Handoffs decide outcomes on a cardiac ward. Day shift hands the monitor alarms, the pending echocardiograms and the anxious families to a night team that was not in the room when any of it started. At one mid-sized heart hospital — the names in this story are invented, the pattern is not — those handoffs used to travel by sticky note, private message and a group mailbox nobody owned. The clinical systems team, four people with day jobs elsewhere in the building, decided to move that traffic into shared chat instead, adopting ChatOps: a shared channel carrying the operational load, where a bot announces events, permitted commands act, and the whole trail — action, outcome, discussion — remains visible, permissioned and logged. Their touchstone document was the Ops Atlas entry on ChatOps, which they printed and taped inside a cupboard door.
The Night a Page Went to an Empty Desk
The incident that forced the change was ordinary, which is what made it frightening. A bed-management alert went out at 02:14 as a direct message to the one coordinator who always answered — except that week she was on leave, and the message sat unread beside a holiday autoreply. Nobody else knew the alert existed, because private channels are invisible by design. The patient was fine; the transfer was delayed by ninety minutes and nobody could afterwards explain why. In the review, the team wrote one sentence on the whiteboard and never erased it: work that only one person can see is work that only one person can do.
Three ChatOps Surfaces, One Channel
What the team built followed the shape the reference describes, and it helped to name the parts explicitly:
- Notifications. Monitoring thresholds, admission events and lab-result flags now arrive as bot posts in a ward channel, where the whole team reads them or nobody does.
- Commands. A small set of typed instructions — page the on-call registrar, fetch the current bed picture, escalate to the duty manager — replaces the hunt for whoever holds the right console.
- Conversation. Questions and decisions stay attached to the event that prompted them, so the 07:00 handoff reads like a transcript rather than a reconstruction.
The discipline that made this safe was the allow-list. The bot does exactly what its catalogue says and nothing else. Nobody can type an arbitrary instruction and have it reach a hospital system, because free text never touches a shell — commands match fixed patterns, and anything outside the pattern is refused in public, which quietly became a feature: refusals showed the team where the gaps were.
Trust Was Designed Before Convenience Was Added
The team sorted every candidate action into risk tiers before wiring anything. Tier zero simply informs. Tier one reads — bed counts, on-call rosters. Tier two covers reversible writes, and each one carries three conditions: the requester holds a specific role, the command works only in designated channels, and the outcome lands in an audit record. Tier three, the high-impact actions such as triggering the major-incident path, demand two people: one to request, one to approve. A break-glass route exists for genuine emergencies, and every use of it triggers a review the next morning, no exceptions and no awkwardness about it.
Identity got the same care. The bot maps every request to an immutable user identifier from the chat platform, never to a display name, because display names are costume jewellery — changeable, decorative and worthless for verification. Approvals are captured as explicit actions, not emoji, after the team read enough about reaction-as-consent gone wrong to drop the idea early.
The Drill That Made It Real
Twenty-three days in, a genuine incident arrived: a monitoring integration degraded during a database failover. The declared incident ran through the full sequence — declare it, create the response channel, page the right people, let the bot assemble a timeline, archive the whole thing afterwards. What mattered clinically was speed; what mattered afterwards was the timeline, which the team exported from the audit system rather than scrolling chat history. Chat is a stage, not a records office, and the durable log lives outside it where retention rules and integrity controls actually apply. The ward’s own patient-facing material teaches the same lesson in a clinical register — recovery depends on structured follow-up, whether that is planned care after adult bypass surgery or structured rehabilitation after a cardiac event — and structure, not memory, is what holds under pressure.
What Changed on the Ward, Honestly
Nobody pretends the channel fixed everything. What changed first was visibility: the night coordinator’s inbox stopped being single point of failure, because alerts had an audience. What changed second was pace of questions — the recurring “where is that documented” thread nearly vanished, because the answer was usually scrolling a few lines up. What changed third was subtler: junior nurses started issuing read-only commands themselves instead of queuing behind whoever was nearest the desk, and the team noticed the hierarchy flattening in the logs before anyone mentioned it aloud.
A channel everyone can read beats an inbox one person guards. That sentence is now part of the ward’s induction.
Keep the ChatOps Logic Where Platforms Cannot Take It
The last lesson arrived from outside. The team’s reading of the reference included the churn of the preceding decade: collaboration platforms retire integrations on their own schedules — legacy custom bots on one major platform were switched off in 2025, connectors on another face the same fate in 2026, and an incident-management product many teams relied on shuts down in 2027. The team took the warning seriously and kept every decision, mapping and policy in their own gateway and audit store, treating the chat adapter as a replaceable plug. When the platform eventually changes — and it will — the ward’s operating logic should not notice. The same thinking shapes how the hospital stages patient-facing transitions, such as telehealth-based follow-up after heart surgery: the channel moves, the care pathway stays.
ChatOps, on this ward, is not a gadget. It is a handoff discipline with a permission slip and a paper trail, and the night team, who asked for almost none of it, now defend it most fiercely of all.