand behind is a decision, recorded as one | The implementer | The recording is held. That committing means reviewing, rather than scrolling past, is the thing no control can enforce — see Editing the draft. |
A pattern page has no component underneath it, so a rule stated here is held by whoever builds against it unless a component already holds it. Of these 11 rules, 5 are held by a component this package ships, and 6 are the implementer’s. Five held, six not. The record can say a person accepted a draft. It cannot say they read it, and this page’s argument is that nothing should pretend to.
Do's and don'ts
Composed by NightBrief v4.2 · accepted by A. Reyes, registrar, 06:58
Three facts, none of them collapsed. A later reader can tell what the machine did from what the person did.
Author: A. Reyes, registrar
Credits a clinician with observations they may never have made, and removes the machine from a record it is the origin of.
Pasted into a referral letter:
"Composed by NightBrief v4.2, accepted by A. Reyes 17 Aug 06:58. Oxygen requirement fell
from 4 L/min to 2 L/min…"
The disclosure travelled with the text, because it was text.
Pasted into a referral letter:
"Oxygen requirement fell from 4 L/min to 2 L/min…"
The chip that said "AI-generated" stayed behind in the toolbar. The disclosure existed exactly where nobody needed it.
Names the act performed. The clinician is agreeing to let it stand.
In every other context in medicine, signing asserts authorship. The word does the misattribution on its own, before the record even stores anything.
Accepted with edits — 2 sentences changed, 1 removed. Composed version retained.
The correction is visible as a correction, so the model's error rate is measurable rather than absorbed.
Accepted.
The draft was overwritten. Every error a clinician quietly fixed is now evidence that the model does not make errors.
Accessibility
- The mark precedes the text in DOM order. A reader needs to know what they are about to read before they read it, not after. A disclosure announced at the end of nine paragraphs arrives after every decision it was meant to inform.
- Composed status is never carried by the left rule alone. The rule is redundant decoration over a text header, per Accessibility — SC 1.4.1.
- Edited and unedited are distinguished in words, in the provenance block, not by a subtly different weight or shade.
- The commit control is last in focus order and is not reachable before the text it commits has been traversed.
- The provenance block is a definition-style list, not a paragraph of run-together metadata, so it can be navigated rather than re-read.
- Targets are at least 44 px — SC 2.5.8. Accepting a clinical record is not a control to place beside Discard at thumb width.
Outcomes of use
What this contributes to, in the terms of Usability & context of use. These are attributes believed to contribute to an outcome; the outcome itself is settled by observing real use in a specified context, not by this page.
- Effectiveness — a later reader's belief about who wrote a sentence matches who wrote it. That belief is load-bearing: how much a clinician trusts a handover note depends heavily on who they think observed the patient.
- Efficiency — worse, here, and deliberately. Recording acceptance properly is slower than a signature. The gain is downstream, in the minutes a later reader does not spend reconstructing where a claim came from, and in surveillance data that is worth having.
- Satisfaction — a clinician is not credited with words they did not write, which is both an accuracy matter and, for many people, a professional one.
Clinical safety notes
Trace these in your risk file (ISO 14971) and usability engineering file (IEC 62366-1). Each bullet says what checks it: a component that holds the rule, a test in your verification file, deployment configuration, post-market surveillance, or a design review where no test can see it. A control checked by nothing is a sentence.
- The disclosure is text, not chrome. (held by Composed text) Mitigates: composed text read as human-authored after copy, print or transfer.
- Attribution is "accepted by", never "author". (held by Composed text) Mitigates: a clinician credited with observations they did not make.
- The composed version is retained beside the committed one. (held by Event log) Mitigates: model error rendered invisible by silent correction, and post-market performance data that overstates the device.
- Degree of change is recorded. (a test in your verification file) Mitigates: rubber-stamp acceptance indistinguishable from genuine review.
- Nothing is committed without a named human act. (a test in your verification file) Mitigates: unreviewed composed text entering a clinical record.
- Discarded drafts are logged but never filed. (a test in your verification file) Mitigates: surveillance blind to the outputs clinicians rejected outright.
- The disclosure string is authored by the application, not the composer. (held by Composed text) Mitigates: a risk control produced by the thing it controls.
Related
- Composed output — whether the text was fit to show before any of this applies.
- Voice & tone — governed strings, and why a composed sentence can never be one.
- Clinician override — the same argument for keeping disagreement rather than discarding it.
- Model version & change — what a version string has to resolve to.
- AI transparency — Article 50 disclosure and Article 12 logging.
- NightBrief — the reference application, and the recipient who was not present.