How to Automate a Clinical Audit Without Losing Clinical Oversight

Disclosure and a note on the name

Disclosure: Oriel is made by Zapx Labs, which publishes this blog. Oriel is a working prototype at pilot stage, shown on a fictional demo hospital with synthetic data only. It is not a medical device, is not for clinical use, and has no published price.

Oriel here is unrelated to Oriel at oriel.nhs.uk, the UK-wide portal for recruitment to postgraduate medical, dental, public health, healthcare science and foundation pharmacy training. Oriel is our working name for the audit platform.

Guidance quoted below is from HQIP, NICE, legislation.gov.uk and NHS England, read on 8 November 2026 and linked at the end.

Where the time goes in a clinical audit

HQIP's Best practice in clinical audit (2020) defines clinical audit as a quality improvement cycle: measuring care against agreed and proven standards, then acting to bring practice in line with them. The measuring is where most of the hours go. A typical local audit means opening one system, then another, and typing what you find into a spreadsheet: pacemaker exams in the RIS against implant images in PACS, dose records against local reference levels, controlled drug registers against witnessing rules.

HQIP's guide to data quality in clinical audits warns that retrieving data from health records is “inherently more complex than clinicians may imagine”. Done by hand, that complexity pushes audits towards small samples, and makes them hard to repeat the same way next month, which matters because a re-audit is only comparable if the method is the same.

For imaging and the cath lab there is also a legal duty. Regulation 7 of the Ionising Radiation (Medical Exposure) Regulations 2017 requires the employer's procedures to provide for clinical audit and, since 1 October 2024, for taking appropriate action on the results.

What to automate and what to keep human

Automation is good at reading, counting, matching and applying explicit rules. It is not a substitute for judgement on an ambiguous case, and it should not be the one deciding whether care met the standard where the evidence is unclear.

• Automate: finding the cases in scope, pulling the fields the standard needs, matching records across systems, applying rules that can be written down, and assembling evidence.
• Automate with checks: the denominator. Compare the number of cases found against a count you trust before relying on the results.
• Keep human: approving the scope and method, deciding each finding, especially unclear ones, and signing off the report and action plan.
• Keep human: any change to a clinical record. An audit finds the gap; correcting the record is a separate, accountable act.

A pattern that keeps oversight intact

Whatever tool you use, these steps keep a person in charge while removing most of the manual reading.

• Agree the standard and method first, and write them down so the next round can be done the same way.
• Turn the request into a written plan that says what will be read, from which system, and which part of local procedure applies, and have a person approve it before anything runs.
• Read data through standard interfaces (FHIR R4, DICOMweb, HL7 v2) or exports where possible. Where a system has no interface, screen reading needs strict controls on what is captured.
• Attach evidence and a reason to every finding, so the reviewer can see why it was flagged.
• Have a named person agree or change each finding, with a note, and keep that record.
• Draft the report from the decided findings, cite the cases and the guidance, and sign it off.
• Save the audit so it can be re-run in exactly the same way.

Where Oriel fits

Oriel is an on-premises AI clinical audit platform built around that pattern. You describe the audit in plain words, for example September's pacemaker exams in the RIS against the implant images in PACS, or pick a pack from its library. Oriel writes a plan saying what it will read, where, and which part of the local procedures applies. Nothing runs until a person approves it, and the run can be paused, stopped or forked at any step.

Once approved, it works through every case rather than a sample, using connectors for FHIR R4, DICOMweb PACS and HL7 v2 over MLLP with TLS. Where a system has no interface, a small workstation runner reads the screen the way staff would: patient names are masked before any screenshot is kept, a banner shows what it is doing, and it stops the moment staff touch the mouse.

Each finding arrives with its evidence and a reason, and a named person agrees or changes it with a note. Oriel never corrects a clinical record on its own; anything that would write to a clinical system needs explicit approval from someone allowed to make that change. It then drafts the audit report in the department's own DOCX or PDF template, cited to the guidance and to the cases, for sign-off.

Audits are saved as versioned packs, which are data rather than code, and can run as schedules or workflows triggered by hand, by a webhook, on a timetable or when another audit finishes. Guidance questions are answered with citations to the section and page of the Trust's own documents.

Which departments it is built for

Oriel starts with the cath lab and imaging and is designed to extend to any department that audits against a standard. The demo hospital includes pacemaker device coding and radiation dose in a cardiac catheter lab, exams without archived images in imaging, turnaround breaches in pathology, controlled drug witnessing in pharmacy, and research. These are demonstrations on synthetic data, not audits run in a real hospital.

Governance questions to settle first

NHS England's guidance for information governance professionals says a data protection impact assessment must legally be completed before implementing AI-based technologies. Beyond the DPIA, these are the questions an audit lead, IG team and clinical safety officer will ask of any audit automation tool.

• Where do the models run? Oriel's models run on site, and a hosted model is added only if the site chooses, with patient identifiers pseudonymised before any outside call.
• What happens if the AI is unavailable? Every Oriel step has a non-AI fallback.
• Who can do what? Oriel has role-based access and a full action log.
• How is it installed? As a desktop app for one PC, or a server install with encrypted backups and readiness checks.
• What comes before real data? A clinical safety case and information-governance approval.