- Subject, respondent, and purpose remain explicit
- Resolve patient and request context, distinguish subject, source and recorder, establish representative scope, explain why information is collected, enforce tenant access and hold ambiguous identities rather than merging records.
- Forms are approved, current, and accessible
- Version clinical and administrative ownership, effective dates, language and branching; label every input; identify errors in text; support correction, save, resume and assistive technology; and retain staff-assisted alternatives.
- Missingness and patient words survive
- Keep blank, declined, unknown, not applicable and not asked distinct; preserve original language and attachments; cite prefill and normalization; require confirmation where material; and prevent silent coercion or auto-correction.
- Validation never becomes clinical interpretation
- Check structure, type, format, range, unit and completeness deterministically; label scores and model candidates; use fixed approved urgent instructions; and route symptoms, medications, allergies, capacity and safeguarding questions to qualified staff.
- Consent and access are separately enforced
- Present purpose-specific choices without preselection, preserve permit, deny, exceptions, period, verification and revocation, confirm applicable legal requirements and enforce data access through deterministic current policy outside the model.
- Delivery, review, and correction are observable
- Record submission, delivery, acknowledgment, staff acceptance, review, escalation and field-level use separately; issue a patient receipt; retain provenance; and propagate amendments and entered-in-error decisions to every affected record and owner.