Clinical safety and governance

How Nova Guide manages clinical risk.

Nova Guide shows guidance over clinical workflows, including prescribing. A guide pointing at the wrong control is treated as a patient safety hazard, and the product, its approval process and its development are designed around that.

DCB0129 and the Clinical Safety Officer

Nova Guide is developed under the NHS standard for clinical risk management in health IT, with a Clinical Safety Officer who is a registered clinician.

1.1The standard: DCB0129, Clinical Risk Management: its Application in the Manufacture of Health IT Systems. Nova Guide shows guidance over clinical workflows, including prescribing, so it is developed as health IT under this standard.
1.2Clinical Safety Officer: A registered clinician is accountable for Nova Guide’s clinical risk management: the risk ratings, the decisions on whether remaining risk is acceptable, and the clinical safety case.
1.3Who decides: Engineering identifies hazards, builds the controls and records the evidence for them. Rating, accepting and closing a hazard belong to the Clinical Safety Officer alone.
1.4Hazard log: Kept with the code. Each entry records the hazard, its cause, its effect and the controls that address it, and each control cites the code and the automated tests that check it.
1.5Safety-relevant changes: A change to step targeting, step advancement, content approval, rendering, delivery or withdrawal is treated as safety-relevant, and the hazard log is reviewed for the entries it affects before release.
1.6Proportion: Nova Guide enters no data, makes no decisions and holds no patient records. It directs the attention and actions of clinicians inside systems that do, and the hazard log is scoped to that influence.
1.7Risk management plan: Ratified by the Clinical Safety Officer on 22 October 2026.

Hazards and their controls

The hazards in Nova Guide’s log, in plain words, with the controls built into the product for each. Risk ratings, and whether the remaining risk is acceptable, are the Clinical Safety Officer’s judgement.

Hazards and the controls that address them
What could go wrong	How Nova Guide controls it
Guidance points at the wrong control.	Each control is identified from several signals. When two controls cannot be told apart, the step is shown as lost, and position on the page is never allowed to decide. A single wrong match in the adversarial test application fails the build.
Guidance appears on the wrong screen.	A step resolves only on the screens it was recorded for. Off those screens, Nova Guide stops looking for its control.
Guidance is wrong or out of date for the workflow it describes.	A named reviewer approves the exact content, and any edit is a new version that needs approval again. Steps that stop finding their controls raise an alert.
Dangerous guidance is live and cannot be stopped.	Withdrawal reaches open screens within about a minute and needs no approval. A workstation that cannot check for withdrawals for 15 minutes stops showing guidance.
A clinician’s focus is taken or trapped while they are entering data.	Nova Guide never moves keyboard focus. Tab and Escape always leave it, and steps are announced to screen readers through a live region.
A guide appears to hang, or traps a clinician part-way through a task.	A step that cannot find its control says so. Exit guide is on every card, needs no confirmation, and Escape does the same.
The guidance covers information the clinician needs.	A step card is placed so that it never covers the control it describes, and it can be left at any time.
One clinician’s progress is shown to another on a shared workstation.	Progress is kept only for a person the application identifies. On a shared workstation nothing is kept.
Guidance reaches staff it was not written for.	Audiences fail closed: an attribute nobody supplied fails every rule about it, and a segment with no rules admits nobody.
Tampered or unverifiable content is served.	Content is delivered as a signed bundle, and the browser verifies the signature before reading it. On any failure, nothing is shown.
Patient data enters the analytics, a screenshot or a guide’s wording.	Events have no field for page text, typed values or web address parameters. Screenshots are off unless switched on for an application, and NHS numbers and dates are filled before upload. Wording drafted from a click never uses the text of a cell, row, link or heading.
Distraction or alert fatigue during clinical work.	An announcement is the only item that opens by itself; it appears once and never over a guide. Beacons hold still for anyone whose computer is set to reduce motion.

3 · Targeting

It points only where it is certain.

Nova Guide identifies each control from several signals. When two controls match on every one of them, the step is shown as lost and the guide waits. The clinician can skip the step or leave the guide.

ElementBoth are buttons.
Accessible nameBoth read “Review”.
AttributesThe same on both.
TextThe same on both.
Position on the pageNot allowed to decide between them.
ResultThe step is shown as lost.

Every build is tested against an adversarial test application, and a single wrong match fails it.

An illustration of the decision. The ring compares the two controls, declines to choose, and the step is shown as lost with the product’s own wording.

3.1Signals: Attributes, accessible name, text and structure, each weighted by how uniquely it identifies the control. Frames and shadow roots are searched.
3.2Ties: Where the two strongest candidates match on every identity signal, position on the page does not decide between them. The target is reported lost.
3.3Screens: A step resolves only on the screens it was recorded for.
3.4Testing: Every build replays an adversarial test application under seeded mutation, and a single wrong match fails the build. Accuracy is tracked separately, and is never raised by loosening the confidence threshold.
3.5At authoring: Each target is graded as it is captured, and a fragile one is flagged while the author still has the screen in front of them.
3.6In service: Content health reports steps that were not found, were ambiguous or were matched through a weaker signal, worst first. Five failures of one step within eight hours open an alert.

Approval of content

Each organisation’s own reviewers approve every item against its exact content, through tiers the organisation sets.

4.1Named approval: Each approval binds a named reviewer to the SHA-256 hash of the exact content, and the hash is checked again at every publish. Any edit is a new version that needs approval again.
4.2Risk tiers: Each organisation chooses a clinical template (navigational, procedural and clinical) or a standard one. Each tier names who may approve, and whether the approver must hold a professional registration or be someone other than the author.
4.3Emergency approval: For an urgent correction: two approvers and a recorded reason, marked on the record, with a retrospective review due within 48 hours.
4.4Publishing checks: Publishing refuses content that is unapproved or changed since approval, approved in the wrong role or without a required registration, approved under a different tier, branching to a step that does not exist, or carrying an identity different from its record.
4.5Whose approval: Each organisation’s own named reviewers approve its content through the tiered process. The Clinical Safety Officer is accountable for that process, and does not sign individual guides.
4.6Audit trail: Approvals, withdrawals and comments are recorded with the person and the time, and approval records are kept when a team member leaves.

Withdrawal and incidents

Any item can be stopped on every open screen within about a minute, without waiting for an investigation.

5.1Withdrawal: Anyone who works on content can withdraw an item, with a reason recorded, and open screens stop showing it within about a minute. A guide in progress stops and says it was withdrawn. It needs no approval.
5.2Without a connection: A workstation that cannot reach the withdrawal list for 15 minutes stops showing guidance. Losing guidance for a while is the safer failure.
5.3If Nova Guide is unavailable: Staff carry on in the application without guidance, and withdrawal stays in force.
5.4Record: Each withdrawal is recorded with who, what, when and why, and that record is what an incident review reads.
5.5Reporting an unsafe guide: A clinician who believes a guide is unsafe tells their organisation’s Nova Guide team, who can withdraw it at once. The organisation reports it to Nexus Nova at admin@nexusnova.co.uk, marked as a safety concern. The Clinical Safety Officer is told of every report marked this way and decides its severity.
5.6Out of hours: Nexus Nova’s support hours are Monday to Friday, 9am to 5pm. Outside them, the organisation’s Nova Guide team handles the report and can withdraw the guide itself, and Nexus Nova takes the report up on the next working day.

The withdrawal is shown step by step on the Product page.

Behaviour inside a clinical system

Nova Guide runs inside live clinical systems, so how it behaves on the screen is part of the safety case.

6.1Focus: Nova Guide never moves keyboard focus. Tab and Escape always leave it, and each step is announced through a live region.
6.2Leaving: Exit guide is on every card and needs no confirmation.
6.3Placement: A step card is placed so it never covers the control it describes.
6.4Field hints: A hint advises and never prevents: every key reaches the field and the form can still be submitted.
6.5Footprint: The guidance layer is under 50 kB compressed, a limit enforced on every build, and it draws in its own isolated layer without changing the application’s page.
6.6Accessibility: Built to WCAG 2.2 AA, with automated accessibility checks on the portal on every build.

Shared workstations and patient data

Wards share workstations, and EPR screens carry patient data. Both shape what Nova Guide keeps and records.

7.1Shared workstations: Progress is kept only for a person the application identifies, and an announcement on a ward terminal is shown once per browser session, so each clinician on the shift sees it.
7.2People and workstations: Counted separately in every report. Where Nova Guide cannot tell who is using a workstation, it counts the workstation and never claims a person.
7.3Analytics: Events record the guide, the step and the screen’s path. They contain no page text, no typed values and no web address parameters, and staff identifiers are pseudonymised as they arrive.
7.4Small numbers: Counts of fewer than five people are withheld.

More on data protection, retention and hosting on the Security and data protection page.

Documents for your assessment

Each organisation runs its own DCB0160 assessment before go-live. Nova Guide supplies the inputs.

Clinical risk management planWho does what, when reviews take place, and how incidents are handled.
Hazard log, customer editionEach hazard, its controls and the evidence for them.
Clinical safety case reportThe argument, with evidence, that the release is acceptably safe.
Risks for the deploying organisationThe residual risks that need controls on your side, such as how authors work on live systems and who staffs content review.
Data protection materialA description of the data Nova Guide processes and why, for your data protection impact assessment, with a separate note on workflow analytics.

All five documents, and an evidence pack for the Digital Technology Assessment Criteria (DTAC), are available on request as PDFs.

Request the assurance documents

See a guide recorded, approved and published.

A demonstration records a guide, takes it through review and publishing, and shows it as staff see it. It also covers how Nova Guide would be deployed and assured in your organisation.

Book a demonstration Read the specification

RecordingA guide recorded in Nova Guide Studio, click by click.
Review and publishingApproval by a named reviewer, then the guide going live.
On the screenThe guide as staff see it, started from the launcher.
Withdrawal and PULSEWithdrawing a guide, and the analytics behind it.
Your organisationDeployment, data protection and the clinical safety material.