Princess of Wales Hospital blood glucometer case
Harold Thimbleby
10 September 2025
Version 3 uses blue to highlight the impact of critical new evidence introduced by the Abbott engineer. Only one node was explicitly highlighted blue, but the REED tool is used to automatically cascade the blue highlight to all affected evidence.
v2
The PrecisionWeb data records XceedPro serial numbers, and shows that XceedPros routinely move around the hospital.
\warn{The PrecisionWeb data confirms that the police seized all three XceedPros that happened to be on Ward 2 on the date when they visited it. However, the seizure did not include any XceedPros that had been used by the defendants at the relevant times.}
\warn{In addition to mistakenly seizing the wrong XceedPros, the police sent them to Abbott (node [[[to:17]]]) to be checked for reliability. Abbott unsurprisingly confirmed the XceedPros worked correctly --- it would have been better to chose an independent organization to check the XceedPros.}
\warn{Furthermore, Abbott's evidence says nothing about the reliability of the XceedPros \emph{actually\/} used by the nurses. Checking the wrong XceedPros is irrelevant to the Prosecution's contention that the nurses fabricated meter readings.}
<latex>Reference \cite{POW} explains how the police came to seize the wrong XceedPros.
<html>The <a href="https://harold.thimbleby.net/reeds">REED paper</a> explains how the police came to seize the wrong XceedPros.
2
v2
v2
v2
The patients on Ward 2 had limited capacity.
1
v2
A blood sample from a patient enters an XceedPro.
v2
The defendant nurses were named, and provided witness statements.
1
v2
v2
A nurse uses an XceedPro to take a sample from a specific patient, and the XceedPro records the nurse's and the patient's IDs.
v2
v2
The US company Abbott manufactured the XceedPros and the PrecisionWeb database, both critical components of this case.
The police sent the 3 seized XceedPros to Abbott to determine if they worked correctly. It is surprising the police chose Abbott themselves to check the XceedPros, as Abbott have a vested interest in saying their own products are reliable. Moreover, the police sent the wrong XceedPros to Abbott, as they had seized the glucometers on the ward when they visited, not the glucometers that the nurses had originally used.
The Abbott labs found no relevant problems with the XceedPros, but they did confirm that all XceedPros had bugs.
However, none of the bugs Abbott described would affect or cause loss of data, unless the XceedPros had been used to try to record over 2,500 tests, which is considerably higher than any XceedPro at the Princess of Wales had ever recorded (at least as established by the police's PrecisionWeb evidence).
2
v2
v3
\warn{Mr\@. Nick Reece, a PrecisionWeb support Specialist employed by Abbott Diabetes Care, had been asked by the hospital to help when the Princess of Wales PrecisionWeb database faced problems in 2013. Mr.\ Reece then worked unsupervised on the PrecisionWeb database, apparently taking no notes and certainly not following any forensic process.}
Reece gave evidence that he had failed to take notes on exactly what he did when editing, deleting, and modifying data in the PrecisionWeb database. He admitted he had deleted critical data, which would have created the impression that nurses had been negligent not performing blood glucose tests.
\warn{This deletion of computer evidence explains the discrepancy in patient records that the prosecution claims had been wholly and entirely caused by the nurses' criminal negligence.}
1
v3
v2
Ward networks may have had outages during the relevant period. The prosecution should supply network logs to confirm relevant ward networks had no outages over the relevant period.
1
v2
v2
The nurse takes an XceedPro to a patient, and they must then tap the XceedPro with their ID card, then scan the patient's ID card. Then the patient is pricked to obtain a small blood sample, which is inserted into the XceedPro. The XceedPro records the IDs, the date and time, and the blood glucose level. Nurses may share ID cards, or they may ``double tap'' and use their ID card twice instead of using the patient's ID card.
See node [[[from:17]]]: \warn{Manufacturer evidence says XceedPros have numerous bugs; however none of the documented bugs lose patient data.}
1
v2
The XceedPros provide date, time, XceedPro ID, nurse ID, patient ID, blood glucose level, etc.
v2
\warn{The Ward PCs can be used by nurses to review the PrecisionWeb database.
Beyond that there is no evidence to explain what else these PCs can do.}
Can they be used to edit or delete existing records on PrecisionWeb? We don't know.
1
v2
v2
\warn{Because of the problems noted under node [[[from:16]]], this evidence was excluded.}
2
v2
\warn{The operators manual for PrecisionWeb says it \textbf{should not be used for clinical purposes}. All the evidence for this case assumed the clinical records in PrecisionWeb were reliable, despite the manufacturer's warning.}
1
v2
v2
Written evidence shows that there have been unmanaged manual edits and manual maintenance of the PrecisionWeb database.
The impact of these edits on the case is as yet unknown.
\warn{If the technicians or engineers (potentially including Abbott maintenance staff) responsible for managing PrecisionWeb do not provide further more specific evidence, we will have no idea what they did to the database, potentially corrupting or deleting critical data it records that is likely to be relevant to the case.}
1
v2
v2
\warn{No evidence of the reliability of the XceedPro dock (for example, hospital test results, or manufacturer claims of reliability, or even daily checks of integrity) has been offered. Its reliable use depends on hospital network reliability, and no evidence of the reliability of the hospital network has been offered.}
1
v2
Should be identical to the XceedPro data from [[[from:4]]] via arrow C plus a timestamp of upload.
v2
The ward has PCs where nurses can review patient information.
\warn{It is not clear whether nurses can edit data, for instance in case two patients were mixed up with the XceedPros (e.g., by putting the wrong test strip in or using one with a second patient) --- and if so, whether edits must be done by the nurse (or person with the same ID) who originally took the readings.}
\warn{We do not know who had access to the Ward PCs (whether nurses or hospital operators).}
1
v2
v2
v2
The police examined the wrong XceedPros. The evidence presented on XceedPros is not relevant to the case.
2
v2
\warn{We have no idea what the hospital computer system operators did, how they were managed, or what their security protocols (if any) were.}
Note how (using Statechart conventions for diagrams) a \emph{single\/} arrow from this node ([[[here: 13]]]) to the group [[[to:hospital]]] is sufficient to show that the computer operators affect \emph{all\/} nodes inside the box.\footnote{Statecharts, invented by David Harel, are well-known diagrams widely used in computer science.}
1
v2
v2
v2
PrecisionWeb is a proprietary database designed by Abbott Diabetes Care Inc.\ to monitor the XceedPros, such as the state of their battery health. The PrecisionWeb database also records date and time, and nurse IDs, patient IDs, blood glucose levels, etc.
The PrecisionWeb manual warns that it is not designed for clinical use. Nevertheless the Princess of Wales hospital used PrecisionWeb for clinical purposes. At the Princess of Wales the blood glucose readings (amongst other data) are copied, via middleware (node [[[to:8]]]) to the main hospital databases.
<html><p/><both>
\warn{If the manufacturers say it is not reliable enough for clinical use, why is PrecisionWeb assumed good enough for evidence?}
<html><p/><b><both>
\warn{The prosecutors must therefore establish that PrecisionWeb \emph{and its sources of data\/} are maintained and used to an appropriate standard to ensure it provides reliable evidence. They should also state what they do to overcome the manufacturer's explicit warnings about its quality.}
<html></b></both>
1
v2
v2
v2
The police manually exported a CSV file from the PrecisionWeb database (supposedly) of every record derived from all XceedPros in the hospital over the relevant period of time. This was then copied to a USB stick and taken by car to be copied to the police system, from where multiple CDs were made for copying to the prosecution and defence. \warn{CSV is a non-forensic and very unreliable data format, and the police made no use of checksums or other techniques to assure that the final CDs correctly held the data from PrecisionWeb.}
v2
v2
\warn{The police visited the hospital and exported CSV data from the hospital's PrecisionWeb database to an unencrypted USB stick, a process that is insecure.}
Although there were opportunities for the police to collect incorrect or incomplete evidence, or to corrupt the evidence that they had collected, there is no nothing to suggest that the police checked their final computer evidence against the original hospital sources. The police process took no precautions to detect or mitigate the effect of possible cyberattack (or other database problems, such as hardware faults, system crashes --- which were known to occur --- or operator error), such as comparing their collected data with backups.
Although the police used Excel to manage the evidence (which can delete data, columns and rows, etc, without leaving any record of changes) there is no record to show that they checked their final evidence against the original data.
\warn{The final evidence was presented to the court on both encrypted CDs and USB sticks \emph{and was explicitly claimed to be forensic quality evidence}.}
1
v2
v2
\warn{Evidence revealed in court was that the PrecisionWeb database (or the server it ran on) frequently crashed. The evidence said nothing about the impact of crashes on the integrity of the database; presumably at least the transactions pending when crashes happened would be lost.}
1
v2
PrecisionWeb (node [[[from: 7]]]) is not interoperable with other hospital systems, so middleware Conworx is used to interface PrecisionWeb to the main patient databases.
\warn{No evidence of the reliability of Conworx and other middleware (for example, hospital test results, or manufacturer claims of reliability) has been mentioned in evidence.}
\warn{The hospital refused access to technicians, which meant we have no idea of or the extent of the middleware or how it is supposed to work.}
\warn{Such complex multi-manufacturer systems will have bugs, so it is very surprising not to have error logs (etc) presented in routine statements.}
1
v2
v2
v2
\warn{The police used PrecisionWeb unsupervised, exported data to CSV format.}\footnote{Hospital policy has since been revised.}
The police certainly examined the PrecisionWeb data in Excel, as their written evidence says their first attempts crashed Excel (presumably because of the size of the Excel spreadsheet). I do not understand why the police did not use SQL (or any other decent database), as they could simply have copied the SQL PrecisionWeb database rather than relying on PrecisionWeb to convert it to CSV\@.
\warn{CSV is a \emph{very\/} unsuitable data format to choose for evidence, as there is no way to detect edited, deleted, or inserted data.}
Whatever CSV data they selected, they copied to a USB stick. This stick was then taken by car to a police forensic environment, and copied to an encrypted secure disk drive. Subsequently, unencrypted CDs were burned from the files on the secure disc.
The police evidence claimed their process was forensic --- but it was only forensic \emph{after\/} copying CSV data to the secure disk drive, and provided that no police staff with password access modified the data.
1
v2
Should be a collection of all data starting at [[[from:4]]] (it wasn't; see figure 7 in the REED paper for the reasons) but crucially the police evidence was incomplete since it provided no way to check consistency with the data from [[[from:4]]].
v2
\warn{The hospital presented no evidence that it knew that any of its systems were reliable. However, the hospital did present evidence that PrecisionWeb regularly crashes (node [[[from:10]]]).}
1
v2
v2
The hospital databases are managed by hospital technicians. None provided evidence statements, and none were called to give evidence.
\warn{Such complex systems will have bugs, so it is very surprising not to have error logs (etc) presented in routine statements.}
\warn{It is curious that the discrepancies were originally discovered from the main hospital databases, not from PrecisionWeb. The police never took evidence from the main hospital databases.}
1
v2
v2
v2
v2
\warn{A joint prosecution/defence expert witness report (``Experts' Joint Statement on Matters Agreed and/or Disagreed in regard to Part 35 12 (3) CPR'') lists many problems, including that the CDs CH/15 the police provided to the prosecution and defence experts were different, raising serious questions of police forensic process
<html> (see <a href="https://www.harold.thimbleby.net/glucometry-records">Archived Princess of Wales glucometer documents and notes, 2024</a>).
<latex>\cite{POW-resources}.<both>}
Refer to node [[[from:11]]].
1
v2
\warn{It is astonishing there is no evidence that the hospital ever checked whether their computer systems were functioning normally.}
\warn{It is also astonishing the police recorded data from hospital systems without confirming the reliability of the data, and did so without hospital supervision.}
1
v2
If backups had been taken (we do not know) then it would have been natural to check if the alleged missing nurse data had ever been stored on the main PrecisionWeb database.
Backups would have shown whether failures happened in PrecisionWeb, or earlier for instance over arrows A (as the prosecution argued), B, C or D.
1
v2
The hospital should have audited or kept logs on PrecisionWeb. There is no evidence (yet) that it did.
1
v2
Contemporaneously with treating patients, nurses should review the XceedPro they have used and copy its data to paper notes. The police never provided the nurse-written records.
\warn{The XceedPro can record up to 2,500 patient records and then it will start overwriting records. As I never had access to the relevant XceedPros, I do not know whether this bug was relevant: had an XceedPro recorded about 2,500 records it \emph{could\/} have given the impression the nurse had not performed tests the nurse had documented on paper notes.}
1
v2
\warn{We know nothing about the management of the hospital systems and any impact on the evidence.} \warn{In a hospital (or any other critical environment) one would expect at least daily checks of reliable performance or error logs. The REED diagram shows there were no such checks.}
1
v2