EHR patient record test cases, where a defect reaches the patient

Patient identity is the first and largest category. A missed duplicate splits a clinical history in two, so the chart a clinician reads is missing half the picture. An over-eager match does the opposite and merges two people into one record, which is worse. Both need testing, and they pull in opposite directions: the same matching rule cannot be tuned for both, so the test set has to assert on a deliberate position rather than on whatever the algorithm returns. The merge itself needs its own cases, including the unmerge, because an incorrect merge that cannot be reversed leaves two patients permanently entangled.

Units of measure are the second and are almost never present in published sets. A value stored without its unit is not clinical data, it is a number. The failure appears at a boundary: a value entered in one unit system, converted for display in another, then read back by a calculation that assumes the original. Testing that the same result agrees in the chart, in a printed summary, in an export and in a reporting extract is one case, and it catches a whole class of conversion defects at once.

Alerting degrades silently. An allergy or interaction check that fires correctly during the first order will often stop firing after a renewal or a generic substitution, because the match is on brand name rather than on ingredient. Nothing errors, no alert appears, and the absence of a warning reads as safety. The related case is the distinction between unknown and none: an empty allergy list rendered as no known allergies asserts something that was never established.

Finally, access and audit are regulated rather than merely desirable. Reads are auditable events in clinical systems, not only writes, and emergency access needs to be possible, recorded, and flagged for a review that the accessing user cannot clear. Consent restrictions have to hold on exports and outbound interface messages, not only on the screen, because that is the path by which restricted data actually leaves the building.