Patient header
The persistent band that answers one question at all times: whose record am I looking at? It is the primary control against wrong-patient error, which is why it is never scrolled away, never collapsed, and never abbreviated.
Overview
Wrong-patient error is among the most consequential and most under-designed failures in clinical software. It rarely happens because someone cannot read a name; it happens because a clinician was interrupted, returned to a screen they believed was one patient, and acted.
The patient header exists for that moment of return. It is not decoration and not a breadcrumb — it is a continuously visible assertion of identity, positioned where the eye lands before any clinical content.
Always present
Visible in every state of every patient-scoped screen. Never scrolled off, never behind a disclosure, never replaced by a modal's own title.
Complete
Name and full identifier in one glance, never truncated with an ellipsis. If the layout cannot fit the identity, the layout is wrong, not the identity.
Distinguishing
Shows the fields that separate this patient from a similar one — date of birth as well as name, because two people on one ward share surnames more often than designers expect.
Anatomy
| Region | Contents | Rule |
|---|---|---|
| Identity | Family name, given name, full MRN | Never truncated. Family name first and in caps so it is unambiguous across naming conventions. |
| Distinguishing fields | Date of birth with derived age, sex, location, encounter | Date of birth is mandatory — it is the field that separates two patients with the same name. |
| Flags | Allergy, anticoagulation, isolation, care limitations | Only facts that change immediate management. Not a general tag system. |
Name plus MRN feels sufficient until two patients on the same ward share a surname and their MRNs differ by one transposed digit. Date of birth is the field a clinician actually cross-checks against a wristband, a chart or a colleague's verbal handover. It appears in the default configuration and cannot be removed by product configuration.
Variants
default
Full band across the top of a patient-scoped screen, directly beneath the application masthead and directly above any docked Alert Banner.
compact
Reduced padding for dense workstation layouts and secondary panels. Identity fields are unchanged — compact reduces whitespace, never information.
In context
The header sits above the alert region, so identity is read before the finding. Reversing that order means a clinician can read "STEMI detected" before they know whose it is.
Context change
The single highest-risk moment for this component is when the record underneath it changes. Three rules govern it:
- A context change is always explicit. The header animates a brief, non-blocking highlight on change so a returning clinician sees that something moved.
- Never change patient context automatically. Not on a new critical alert, not on a queue update, not on a colleague opening a case. Arriving alerts are announced; the clinician navigates.
- Two patients are never open in one window. If a product supports comparison, each record carries its own header and the surrounding chrome states plainly that two contexts are visible.
After a documented idle period the header enters a confirm identity state: the record stays visible and readable, but write actions are suspended until the clinician re-confirms which patient they are on. This is the direct control against the interrupted clinician returning to a screen and acting on the wrong record.
Formatting rules
- Family name in caps, given name in sentence case —
HARLAND, Arthur J.. Removes ambiguity where naming order differs by culture. - MRN grouped in threes, mono, tabular —
44 812 907. Grouping measurably reduces transcription error; grouping with spaces rather than hyphens avoids implying the hyphen is part of the identifier. - Date of birth in ISO 8601 —
1964-03-11— with derived age alongside. Never03/11/1964, which means two different dates depending on the reader's country. - Age derived, never stored. A displayed age that was correct at admission is wrong later.
- Never abbreviate an identifier to fit. Wrap, reflow, or drop a lower-priority field — never truncate identity.
Long name wraps the layout, not the identity. ISO date, grouped MRN.
Truncated name, partial MRN, and a date that reads as 4 December or 12 April depending on where you trained.
Who holds each rule
Identity is carried by three components in the package and by the layout that keeps them on screen. The layout is the part that fails, and it is the part nothing here holds.
| Rule | Held by | Where |
|---|---|---|
| Identity never truncated | Breadcrumb | No segment of the trail is ever shortened to fit. A patient identifier cut to make room is the one segment that had to be complete. Asserted: Breadcrumb: a real landmark holding an ordered list |
| Context change is announced | View heading | A route change moves focus to the new heading and announces it, and the document title follows — so the tab strip says which patient is open. Asserted: ViewHeading: the document title follows the view |
| Name and role of the clinician alongside the patient | Masthead | The signed-in identity renders as a name and a role, so who is looking is as stated as who is being looked at. Asserted: Masthead: the product and the signed-in identity are both named |
| A context change is always explicit; never automatic | The implementer | Routing. Nothing in the package changes patient context; nothing in it can stop your application doing so on a timer or a background event. |
| Two patients are never open in one window | The implementer | Application state. Every component here renders one subject; none can see a second one open beside it. |
| Persistent, never scrolled or collapsed | The implementer | Layout. The app layout gives the alarm region a docked slot; the patient header is yours to place above the scroll, and the visual gate cannot tell that you did not. |
| Family name in caps, given name in sentence case; MRN grouped in threes; date of birth in ISO 8601 | The implementer | Formatting rules applied to strings you build. The Search result row follows them; the header is your markup. |
| Age derived, never stored | The implementer | A data rule. Whether the age shown was computed from the date of birth today is invisible to anything that renders it. |
| Landmark region | The implementer | A region with a name, on the container you write. |
| Flags carry text | The implementer | A Status chip cannot be rendered without its word, if that is what you use. A coloured dot of your own can. |
A pattern page has no component underneath it, so a rule stated here is held by whoever builds against it unless a component already holds it. Of these 10 rules, 3 are held by a component this package ships, and 7 are the implementer’s. The three rules that prevent a wrong-patient event — explicit context change, one patient per window, a header that never scrolls away — are all the implementer’s. The package holds the typography of identity, not its persistence.
Do's and don'ts
Date of birth present and in ISO form. It is the field clinicians cross-check against a wristband.
No date of birth. Two Arthur Harlands on the ward are now separated only by a nine-digit number.
HARLAND, Arthur J. · 1964-03-11 · MRN 44 812 907
stays above the scroll
The identity is complete and it does not move. However far down the record the reader is, the patient is still at the top.
HARLAND, A. · …907
scrolls away with the page
Abbreviated to fit, and gone once the reader scrolls. Two Harlands on the ward and the one thing that told them apart is now three digits.
Accessibility
- Landmark region. Rendered as
<header aria-label="Patient context">so screen-reader users can jump to identity from anywhere in the page. - Context change is announced. A polite live region states the new patient on change — the visual highlight alone is useless to a non-sighted user.
- Flags carry text. "Allergy", not a coloured dot. Colour is redundant encoding only.
- MRN read in groups. Marked up so assistive technology reads "44 812 907" rather than a nine-digit run.
- Never
position: fixedwithout reflow testing. At 200 % zoom a fixed header can consume half the viewport; it reflows to two rows instead.
Outcomes of use
What this contributes to, in the terms of Usability & context of use. These are attributes believed to contribute to an outcome; the outcome itself is settled by observing real use in a specified context, not by this page.
- Effectiveness — Actions land on the intended patient. Wrong-patient actions per 1 000 sessions is the measure this pattern exists to move.
- Efficiency — Time to re-establish identity after an interruption — the common case, not the exception.
- Satisfaction — Confidence about whose record is open, especially on returning to a screen left minutes earlier.
Clinical safety notes
Trace these in your risk file (ISO 14971) and usability engineering file (IEC 62366-1). Each bullet says what checks it: a component that holds the rule, a test in your verification file, deployment configuration, post-market surveillance, or a design review where no test can see it. A control checked by nothing is a sentence.
- Persistent, never scrolled or collapsed. (a test in your verification file) Mitigates: acting on a record whose identity is off-screen.
- Identity never truncated. (held by Breadcrumb) Mitigates: two similar patients being indistinguishable at a glance.
- Date of birth mandatory and not configurable away. (a test in your verification file) Mitigates: same-surname mis-selection.
- ISO 8601 dates only. (a test in your verification file) Mitigates: day/month transposition between locales.
- Context never changes automatically. (a test in your verification file) Mitigates: an arriving alert moving the record under a clinician mid-action.
- Idle re-confirmation suspends writes. (a test in your verification file) Mitigates: the interrupted clinician resuming on the wrong patient.
- Age derived at render. (a test in your verification file) Mitigates: a stale age contributing to a weight- or age-banded decision.
- Header precedes the alert region. (a test in your verification file) Mitigates: reading a finding before knowing whose it is.
Related
- Triage worklist — where a patient context is chosen.
- ECG review — the evidence screen this header sits above.
- Alert Banner — docked directly beneath.
- Typography — identifier formatting.