Medical Device Information Architecture: Where Navigation Becomes a Patient Safety Risk

This article draws on Creative Navy's project work in medtech UX, spanning practice management software, surgical equipment, ventilators, blood pumps, infusion systems, and patient monitoring devices, including Class II and Class III regulated products. Our work in this sector covers clinical environments including the ICU and operating theatre, designing for surgeons, nurses, and biomedical engineers. Dennis Lenard, who leads this work at Creative Navy, is the author of User Interface Design For Medical Devices And Software, the practitioner reference on UX design for medical devices and software. Our approach integrates IEC 62366 usability engineering requirements and FDA Human Factors guidance as structural inputs to the design process, not post-hoc compliance activities.


From January 2023 to August 2024, 204,163 infusion pump events were submitted to the FDA's MAUDE database: 204 deaths, 1,901 injuries, 202,025 malfunctions (ECRI/ISMP, April 2025). The Baxter Sigma Spectrum, one of the most widely deployed infusion pumps in US acute care, requires 16 steps to complete a secondary medication infusion, nearly double the step count of its nearest competitor. Nurses bypass smart pump drug libraries at rates reaching 70% for specific medications. These are not isolated device failures. They are the operational signature of interfaces organised around internal software function rather than clinical task sequence.

This benchmarking review covers five medical device interfaces across the infusion pump, patient monitoring, hemodialysis, and ventilation categories. The evaluation draws on published regulatory findings, documented workaround behaviour from peer-reviewed clinical literature, and comparative step-count analysis. Healthcare UX's relationship to patient safety outcomes is established in detail elsewhere; the argument here is about the specific architectural variable that drives or prevents those outcomes. The audience is product directors and senior PMs responsible for the next generation of these devices.

Every claim about incident data and regulatory action in this article carries its publication date. Dates matter: the regulatory record is active, and several of the most significant findings post-date benchmarking work conducted in mid-2025.

Poor information architecture in medical devices creates measurable operational liabilities. When device navigation is organised around internal software functions rather than clinical task sequences, clinicians develop workarounds: drug library bypass rates reaching 70%, training periods extending to weeks, and alarm systems generating 85-99% non-actionable signals. These are not user errors. They are the predictable outcomes of interfaces that impose cognitive demands the clinical environment cannot absorb under time pressure.

The central diagnostic question in this review is whether each device's information architecture is organised around what the device does or around what the clinician needs to decide. These are not equivalent structures. The distinction is not cosmetic.

A function-anchored IA groups screens and controls by device capability: pump parameters, alarm settings, log files. Each layer makes internal technical sense. A task-anchored IA groups screens by clinical decision point: what does the clinician need to confirm before proceeding, what action is available right now, what state is critical at this moment. The device's internal structure becomes invisible. The clinician's task sequence becomes the organising principle.

The Task-Anchored IA framework evaluates devices across four criteria:

These criteria are not design preferences. They are derived from failure modes documented in the FDA regulatory record and peer-reviewed practitioner literature. Each device reviewed below fails or satisfies these criteria in a specific way, and that specificity is what makes the comparison useful for a product decision.

The transition between each reviewed device is also a transition in how severely the gap between IA logic and clinical workflow compounds over time.

The Sigma Spectrum line (V6, V8, Spectrum IQ) has not been materially redesigned since July 2025. The FDA's June 2025 early alert for software version mismatch across V6 and V8 hardware confirms the interface is still in active deployment without structural revision.

That version mismatch incident is analytically significant beyond its immediate cause. The FDA's documentation states that V6 and V8 hardware "include many differences in the clinical workflow and user interface" and that a user trained on one platform "may experience confusion and delay during use or may accidentally mis-programme the infusion" when presented with the other (FDA Early Alert, June 2025). A software distribution error produced a clinical cognitive architecture mismatch that reached the installed base. The vulnerability was latent in the gap between two interface generations whose IA logic had not been reconciled at the task-sequence level.

The step-count evidence reinforces the structural diagnosis. A published comparison found the Sigma Spectrum requires 16 steps to complete a secondary medication infusion: the highest count among four pumps tested. Two of those steps were characterised as non-actionable prompts: signals that do not require clinical judgment to clear, which experienced users learn to dismiss without review (AAMI Biomedical Instrumentation and Technology, 2018). A prompt that experienced clinicians dismiss on sight is no longer a verification step. The interface retains the structure of a safety check while decoupling it from the cognitive engagement that made it one.

Drug library bypass is where the accumulated cost becomes visible. The AACN Advanced Critical Care symposium of September 2025 states that "the complexity of IVSP technology is often underestimated by multidisciplinary teams and clinical leadership, resulting in mismatched expectations and potential risks that may not be immediately visible." The interface imposes more steps than clinical time pressure allows. Workaround behaviour is rational.

For the pattern of how programming step complexity distributes across infusion device categories, our syringe pump UX benchmarking maps the structural failure modes across the broader device group.

The Welch Allyn Connex Spot Monitor (Baxter/Hillrom) has received two firmware updates since the original article's subject matter was current. Both addressed security vulnerabilities: v1.52.01 (October 2023) resolved a critical cryptographic flaw with a CVSS v4 score of 9.1; v1.54.01 (announced October 2025) delivered security enhancements. Neither release included interface changes. Product marketing as of 2025 describes an identical feature set to the device at launch.

The topical scheme the original article identified as a structural strength has not been redesigned. It does not need to be. The Connex's organisation around vital parameter sections (heart rate, blood pressure, temperature, SpO₂) is coherent for its use case. Each section serves as a topical entry point with context-specific functions. That assessment holds.

The relevant diagnostic question is what the static interface is being asked to carry. The Joint Commission's estimate that 85-99% of hospital alarms are non-actionable, reaffirmed through 2024, is not a device-specific finding. But the Connex's topical organisation does not distinguish clinically urgent signals from sensor artefacts within its parameter categories. A topically accurate interface that cannot prioritise across categories by clinical urgency trains clinicians in a disambiguation task the interface does not support.

Whether a device-level IA redesign would meaningfully reduce alarm fatigue in hospital environments, or whether the problem is at the care-system level and individual device redesigns cannot move it, remains unresolved. A signal that originates from electrode placement and a signal that originates from a critical desaturation event can reach the clinician through the same topical category with indistinguishable visual weight. The device IA might not be the structural variable that matters most. That is not a finding this review can settle.

What it can observe: sense decay in a static interface does not always surface in the interface. Sometimes it surfaces in the gap between what the alarm hierarchy communicates and what the alarm environment requires.

The Baxter AK 98 hemodialysis machine has been transferred to Vantive, a newly independent company spun off from Baxter's kidney care division. Vantive's product pages retain the same positioning and feature description as at launch. No interface update announcements were found post-July 2025.

The AK 98's closed audience scheme, which presents treatment-related tools to clinicians and locks service functions behind a PIN, is appropriate for its compliance context. The April 2024 Class I recall was a materials safety issue (polychlorinated biphenyl acids in silicone tubing), not a UX finding. The interface is structurally unchanged.

The diagnostic question the AK 98 raises is not about the device's current state. It is about what happens to IA coherence during corporate transition. The team that holds the rationale for an IA is not necessarily the team that transfers with the product. The resource guide (version 3.0, July 2024) covers alarm resolution flows and maintenance procedures consistent with the original design. There is no evidence of a usability review as part of the transition.

Sense decay in an IA does not always surface in the interface itself. Sometimes it surfaces in the absence of a programme that would catch it.

The SV800 ventilator has not been updated since the original article's subject matter was current. Distributor listings from April 2025 describe an identical feature set to the 2021 launch: 18.5-inch 1080p display, PulmoSight numerical and graphical displays, customisable shortcut keys, intelligent assistant tools.

The task-oriented bottom row and right sidebar layout places essential parameters within one interaction of the main screen. That structural assessment holds. The tension is in what "all essential parameters on the home screen" means for a device managing a critically ill patient on mechanical ventilation.

Cognitive load in ICU ventilator management is not primarily a navigation problem. The clinician is monitoring a signal landscape simultaneously, not searching for a parameter. The SV800's information density reflects a correct assumption: clinicians need rapid access to multiple values. It does not resolve the harder problem: which values demand immediate attention and which are context noise at this specific moment in this patient's status.

The alarm hierarchy coherence criterion is where the SV800's task orientation reaches its structural limit. The device organises tasks well. It does not prioritise them in response to current patient state. That is the distinction between a task-oriented IA and a task-anchored one.

The Outset Medical Tablo hemodialysis system was absent from the original article despite being commercially available and positioned explicitly on IA differentiation. It is the most analytically significant comparison point in this review.

The Tablo's architecture is built around guided sequential flows: 3D animations and step-by-step instructions walk users through setup, treatment initiation, alarm resolution, and takedown. Two-way cloud connectivity automates documentation and transmits near-real-time machine performance data, removing manual data entry from the clinical workflow entirely. Outset claims nurse training in under four hours, compared to weeks for conventional hemodialysis machines (Outset Medical clinical evidence, 2025).

Each screen in the Tablo's workflow is defined by what the clinician needs to do next. Device capability is present but not the organising principle. The training time difference is the operational signature of that architectural choice. Under four hours to competency means the task architecture is legible enough that training is primarily familiarisation rather than navigation memorisation.

A Medicare Advantage analysis cited $686 per member per month in cost reduction for health plans growing Tablo home hemodialysis utilisation (Outset Medical clinical evidence, 2025). This figure is vendor-sourced and should be treated as directional until independent replication is available. The training time reduction is the stronger conservatively sourced evidence for IA impact at the category level.

Outset Medical was acquired by Fresenius Medical Care's parent company in 2023, extending its distribution footprint. Whether the Tablo's task-anchored architecture absorbs additional clinical functionality without drifting toward function-anchored logic across future software cycles is not yet answerable. That is a significant open question, and it applies to every device in this review.

The five devices fall into three positions on the task-to-function axis, and the cross-device pattern is clear enough to be strategically useful.

The Sigma Spectrum is the clearest function-anchored case: step count, bypass behaviour, and the version mismatch incident all trace to the same architectural root. The Tablo is the clearest task-anchored case, with training time as the most direct operational evidence of what architectural alignment produces. The remaining three devices occupy a middle position: coherent for their primary use cases, task-oriented in parts, but without the integrated task-sequence architecture that makes workaround behaviour structurally difficult to sustain.

The pattern that holds across all five: devices that have not redesigned their IA since 2025 have accumulated alarm environment complexity against an interface architecture that was not built to handle it. The question for any product team is not whether their device works. It is whether it is becoming progressively harder to operate as the clinical environment changes around it.

The standard defence of complex sequential workflows in medical device IA runs as follows: removing steps removes verification. A confirmation prompt that a nurse bypasses some of the time is still a net safety gain, because it interrupts the path toward error often enough to justify its friction cost. The Sigma Spectrum's 16-step flow, on this argument, represents accumulated clinical safety logic, not accumulated engineering debt.

The argument fails at one specific point.

The AAMI comparison study found that two of the Sigma Spectrum's 16 steps are non-actionable prompts: signals that do not require clinical judgment to clear and that experienced users learn to dismiss without review (as of 2018; the characterisation has been sustained through AACN's September 2025 symposium without revision). A prompt dismissed on sight is not a verification step. The interface retains the structure of a safety check. The behaviour the check was designed to produce has been eliminated by familiarity.

The Tablo challenges the step-count logic from the other direction. Under four hours to competency on a hemodialysis machine means the task architecture is legible enough that training is familiarisation, not navigation memorisation. Fewer steps, anchored to clinical decisions rather than device state changes, produced a faster-to-competency system. The relationship between step count and safety is not linear, and the assumption that it is leaves genuine risk unaddressed.

The case for sequential confirmation steps holds precisely where each step maps to a genuine clinical decision point: where each screen corresponds to a judgment the clinician must actually make. It weakens at every step that does not. The discipline required is distinguishing load-bearing safety structure from navigational overhead that has accumulated across software release cycles. Those two things are not the same, and conflating them is the most common way organisations defend interfaces that are generating workaround behaviour.

Task-anchored information architecture organises medical device screens around clinical decisions, not device capabilities. Each screen is defined by what the clinician needs to determine at that moment, not what the device is technically capable of displaying. The Outset Medical Tablo demonstrates the outcome: nurse training reduced to under four hours, compared to weeks for conventional hemodialysis systems. The architectural choice is the structural variable. Everything else is implementation detail.

Three principles follow from the cross-device evidence for product directors approaching the next IA decision.

First: map workaround behaviour before redesign, not after. Drug library bypass rates, alarm mute patterns, and sequential step skip rates are diagnostic signals. They identify where the interface is imposing more cognitive load than the clinical environment can absorb under time pressure. This mapping is cheaper to conduct than a recall correction. The FDA's public-facing compilation of reported infusion pump problems includes clinicians describing screens that fail to communicate which unit of measurement to enter, warning messages that appear so often users stop reading them, and adjacent keys that shut the device down when the intent was to start an infusion. These reports are the surface trace of an IA that has drifted from operational reality.

Second: treat training time as an IA metric. Training time is not a function of device complexity alone. It is a function of how much of the device's internal logic a clinician must hold in working memory to navigate safely. A reduction from weeks to hours is an architectural finding, not a pedagogical one.

Third: alarm hierarchy coherence requires state-responsive priority, not category accuracy. Organising alarms by parameter category is accurate. Presenting all signals within a category at equivalent visual weight is not sufficient when 85-99% of those signals are non-actionable. The connection between alarm hierarchy design and the adverse events that follow from it is examined in detail in our analysis of medical device error state design, which covers the Graseby, Therac-25, and UCSF infusion pump cases as structural parallels across device categories.

Across our work on clinical interfaces, the finding that consistently surprises engineering teams is not that their IA is complex. They know that. What surprises them is how much of that complexity serves the device's internal software model rather than the clinician's task sequence. In projects where we have worked through a full IA audit against clinical workflows, including our work on the deSoutter ultrasonic surgical console, where screens were reorganised by procedural relevance rather than software module on a gloved-hand 7-inch display, with 13 surgeon sessions and 12 human factors studies. The first assumption to dissolve is that more confirmations mean more safety. The second is that clinicians who take the fast path are the problem.

This review has specific constraints that condition how its findings should be applied.

The Outset Medical Tablo training time claim is vendor-sourced. Independent peer-reviewed replication was not found in sources accessible at the time of writing (March 2026). The four-hour figure is directionally credible given the IA architecture, but it should not function as a benchmark without independent verification.

The drug library bypass evidence derives from studies conducted predominantly in US academic and community hospital settings. Bypass behaviour in clinical environments with significantly different staffing ratios or formulary management practices may show different patterns.

The MedCaptain syringe pump is excluded from this review. Insufficient English-language evidence is available to assess its current interface state, update history, or practitioner experience in deployed settings.

The review's most significant gap: it does not address whether task-anchored IA architectures remain coherent across multiple feature addition cycles. The Tablo's architecture is demonstrably coherent at its current scope. Whether it absorbs additional clinical functionality without drifting toward function-anchored logic over software generations is not answerable from available evidence. This is the most important open question the Tablo raises for the field.

Finally, the alarm fatigue finding for the Connex Spot Monitor is stated at the care-system level, not the device level. Whether device-level IA redesign would meaningfully reduce alarm fatigue in real hospital deployments, or whether the problem operates above the device tier, is unresolved in the current literature.

The 204,163 infusion pump events submitted to FDA MAUDE between January 2023 and August 2024 did not accumulate because device teams failed to think about safety. They accumulated because the structural variable that drives workaround behaviour (whether the interface is organised around clinical task sequence or device capability) has not been treated as a design decision requiring the same rigor as the clinical safety architecture of the device itself.

The Sigma Spectrum is not an outlier. It is the mature expression of a development pattern where interface capability tracks device capability release by release, and where each addition to the navigation structure represents a rational local decision that compounds into a system experienced clinicians route around. Workaround behaviour is not a training failure. It is the system working as it actually works, once the clinical environment has adapted to the interface's constraints.

The Tablo makes a different architectural bet: start from the task, build the interface inward. Four-hour training is the visible outcome. Less visible: the correct path is faster than the workaround. The competitive vector from that architecture is not primarily about user experience. It is about where liability accumulates, where biomedical engineering service costs concentrate, and where clinical adoption stalls because the cognitive overhead of operating the device exceeds what the deployment environment can sustain.

The gap between the Sigma Spectrum's documented workaround behaviour and the Tablo's training time outcome is not a gap in engineering quality. It is a gap in which architectural question each team decided to answer.

What causes drug library bypass in smart infusion pumps?

Published clinical literature attributes drug library bypass primarily to interface complexity and the time it takes to complete the correct programming path under clinical pressure. A 2015 publication in Nursing Management states explicitly: "Reasons that nurses bypass the drug libraries include both the complexity of the user interface and the time it takes to programme the DERS." This characterisation was sustained through the AACN Advanced Critical Care symposium of September 2025 without revision. When the workaround is faster than the correct path, the workaround becomes standard practice regardless of training reinforcement.

How does IEC 62366 apply to navigation complexity?

IEC 62366 requires manufacturers to conduct use-related risk analysis across the intended use population under realistic conditions. Navigation complexity that produces workaround behaviour constitutes a foreseeable use error under the standard. The FDA's Infusion Pump White Paper states explicitly that "many adverse events are caused by design deficiencies that were foreseeable and preventable." An interface that generates documented bypass rates of 25-70% has produced a foreseeable departure from intended use. The standard requires that departure to be identified in the risk analysis.

What does training time signal about information architecture?

Training time reflects how much of a device's internal logic clinicians must hold in working memory to navigate it safely. When training takes weeks, a significant portion of that time is navigation memorisation rather than clinical skill development. The Outset Medical Tablo's under-four-hour training claim (vendor-sourced, pending independent verification) indicates a task architecture legible enough that familiarisation with the workflow is the primary training task. That is an architectural characteristic, not a pedagogical one.

When does a sequential confirmation step stop being a safety check?

When experienced users can complete it without engaging the clinical judgment it was designed to prompt. The AAMI comparison study found two of the Sigma Spectrum's 16 programming steps are non-actionable prompts that experienced users learn to dismiss without review. The interface retains the structure of a safety check; the behaviour that made it one has been eliminated by familiarity. Load-bearing safety steps require that completing them demands a clinical decision. Steps that can be cleared without one are navigational overhead.

What is the difference between task-oriented and task-anchored IA?

Task-oriented IA places primary functions on accessible screens and organises controls around key tasks; the Mindray SV800 and AK 98 both do this. Task-anchored IA goes further: each screen is defined by a specific clinical decision point, device state is invisible unless clinically relevant, and the task sequence is the organising principle rather than device capability. The distinction becomes operationally significant when feature additions occur. Task-oriented IA tends to add screens; task-anchored IA absorbs features into the existing decision sequence.

Why does the Sigma Spectrum version mismatch incident matter for IA analysis?

Because it exposes latent architectural risk rather than a software defect in the conventional sense. The FDA's documentation states that V6 and V8 hardware "include many differences in the clinical workflow and user interface" and that a trained user presented with the wrong version "may accidentally mis-programme the infusion" (FDA Early Alert, June 2025). The risk resided in the gap between two interface generations whose task-sequence logic had not been reconciled. A function-anchored IA, where capability layers are added independently, accumulates this gap; a task-anchored IA, organised around a stable clinical task sequence, is structurally less susceptible to it.

AAMI Biomedical Instrumentation and Technology. (2018). IV smart pumps and error-prone programming tasks: Comparison of four devices. Biomedical Instrumentation and Technology, 52(s2). https://array.aami.org/doi/10.2345/0899-8205-52.s2.2

AACN Advanced Critical Care. (2025, September 15). When technology meets practice: Infusion pump safety in the real world. AACN Advanced Critical Care. https://aacnjournals.org/aacnacconline

ECRI Institute and Institute for Safe Medication Practices. (2025, April). Implement strategies to prevent persistent medication errors and hazards. ECRI. https://www.ecri.org/components/hrc/pages/ther27.aspx

Food and Drug Administration. (2025, June). Early alert: Baxter Sigma Spectrum infusion pumps, V6 and V8 software version mismatch. Center for Devices and Radiological Health. https://www.fda.gov/medical-devices/medical-device-recalls/baxter-issues-voluntary-recall-sigma-spectrum-infusion-pump

Food and Drug Administration. (2010). Infusion pump improvement initiative [White Paper]. Center for Devices and Radiological Health. https://www.fda.gov/media/79653/download

Giuliano, K. K., and Niemi, C. (2015). The urgent need for innovation in IV smart pumps. Nursing Management, 46(2), 16-18. https://pmc.ncbi.nlm.nih.gov/articles/PMC4924428/

Joint Commission. (2013). Sentinel event alert issue 50: Medical device alarm safety in hospitals. https://www.jointcommission.org/resources/sentinel-event/sentinel-event-alert-newsletters/sentinel-event-alert-issue-50-medical-device-alarm-safety-in-hospitals/

Outset Medical. (2025). Tablo hemodialysis system: Clinical evidence. https://www.outsetmedical.com/clinical-evidence

PMC. (2024, November). Evaluating the impact of smart infusion pump interoperability on reducing medication administration errors: A systematic review. https://pmc.ncbi.nlm.nih.gov/articles/PMC11691665/

Prewitt, J., et al. (2023). Impact of smart pump technology on medication safety. Cited in Medication Safety Practices with Smart Infusion Pumps (PMC, 2023). https://pmc.ncbi.nlm.nih.gov/articles/PMC9907867/