A never event,
prevented by a whiteboard.
Retained surgical items are classed as never events — occurrences that should be impossible. The defence is two people counting sponges and instruments at each stage and agreeing. That count is tracked on a whiteboard and written into the record afterwards, from memory, by people who have been standing for six hours.
Each count stage · both parties · discrepancies visible rather than reconciled
Closing count · sealed
● 2 of 2 signedLaparoscopic sponges · 18 in / 18 out
Closing count — reconciled
R. Castillo · circulating
RN · TX-5512 · signed 16:41:10N. Adeyemi · scrub
CST · TX-6034 · signed 16:41:44Sealed — both signatures verify
Editing anything breaks it visiblyWhy counts are hard to evidence.
The count itself is disciplined. Its record is the weakest link in one of the most consequential controls in the building.
It is documented after the fact
The count happens at the field; the charting happens later. Memory fills the gap, and memory is at its worst at the end of a long case.
Discrepancies get resolved quietly
A miscount found and fixed is the system working. But if resolution is not recorded as it happens, an investigation cannot distinguish that from a count that was never right.
Time pressure is constant
Counts compete with closing. Anything that adds friction at that moment loses, which is why the record has stayed a whiteboard.
What a real count seal looks like.
Both people sign the same record, at the moment it happens, each bound to their own credential. Neither can produce it alone.
Both parties sign the same numbers
Initial, closing and any additional counts are sealed with the actual figures, signed by circulating and scrub together, at the moment of agreement.
The credential is captured, not asserted
Each signature carries the signer’s credential and role as part of the sealed content, so who counted is a fact rather than a recollection.
One person cannot count twice
If both signatures resolve to the same credential the record refuses to seal. A count agreed with yourself is not a count.
A discrepancy stays visible
A miscount and its resolution are both sealed, so the record shows the system working rather than looking like a gap someone papered over.
Who this protects.
The surgical team
Evidence the count was done and reconciled, dated to the moment, not reconstructed from a whiteboard photograph.
Risk management
A never event with a complete sealed count trail is a very different conversation from one without.
The patient
The reason the count exists. Making it provable makes it harder to shortcut.
Where this actually stands.
We’d rather tell you plainly than let you find out on a call.
What exists today
- The two-person seal is built and tested in our signing library
- Self-witnessing is refused at the cryptographic layer, not by policy
- Tamper-evidence and independent verification already run in our live review product
- The signing key is published, so anyone can verify a sealed record without an account
What does not exist yet
- An OR-facing capture flow that does not add friction during closing
- Integration with any perioperative system or count board
- Per-signer keys — credentials are captured, but signing runs on a service key today
- Any deployment in a live operating room
So this is a pilot conversation, not something you can buy this afternoon. If the problem is real where you work, that’s exactly who we want to build the first one with.
Talk to us about a pilot.
The founder reads every message and will tell you honestly whether this is ready for what you need.