No critical result sits unacknowledged past SLA without a signed escalation.
When a lab or instrument flags a critical or abnormal result, the risk is not the value — it is the loop. Was it routed to the required authority inside the policy window, did someone with the right authority acknowledge it, and did an SLA breach escalate up the coverage chain? Decionis governs the integrity of that notify → acknowledge → escalate loop and seals it into a signed Decision Dossier — while never interpreting the result itself.
Roadmap workflow. This is Phase 3 clinical scope — it follows the procurement workflow and sits behind the same gates (SOC 2 Type II, FDA-counsel review, signed BAA, on-premise deployment), and it is shadow-mode-first by mandate.
It governs the loop. It never touches the value.
The whole point of putting this near the diagnosis boundary is the discipline of staying on the administrative side of it. Decionis does not:
- Whether the result is truly critical — the LIS/instrument already flagged it; Decionis consumes the flag as an opaque token.
- What the result means clinically, or how urgently it must be acted upon.
- Re-ranking or suppressing an alert by re-scoring its severity (no alert-fatigue tuning by clinical degree).
- Whether a clinician's acknowledge-and-defer was the medically correct call.
The governed flow
The criticality flag is made upstream by the analyzer. Decionis starts the policy SLA clock, identifies the required-authority routing tier, and returns one verdict.
Critical/abnormal result flagged by LIS/instrument
(FHIR Observation/DiagnosticReport.category = "critical")
│
▼
Decionis starts policy SLA clock + identifies required-authority tier
(by result class + coverage schedule)
│
▼
── DECIONIS VERDICT → proceed / hold / escalate / restrain ──
│
▼
Action: acknowledgment captured (NPI + timestamp)
OR escalation fired up the coverage tier
│
▼
Decision Dossier sealed: notify → acknowledge → escalate, tamper-evident, signedRouted to the required authority and acknowledged within the policy window.
Acknowledgment not yet captured — the loop is open and the clock is running.
SLA window breached — notify the next tier up the coverage chain, recorded.
Routing target invalid or no authorized recipient on duty — loop held open, flagged.
What the signed dossier proves
The board- and counsel-legible guarantee is narrow and absolute: no critical result sat unacknowledged past SLA without a recorded, signed escalation. It never records a clinical-merit judgment of the result.
| Dossier field | What it attests |
|---|---|
| Result class | Critical / abnormal category token (consumed, never derived) |
| Notification timestamp | When the result entered the governed loop / SLA clock started |
| Required-authority tier | Which role or coverage tier policy required for this result class |
| Routing target | Whom the result was routed to (NPI / role) and whether the target was valid |
| Acknowledgment record | Acknowledging clinician NPI + timestamp — or the recorded absence of one |
| Time-to-acknowledge | Latency measured against the policy SLA window |
| SLA outcome | Within-window or breached |
| Escalation chain | If breached: each up-tier notification, recipient, and timestamp |
| Loop status | Closed (acknowledged), escalated, or open |
| Policy version | The SLA + coverage-tier policy version that governed the decision |
Every verdict turns on authority, timing, and acknowledgment — never clinical content.
IF inbound event.category == "critical" // ingested flag, not derived
AND required_authority_tier(result_class) is defined by coverage policy
AND elapsed_since_notify >= sla_window(result_class)
AND acknowledgment_record IS NULL
THEN ESCALATE to next_tier(coverage_chain)
AND record escalation_event(tier, recipient_NPI, timestamp)
AND seal Decision Dossier (loop_status = "escalated")
// companion proceed rule
IF acknowledgment_record.NPI authorized_for(result_class)
AND acknowledgment_record.timestamp <= notify_time + sla_window(result_class)
THEN PROCEED
AND seal Decision Dossier (loop_status = "closed")
// companion restrain rule
IF routing_target IS NULL OR no authorized recipient on_duty(coverage_chain)
THEN RESTRAIN
AND record routing_failure
AND seal Decision Dossier (loop_status = "open, no valid authority")Regulatory posture & sequencing
SaMD / diagnosis boundary
Governs the administrative closed-loop, not a clinical recommendation — the criticality flag is determined upstream and consumed as a category token. Because FDA classifies by intent at the point of use, the clinically-adjacent posture still requires outside FDA-counsel sign-off before scoping. It is not counsel-clear the way procurement is.
PHI & integration
PHI-light, not PHI-free: result-category + NPI + timestamp, raw values excluded by design. Requires a signed BAA, tokenized PHI, SOC 2 Type II, NPI identity, real-time FHIR result subscriptions, and an on-call coverage-tier directory. The heaviest build of the vertical.
Phase & rollout
Phase 3 — after the procurement workflow moves to enforcement, alongside or just after referral and prior authorization. Shadow-mode-first is mandatory: a false hold or outage in this loop delays response to a genuinely critical result, so enforcement is earned only on observed evidence, with a kill switch back to shadow mode.
Pressure-test the loop before it ever holds an action.
Critical-result governance is a roadmap workflow — start with procurement, prove the control plane, then bring this into shadow mode where it observes the notify → acknowledge → escalate loop and produces dossiers without touching a single clinical decision.