The Seven Flows of Clinical Handover Governance
Every organisational boundary in healthcare must function across seven governance dimensions. A failure in any one creates clinical risk. Failures cascade — a failure in Identity undermines Consent and Provenance. A failure in Clinical Intent undermines Alert & Responsibility and Service Routing.
The Seven Flows methodology is the structured framework inside every Boundary Risk Assessment. Each flow is assessed at each boundary with a specific question, specific evidence requirements, specific statutory traceability, and a 0–4 maturity rating. The framework builds on the full Seven Flows governance model developed by Inference Clinical.
Legal foundation
Every audit finding traces to specific statutory obligations across six layers:
| Layer | Instruments |
|---|---|
| Primary Legislation | Health and Social Care Act 2012 (s.250), Health and Care Act 2022 (s.95), Data Use and Access Act 2025 (s.121), Data Protection Act 2018 / UK GDPR |
| Mandatory Standards | DCB 0129 (manufacturers), DCB 0160 (deploying organisations), DSPT (data security) |
| CQC Fundamental Standards | Regulation 9 (person-centred care), 11 (consent), 12 (safe care), 13 (safeguarding), 17 (good governance), 20 (Duty of Candour) |
| NHS Contractual | NHS Standard Contract, PSIRF, Caldicott Principles |
| Emerging Framework | MHRA AI/medical device framework (2026), Ten Year Plan structural reforms, FT/IHO authorisation requirements |
| Personal Liability | CSO liability under DCB 0129/0160, CQC Registered Manager/Nominated Individual liability under Reg 5 |
The methodology distinguishes between statutory requirements and interpretive governance positions. Where specific statutory clauses are cited, the citation refers to the statutory text. Where governance principles are applied precautionarily (such as lawful basis non-inheritance at boundaries), the interpretive basis is stated.
Seven governance dimensions at every boundary
What is clinical identity verification at boundaries? Clinical identity verification at organisational boundaries is the process of confirming patient, practitioner, and organisation identity when data crosses between separate healthcare systems — ensuring that clinical actions are attributed to the correct patient regardless of which system originated the data.
The boundary question
Can both organisations verify who the patient is and who is acting on their behalf at the point of data exchange?
What we assess
PDS lookup at boundary, NHS number verification, clinician identity in structured messages, cross-system identity reconciliation.
Specific audit questions
- What identifiers are used at the boundary (NHS number, local IDs, demographic matching)?
- Is there a documented process for verifying patient identity at the point of transfer?
- What happens when identifiers do not match or are absent? Is there a fallback protocol?
- Are identity verification events logged and auditable?
- Has the hazard log (DCB 0129/0160) identified identity matching at the boundary as a hazard?
- Is there a documented incident where misidentification at the boundary caused or risked patient harm?
Statutory basis
UK GDPR Article 5(1)(d) accuracy; CQC Regulation 17 good governance.
What failure looks like
Patient data crosses a boundary without verified identity. Receiving organisation acts on data attributed to the wrong patient. No one detects the mismatch because neither system cross-references.
Cascade effect: If Identity scores below Level 2, Consent and Provenance are automatically capped at Level 1.
What is boundary-specific consent in healthcare? Boundary-specific consent ensures that a patient's permission and lawful basis for data processing are verified, recorded, and propagated specifically for each organisational boundary their data crosses — not assumed from a generic privacy notice or inherited from the sending organisation's public task.
The boundary question
Has the patient's consent been obtained, recorded, and propagated for the specific boundary crossing?
What we assess
Boundary-specific DPIA, privacy notice referencing the specific crossing, National Data Opt-Out compliance, consent propagation mechanism, patient awareness of constitutional transition (where applicable).
Specific audit questions
- Does a boundary-specific DPIA exist for this crossing?
- Does the privacy notice explicitly reference this specific organisational boundary?
- Has the National Data Opt-Out been implemented at this boundary?
- How is consent propagated across the boundary — is there a technical mechanism or is it assumed?
- Where the boundary crosses constitutional domains, has the patient been informed of the transition (e.g., care → commercial)?
- Can the receiving organisation demonstrate independent lawful basis, or does it rely on the sending organisation’s basis?
Statutory basis
UK GDPR Article 6 lawful basis; UK GDPR Article 5(1)(b) purpose limitation; Common Law Duty of Confidentiality.
What failure looks like
Patient data crosses a boundary under a generic privacy notice that doesn't reference the specific crossing. Patient is unaware their data has moved from a care context to a commercial or compliance context. Lawful basis is assumed rather than independently established by the receiving organisation.
Our interpretive position: Each controller must independently establish its lawful basis at every boundary. Organisation B cannot rely on Organisation A's consent or public task. This is our "lawful basis non-inheritance" principle, grounded in UK GDPR controller obligations.
What is clinical data provenance? Clinical data provenance is the complete, verifiable lineage of a clinical record — its origin, authorship, method of capture, and any transformations applied during transfer. At organisational boundaries, provenance ensures the receiving clinician can trust the integrity and source of the data they act upon.
The boundary question
Can the receiving organisation verify the source, authorship, and integrity of the data it receives?
What we assess
Structured metadata in transfer messages, author identification, timestamp integrity, data integrity verification, audit trail through the boundary.
Specific audit questions
- Does data crossing the boundary carry structured metadata (author, timestamp, source system)?
- Can the receiving clinician verify who created the data and when?
- Is there an audit trail through the boundary showing the data’s journey?
- If data is transformed, compressed, or summarised during transfer, is the transformation documented?
- Has a data integrity check been implemented at the boundary?
- Are there known incidents where data quality degraded during boundary transfer?
Statutory basis
DCB 0129 clinical risk management; CQC Regulation 17(2)(c) quality and accuracy of records.
What failure looks like
Data arrives at the receiving organisation without structured metadata. The clinician acts on information whose source and reliability they cannot verify. If the data was corrupted, compressed, or truncated during transfer, no one detects it.
What is clinical intent in healthcare data exchange? Clinical intent is the explicit, structured communication of why data is being shared and what clinical action is expected from the receiving organisation. Without it, referrals and discharges become narrative documents that require interpretation rather than computable, actionable instructions.
The boundary question
Does the receiving organisation know precisely why the data was shared and what clinical action is expected?
What we assess
Structured action coding in referrals and discharges, explicit clinical questions, urgency classification, expected response specification.
Specific audit questions
- Are referrals and discharges communicated with structured action codes or only free text?
- Is there an explicit clinical question or action requirement in every boundary crossing?
- Is urgency classification communicated in structured form?
- Does the receiving organisation know what clinical response is expected and within what timeframe?
- Are there instances where clinical intent has been lost or misinterpreted at this boundary?
- Is clinical intent preserved when data crosses between different IT systems?
Statutory basis
CQC Regulation 12 safe care and treatment; DCB 0160 clinical risk management in deployment.
What failure looks like
A discharge summary states the diagnosis but follow-up actions are in free text. The GP receives a narrative letter without structured action codes. The specialist receives a referral without a clear clinical question. Clinical intent degrades or is lost in translation between systems.
Cascade effect: If Clinical Intent scores below Level 2, Alert & Responsibility and Service Routing are automatically capped at Level 1.
What is clinical responsibility transfer at boundaries? Clinical responsibility transfer is the explicit, bilateral handover of accountability for a patient's care from one organisation to another. The Seven Flows methodology requires that responsibility cannot be relinquished until the receiving party has explicitly accepted it — the Minimum Viable Responsibility Transfer (MVRT) principle.
The boundary question
When responsibility transfers, is there an explicit, bilateral handover — or does it fall into a gap?
What we assess
MVRT compliance (see below). Confirmed receipt mechanism. Clinically-timed escalation pathway. Unowned patient identification. Audit trail of responsibility transfer.
Specific audit questions
- When responsibility transfers at this boundary, is there confirmed bilateral acceptance?
- Can the infrastructure prevent a transfer from completing without acknowledgement?
- What is the escalation pathway if acknowledgement is not received within a defined timeframe?
- Can the system identify patients currently in transit with no named responsible clinician?
- Are MVRT events logged as auditable governance artefacts?
- Has the boundary been tested with a simulated MVRT failure scenario?
Statutory basis
CQC Regulation 12(2)(i) proper and safe management of medicines and treatments; PSIRF patient safety principles.
What failure looks like
A patient is discharged from one organisation without confirmed receipt by the next. For a period measured in hours or days, no named clinician has responsibility. The patient is clinically unowned. This is the most dangerous failure in boundary governance.
Cascade effect: If Alert & Responsibility scores below Level 2, Outcome is automatically capped at Level 1.
MVRT — Minimum Viable Responsibility Transfer
MVRT is the normative control at the centre of the assessment. A boundary that cannot demonstrate explicit, bilateral responsibility transfer cannot score above Level 2 on Alert & Responsibility — regardless of how well everything else functions.
Five requirements:
- Explicit, bilateral declaration — sending releases, receiving accepts
- Infrastructure enforcement — the transfer cannot complete without acknowledgement
- Clinically safe escalation — if unacknowledged, the system escalates within a defined timeframe
- Unowned patient identification — the system can identify patients in transit with no responsible clinician
- Auditable governance artefact — every transfer logged, timestamped, traceable
What is clinical service routing? Clinical service routing is the governance-informed allocation of patients to receiving providers based on clinical criteria, constitutional domain awareness, and care appropriateness — not simply capacity, waiting list length, or geographical proximity.
The boundary question
Is the patient routed based on clinical criteria and governance, not just capacity or convenience?
What we assess
Clinical triage criteria for routing decisions, governance-informed routing (constitutional domain awareness), capacity vs. clinical appropriateness, waiting list management at boundaries.
Specific audit questions
- Are routing decisions at this boundary based on clinical criteria or primarily on capacity?
- Do routing decisions account for the constitutional domain of the receiving provider?
- Is there a documented triage protocol for determining which patients are routed across this boundary?
- Are waiting list management practices at this boundary clinically governed?
- Has routing at this boundary ever resulted in a patient being sent to an inappropriate provider?
- Is there governance oversight of routing decisions (not just clinical, but constitutional)?
Statutory basis
CQC Regulation 9 person-centred care; NHS Standard Contract service specifications.
What failure looks like
A patient is routed to the nearest available provider rather than the clinically most appropriate one. Routing decisions don't account for the constitutional domain of the receiving provider — a complex patient is routed to a provider whose governance framework is inadequate for their needs.
What is cross-boundary outcome tracking? Cross-boundary outcome tracking is the structured feedback loop that ensures the originating organisation learns what happened to a patient after they crossed an organisational boundary — closing the loop between referral and result to enable continuous improvement of boundary governance.
The boundary question
Does the originating organisation learn what happened, and is outcome data used to improve the boundary?
What we assess
Structured outcome reporting across boundaries, cross-boundary clinical audit, boundary-specific outcome metrics, feedback loops into governance.
Specific audit questions
- After a patient crosses this boundary, does the originating organisation routinely receive structured outcome data?
- Is there a cross-boundary clinical audit that covers this boundary?
- Are boundary-specific outcome metrics tracked and reported?
- Is outcome data used to improve governance at this boundary?
- What is the feedback mechanism when outcomes are poor — is there a structured loop or is it ad hoc?
- Can the originating organisation demonstrate learning from outcomes at this boundary?
Statutory basis
CQC Regulation 17(2)(a) quality improvement; outcomes-based commissioning requirements under Ten Year Plan.
What failure looks like
The boundary is a one-way door. The originating organisation never learns whether the referral resulted in good care, delayed care, or harm. Without this feedback loop, the same boundary failures repeat indefinitely. Outcome consistently scores the lowest of any flow in our assessments.
Why cascade-adjusted scores matter
A boundary that scores 3 on Consent looks good in isolation. But if Identity scores 1, Consent is cascade-adjusted to 1 — because you cannot meaningfully verify consent for a patient whose identity you haven't confirmed at the point of crossing.
The cascade rules:
Identity < 2→ Consent and Provenance capped at 1Clinical Intent < 2→ Alert & Responsibility and Service Routing capped at 1Consent < 2→ Service Routing capped at 2Alert & Responsibility < 2→ Outcome capped at 1
Raw and cascade-adjusted scores are both recorded in the scorecard. The adjustment shows structural reality that individual flow assessments miss.
How we conduct the assessment
Stakeholder engagement
For each boundary, the audit requires structured interviews with stakeholders on both sides:
| Role | Flows Covered | Evidence Expected |
|---|---|---|
| Clinical Safety Officer | All flows, especially Identity and Alert & Responsibility | Hazard log, clinical safety case, DCB 0129/0160 compliance evidence, incident reports at boundary |
| Clinical Lead | Clinical Intent, Alert & Responsibility, Outcome | Referral pathways, escalation protocols, outcome reporting, clinical governance records |
| IG / DPO Lead | Identity, Consent, Provenance | DSAs, DPIAs, privacy notices, lawful basis documentation, National Data Opt-Out implementation |
| IT / Integration Lead | All flows (technology dimension) | Integration specifications, API documentation, network topology, system architecture, logging |
| Governance / Compliance Lead | Service Routing, Outcome | Governance framework, CQC self-assessment, DSPT submission, quality improvement records |
| Board Sponsor | Scoping and sign-off | Organisational risk appetite, strategic priorities, board reporting requirements |
Evidence hierarchy
Evidence is categorised and weighted:
Level 1 — Documentary: Written policies, procedures, DSAs, DPIAs, hazard logs, integration specifications. Establishes that governance processes exist.
Level 2 — Demonstrable: Audit trails, incident reports referencing the boundary, test results, governance meeting minutes. Establishes that processes function.
Level 3 — Observed: Direct observation or walkthrough of boundary processes. API call tracing, live system demonstration, real-time data flow observation. Establishes that processes function as documented.
A flow cannot score above Level 2 (Defined) on documentary evidence alone. Level 3 (Managed) requires at least Level 2 evidence. Level 4 (Optimised) requires all three levels plus continuous improvement evidence.
Cross-organisation evidence reconciliation
Every boundary has two sides. Evidence must be reconciled across organisations. We interview stakeholders on both sides and cross-reference their accounts. Where Organisation A claims a process exists but Organisation B is unaware of it, the evidence is flagged as unreconciled and the lower assessment prevails. This is particularly critical for Alert & Responsibility, where the sending organisation may believe responsibility has transferred but the receiving organisation has not accepted it.
Not all boundaries are equal
When a boundary crosses between organisations under different legislation, different regulators, and different institutional orientations, additional governance requirements apply. We identify ten constitutional domains in healthcare and map the risk level of every possible crossing.
Five Constitutional Authority Interaction Principles
- Clinical risk responsibility follows care delivery
- Lawful basis cannot be inherited across boundaries
- Purpose limitation travels with the data
- Higher-risk orientation requires enhanced governance
- Neither constitution dominates by default
DCB 0129 addresses clinical safety within a single manufacturer's product and its deployment context. The Seven Flows methodology extends governance assessment to the boundaries between organisations — the joins where data, responsibility, and clinical risk cross between separate governance frameworks. The two are complementary: DCB 0129/0160 governs within, Seven Flows governs between.
Cascading failure logic captures structural dependencies between flows. For example, if Identity scores below Level 2, Consent and Provenance are automatically capped at Level 1 — because you cannot meaningfully verify consent for a patient whose identity you haven't confirmed. These cascade rules reveal risks that individual flow assessments miss.
SBAR is a communication tool for clinical handover within an organisation. MVRT is a governance principle for responsibility transfer between organisations. SBAR structures the content of a handover. MVRT ensures the handover is bilateral, confirmed, and auditable — that responsibility cannot be relinquished until the receiving party has explicitly accepted it.
How the Seven Flows apply to your sector
The Seven Flows methodology applies to any organisational boundary where clinical data, responsibility, or accountability crosses between governance frameworks. See how it applies to your context:
Julian Bradder
Founder & CEO, Inference Clinical. The Seven Flows methodology is developed from governance analysis of clinical handover across NHS, private, local authority, and commercial healthcare boundaries.