Court Opinion

ID: 9297588
Source: CourtListenerOpinion
Date Created: 2022-11-30 21:00:53.14547+00
Date Added: 2024-06-11T17:13:28.730497
License: Public Domain

USCA4 Appeal: 20-2270     Doc: 48         Filed: 11/29/2022   Pg: 1 of 35

                                            UNPUBLISHED

                              UNITED STATES COURT OF APPEALS
                                  FOR THE FOURTH CIRCUIT

                                              No. 20-2270

        RUBY L. LOWE, Power of Attorney for Michael A. Taylor, disabled,

                            Plaintiff - Appellant,

                     v.

        CERNER CORPORATION,

                            Defendant - Appellee.

        Appeal from the United States District Court for the Eastern District of Virginia, at
        Alexandria. Claude M. Hilton, Senior District Judge. (1:19−cv−00625−CMH−TCB)

        Argued: September 13, 2022                               Decided: November 29, 2022

        Before WILKINSON, Circuit Judge, and KEENAN and MOTZ, Senior Circuit Judges.

        Vacated and remanded by unpublished opinion. Senior Judge Keenan wrote the majority
        opinion, in which Senior Judge Motz joined. Judge Wilkinson wrote a dissenting opinion.

        ARGUED: Mikhael D. Charnoff, PERRY CHARNOFF PLLC, Arlington, Virginia, for
        Appellant. David Brent Dwerlkotte, SHOOK, HARDY & BACON, L.L.P., Kansas City,
        Missouri, for Appellee. ON BRIEF: Scott M. Perry, PERRY CHARNOFF PLLC,
        Arlington, Virginia, for Appellant. Amy M. Crouch, SHOOK, HARDY & BACON L.L.P.,
        Kansas City, Missouri; Roman Lifson, Belinda D. Jones, CHRISTIAN & BARTON,
        L.L.P., Richmond, Virginia, for Appellee.
USCA4 Appeal: 20-2270      Doc: 48         Filed: 11/29/2022    Pg: 2 of 35

        Unpublished opinions are not binding precedent in this circuit.

                                                    2
USCA4 Appeal: 20-2270      Doc: 48         Filed: 11/29/2022     Pg: 3 of 35

        BARBARA MILANO KEENAN, Senior Circuit Judge:

               In this product liability negligence action, Ruby L. Lowe, on behalf of her injured

        grandson Michael A. Taylor, filed suit against Cerner Health Services, Inc. (Cerner), the

        developer and seller of a software system used for entry of medical orders for patient care.

        Cerner sold its software system to the Virginia Hospital Center (VHC, or the hospital),

        where Taylor was a patient.       Taylor suffered brain damage and resulting physical

        impairments at VHC after failing to receive “continuous pulse oximetry” as intended by

        his physician, who had entered an order for that care into the Cerner system used by VHC.

               Lowe asserted negligence claims against Cerner under Virginia law, alleging that

        the Cerner software was negligently designed (the negligent design claim), and that Cerner

        negligently failed to warn system users of those design defects (the failure to warn claim).

        Lowe asserted that Cerner’s negligent acts caused the failure to properly monitor Taylor’s

        oxygen level, and that proper monitoring would have prevented Taylor’s injuries. The

        district court awarded summary judgment to Cerner.

               Upon our review, we hold that the district court erred in awarding summary

        judgment to Cerner on both claims. On the record before us, a jury reasonably could

        conclude that Cerner’s software contained two design defects that did not comply with

        industry standards or satisfy reasonable consumer expectations. We also hold that the

        district court misstated Virginia law on proximate causation, which provides that there can

        be more than one cause of an injury and, contrary to the court’s holding, did not require

        Lowe to eliminate other causes of the injury. Lowe presented sufficient evidence for a jury

        to conclude that the software defects were a proximate cause of Taylor’s injuries. We also

                                                     3
USCA4 Appeal: 20-2270      Doc: 48         Filed: 11/29/2022      Pg: 4 of 35

        hold that the court erred in awarding summary judgment to Cerner on Lowe’s failure to

        warn claim. That evidence likewise was sufficient for a jury to conclude that Cerner failed

        to warn users about the software design defects and that Cerner’s failure to do so was a

        proximate cause of Taylor’s injuries. We therefore vacate the district court’s judgment and

        remand the case for trial on both claims.

                                                     I.

               We recite the facts, and reasonable inferences that can be drawn from those facts,

        in the light most favorable to Lowe as the nonmoving party. Betton v. Belue, 942 F.3d 184,

        191 (4th Cir. 2019). On April 5, 2016, Dr. Alexandria Booth performed surgery on 25-

        year-old Taylor to remove his gall bladder. Because Taylor suffered from sleep apnea and

        other medical conditions, Dr. Booth intended that Taylor receive “continuous pulse

        oximetry” as he recovered from surgery. 1 Pulse oximetry measures a patient’s oxygen

        level in the blood, and typically is measured by placing a monitoring device on the patient’s

        finger. When a patient’s oxygen level is monitored continuously, an alarm sounds when

        the patient’s oxygen level falls below a certain percentage. The alarm alerts hospital staff

        and wakes the patient so that the situation can be addressed before injury occurs.

               After Taylor’s surgery, Dr. Booth entered an order for “continuous pulse oximetry”

        into the health record software developed by Cerner and used at VHC. Dr. Booth intended

               Taylor’s anesthesiologist also intended that Taylor have continuous pulse oximetry
               1

        monitoring and issued a “postoperative evaluation” regarding Taylor and included a
        handwritten note: “Admit to floor w/ continuous pulse oximetry. [staff] notified.” Dr.
        Booth explained that “either [this handwritten] order wasn’t conveyed or it was ignored.”

                                                     4
USCA4 Appeal: 20-2270      Doc: 48          Filed: 11/29/2022        Pg: 5 of 35

        that this order be effective from the time she entered the order, at 4:34 p.m. on April 5,

        2016, until Taylor’s expected discharge from the hospital on April 6, 2016. As explained

        in more detail below, the order for continuous pulse oximetry did not take effect until 10:00

        a.m. on April 6, 2016. Thus, Taylor was not provided continuous oxygen monitoring

        during the night of, or in the morning after, his surgery.

               At 5:01 a.m. on April 6, 2016, the hospital nursing staff checked Taylor’s vital signs,

        which were normal. Pursuant to hospital guidance, another check of Taylor’s vital signs

        should have occurred around 9:00 a.m., but did not. Around 10:30 a.m., Dr. Booth found

        Taylor unresponsive and in respiratory distress. Taylor suffered a “respiratory arrest,”

        which caused “hypoxia,” a deficiency of oxygen reaching the tissues of the body, and brain

        damage. As a result, Taylor cannot walk, bathe, or use the bathroom independently. The

        parties do not dispute that if Taylor’s oxygen level had been monitored continuously, his

        resulting hypoxia and brain damage would not have occurred.

               Taylor’s grandmother, Lowe, filed an action alleging medical malpractice against

        Dr. Booth’s employer and VHC. The parties to that action later entered into a settlement

        agreement. Lowe also filed the present action against Cerner, seeking $50 million in

        damages. 2 Lowe alleged that there were two design defects in Cerner’s electronic ordering

        software, and that Cerner failed to warn users of those defects. Lowe asserted that these

        defects, and Cerner’s failure to warn users of its product of those defects, caused Dr. Booth

               2
                 Lowe initially filed suit in a Virginia circuit court, and Cerner removed the suit to
        federal district court under that court’s diversity jurisdiction.

                                                      5
USCA4 Appeal: 20-2270       Doc: 48          Filed: 11/29/2022      Pg: 6 of 35

        inadvertently to enter the continuous pulse oximetry order as beginning at 10:00 a.m. the

        day after Taylor’s surgery, instead of immediately after the surgery.

               As alleged by Lowe, the first defect relevant to this appeal related to the software’s

        “order entry screen,” on which a physician enters specific information about the medical

        care that the hospital staff is required to administer to the patient. On the order entry screen,

        the “start time” for these orders appeared automatically as the date and time of entry. The

        order entry screen also contained drop-down menus to direct the frequency and recurrence

        of the particular care directed. For the frequency, Dr. Booth chose “daily,” and for the

        recurrence, she selected “once.” Unbeknownst to Dr. Booth, her selection of “once”

        triggered an automatic start time of 10:00 a.m. that VHC had implemented based on when

        its pharmacy filled medication orders. Despite this 10:00 a.m. start time, however, the

        order entry screen continued to display the start time for continuous pulse oximetry as April

        5, 2016, at 4:34 p.m. This feature was “hardcoded” into the software developed by Cerner,

        meaning that VHC could not alter the order entry screen’s start time display.

               After inputting the above instructions on the order entry screen, Dr.

        Booth next selected “add to order session,” which electronically moved those orders to the

        “unsigned orders list.” The unsigned orders list contained the second, related design defect

        alleged by Lowe.

               The unsigned orders list displayed all the orders entered by a physician, and

        Cerner’s software required that the physician approve the list before those orders would

        take effect. The last of the 30 orders entered by Dr. Booth for Taylor’s care appeared on

        the list as “Pulse oximetry: Continuous Once As Ordered; start on 4/6/2016 at 10:00.”

                                                       6
USCA4 Appeal: 20-2270      Doc: 48          Filed: 11/29/2022     Pg: 7 of 35

        However, the unsigned orders list contained detailed information for each order in a

        “stacked” format, displaying the details of only the first few orders. Thus, a physician was

        required to scroll across “multiple computer screens” to review the details of each order.

        If the physician did not review the details of each order, she nevertheless could

        electronically sign, or approve, all the pending orders as a group.

               Dr. Booth stated that she did not see the 10:00 a.m. start time for the pulse oximetry

        order on the unsigned orders list, and instead relied on the start time shown on the order

        entry screen. According to Dr. Booth, she did not expect the start time for the continuous

        pulse oximetry order to “change[]” between the order entry screen and the unsigned orders

        list. Therefore, Dr. Booth electronically accepted all the orders, including the continuous

        pulse oximetry with the improper 10:00 a.m. start time.

               Dr. Booth had practiced medicine as a surgeon for 16 years, and had been using

        Cerner’s software at VHC for several years. Dr. Booth also stated that she had used a

        different software program at another medical center and had not encountered the same

        start time problem at that other location.

               After Lowe filed suit against Cerner, the parties engaged in extensive discovery.

        Cerner later moved for summary judgment, and Lowe moved for partial summary

        judgment seeking to prevent Cerner from asserting at trial that any third-party’s conduct

        was the sole or superseding cause of Taylor’s injuries. Lowe submitted for the court’s

        consideration testimony and reports from several expert witnesses, including the deposition

        testimony of Taylor’s surgeon, Dr. Booth. Lowe also presented testimony and reports

        prepared by two of her designated expert witnesses in the field of use of electronic health

                                                     7
USCA4 Appeal: 20-2270      Doc: 48         Filed: 11/29/2022      Pg: 8 of 35

        records: Ross Koppel, Ph.D., a professor of biomedical informatics, and Peter Elkin, M.D.,

        a board-certified physician in clinical informatics and professor of biomedical informatics.

        Both Lowe and Cerner also filed several Daubert motions and other motions in limine.

               Without ruling on the parties’ evidentiary motions, the district court granted

        Cerner’s motion for summary judgment and summarily denied Lowe’s motion for partial

        summary judgment. Lowe later filed the present appeal.

                                                     II.

               We review de novo the district court’s decision granting summary judgment. RXD

        Media, LLC v. IP Application Dev. LLC, 986 F.3d 361, 372 (4th Cir. 2021). Summary

        judgment is appropriate only “if the movant shows that there is no genuine dispute as to

        any material fact and the movant is entitled to judgment as a matter of law.” Fed. R. Civ.

        P. 56(a). Summary judgment may not be granted “merely because the court believes that

        the movant will prevail if the action is tried on the merits.” Jacobs v. N.C. Admin. Off. of

        the Courts, 780 F.3d 562, 568 (4th Cir. 2015) (citation omitted).

               The district court may grant summary judgment only if it concludes that the

        evidence would not permit a jury to return a verdict in favor of the nonmoving party.

        Variety Stores, Inc. v. Wal-Mart Stores, Inc., 888 F.3d 651, 659 (4th Cir. 2018). In

        considering a motion for summary judgment, a court improperly weighs the evidence when

        it fails to credit contradictory evidence or fails to draw reasonable inferences in the light

        most favorable to the nonmoving party. Id. at 659-60 (citations omitted).

                                                     8
USCA4 Appeal: 20-2270      Doc: 48          Filed: 11/29/2022     Pg: 9 of 35

               The district court considered Lowe’s action under its diversity jurisdiction, and

        properly concluded that the substantive law of Virginia is controlling. See Volvo Const.

        Equip. N. Am., Inc. v. CLM Equip. Co., 386 F.3d 581, 599-600 (4th Cir. 2004). Under

        Virginia law, a plaintiff may seek recovery of damages for injuries cause by a defective

        product in accordance with common law principles of negligence. See Sardis v. Overhead

        Door Corp, 10 F.4th 268, 280 (4th Cir. 2021) (applying Virginia law). Under those

        principles, the plaintiff is required to establish that she suffered an injury caused by the

        defendant’s breach of a duty owed to the plaintiff. See Evans v. Nacco Mats. Handling

        Grp., Inc., 810 S.E.2d 462, 469 (Va. 2018) (explaining that plaintiff may proceed under

        theory of negligence in proving design defect); Dorman v. State Indus., Inc., 787 S.E.2d

        132, 139 (Va. 2016) (addressing causation in product liability action). In the present case,

        the parties do not dispute that Turner suffered an injury and, thus, we do not address further

        that element of the case.

               In a product liability claim brought under Virginia negligence law, a plaintiff must

        show that the product was unreasonably dangerous for a foreseeable use. 3 Sardis, 10 F.4th

        at 280 (citing Evans, 810 S.E.2d at 469). A product may be deemed “unreasonably

               3
                 A plaintiff must also show that the “dangerous condition existed when the goods
        left the defendant’s hands.” Evans v. Nacco Mats. Handling Grp., 810 S.E.2d 462, 469
        (Va. 2018) (quoting Featherall v. Firestone Tire & Rubber Co., 252 S.E.2d 358, 367
        (1979)). Although the district court concluded that “most” of the alleged “defects” in
        Cerner’s software “were created through choices made by VHC,” the record shows that the
        start time display on the order entry screen and the ability to approve a group of orders
        without reviewing all the data for each order were features of the software incorporated by
        Cerner. Notably, Cerner does not defend the district court’s conclusion on this point.

                                                      9
USCA4 Appeal: 20-2270        Doc: 48        Filed: 11/29/2022     Pg: 10 of 35

        dangerous if it is defectively manufactured, defectively designed, or unaccompanied by

        adequate warnings” about the product’s dangerous qualities. Id. (quoting Morgen Indus.,

        Inc. v. Vaughan, 471 S.E.2d 489, 492 (Va. 1996)).

               In the present case, Lowe was required to present proof to satisfy the elements of

        each claim that she asserted, namely, the claims of negligent design and of failure to warn. 4

        With these general negligence principles in mind, we turn to consider each of Lowe’s

        claims.

                                                     A.
                                          Negligent Design Claim

                                         1. Duty and Breach of Duty

               To prevail on a negligent design claim, a plaintiff must show that the defendant has

        a legally recognized duty to design a product to ensure that it is “reasonably safe for the

        purpose for which it is intended.” Sardis, 10 F.4th at 280 (quoting Holiday Motor Corp.

        v. Walters, 790 S.E.2d 447, 454-55 (Va. 2016)); see Dorman, 787 S.E.2d at 139. This

        element of duty can be established by presenting evidence that the defendant’s product

        failed to satisfy:    (1) governmental safety standards, (2) industry standards, or (3)

        reasonable consumer expectations. Sardis, 10 F.4th at 280 (citing Evans, 810 S.E.2d at

        472). “If a plaintiff successfully establishes a duty to construct a product in a particular

               4
                 We observe that Lowe also asserted a general negligence claim, which the district
        court dismissed in its ruling on summary judgment. Because Lowe does not challenge that
        ruling on appeal, we do not address it.

                                                     10
USCA4 Appeal: 20-2270      Doc: 48         Filed: 11/29/2022     Pg: 11 of 35

        manner, the manufacturer breaches that duty if the product does not conform to that

        standard.” Id.

               The district court held that Lowe failed to identify an acceptable industry standard

        that imposed a duty on Cerner. The court rejected the standard relied on by Dr. Koppel,

        namely, the National Institute of Standards and Technology Internal or Interagency Report

        7804 (NIST 7804). The court reasoned that NIST 7804 was not part of the governmental

        safety standards set forth in the Health IT Certification Program promulgated by the Office

        of the National Coordinator of Health Information Technology (ONC), with which Cerner

        had complied. The court further reasoned that Dr. Koppel did not address the relationship

        between NIST 7804 and the ONC standard.

               Similarly, the court rejected the standard relied on by Dr. Elkin, namely, the

        Healthcare Information and Management Systems Society’s (HIMSS) usability standard

        for electronic health records. The court stated that Dr. Elkin failed to explain how HIMSS

        differed from the ONC’s safety standards and concluded that even if HIMSS adequately

        set forth an industry standard, Dr. Elkin did not explain how Cerner’s software violated the

        HIMSS standard. The court held that Cerner complied with the HIMSS standard by

        conducting its own safety and usability testing.

               Finally, the district court held that Dr. Koppel and Dr. Elkin “offer[ed] exactly the

        type of opinions rejected” by this Court in Alevromagiros v. Hechinger Co., 993 F.2d 417

        (4th Cir. 1993), because Lowe’s experts “generically argue[d]” that the software should

        have contained design features to make it safer, without explaining how the software design

        violated “prevailing safety standards.” The district court summarily concluded, without

                                                    11
USCA4 Appeal: 20-2270      Doc: 48         Filed: 11/29/2022     Pg: 12 of 35

        reference to any evidence in the record, that “[n]one of the features and functionality

        challenged” by Lowe were “unusual” and that “all are industry standard.”

               Additionally, the district court concluded that Lowe failed to present sufficient

        evidence to allow a jury to conclude that the software violated consumer expectations. The

        court held that Dr. Koppel and Dr. Elkin did not “suggest[]” that Cerner’s software violated

        consumer expectations.       The court also stated that Cerner “received no customer

        complaints similar to those raised here.”

               On appeal, Lowe argues that the district court erred in holding that she failed to

        present sufficient evidence to permit a jury to conclude that the software contained design

        defects.   According to Lowe, the court erroneously analyzed the industry standards

        identified by Dr. Koppel and Dr. Elkin by comparing those to the prevailing government

        standards set forth by ONC, when Lowe did not seek to establish a duty by relying on those

        governmental safety standards. Lowe submits that Dr. Koppel and Dr. Elkin identified

        acceptable industry standards that imposed a duty on Cerner to design its software free

        from the defects identified by Lowe. She also argues that evidence presented by Dr.

        Koppel and Dr. Booth was sufficient to permit a jury to conclude that Cerner’s software

        violated reasonable consumer expectations.

               Cerner, in response, does not defend the district court’s rationale that the industry

        standards identified by Dr. Koppel and Dr. Elkin were unacceptable because they were not

        part of ONC’s standards, or because those experts did not compare those safety standards

        with the proposed industry standards. Instead, Cerner contends that Lowe’s evidence

        showed only that the software violated “generic ‘industry standards,’” which were not

                                                     12
USCA4 Appeal: 20-2270      Doc: 48         Filed: 11/29/2022      Pg: 13 of 35

        specific enough to establish a standard of care. Relying on two court decisions, Holiday

        Motor Corp. v. Walters, 790 S.E.2d 447 (Va. 2016), and Alevromagiros v. Hechinger Co.,

        993 F.2d 417 (4th Cir. 1993), Cerner submits that the industry standards identified by Dr.

        Koppel and Dr. Elkin served only as generalized guidance and did not impose any duty on

        Cerner to design its software in a different manner.

               Cerner also contends that Lowe failed to put forth sufficient evidence to show that

        Cerner’s software violated reasonable consumer expectations. Although Dr. Koppel relied

        on literature describing recognized risks associated with the design of electronic record

        systems, and Dr. Booth addressed her expectations about the software, Cerner contends

        that this evidence described only “generic risks” associated with electronic health records.

        According to Cerner, Lowe failed to show that the software violated objective industry

        standards or reasonable consumer expectations and that, therefore, Cerner was entitled to

        judgment as a matter of law. We disagree with Cerner’s position.

               Initially, we agree with Lowe that the district court erred in rejecting as inadequate

        the industry standards relied upon by Dr. Koppel and Dr. Elkin because the experts did not

        explain why those standards were applicable even though they were not incorporated into

        the ONC government safety certification program. A defendant’s failure to comply with

        government safety standards is one of three alternative means by which a plaintiff may

        demonstrate a design defect. See Evans, 810 S.E.2d at 470. Lowe did not dispute that

        Cerner’s software had been certified by ONC as having “safety-enhanced design,” nor did

        Lowe rely on these standards as setting forth the alleged duty owed by Cerner. Therefore,

        we turn to address Lowe’s evidence of industry standards and consumer expectations.

                                                     13
USCA4 Appeal: 20-2270       Doc: 48          Filed: 11/29/2022      Pg: 14 of 35

                                             a. Industry Standards

               In his expert witness report, Dr. Koppel cited the NIST 7804 as a usability protocol

        widely recognized in “user-interface design” for software. NIST itself explains that this

        protocol “provide[s] detailed systematic steps for conducting validation studies . . . to help

        ensure that the application’s user interface is free from critical usability issues and supports

        error-free user interaction” with electronic health records.

               Dr. Koppel opined that Cerner’s software contained a “use-error root cause,” as

        defined by NIST 7804, including that the order entry screen contained “Inadequate

        Feedback About Automation.” Dr. Koppel explained that Cerner’s order entry screen

        failed to warn a physician that a start time other than the one displayed on the order entry

        screen had been selected by the software. And Dr. Koppel further explained that although

        the unsigned orders list could alert a physician about the altered start time, that list was

        “convoluted” and contrary to “all rule[s] of usability.” Dr. Koppel concluded that it was

        “an abrogation of design responsibility to create . . . an interface” in which 30 orders for a

        patient were “stack[ed]” and were “not visible without extensive scrolling.”

               In offering his expert opinion, Dr. Elkin relied upon a usability standard established

        by HIMSS, a non-profit organization dedicated to improving health care by assessing the

        best use of information technology and management systems. Contrary to the district

        court’s conclusion, Dr. Elkin explained how Cerner’s software violated HIMMS usability

        standards. Dr. Elkin identified one particularly relevant usability factor, the issue of

        “forgiveness.” Dr. Elkin opined that software fails to meet industry forgiveness standards

        when it does not provide cautionary information to users about their prospective or existing

                                                      14
USCA4 Appeal: 20-2270       Doc: 48          Filed: 11/29/2022      Pg: 15 of 35

        entries that would help prevent errors or enable those users to “recover from errors easily.”

        In view of these standards, Dr. Elkin identified at least two design defects: (1) the

        imposition of a default start time that differed from the order entry time; and (2) a system

        permitting a physician to approve numerous orders without reviewing them.

               Upon consideration of this expert witness evidence, we first observe that the

        standards identified and relied upon by Dr. Koppel and Dr. Elkin were more specific than

        the evidence discussed in Holiday Motor and Alevromagiros. In Holiday Motor, the

        Supreme Court of Virginia held that the plaintiffs’ expert witness failed to identify an

        applicable industry standard relating to the design of a “soft top latching system” to protect

        occupants of convertible automobiles “during [a] rollover crash.” 790 S.E.2d at 455, 457.

        The court held that the plaintiff’s expert witness instead merely relied on “a general

        engineering principle . . . applicable to all automobile components.” Id. at 457.

               In Alevromagiros, we affirmed a district court’s entry of a directed verdict at the

        close of the plaintiff’s evidence at trial in a product liability case alleging defective design

        of a ladder under Virginia law. 993 F.2d at 419-20, 421. We explained that the plaintiff’s

        only expert witness did not present sufficient testimony that the ladder was dangerous

        because he did not test the ladder to determine whether it “conformed to the published

        industry standards.” Id. at 421. We also observed that the expert witness improperly and

        subjectively opined that the ladder lacked certain safety features such as “triangular

        bracing,” which was not required by industry standards. Id. at 419, 421.

               In contrast to these decisions cited by Cerner, Dr. Koppel and Dr. Elkin did not rely

        solely on general software design principles but identified concrete usability standards

                                                      15
USCA4 Appeal: 20-2270      Doc: 48          Filed: 11/29/2022     Pg: 16 of 35

        recognized in the industry of electronic health records. 5 Both witnesses confirmed the

        applicability of these standards to the design of software for automated default start times

        for medical orders, and to the prevention of related errors by physicians using that software.

        Dr. Koppel and Dr. Elkin applied the NIST and HIMSS usability standards in examining

        Cerner’s electronic ordering software, and specifically considered the different features of

        the order entry screen and the unsigned orders list in concluding that they were defectively

        designed.

               Accordingly, we hold that the district court erred on the present summary judgment

        record in rejecting the industry standards relied upon by Dr. Koppel and Dr. Elkin. Those

        experts (1) articulated industry standards creating a duty on the part of Cerner to design its

        software to avoid the identified failures in its system, and (2) opined that Cerner violated

        those industry standards in designing the system. 6 See Variety Stores, 888 F.3d at 659.

                                          b. Consumer Expectations

               5
                This conclusion is not altered by Cerner’s additional reliance on Sardis. 10 F.4th
        at 287-88. In that case, we explained that the industry standard relied on by the expert
        witness was not applicable to the product at issue, and that the expert presented no
        additional objective analysis to support his conclusion that the product was defectively
        designed. Id.
               6
                Because the district court did not address Cerner’s Daubert motions, we consider
        Dr. Koppel’s and Dr. Elkin’s opinions as part of the record on appeal without expressing
        any opinion regarding the reliability or admissibility of their testimony. See Sedar v.
        Reston Town Ctr. Prop., LLC, 988 F.3d 756, 760 n.2 (4th Cir. 2021) (citing Daubert v.
        Merrell Dow Pharm, Inc., 509 U.S. 579 (1993)).

                                                     16
USCA4 Appeal: 20-2270      Doc: 48         Filed: 11/29/2022      Pg: 17 of 35

               We also hold that Lowe presented sufficient evidence for a jury to conclude that

        Cerner’s software contained design defects that violated “reasonable consumer

        expectations.”   Under Virginia law, reasonable consumer expectations are standards

        “deemed appropriate by society,” Redman v. John D. Brush & Co., 111 F.3d 1174, 1181

        (4th Cir. 1997) (applying Virginia law), and can be established by direct evidence,

        published literature, or industry practices regarding a safety standard expected by

        reasonable users of the product. Evans, 810 S.E.2d at 470; Alevromagiros, 993 F.2d at

        420. Thus, a consumer’s subjective expectation, standing alone, is not sufficient to

        establish a reasonable consumer expectation. Evans, 810 S.E.2d at 470 (“The subjective

        expectations of a single user, however, are not sufficient to establish the objective,

        reasonable expectations of consumers as a class.”); Redman, 111 F.3d at 1181.

               The record before us shows that Dr. Koppel cited several published articles that

        identified certain risks in the design and use of electronic health record software. He also

        addressed several published studies, including a particular study discussing the software in

        an electronic order entry system in which the selection of a “daily” dose of medication

        defaulted to an 8:00 a.m. start time, which, if ordered at 3:00 p.m., would cause an improper

        administration of that medication. Additionally, Dr. Koppel cited at least one complaint

        by a user of Cerner’s software in 2009, in which a physician’s orders “were circumvented

        by the software, resulting in orders that ‘defaulted to [the following] morning.’”

               Although Dr. Koppel did not ultimately opine that the literature and studies he relied

        on established a reasonable consumer expectation, the evidence he presented plainly was

        relevant to that inquiry. See Evans, 810 S.E.2d at 470. And, contrary to the district court’s

                                                     17
USCA4 Appeal: 20-2270      Doc: 48         Filed: 11/29/2022     Pg: 18 of 35

        conclusion that Cerner “received no customer complaints similar to those raised” in the

        present case, Dr. Koppel described at least one complaint of a similar nature received by

        Cerner in 2009.

               We also observe that Dr. Booth’s testimony buttressed Dr. Koppel’s evidence of

        consumer expectations. Dr. Booth had worked for many years using electronic ordering

        software and was familiar with a competitor’s ordering software used at another medical

        center. She testified that Cerner’s software worked differently than she expected and

        differently from her experience with the competitor’s software in its treatment of default

        start times. This evidence supplemented Dr. Koppel’s testimony regarding applicable

        design issues requiring notice of default start times. Thus, we hold that Lowe presented

        sufficient evidence at this stage of the proceedings to show that Cerner violated reasonable

        consumer expectations in the design of its software.

               We therefore hold that the district court erred in awarding summary judgment to

        Cerner on the elements of duty and breach of duty, given the evidence of industry standards

        and reasonable consumer expectations and of Cerner’s failure to design a system in accord

        with those standards. Thus, we turn to consider the final element of Lowe’s negligent

        design claim, namely, the element of proximate causation.

                                           2. Proximate Causation

               In awarding summary judgment to Cerner, the district court stated that the record

        showed “multiple possible causes” of Taylor’s injuries, demonstrated in part by Taylor’s

        settlement agreement with VHC and Dr. Booth’s employer.             Adopting the position

        advanced by Cerner, the district court held that Lowe’s expert witnesses, Dr. Koppel and

                                                    18
USCA4 Appeal: 20-2270       Doc: 48          Filed: 11/29/2022      Pg: 19 of 35

        Dr. Elkin, “failed to take serious account of, or to rule out, VHC, Dr. Booth, or the nursing

        staff as potential causes” of Taylor’s harm. The court held that this failure was “fatal” to

        Lowe’s claims of negligence, and that Lowe did not establish with “reasonable certainty”

        that Taylor’s injuries were caused by Cerner’s negligently designed software.

               Lowe contends that the district court erred in this application of Virginia negligence

        law on proximate causation, and in concluding that Lowe failed to present sufficient

        evidence to present a jury question on that issue. In particular, Lowe asserts that the district

        court erred in holding that her expert witnesses, Dr. Koppel and Dr. Elkin, were required

        to “rule out” the negligent actions of other tortfeasors as causes of Taylor’s injuries. Lowe

        submits that contrary to the district court’s holding, Virginia law provides that multiple

        proximate causes may contribute to an injury and, thus, that she was required to show only

        that Cerner’s software design defects and Cerner’s failure to warn users of those defects

        were themselves proximate causes contributing to Taylor’s injuries. 7 Lowe argues that

        based on this well-established standard, she presented sufficient evidence of proximate

        causation to permit a jury to find in her favor.

               7
                 Lowe also argues that the district court erred in denying summarily her motion for
        partial summary judgment, in which Lowe sought to prevent Cerner from raising a
        superseding cause defense. Because the district court did not provide any rationale for its
        ruling, we are unable to consider the ruling on appeal. Certain Underwriters at Lloyd’s v.
        Axon Pressure Prods. Inc., 951 F.3d 248, 272 (5th Cir. 2020); see Thomas v. Berryhill, 916
        F.3d 307, 312-13 (4th Cir. 2019) (holding that ALJ’s failure to provide sufficient
        explanation prevented “meaningful appellate review” of the decision and required us to
        vacation and remand). Accordingly, we vacate the district court’s ruling denying Lowe’s
        motion for partial summary judgment. Upon remand, Lowe may renew its motion, and the
        district court can consider it in accordance with the Virginia principles of proximate
        causation set forth in this opinion.
                                                      19
USCA4 Appeal: 20-2270      Doc: 48         Filed: 11/29/2022      Pg: 20 of 35

               In response, Cerner argues that there were numerous “obvious alternative causes”

        of Taylor’s injuries, including VHC’s role in configuring the adaptable portion of the

        software, Dr. Booth’s error in entering the continuous pulse oximetry order when

        approving the unsigned orders list, VHC’s failure to train physicians using the software,

        and VHC’s nursing staff errors in failing to recognize the need to provide Taylor with

        continuous oxygen monitoring and in failing to check Taylor’s vital signs every four hours.

        Cerner argues that because Lowe’s expert witnesses did not address these other causes of

        Taylor’s injuries, Lowe failed, as a matter of law, to establish that Cerner was a proximate

        cause of Taylor’s injuries. We disagree with Cerner’s position. As explained below, we

        first address the requirements of proximate causation under Virginia law, and we next

        review the sufficiency of Lowe’s evidence at the summary judgment stage to satisfy those

        requirements.

               A proximate cause of an event is an act or omission that in natural and continuous

        sequence produces the event, and without which that event would not have occurred.

        Kellermann v. McDonough, 684 S.E.2d 786, 793 (Va. 2009); Ford Motor Co. v. Boomer,

        736 S.E.2d 724, 731 (Va. 2013) (explaining that proximate cause is a necessary antecedent

        of injury). Under Virginia law, there may be more than one proximate cause of an injury.

        Williams v. Le, 662 S.E.2d 73, 77 (Va. 2008). When the concurring negligence of more

        than one cause produces a single injury, each negligent act is a proximate cause of that

        injury and each of these multiple actors is liable for the injury. Id. In other words, under

        Virginia law, it is not required that a plaintiff “show that an act, claimed to have been the

        proximate cause of a certain result, was the only cause.” Schools v. Walker, 47 S.E.2d 418,

                                                     20
USCA4 Appeal: 20-2270      Doc: 48         Filed: 11/29/2022     Pg: 21 of 35

        423 (Va. 1948) (emphasis added) (quoting Chesapeake & O. Ry. Co. v. Wills, 68 S.E. 395,

        397 (Va. 1910)); accord White Consol. Ind. Inc. v. Swiney, 376 S.E.2d 283, 286 (Va. 1989).

        Instead, it is sufficient that a plaintiff show “that the defendant’s act produced or set in

        motion other agencies, which in turn produced or contributed to the final result.” Von Roy

        v. Whitescarver, 89 S.E.2d 346, 352 (Va. 1955) (quoting Chesapeake & O. Ry. Co., 68 S.E.

        at 397); accord Ford Motor Co., 736 S.E.2d at 731.

               Under certain conditions, a proximate cause of an event also may be a superseding

        cause of that event. Williams v. Joynes, 677 S.E.2d 261, 264 (Va. 2009). A superseding

        cause is an intervening act that severs the link of proximate causation between an initial

        act of negligence and the resulting harm. Id.; Hubbard v. Murray, 3 S.E.2d 397, 401 (Va.

        1939). By entirely supplanting another act of negligence, a superseding cause relieves the

        initial negligent actor from liability and, thus, becomes the only proximate cause of the

        plaintiff’s injury. Joynes, 677 S.E.2d at 264; Le, 662 S.E.2d at 77; Jenkins v. Payne, 465

        S.E.2d 795, 799 (1996). Critically, the defendant bears the burden of demonstrating the

        existence of a superseding cause by showing that another’s negligence alone, “without any

        contributing negligence by the defendant in the slightest degree, causes the injury.”

        Jenkins, 465 S.E.2d at 799; see Atkinson v. Scheer, 508 S.E.2d 68, 72 (Va. 1998); Panousos

        v. Allen, 425 S.E.2d 496, 499 (Va. 1993). An intervening act does not qualify as a

        superseding cause when the intervening act was set in motion by the initial act of

        negligence. Joynes, 677 S.E.2d at 264; Philip Morris Inc. v. Emerson, 368 S.E.2d 268,

        277 (Va. 1988).

                                                    21
USCA4 Appeal: 20-2270      Doc: 48          Filed: 11/29/2022     Pg: 22 of 35

               Here, the parties do not dispute that Taylor’s injuries resulted from a lack of oxygen,

        and that continuous monitoring of Taylor’s oxygen level would have prevented his hypoxia

        and brain damage. Under the summary judgment standard, Lowe bore the burden of

        producing sufficient evidence from which a jury could find that Cerner’s negligently

        designed software was a proximate cause of Taylor’s injuries. See Le, 662 S.E.2d at 77;

        Ford Motor Co., 736 S.E.2d at 731. Lowe was not required to address any other proximate

        causes of Taylor’s injuries, or to eliminate such other proximate causes as a source of those

        injuries. Instead, Lowe was required to show only that negligence on Cerner’s part was a

        necessary antecedent of Taylor’s injuries. See Ford Motor Co., 736 S.E.2d at 731.

        Therefore, we hold that the district court erred in concluding that Lowe was required to

        “rule out” other causes of Taylor’s injury.

               Our conclusion is not altered by Cerner’s argument that other possible causes of

        Taylor’s injuries affect whether Lowe established causation attributable to Cerner.

        According to Cerner, Dr. Booth was negligent in using the software, the nursing staff was

        negligent in failing to monitor Taylor’s oxygen level, and VHC was negligent in

        configuring its order entry screen permitting Dr. Booth to select an option that altered her

        desired start time. Any consideration of these alternative causes of injury is relevant only

        to the extent that Cerner can show that a third-party tortfeasor’s conduct wholly supplanted,

        or superseded, its own negligence in causing the injury. See Joynes, 677 S.E.2d at 264; Le,

        662 S.E.2d at 77. And notably, Cerner, not Lowe, would bear the burden to show that a

        third party’s negligence broke the link between Cerner’s negligence and the injury to

        become the sole cause of Taylor’s injuries. See Atkinson, 508 S.E.2d at 72. To be relieved

                                                      22
USCA4 Appeal: 20-2270        Doc: 48       Filed: 11/29/2022      Pg: 23 of 35

        of liability, Cerner would have to establish that its conduct did not contribute to cause

        Taylor’s injuries “in the slightest degree.” 8 See Jenkins, 465 S.E.2d at 799. For these

        reasons, we hold that the district court erred in setting forth the standards of proximate

        causation under Virginia law.

               Additionally, we hold that Lowe presented sufficient evidence at this stage of the

        proceedings to permit a jury to find that Cerner’s negligence was a proximate cause of

        Taylor’s injuries. Dr. Koppel addressed in his report the problems with electronic ordering

        software in which “a doctor’s orders [are] circumvented by the software, resulting in orders

        that ‘default[] to [the following] morning.’” As applied to the present case, Dr. Koppel

        opined that Dr. Booth intended to order continuous pulse oximetry immediately, but that

        the software “circumvented her order and her intentions.” Additionally, Dr. Koppel opined

        that the “difference between what [Dr. Booth] thought she ordered and what the nurse saw

        was due to a defective and/or invisible changing of [Dr. Booth’s] order” by the software

        and the fact that a physician can “approve” a group of orders after viewing only “the first

        couple of orders.”

               Dr. Elkin discussed the risks inherent when an entry by a physician is “overwritten”

        by a default value established in the electronic ordering software. Dr. Elkin explained that,

        in this case, Dr. Booth intended an immediate start time, which was overridden

        electronically to show a default start time without notifying Dr. Booth of the change.

               8
                 Although Cerner did not argue in its brief filed in this Court that other causes
        served as a superseding cause, Cerner did preserve this argument in the district court in its
        opposition to Lowe’s motion for partial summary judgment.

                                                     23
USCA4 Appeal: 20-2270      Doc: 48          Filed: 11/29/2022     Pg: 24 of 35

        According to Dr. Elkin, this design defect proximately caused the failure to continuously

        monitor Taylor’s oxygen level.

               Dr. Elkin also explained that on the unsigned orders list, the order for pulse oximetry

        “was at the very bottom” of the list of 30 orders entered by Dr. Booth. He opined that

        because Dr. Booth could approve all 30 orders at once, “without actually looking” at the

        orders, Dr. Booth “was able to transmit the order without ever seeing the pulse oximetry

        order.” This defect, in Dr. Elkin’s view, also caused the failure to monitor Taylor’s oxygen

        level on a continuing basis.

               In addition, Dr. Booth’s deposition testimony established that when she entered the

        continuous pulse oximetry order, she (1) relied on the start time as the present time

        displayed on the order entry screen, and (2) did not see the improper start time of 10:00 am

        listed for pulse oximetry in the list of unsigned orders before ultimately confirming that

        group of orders. From this evidence, a jury reasonably could conclude that the software

        design defects, allowing an incorrect “start time” to appear on the order entry screen, and

        permitting a physician to approve all her orders as a group without scrolling through the

        data associated with each order, caused the failure to monitor continuously Taylor’s oxygen

        level and resulted in his injuries. Accordingly, we conclude that the district court erred in

        holding that Lowe failed to present sufficient evidence of proximate causation on the

        negligent design claim.

               Because the summary judgment record, fully considered and construed in Lowe’s

        favor, was sufficient to establish all the elements of Lowe’s negligent design claim, we

        hold that the district court erred in awarding summary judgment to Cerner on this claim.

                                                     24
USCA4 Appeal: 20-2270      Doc: 48         Filed: 11/29/2022      Pg: 25 of 35

        We therefore vacate the court’s judgment on the negligent design claim and remand that

        claim for trial. We next turn to consider Lowe’s failure to warn claim.

                                                    B.
                                          Failure To Warn Claim

               In asserting a failure to warn claim under Virginia law, a plaintiff must establish

        that the manufacturer of a product knew or had reason to know that its product was likely

        to be dangerous for its intended use. Funkhouser v. Ford Motor Co., 736 S.E.2d 309, 313

        (Va. 2013). No duty exists, however, when the product’s user was or should have been

        aware of a danger that was obvious. Austin v. Clark Equip. Co., 48 F.3d 833, 836 (4th Cir.

        1995); see Funkhouser, 736 S.E.2d at 313. To show that a defendant breached its duty to

        warn, a plaintiff must show that the defendant failed to exercise reasonable care to inform

        the user of the product’s dangerous condition. Funkhouser, 736 S.E.2d at 313. Finally, a

        plaintiff must show that the defendant’s failure to warn caused the plaintiff’s injuries.

        Featherall v. Firestone Tire & Rubber Co., 252 S.E.2d 358, 369 (Va. 1979).

               The district court held that Lowe failed to present sufficient evidence to support her

        failure to warn claim and awarded judgment in Cerner’s favor on that claim. In particular,

        the court held that Lowe “provided no evidence” that Cerner knew or had reason to know

        that its software was dangerous for its intended use. Although the court acknowledged that

        Lowe submitted evidence of a complaint from a physician who used the software in another

        hospital in 2009, the court characterized that complaint as a “request” to change the “start

        time” field on the order entry screen from a grey-colored font to a red or yellow display.

        The court found that this complaint did not include an affirmative statement of patient harm

                                                     25
USCA4 Appeal: 20-2270      Doc: 48         Filed: 11/29/2022      Pg: 26 of 35

        and that, therefore, the complaint was insufficient to put Cerner on notice that the software

        could cause injury. The court further held that VHC, as the “user,” should have been aware

        of the “defects” in Cerner’s software because VHC configured the software to include a

        10:00 a.m. default start time and had used the software for many years without complaint. 9

               Lowe argues on appeal that the record contained sufficient evidence to establish that

        Cerner was on notice that its software was dangerous, triggering Cerner’s duty to warn.

        Lowe also argues that the court failed to address the evidence that Dr. Booth, as a user of

        the software, was unaware of the dangerous aspects of the software involving the default

        start time. Thus, Lowe submits that Cerner was not relieved of its duty to warn because a

        jury could conclude that the danger was not apparent to the user of the software.

               In response, Cerner maintains that the district court correctly concluded that Cerner

        was not on notice of the software’s alleged dangerous feature. According to Cerner, Lowe

        did not establish a “substantial similarity” between the 2009 complaint made to Cerner and

        the defect alleged by Lowe because the 2009 complaint did not include a report of harm to

        a patient. Cerner also summarily asserts that the question whether Dr. Booth was aware of

               9
                 We observe that the district court also concluded that VHC was a “sophisticated
        billion-dollar hospital” and necessarily should have realized any “dangerous conditions”
        in the software. In Cerner’s motion for summary judgment, however, it did not advance a
        “sophisticated user” defense to argue that VHC had equal knowledge of the dangers of the
        software and, thus, may have been responsible to protect its employees and other users of
        the ordering software. See Willis v. Raymark Indus., 905 F.2d 793, 796 (4th Cir. 1990)
        (applying Virginia law). If upon remand, Cerner asserts such a defense at trial, Cerner
        bears the burden to establish that defense. See id.

                                                     26
USCA4 Appeal: 20-2270       Doc: 48         Filed: 11/29/2022      Pg: 27 of 35

        any dangerous aspect of the software is irrelevant to Cerner’s duty to warn. We disagree

        with Cerner’s position.

               A plaintiff can prove that a defendant has notice of a dangerous condition in its

        product by showing evidence of a similar incident so long as that incident occurred under

        “substantially the same circumstances” and was “caused by the same or similar defects and

        dangers as those in issue.” Funkhouser, 736 S.E.2d at 313-14 (quoting Roll ‘R’ Way Rinks,

        Inc. v. Smith, 237 S.E.2d 157, 160 (1977)). Here, the district court erred in construing the

        2009 complaint as a mere request to change the font color of the software program’s start

        time display. As previously described, in that 2009 complaint, a physician reported that

        Cerner’s software circumvented the intended start time for a patient’s medication, resulting

        in the patient failing to receive medication until the next day. Cerner’s representatives later

        altered the appearance of the actual start time on that hospital’s software to a brighter color

        “so the physician is more aware” of the start time entry. Although the 2009 complaint did

        not state whether the patient suffered harm by failing to receive the intended first dose of

        medication, the danger inherent in the software’s ability to override a physician’s intended

        medical order was made apparent by this complaint. Thus, we conclude that the 2009

        complaint was sufficient to show that Cerner was on notice that the software contained

        dangerous features relating to the entry of medical orders.

               The 2009 complaint also was evidence that Cerner had reason to know that

        physician users of its software could be unaware that default start times embedded in the

        program could override a physician’s intended start time for an order. Dr. Booth likewise

        stated that she was unaware of the default start time dangers inherent in the software.

                                                      27
USCA4 Appeal: 20-2270       Doc: 48           Filed: 11/29/2022   Pg: 28 of 35

        Because Dr. Booth was a physician working at VHC, which had purchased and

        implemented the software, she was a user of the software for purposes of Cerner’s alleged

        duty to warn. See Featherall, 252 S.E.2d at 366 (explaining that a duty to warn “extends

        not only to the immediate purchaser but to other persons who might in the ordinary and

        natural course of events be subjected to [the] danger”). Thus, the district court erred in

        concluding that Lowe failed to present sufficient evidence at this stage of the proceedings

        that Cerner had a duty to warn users of this danger inherent in its software, and that Cerner

        breached that duty in this case. 10

               We therefore turn to the element of proximate causation. Based on the principles

        discussed above, we easily conclude from the present record that Cerner’s failure to warn

        VHC and Dr. Booth about the software’s defects presented a question for the jury regarding

        whether that failure to warn was a proximate cause of Taylor’s injuries. A jury reasonably

        could infer that if Dr. Booth had been warned that an alternate default start time had been

        triggered by the software, overriding her intended start time, continuous pulse oximetry

        would have begun immediately after Taylor’s surgery, thereby preventing his injuries.

        Accordingly, because Lowe presented sufficient evidence at this stage of the proceedings

        to establish all the elements of a failure to warn claim, the district court erred in awarding

        summary judgment in favor of Cerner on that claim.

               10
                 We further conclude that the evidence was insufficient to support a failure to warn
        claim based solely on the configuration of the unsigned orders list. However, the evidence
        from Lowe’s expert witnesses and Dr. Booth concerning the unsigned orders list
        nevertheless was relevant to the failure to warn claim addressing the start time override.

                                                      28
USCA4 Appeal: 20-2270       Doc: 48        Filed: 11/29/2022     Pg: 29 of 35

                                                    III.

                For these reasons, we vacate the district court’s judgment on both Lowe’s negligent

        design claim and her failure to warn claim, and we remand those claims to the district court

        for trial.

                                                                    VACATED AND REMANDED

                                                    29
USCA4 Appeal: 20-2270       Doc: 48         Filed: 11/29/2022      Pg: 30 of 35

        WILKINSON, Circuit Judge, dissenting:

               There is one reason, and one reason only, that the manufacturer is a defendant in

        this suit. It has a deep pocket. Plaintiff’s settlement with Virginia Hospital Center (VHC)

        within the limits established by Virginia medical-malpractice law was not enough. The

        benefits provided by Medicare, presumably covering some medical expenses but not life-

        care expenses, were not enough. So plaintiff’s recourse was to sue the manufacturer, not

        because it was culpable but because it could pay out. I do not criticize plaintiff for pursuing

        this course of action in a deeply tragic case, but I do take exception to the majority’s

        application of several basic principles of products liability law.

               Ruby Lowe filed suit against Cerner Health Services on behalf of her severely

        injured grandson Michael Taylor. Cerner is in the business of making software that

        transmits medical orders. Lowe must of course prove every element of her claim. Her case

        runs aground on an inability to create an issue of triable fact as to proximate causation for

        Taylor’s injury. Causation is an element both of plaintiff’s design-defect and failure-to-

        warn claims. Some 32,000 pages of discovery and the designation of seven experts have

        produced only pretty thin gruel. A record this thick often suggests a fishing expedition, as

        I think it does here. I would thus affirm the judgment.

               As to causation, this is a “many hands” case. Dr. Alexandra Booth and the hospital

        staff provided the most immediate set of hands with respect to Taylor’s care. The

        manufacturer’s involvement, if such there was, was remote and attenuated. Checking the

        patient’s blood-oxygen level is a standard medical procedure. Monitoring blood-oxygen

                                                      30
USCA4 Appeal: 20-2270      Doc: 48          Filed: 11/29/2022     Pg: 31 of 35

        levels is “routine”: Doctors and hospitals know how to do it, because they do it all the time.

        Appellant Br. 14. They know to be careful, not sloppy.

               In this very case, personnel throughout the hospital had been placing orders with the

        manufacturer’s software for six years without mishap. J.A. 3880. It happened that on this

        day, Booth failed when reviewing the orders for Taylor to notice the start time correctly

        displayed on the software’s summary screen. J.A. 3867. She likewise filled out a field on

        the ordering screen that she claims confused her, where “[n]one of those options ma[d]e

        any sense,” and then signed off on a full slate of orders despite her professed apprehension

        around language on the summary screen. J.A. 3866.

               Similarly, multiple lapses made by hospital staff do not inspire confidence that a

        correct order from Booth would have even been obeyed. First, hospital staff failed to

        respond to a duplicative order from Taylor’s anesthesiologist concerning the same blood-

        oxygen monitoring device that Booth had ordered for the following day. J.A. 3865. Second,

        they failed to heed an order from Booth requesting that Taylor’s vital signs be checked

        every four hours. (During a 5.5-hour period, which only ended when Booth herself visited

        Taylor, no check was performed. J.A. 3867.) And third, hospital staff did not attempt to

        confirm or corroborate the delayed start time in Booth’s order, despite that instruction

        being inconsistent with two other orders that Booth had placed also concerning Taylor’s

        oxygen levels. J.A. 3865–67.

               It is understandable that those immediately responsible for Taylor’s care would seek

        to place blame for this sad outcome everywhere but on themselves. One can appreciate also

        how this could happen. Hospitals are busy places. Doctors and nurses have many patients

                                                     31
USCA4 Appeal: 20-2270        Doc: 48          Filed: 11/29/2022       Pg: 32 of 35

        to monitor. Different shifts demand hand-offs. Things can get lost or fall through the

        cracks. Fatigue at the end of a shift can set in. There is, in short, a lot to keep track of. There

        was nothing malign or intentional about Booth’s mistake or the hospital’s faulty oversight

        here. It was a simple, classic case of negligence. Unfortunately, negligence can cause

        devastating consequences far out of proportion to the state of mind that brings them about.

               It is true, as the majority observes, that Virginia law does not require plaintiff to

        “rule out” all other causes in a multiple-cause case. Majority Op. 22. The Commonwealth

        recognizes that “[t]here may be more than one proximate cause of an event.” Kellermann v.

        McDonough, 684 S.E.2d 786, 793 (Va. 2009). But this general proposition of law does not

        go as far as the majority takes it. In reality, the proposition refers to scenarios in which

        multiple parties each furnished but-for causes. Thus, in a case involving two negligent

        drivers, both drivers were found liable since “the collision . . . would not have occurred”

        absent either’s errors. Von Roy v. Whitescarver, 89 S.E.2d 346, 352–53 (Va. 1955). Or, in

        a case over tortious medical prescriptions, both the pharmacist and doctor could have been

        liable since their “independent acts of negligence” operated in tandem. Sullivan v.

        Robertson Drug Co., 639 S.E.2d 250, 252–53, 255 (Va. 2007). But the law of causation,

        while nuanced and open to massaging, still requires at bottom more than a “conjecture,

        guess, or random judgment” that the defendant’s acts brought about the ultimate injury.

        Town of W. Point v. Evans, 299 S.E.2d 349, 351 (Va. 1983). Therefore, expert references

        to HIMSS, NIST 7804, and “usability factors” notwithstanding, “[n]egligence and an

        accident . . . do not make a case.” Wells v. Whitaker, 151 S.E.2d 422, 428 (Va. 1966)

        (quoting Hawkins v. Beecham, 191 S.E. 640, 643 (Va. 1937)).

                                                        32
USCA4 Appeal: 20-2270      Doc: 48          Filed: 11/29/2022     Pg: 33 of 35

               The causation analysis is even more problematic when one considers the weakness

        of plaintiff’s design-defect claim. The two elements are not unrelated. The more severe the

        defect, the easier it is for a plaintiff to survive summary judgment by “eliminat[ing] the

        possibility that the blame attaches to some party other than” the manufacturer. Logan v.

        Montgomery Ward & Co., 219 S.E.2d 685, 688 (Va. 1975). Here, plaintiff’s theory for a

        design defect is tenuous. For all the opining of her seven experts, “[t]he manufacturer is

        not an insurer and is not required to design and market an accident-proof product.”

        Turner v. Manning, Maxwell & Moore, Inc., 217 S.E.2d 863, 868 (Va. 1975). That the

        manufacturer’s supposed defects are speculatively linked, as here, only to a single injury

        suggests that the majority is wrongly scouring for “the safest conceivable design,” not a

        “reasonably safe product[].” Redman v. John D. Brush & Co., 111 F.3d 1174, 1177

        (4th Cir. 1997). One accident in six years of frequent use does not a “hard coded” defect

        make. J.A. 2879.

               In products liability litigation, summary judgment is often the whole candle. If

        plaintiffs lose, they’re out of court. If defendants lose, they may be forced to settle for an

        exorbitant sum in order to avoid an even more ruinous award of damages. In a sad case like

        this, a jury would understandably be drawn to Taylor’s tragic circumstances and do what

        it could to help. Jurors might return home and—again understandably—believe they have

        done a Good Turn for the day.

               This to me suggests the need for real caution in summary judgment rulings. The law

        tells us that jury verdicts are not to be based on “sympathy,” Rutherford v. Zearfoss, 272

                                                     33
USCA4 Appeal: 20-2270       Doc: 48          Filed: 11/29/2022      Pg: 34 of 35

        S.E.2d 225, 228 (Va. 1980), or “speculation,” Shepherd v. Davis, 574 S.E.2d 514, 524

        (Va. 2003). Yet a verdict here would show a high likelihood of being based on both.

               This danger should be mitigated by returning the case to the district court for review

        of defendant’s summary judgment motion in accordance with the standards the majority

        now announces. Pushing a thin case to a jury with such a high potential for a sympathy

        verdict is, at this point, wholly premature. If, as the majority holds, plaintiff is not required

        to rule out all causes in addition to that of the defendant, the district court should at least

        be given an opportunity to review the record under the correct standard. The district court

        should also be given the chance before ruling on the summary-judgment motion to

        determine whether the testimony of plaintiff’s experts would be admissible at trial under

        the well-known criteria of Daubert v. Merrell Dow Pharmaceuticals, Inc., 509 U.S. 579

        (1993). It may be that the district court would ultimately send the case to trial, but a basic

        concern for fair process as well as the role of district courts demands a review of the record

        under the correct principles of law.

               A sense of balance in this kind of case is crucial. The plaintiff’s bar provides a real

        service in products liability cases. Well-founded suits have, in my judgment, helped to

        ensure a safer world. No doubt the fear and apprehension of litigation have caused many a

        manufacturer to keep a risky product off the market or at least to delay its introduction until

        those risks have been minimized.

               And yet safety does not cut just one way. The technological advances that often

        come with new products can enhance safety too. Consider the automobiles of the 1950s.

        With their shattering glass and shiny chrome and fancy fins, they were still death traps. It

                                                       34
USCA4 Appeal: 20-2270       Doc: 48         Filed: 11/29/2022     Pg: 35 of 35

        was only technical advances in the form of shatterproof windshields, seat belts and

        shoulder straps, roll bars, and the like that brought about safer travel. See Charles M.

        Farmer & Adrian K. Lund, The Effects of Vehicle Redesign on the Risk of Driver Death,

        16 Traffic Inj. Prevention 684, 684–90 (2015).

                The point is easily expanded beyond automobiles. Fear of this sort of litigation has

        the potential to deter products that might enhance patient care and recovery and even, in

        some cases, hold down costs. See, e.g., Jacobs v. E.I. du Pont de Nemours & Co., 67 F.3d

        1219, 1241 (6th Cir. 1995) (making the supplier liable for users’ mistakes would “stymie

        the kind of beneficial scientific innovation” recurrent in “human endeavor”); Keith N.

        Hylton, The Law and Economics of Products Liability, 88 Notre Dame L. Rev. 2457, 2497

        (2013) (“[H]igh levels of uncertainty are likely to be met with withdrawal from the product

        innovation process.”). A suit like this one runs the risk of retarding the safety and utility

        that innovative technologies can bring.

                Post hoc ergo propter hoc. (After which, because of which.) What part that nostrum

        played in Roman law I do not know. The venerable Latin phrase, however, cannot be the

        sole basis of modern tort liability. Causation requires more than the mere sequencing of

        time.

                What happened here is sad beyond measure. But holding an innocent party culpable

        is not the law. I respectfully and reluctantly dissent. May fastening consequences where

        they belong show us to a safer day.

                                                     35