Patient header
The persistent band that answers one question at all times: whose record am I looking at? It is the primary control against wrong-patient error, which is why it is never scrolled away, never collapsed, and never abbreviated.
Overview
Wrong-patient error is among the most consequential and most under-designed failures in clinical software. It rarely happens because someone cannot read a name; it happens because a clinician was interrupted, returned to a screen they believed was one patient, and acted.
The patient header exists for that moment of return. It is not decoration and not a breadcrumb — it is a continuously visible assertion of identity, positioned where the eye lands before any clinical content.
Always present
Visible in every state of every patient-scoped screen. Never scrolled off, never behind a disclosure, never replaced by a modal's own title.
Complete
Name and full identifier in one glance, never truncated with an ellipsis. If the layout cannot fit the identity, the layout is wrong, not the identity.
Distinguishing
Shows the fields that separate this patient from a similar one — date of birth as well as name, because two people on one ward share surnames more often than designers expect.
Anatomy
| Region | Contents | Rule |
|---|---|---|
| Identity | Family name, given name, full MRN | Never truncated. Family name first and in caps so it is unambiguous across naming conventions. |
| Distinguishing fields | Date of birth with derived age, sex, location, encounter | Date of birth is mandatory — it is the field that separates two patients with the same name. |
| Flags | Allergy, anticoagulation, isolation, care limitations | Only facts that change immediate management. Not a general tag system. |
Name plus MRN feels sufficient until two patients on the same ward share a surname and their MRNs differ by one transposed digit. Date of birth is the field a clinician actually cross-checks against a wristband, a chart or a colleague's verbal handover. It appears in the default configuration and cannot be removed by product configuration.
Variants
default
Full band across the top of a patient-scoped screen, directly beneath the application masthead and directly above any docked Alert Banner.
compact
Reduced padding for dense workstation layouts and secondary panels. Identity fields are unchanged — compact reduces whitespace, never information.
In context
The header sits above the alert region, so identity is read before the finding. Reversing that order means a clinician can read "STEMI detected" before they know whose it is.
Context change
The single highest-risk moment for this component is when the record underneath it changes. Three rules govern it:
- A context change is always explicit. The header animates a brief, non-blocking highlight on change so a returning clinician sees that something moved.
- Never change patient context automatically. Not on a new critical alert, not on a queue update, not on a colleague opening a case. Arriving alerts are announced; the clinician navigates.
- Two patients are never open in one window. If a product supports comparison, each record carries its own header and the surrounding chrome states plainly that two contexts are visible.
After a documented idle period the header enters a confirm identity state: the record stays visible and readable, but write actions are suspended until the clinician re-confirms which patient they are on. This is the direct control against the interrupted clinician returning to a screen and acting on the wrong record.
Formatting rules
- Family name in caps, given name in sentence case —
HARLAND, Arthur J.. Removes ambiguity where naming order differs by culture. - MRN grouped in threes, mono, tabular —
44 812 907. Grouping measurably reduces transcription error; grouping with spaces rather than hyphens avoids implying the hyphen is part of the identifier. - Date of birth in ISO 8601 —
1964-03-11— with derived age alongside. Never03/11/1964, which means two different dates depending on the reader's country. - Age derived, never stored. A displayed age that was correct at admission is wrong later.
- Never abbreviate an identifier to fit. Wrap, reflow, or drop a lower-priority field — never truncate identity.
Long name wraps the layout, not the identity. ISO date, grouped MRN.
Truncated name, partial MRN, and a date that reads as 4 December or 12 April depending on where you trained.
Do's and don'ts
Date of birth present and in ISO form. It is the field clinicians cross-check against a wristband.
No date of birth. Two Arthur Harlands on the ward are now separated only by a nine-digit number.
Accessibility
- Landmark region. Rendered as
<header aria-label="Patient context">so screen-reader users can jump to identity from anywhere in the page. - Context change is announced. A polite live region states the new patient on change — the visual highlight alone is useless to a non-sighted user.
- Flags carry text. "Allergy", not a coloured dot. Colour is redundant encoding only.
- MRN read in groups. Marked up so assistive technology reads "44 812 907" rather than a nine-digit run.
- Never
position: fixedwithout reflow testing. At 200 % zoom a fixed header can consume half the viewport; it reflows to two rows instead.
Outcomes of use
What this contributes to, in the terms of Usability & context of use. These are attributes believed to contribute to an outcome; the outcome itself is settled by observing real use in a specified context, not by this page.
- Effectiveness — Actions land on the intended patient. Wrong-patient actions per 1 000 sessions is the measure this pattern exists to move.
- Efficiency — Time to re-establish identity after an interruption — the common case, not the exception.
- Satisfaction — Confidence about whose record is open, especially on returning to a screen left minutes earlier.
Clinical safety notes
Trace these in your risk file (ISO 14971) and usability engineering file (IEC 62366-1).
- Persistent, never scrolled or collapsed. Mitigates: acting on a record whose identity is off-screen.
- Identity never truncated. Mitigates: two similar patients being indistinguishable at a glance.
- Date of birth mandatory and not configurable away. Mitigates: same-surname mis-selection.
- ISO 8601 dates only. Mitigates: day/month transposition between locales.
- Context never changes automatically. Mitigates: an arriving alert moving the record under a clinician mid-action.
- Idle re-confirmation suspends writes. Mitigates: the interrupted clinician resuming on the wrong patient.
- Age derived at render. Mitigates: a stale age contributing to a weight- or age-banded decision.
- Header precedes the alert region. Mitigates: reading a finding before knowing whose it is.
Related
- Triage worklist — where a patient context is chosen.
- ECG review — the evidence screen this header sits above.
- Alert Banner — docked directly beneath.
- Typography — identifier formatting.