Measured Behaviour
Published
A patient who has made anti-K must receive K-negative red cells. The check is an intersection: the antibodies on the patient's record against the antigens on the unit's typing record, and the unit is acceptable when nothing is in both. An intersection is symmetric, which sounds like a safety property and is the opposite of one.
Two ways to ask the same question
The companion article in this pass measures ABO compatibility, which is a nested table: the recipient selects a row, the donor selects a cell, and because a missing row and a missing cell reach different fallbacks the two parties fail in opposite directions.
Antigen matching asks the same clinical question about the same two records and implements it completely differently. There is no table. There is a list of specificities the patient has made antibodies against, a list of antigens the unit types positive for, and a test for overlap.
An intersection is symmetric in its implementation as well as in its domain, and that is the problem rather than the reassurance. An intersection with an unreadable set is EMPTY. Empty means no overlap. No overlap means the unit is acceptable - not unknown, not deferred, acceptable, and reported as such. The whole control is built on POSITIVE EVIDENCE OF A HAZARD: a named antibody on one side and a named antigen on the other. Remove either the hazard or the evidence for it and there is no hazard left to find.
What we built and what the correct run says
Seven patients on one haematology service. One with no antibodies. One with anti-K. One with anti-Jka. One with anti-Fya and anti-S. One with anti-Lea, which is a real, detectable, correctly reported antibody that does not destroy red cells at body temperature and is not a reason to refuse a unit. One sickle-cell patient with no antibody yet, flagged for prophylactic Rh matching, which is the point: the alternative is to wait until they have made one. And one patient whose anti-Jkb was identified two years ago and is no longer detectable.
That last patient is why the historical record exists. Kidd antibodies are notorious for falling below the detection threshold and then causing a delayed haemolytic reaction when the antigen is met again. An antibody that cannot be detected has not gone away.
Eight typed units and one that nobody has typed beyond ABO and D. Fourteen proposed selections. The correct run selects eight and holds six: four antigen conflicts, one prophylactic phenotype mismatch, and the untyped unit. The price counter - transfusions that put an implicated antigen into a patient who has an antibody against it - reads zero.
A prediction that failed, and the failure is the finding
We pre-registered a prediction before measuring: because an intersection is symmetric, both of its parties should fail the SAME way, and that way should be open.
Removing the patient's ANTIBODY LIST did exactly that. SELECTED went from 8 to 11 and the price counter from 0 to three exposures: anti-K met K, anti-Jka met Jka, anti-S met S. Every line of the report says no conflict, because there was no conflict to find.
Removing the unit's ANTIGEN LIST did not. SELECTED went to ZERO and every one of the fourteen selections was held. The prediction was wrong, and the reason it was wrong is the most useful thing in this area.
An empty antigen list and an unreadable one are the same thing to an intersection - both produce no overlap. What separated them was a completely different check standing in front: the service requires a unit to have antigen typing on record before it can be called antigen-negative. Losing the antigen field made every unit read as UNTYPED, and untyped units are refused. The intersection did fail open. A second control caught it.
The one key that separates tested from untested
So we removed that second control as well, and the two together.
The typing requirement alone is mild: SELECTED 9, price counter still zero, because the antibody lists were all still readable and did their work. It reads like a cosmetic finding.
The typing requirement AND the antigen list together produced the worst result in the area: SELECTED 13 of 14, HELD 1, and FOUR antigen exposures. Every implicated antigen in the fixture went into the patient with an antibody against it, plus the untyped unit for good measure.
That is worth stating plainly, because it is the practical form of the whole finding. An antigen-NEGATIVE unit is defined by something not being there. A unit that was tested and found K-negative and a unit nobody has tested both have no K on the record. The only thing in the system that knows the difference is the requirement that typing exists at all - and it is one boolean, sitting on the same options object as everything else, reachable by the same pattern.
The boolean that carries two years of history
The single most consequential name in this area for its size is the flag that decides whether a historically identified specificity is still a requirement.
Removing it took SELECTED from 8 to 9 and the price counter from 0 to one exposure. One. It is the smallest non-zero number in the pass and it is a patient meeting the Kidd antigen their immune system has already been primed against, on a unit the report describes as having no conflict, because by the standard of the current screen there is none.
Nothing else in the fixture changed. The patient's record still lists the historical specificity; it is printed in the panel line in every arm. What moved is whether the selection engine consults it.
For contrast, the significance list moved things the other way. Removing it made every specificity count as clinically significant, which sounds conservative and is: SELECTED went to 7, the price counter stayed at zero, and a perfectly good unit was refused because the patient has anti-Lea. That is a stock problem rather than a safety problem, and stock problems in a transfusion service are not nothing - but they are visible.
What this means if you protect a laboratory system
The mechanics are the same as the rest of this series. Renaming is a claim about which names in your bundle are yours to move, and the fields on records an installed library reads are not yours in the sense that matters. Scope the member pattern, or use a named set to keep the boundary explicit.
What this area contributes is a design rule that costs nothing and does not depend on obfuscation at all. When a control is built on positive evidence of a hazard, losing the evidence removes the hazard, and the loss can come from a rename, a partial response, a serialisation hop that drops empty arrays, or a hand-written test double. Make the ABSENCE of evidence distinguishable from evidence of absence, and make the indistinguishable case a refusal.
In this fixture that is exactly what the typing requirement does, and it is why removing the antigen list alone failed closed rather than open. It is also why a review that closed the typing requirement as a cosmetic finding - it moved one number and exposed nobody - would have left the system one rename away from its worst outcome.
Finally, build the fixture with the antibodies in it. Our negative control is the same service on a day when every screen is negative and every unit is fully typed. There is nothing to intersect, so there is nothing to get wrong, and it is blind by construction to every arm above.
Frequently asked questions
How does obfuscation affect antigen-negative unit selection?
The check is an intersection between the antibodies on the patient record and the antigens on the unit's typing record. If a renaming pattern reaches either list, the intersection is empty, and empty means no conflict. In our fixture removing the antibody list produced three antigen exposures with every line of the report reading no conflict.
Why is a symmetric check more dangerous than an asymmetric one?
Because both of its parties fail the same way, and that way is open. A nested table gives its two parties different fallbacks, so one of them fails loudly. An intersection has no such asymmetry: losing either set produces no overlap, which is the answer that permits the unit.
Is an untyped unit the same as an antigen-negative unit?
Not clinically, and identical on the record - both have no antigen listed. The only thing that separates them is a requirement that antigen typing exists at all. In our measurement, removing that requirement together with the antigen list selected thirteen of fourteen units and produced four antigen exposures.
What is the risk to historical antibodies specifically?
An antibody that has fallen below the detection threshold has not gone away, and Kidd antibodies are known for exactly that. The flag that decides whether a historically identified specificity is still a requirement is one boolean. Removing it in our fixture produced one exposure, on a unit the report described as having no conflict.
Can this fail in the safe direction too?
Yes, and it did. Removing the list of clinically significant specificities made every antibody count, including anti-Lea, which does not destroy red cells at body temperature. That refused a good unit and exposed nobody - a stock problem rather than a safety one, and a visible one.
Which finding would a reviewer most likely dismiss?
The antigen typing requirement on its own. It moved one number, exposed nobody, and reads as cosmetic. It is also the only thing standing between the antigen list and the worst outcome in the area, which is what makes it worth keeping rather than closing.
What design change helps regardless of obfuscation?
Make the absence of evidence distinguishable from evidence of absence, and make the indistinguishable case a refusal. A partial response, a serialisation hop that drops empty arrays and a hand-written test double all produce an unreadable set the same way a rename does.
Related reading