A value enters the order only after it is proved
Read-back is mandatory under ICAO Annex 11 §3.7.3.1 for flight crews and has been a Joint Commission requirement for verbal orders and critical test results since it became a patient safety goal in 2003 (NPSG.02.01.01; ISMP places it at PC.02.01.03 EP 20 in 2017; its 2026 location is not verified). We automate a step that regulation already requires and practice routinely skips. The exact clauses
Three reasons to ask again, and only the third refuses a yes
5 fields are always read back once, whatever else happens (E_READ_BACK_REQUIRED): drug name, strength, quantity, directions (sig) and patient name.
| Reason | Reason code | What it means |
|---|---|---|
| UnsureThe recognizer was unsure | E_LOW_CONFIDENCE | The lowest certainty across the source words fell under the threshold for that field. The minimum is used rather than the mean, because a mean hides the single failed word that happens to be the drug name. |
| A check failedA validator said no | E_VALIDATOR_CHECKSUM | A checksum, a catalogue lookup or an internal consistency check rejected the value. NPI and DEA are arithmetic; a drug name is proved by existing in the catalogue, and we say so rather than calling it a checksum. |
| Look-alike pairThe name is on a published pair | E_LASA_HIT | This one fires even at certainty 1.00 and is read before the threshold, so a confident value cannot reach acceptance by being confident. The agent names both drugs, and only a spoken name answers. |
What counts as proof differs by field
Where arithmetic exists, voice is not spent. Where no checksum and no catalogue exist, the spoken confirmation is the only proof there is.
| Field | What proves it |
|---|---|
| Prescriber NPI | Proved arithmetically: Luhn mod-10 over 80840 plus the first nine digits. |
| Prescriber DEA | Proved arithmetically: the mod-10 rule over the seven digits. |
| Drug name | Proved by existence in the built NDC catalogue. There is no check digit here. |
| Strength | Proved by the drug, strength, form and route tuple existing together. |
| Sig | Checked against the ISMP error-prone abbreviation list. |
| Patient name | No checksum and no catalogue exist, so the voice confirmation is the only proof. |
An extended script: 7 checks a skeptic would run
The 90-second tour on the replay hub visits each surface once. This script is its longer continuation, about seven minutes: it adds the checks a skeptic runs, including one the product only partly passes. 5 of these 7 steps need no microphone and no second person; the 2 that do are marked.
| Step | Do this | What to watch |
|---|---|---|
| 1 | Play the replay.Open the replay | Both panels read the drug back. The left one asks which of the two drugs was meant and writes hydromorphone once the caller names it. The right one, the pair rule switched off and nothing else, reads morphine back, hears yes, and orders morphine where hydromorphone was spoken. |
| 2 | Show that nothing changed.Open the replay | Before you press play, both panels already name what will happen. Play it and the panels reach exactly those outcomes. The refusal is not a reaction the page invents at the last moment. |
| 3 | Look for a contradiction on the field card.Open the replay | The recognizer reported its highest certainty and the gate still asks again. If those two read as contradicting each other on screen rather than as two independent facts, the interface has failed. |
| 4 | Attack the gate from the console below. | Each button builds a real candidate and calls the only constructor that can write a field. The refusal you read is the string the gate raised, not a message written for this page. |
| 5 | Open the measurements and read what the pair rule costs beside what it catches.Open the measurements | How often the gate asked when the value was already right is published beside the catches on the measurements page. A counter that only showed the catches would make the metric one-sided. |
| 6 | Interrupt the agent mid-sentence.Start a callneeds a microphone | Nothing reaches the recognizer between the reply starting and the reply finishing, and a turn that matches the agent's own last line is discarded. Watch the dropped-turn count rather than the transcript: a phantom turn would put words nobody said into a field's provenance. |
| 7 | Say a drug name and correct yourself, once with a marker and once without.Start a callneeds a microphone | With a marker (“no wait”, “sorry”, “I mean”, “actually”, “scratch that” or “not X, Y”, followed within four words by the new name), the first name is refused as a value you took back, E_RETRACTED_VALUE. Without a marker, or with the correction spread across two turns, it is not detected: both words were said, so either can be proved spoken, and you reject the wrong one when it is read back. This step is here because a script containing only the parts that work is a sales pitch. |
Try to write a value the gate did not prove
Each button builds a real candidate, runs the real decision function and calls the only constructor that can write a field. Nothing here is staged: the refusal you read is the string the gate raised.
- Lower the confidence threshold to zeroIf the gate is only a threshold, accepting everything should let the value through.
- Claim the caller confirmed it, without a read-backThe tool payload says caller_confirmed. Surely that is enough.
- Write a value its validator rejectedThe recognizer was certain and the field is filled in, so write it.
- Write a value with no source wordsThe value is correct. Does it matter which words produced it?
- Reuse an accepted decision from another fieldOne field was accepted, so borrow its approval for this one.
- Order a Schedule II medicine with five refillsEvery check agrees: the drug exists, the number is in range, and the recognizer was certain. Write it.
- Order a medicine whose name is one vowel away from a real oneThe recognizer was fully certain and the name sounds like a real medicine, so accept it.
What this does not prove
The three limits closest to this page, each stated in full on the limitations page. A demonstration that hides its own boundary is the failure this product argues against.