Correcting a clinical record without erasing what it said

Something in a patient's record is wrong. A weight was typed with an extra digit, a diagnosis was recorded against the wrong visit, a payment was entered twice. The instinct is to fix it so the record reads correctly, and in most of the systems a hospital uses for anything else, that is exactly right.

In a clinical record it is not, and Nigerian law is unusually direct about why.

What the National Health Act actually makes an offence

Section 29 of the National Health Act 2014 has two halves. The first puts a duty on the person in charge of a health establishment to set up control measures preventing unauthorised access to patient records and to the system holding them. The second turns a list of things into offences, and the list is worth reading rather than summarising:

• falsifying a record;
• altering or destroying a record without authority;
• copying a record without authority;
• connecting identifiers back to records from which they had been removed;
• accessing a record without authority;
• and modifying the system used to store or retrieve records without authority.

The penalty is imprisonment of up to two years, a fine of 250,000 naira, or both.

Read the second and last items together. The Act does not only care what is in the record. It cares that the record, and the system holding it, are not quietly changed. That is a statement about evidence, not about tidiness, and it decides the design question this article is about.

A note on sourcing: sections 25 to 29 are read from the gazette scan linked below. The itemised offences in section 29(2) and the penalty attached to them come from a secondary reading of the same Act, because that scan carries no text layer; if the exact wording of an offence matters to a decision you are making, read the gazette page and take advice.

Why the correct fix is an addition, not an edit

Set the statute aside for a moment, because the clinical argument arrives at the same place.

The wrong entry was acted on. Somebody read that weight and calculated a dose from it. Somebody read that diagnosis and made a referral. If you overwrite the entry, the record now says the dose was calculated from a number nobody could have read, and the only account of why a reasonable decision was reasonable has gone.

There is a second loss, and it is the one that matters in a dispute. Once an edit lands, "this was always right" and "we corrected a mistake" look identical. A record that can be silently changed cannot be used to show that it was not, and so it cannot support the practice either, on the day the practice is the one that needs it.

So the operation you want is not edit. It is amend: a new entry, attached to the original, carrying what is now believed, why, who says so and when. Both stay readable afterwards.

Practices that keep paper already do a version of this. A single line drawn through an entry, initialled and dated, leaves the original legible underneath. That convention exists for the same reason, and a system that lets you obliterate the line is a step backwards from the paper it replaced.

The same rule applies to money

A payment recorded in error is the commonest correction in a small practice, and it is where the temptation to delete is strongest, because the deleted line makes the day's total come out right.

It also makes the day's total unauditable. A payment line that was removed is indistinguishable from one that never existed, so a practice cannot reconcile against it, cannot answer a patient who says they paid, and cannot tell an honest mistake from anything else. The correction for a payment is a reversal with a reason attached, leaving both entries in the history.

And to work the system refused

There is a third case that only appears once a practice is working across devices and connections. Work is recorded, sent, and then rejected: a duplicate, something that arrived out of order, something the practice needs to look at again.

The tempting behaviour is to discard it, because it is not valid. The correct behaviour is to keep it and mark it as needing review. A member of staff did that work; if it disappears, they have no way to know whether it was ever recorded, and the practice has no way to find out what was attempted. Rejected is a state, not a reason to delete.

What to ask of a system

Four questions, and the answers you want are behavioural rather than reassuring:

1. Can a signed note be edited afterwards? You want: no. A correction is a new note attached to the original, with a reason, and both stay readable.
2. Can a recorded payment be deleted? You want: no. It is reversed with a reason, and both entries stay in the history.
3. What happens to work the practice rejected? You want: it is kept and marked for review, not discarded.
4. Can you tell who did what? Section 29(1) asks you to control access; you can only show that you did if actions are recorded against the person who took them.

RizCare behaves this way, and it is worth saying plainly what that does and does not amount to. It is built to help an establishment meet its section 29 duty. There is no certification against section 29, because no such thing exists, and anyone offering you one is selling something that is not real.

If you are looking at the wider set of duties that come with holding patient data at all, what Nigerian data-protection law asks of a hospital that keeps records covers registration, the assessment you have to file before you start, and the 72-hour clock on a breach.