Capture & quality gate
When the person operating the device cannot interpret what it produces, they have exactly one safety judgement available to them: was the input good enough? This pattern is about making that judgement possible for someone with no clinical training — and about refusing to produce a finding when the answer is no.
Overview
Everything else in this system assumes the reader can check the software's work. A clinician looks at the trace before the interpretation; if the machine is wrong, they see that it is wrong. That assumption is what makes evidence before conclusion a workable strategy at all.
Remove it and the safety architecture has to move. A screening operator in a high-street optometry practice cannot tell a healthy retina from a diseased one, and should not be asked to. What they can tell — with training that takes an afternoon rather than a decade — is whether the image is in focus, correctly framed, of the right eye, and free of the artefacts that make it uninterpretable. So that is where the safety judgement is placed, and the interface is built to support that judgement and no other.
This pattern is the operator-side, pre-analysis counterpart to out-of-scope disclosure, which is the reviewer-side, post-analysis version of the same instinct — withhold rather than extrapolate. The difference matters: by the time a confidence score exists, the bad input has already been analysed. The gate exists so that never happens.
It is also distinct from signal quality on the ECG review screen. That annotates quality for a reader who can already interpret the trace and lets them decide. Here there is no such reader, so the software decides.
Gate before analyse
Adequacy is settled before any analysis runs. A finding derived from an inadequate image is worse than no finding, because it looks like one.
Judged on the input
Every question the gate asks the operator is answerable without clinical knowledge. If it needs interpretation, it is the wrong question.
Ungradable is an answer
"We could not assess this" is a valid, complete, reportable outcome — never a degraded version of "nothing found".
Anatomy
Four fundus images per person — macula-centred and disc-centred, each eye. Each is gated individually, and the encounter is only as complete as its weakest field.
There is no path from a failed gate to a result. That is the whole design.
-
Right eye · macula-centred AdequateFocus, framing and illumination within limits
-
Right eye · disc-centred AdequateFocus, framing and illumination within limits
-
Left eye · macula-centred AdequateFocus, framing and illumination within limits
-
Left eye · disc-centred Not adequateOptic disc not fully within frame. Ask the person to look at the fixation light and recapture.
| Part | Rule |
|---|---|
| Field identity | Eye and field named in full on every item — left eye, disc-centred, never
L-DC. Wrong-eye capture is this device's version of wrong-patient error,
and abbreviation is where it starts. See Patient
header. |
| Verdict | Adequate or not adequate. Two states, no middle. "Borderline" is a category that exists to let throughput win an argument it should lose. |
| Reason | Required on every failure, in operator language, naming the physical cause — not a score, not a code. |
| Instruction | What to physically do differently. A reason without an instruction leaves the operator retaking the same inadequate image. |
| Exits | Exactly two: recapture, or refer to a human grader. There is no third button and no way to proceed to analysis. |
| Completeness | The encounter states how many fields passed. Three of four is not a complete screen, and the result must not be issued as though it were. |
What the gate may ask
The constraint that shapes everything: every question must be answerable by someone who cannot interpret a retina. That rules out more than it sounds like it does.
| The gate may judge | The gate may not judge |
|---|---|
| Focus and sharpness | Whether a lesion is present |
| Framing — is the required landmark within the field | Whether an appearance is pathological or a normal variant |
| Illumination, over- and under-exposure | Whether the finding is worse than last year |
| Artefact — eyelash, reflection, dust, smudge | Whether the person needs treatment |
| Media opacity obscuring the view | Why the media are opaque — that is a clinical question, and the referral exists so a clinician answers it |
| Laterality — is this the eye it claims to be | Whether one eye's result can stand in for the other. It cannot. |
A field that fails the gate produces no finding at all. Not a finding with a caveat, not a lowered confidence score, not "no referable disease detected — image quality limited". Every one of those is read as a negative result by the person receiving it, and the caveat is the part that does not survive being repeated at the front desk.
This is a governed behaviour. The gate has no sensitivity setting exposed to a deployment, no per-site threshold, and no operator override — because the pressure to loosen it is a throughput pressure, and throughput pressure is exactly what a safety gate exists to resist.
Ungradable is an answer
The strongest temptation in an autonomous screening device is to treat "could not assess" as a failure of the encounter rather than as its outcome. It is not a failure. A person whose media are too opaque to photograph has been given real, actionable information: this cannot be screened by camera, and you need to see someone who can examine you directly.
Note what is absent: no confidence score, no "probably normal", and no alarm colour. An ungradable image is a state, not a clinical priority — so it takes a neutral chip and never an IEC hue. See Colour.
- Never "no disease detected, quality limited". The two halves of that sentence contradict each other and only the first half gets remembered.
- Never a partial screen reported as a screen. If one eye could not be assessed, the encounter is ungradable for that eye, and the person is told which.
- Never let the other eye stand in. Retinopathy is not symmetrical, and a clear right eye says nothing about the left.
- Never present it as an error. No red, no apology, no "failed". The operator did their job and the outcome is legitimate; copy that implies otherwise trains people to force a pass.
- Count it. Ungradable rate per operator, per site and per device is a post-market surveillance signal — a site whose rate suddenly drops is not getting better at photography.
Retake, refer, and the loop that must end
Recapture is the right first response and the wrong last one. Each attempt costs the person a flash, some discomfort and some goodwill, and after a few attempts the marginal image quality stops improving — the limit is the eye, not the operator.
| Attempt | What the interface does |
|---|---|
| First failure | Names the physical cause and what to change. Recapture is the prominent action. |
| Second failure | Same, plus the refer option raised to equal prominence. The operator is told this is normal and not their error. |
| Third failure | Recapture stops being offered for that field. The encounter proceeds to referral. The decision is the system's, not the operator's, so that no one has to justify stopping. |
| Any point | Refer is always available immediately. An operator who can see it is not going to work must never have to perform two more attempts to prove it. |
Put the stopping decision on the operator and you have created a judgement call between "keep trying" and "send this person to a clinician", made by someone with no clinical training, under appointment-time pressure, with a queue in the waiting room. The cap removes the judgement. It is a smaller design than it looks and it is the reason the operator's afternoon of training is enough.
States
| State | Rendering |
|---|---|
| Capturing | Field named before the shutter, not after. The operator confirms which eye they are about to photograph, not which one they just did. |
| Assessing | Activity shown in place, with the field named. Never a full-screen block — the operator is mid-encounter with a person in the chair. |
| Adequate | Neutral chip and a plain statement. No celebration, no green tick: passing the gate is the ordinary case and does not deserve emphasis. |
| Not adequate | Quiet chip, physical cause, instruction, and the two exits. |
| Gate unavailable | Capture is disabled. If adequacy cannot be assessed, images must not be taken and banked for later analysis — an unassessed image in a queue is an unscreened person who believes they were screened. |
| Encounter incomplete | Named field by field. The person is never told "screening complete" while any field is outstanding. |
Do's and don'ts
A complete outcome. It says what happened, what it does not mean, and what happens next.
A negative result with a caveat attached. The headline is what gets repeated at the desk and remembered a year later; the second line is not.
Physical cause plus a physical instruction. The operator knows exactly what to change before the next attempt.
A code, a number and a threshold. It tells an untrained operator nothing they can act on, and the abbreviated laterality invites a wrong-eye retake.
Two exits, both legitimate. Neither is framed as giving up, and refer is available from the first failure onward.
An override. Every appointment running late will press it, and the gate has been converted into a suggestion.
Both eyes required. Right eye adequate; left eye not assessable — left eye referred.
Laterality carried all the way to the outcome. One eye's result never speaks for the other.
Screening complete. No referable disease detected.
Issued on one adequate eye. The person now believes both eyes were examined, and will not come back for a year.
Accessibility
- The verdict is text, never an overlay on the image. A green or red border drawn on a thumbnail is unreadable to a screen-reader user, unreliable for an operator with colour vision deficiency, and invisible in a printed record.
- The reason and the instruction are separate sentences, both in the accessible name of the item — "left eye, disc-centred, not adequate, optic disc not fully within frame".
- Laterality is spelled out for assistive technology.
LandRare near-homophones when announced and are the single highest-consequence abbreviation on this screen. - Gate results are announced politely (
aria-live="polite") as each field completes. Never assertive — the operator is talking to the person in the chair. - Neutral chips, not alarm hues. A quality state is not a clinical priority and must not borrow the IEC palette — see Colour.
- Targets ≥ 24 px with ≥ 24 px between centres (WCAG 2.2 SC 2.5.8). This is a workstation operated between patients, often standing and sometimes gloved — see Scaling & displays.
- Recapture and refer are keyboard-reachable without traversing the image thumbnails, which are the largest and least useful tab stops on the screen.
- No flashing anywhere in the capture flow (SC 2.3.1). The camera flash is already a photosensitivity consideration; the software must not add another.
- Readable at 200 % zoom and 320 px (SC 1.4.10) — the reason and instruction wrap rather than truncate, because a truncated instruction is no instruction.
Outcomes of use
What this contributes to, in the terms of Usability & context of use. These are attributes believed to contribute to an outcome; the outcome itself is settled by observing real use in a specified context, not by this page.
- Effectiveness — no result is issued from an image that could not support it. The measure is the rate of results later found to have been based on inadequate input, which should be zero by construction.
- Efficiency — adequacy decided in the room, in seconds, by someone who cannot interpret the image. Every field resolved at capture is a referral that does not need to be made and an appointment that does not need repeating.
- Satisfaction — an operator who is confident they did the job properly when they refer. If referring feels like failing, the ungradable rate will fall for reasons that have nothing to do with image quality.
Clinical safety notes
Trace these in your risk file (ISO 14971) and usability engineering file (IEC 62366-1).
- Analysis cannot run on a field that failed the gate. Mitigates: a finding derived from an image incapable of supporting it.
- No hedged negative. Mitigates: "no disease detected, quality limited" read and repeated as "no disease detected".
- No operator override, no per-site threshold. Mitigates: throughput pressure loosening a safety gate one deployment at a time.
- Reason and instruction required on every failure. Mitigates: repeated identical retakes, and the discomfort and delay they cost the person.
- Retake capped by the system, not the operator. Mitigates: an untrained operator making a clinical stopping decision under time pressure.
- Laterality named in full at capture, gate and outcome. Mitigates: wrong-eye capture, and one eye's result being issued for both.
- Per-field completeness stated. Mitigates: a partial screen reported as a complete one.
- Capture disabled when the gate is unavailable. Mitigates: unassessed images banked for later, leaving a person who believes they were screened.
- Ungradable rendered in neutral, never alarm, colour. Mitigates: dilution of the IEC palette, and a legitimate outcome read as a device fault.
- Ungradable rate monitored per operator and site. Mitigates: silent drift toward forcing passes; feeds post-market surveillance.
Related
- Autonomous result & the safety net — what happens to a field that passes, and to the person who was referred.
- Confidence disclosure — the reviewer-side, post-analysis version of withholding.
- ECG review — signal quality where a reader can interpret, and therefore decides for themselves.
- Patient header — identity, and why laterality is the same hazard family.
- Empty state — the three kinds of nothing, of which "not assessable" is one.
- FieldGrade — the reference application, and why an operator who cannot grade changes the design.