EMR & ADC feeds
From the EMR: orders, labs, vitals, allergies, problems. From the cabinets (e.g. Pyxis / Omnicell): dispense & override events. Ingested over HL7 v2 and FHIR R4 — read-only, no write-back.
Fits your stack. Built for your security review. Advisory by design.
Safer-Med is a read-only, single-tenant safety layer that listens to the events your EMR and cabinets already emit, re-checks the dispense against the patient, and routes a finding to the nurse and pharmacist. It never writes to the EMR, never controls the cabinet, and never blocks a dispense — and it activates gradually, reversible at any point. This page is the technical brief: what it connects to, what it never does, and what gets validated with you.
Standard interfaces (HL7 v2 · FHIR R4 · SMART on FHIR) · single-tenant · read-only · non-blocking
The data flow
Read-only in, notification-only out.
Safer-Med sits between the systems you already run. It consumes standard feeds, evaluates against the patient, and emits a notification — nothing more. The specific interfaces, event fields and routing are confirmed against your environment during setup.
Rules on all, AI on overrides
Personalized clinical rules re-check every dispense and override against the current patient. A targeted AI model screens overrides only for a likely wrong-drug or wrong-patient selection. Safer-Med never writes back and never controls the cabinet.
Nurse & pharmacist
A finding reaches the dispensing nurse on the clinical-communications app they already carry (CC&C), with a one-tap acknowledgment; pharmacy sees alert type, reason and outcome on a SMART on FHIR review dashboard.
The boundaries
What Safer-Med never does.
The safety case rests as much on the boundaries as the function. Safer-Med is additive and advisory — it does not sit in any critical path.
Never writes to the EMR
No orders, no chart entries, no modifications. Safer-Med is read-only to the EMR; its only output is a notification to a clinician.
Never controls the cabinet
No hardware or firmware change. It rides the standard dispense and override events the cabinets already emit; it never locks a drawer or blocks a dispense.
Never blocks or delays care
Advisory by design: it surfaces a finding and asks for a second look. The clinician always decides. If Safer-Med is unavailable, the existing dispense workflow is unaffected.
Fully reversible
It is a separate component. Turning it off — per unit or entirely — changes nothing in your EMR or cabinet workflow. Live alerting activates gradually, only when you choose.
Integration, security & posture
Built to clear the review it will face.
Integration
Standard read-only interfaces — Epic HL7 v2, FHIR R4, SMART on FHIR — built against Epic’s sandbox and validated operationally with you during setup. No cabinet hardware or firmware change. Hands-on interface work is an estimated 15–20 hours based on comparable integrations; data extraction, security approval, governance, education and site-specific dependencies are scoped separately, phase by phase.
Security
Single-tenant — a secure, dedicated AWS environment (your VPC), or on-premise where your infrastructure supports it — encrypted in transit and at rest, with PHI minimized and a documented review trail. HITRUST-aligned design. A Business Associate Agreement is executed before any PHI moves; no PHI leaves the environment until it is in place.
Regulatory
Designed to meet the Non-Device CDS criteria: advisory, transparent on every alert, driven by structured data, and built to support — never replace — clinician judgment. Formal regulatory assessment and any certification are pursued jointly as part of the partnership program.
The initial technical deliverable is a one-time, read-only 12-month data extract — field specification provided, with scope and responsibilities agreed together in the scoping workshop. Safer-Med leads the integration and analysis from there.
What gets validated with you
Technical acceptance, measured before go-live.
These are joint validation objectives for the partnership — measured during the retrospective and shadow phases, before any nurse receives a live notification.
-
Feeds & mapping
Source feeds, semantic mapping, and correlation of the order and dispense to the right patient — confirmed against your data.
-
Routing & identity
Matching the finding to the nurse holding the dose, and delivery to the right recipient on the communications platform — with escalation when a high-risk alert goes unanswered.
-
Latency
Event-to-notification latency (median and p95), measured on live feeds in shadow mode — so timing is a measured number, not a promise.
-
Reliability & rollback
Behavior when a feed is unavailable, data completeness, and clean per-unit rollback — validated before and during graded activation.
Shape it with us. Clinical informatics helps design the data mapping, identity matching, notification routing and technical acceptance criteria — alongside pharmacy and nursing, not a sign-off at the end. See the view for pharmacy leadership or nursing leadership, or the three-stage evaluation.
Start a conversation.
Tell us about your EMR and cabinet environment, your interface and security requirements, and how you’d want a read-only evaluation scoped — we’ll walk through the architecture and what gets validated with your team.