One of the few errors
that kills in minutes.
An ABO-incompatible transfusion can be fatal before anyone realises what happened, which is why two people are required to verify patient identity against the unit at the bedside. That verification is recorded as signatures on a form attached to a bag that gets discarded. The stakes could not be higher and the evidence could not be thinner.
Unit number · patient identifiers · both verifiers · sealed at the bedside
Bedside check · sealed
● 2 of 2 signedUnit W1234 56 789012 · O NEG
Matched to patient armband + order
S. Kaur · administering
RN · TX-2204 · signed 09:14:02T. Boateng · verifying
RN · TX-8891 · signed 09:14:35Sealed — both signatures verify
Editing anything breaks it visiblyWhy the bedside check is hard to prove.
The procedure is sound. The record of it is the weak part, and it is weakest exactly when it matters.
The evidence gets thrown away
The tag and the bag go in the bin after transfusion. What survives is a form, and the form is only as good as the moment it was filled in.
One person can complete both halves
Two signature lines on one form do not prove two people stood at the bed. Under pressure the second is sometimes collected afterwards, in the corridor.
Reconstruction happens after harm
By the time anyone examines the record, a patient has been harmed and everyone is recalling a routine moment from days earlier.
What a real bedside seal looks like.
Both people sign the same record, at the moment it happens, each bound to their own credential. Neither can produce it alone.
Both nurses sign the same identifiers
Unit number, blood type, patient identifiers and the order are sealed as one record, signed by both people while they are standing there.
The licence is captured, not asserted
Each signature carries the signer’s credential and role as part of the sealed content, so who verified is not a matter of recollection.
One person cannot be both checkers
If both signatures resolve to the same credential the record refuses to seal — which is the entire point of a two-person check.
The record outlives the bag
The unit is discarded; the sealed record is not. Change any identifier afterwards and verification fails, independently confirmable.
Who this protects.
The nurses at the bedside
Proof they did the check correctly that does not depend on anyone remembering, or on a form nobody can date.
The transfusion service
Traceability from issue to bedside without reconciling paper against a discarded tag.
The patient
A verification that is provably two people is the difference between a control and a ritual.
Where this actually stands.
We’d rather tell you plainly than let you find out on a call.
What exists today
- The two-person seal is built and tested in our signing library
- Self-witnessing is refused at the cryptographic layer, not by policy
- Tamper-evidence and independent verification already run in our live review product
- The signing key is published, so anyone can verify a sealed record without an account
What does not exist yet
- A bedside capture flow, including scanning the unit and armband
- Integration with any blood bank system, LIS or EHR
- Per-signer keys — credentials are captured, but signing runs on a service key today
- Any deployment in a live clinical setting
So this is a pilot conversation, not something you can buy this afternoon. If the problem is real where you work, that’s exactly who we want to build the first one with.
Talk to us about a pilot.
The founder reads every message and will tell you honestly whether this is ready for what you need.