Ruby Lowe v. Cerner Corporation ( 2022 )

USCA4 Appeal: 20-2270 Doc: 48 Filed: 11/29/2022 Pg: 1 of 35
UNPUBLISHED
UNITED STATES COURT OF APPEALS
FOR THE FOURTH CIRCUIT
No. 20-2270
RUBY L. LOWE, Power of Attorney for Michael A. Taylor, disabled,
Plaintiff - Appellant,
v.
CERNER CORPORATION,
Defendant - Appellee.
Appeal from the United States District Court for the Eastern District of Virginia, at
Alexandria. Claude M. Hilton, Senior District Judge. (1:19−cv−00625−CMH−TCB)
Argued: September 13, 2022 Decided: November 29, 2022
Before WILKINSON, Circuit Judge, and KEENAN and MOTZ, Senior Circuit Judges.
Vacated and remanded by unpublished opinion. Senior Judge Keenan wrote the majority
opinion, in which Senior Judge Motz joined. Judge Wilkinson wrote a dissenting opinion.
ARGUED: Mikhael D. Charnoff, PERRY CHARNOFF PLLC, Arlington, Virginia, for
Appellant. David Brent Dwerlkotte, SHOOK, HARDY & BACON, L.L.P., Kansas City,
Missouri, for Appellee. ON BRIEF: Scott M. Perry, PERRY CHARNOFF PLLC,
Arlington, Virginia, for Appellant. Amy M. Crouch, SHOOK, HARDY & BACON L.L.P.,
Kansas City, Missouri; Roman Lifson, Belinda D. Jones, CHRISTIAN & BARTON,
L.L.P., Richmond, Virginia, for Appellee.
USCA4 Appeal: 20-2270 Doc: 48 Filed: 11/29/2022 Pg: 2 of 35
Unpublished opinions are not binding precedent in this circuit.
2
USCA4 Appeal: 20-2270 Doc: 48 Filed: 11/29/2022 Pg: 3 of 35
BARBARA MILANO KEENAN, Senior Circuit Judge:
In this product liability negligence action, Ruby L. Lowe, on behalf of her injured
grandson Michael A. Taylor, filed suit against Cerner Health Services, Inc. (Cerner), the
developer and seller of a software system used for entry of medical orders for patient care.
Cerner sold its software system to the Virginia Hospital Center (VHC, or the hospital),
where Taylor was a patient. Taylor suffered brain damage and resulting physical
impairments at VHC after failing to receive “continuous pulse oximetry” as intended by
his physician, who had entered an order for that care into the Cerner system used by VHC.
Lowe asserted negligence claims against Cerner under Virginia law, alleging that
the Cerner software was negligently designed (the negligent design claim), and that Cerner
negligently failed to warn system users of those design defects (the failure to warn claim).
Lowe asserted that Cerner’s negligent acts caused the failure to properly monitor Taylor’s
oxygen level, and that proper monitoring would have prevented Taylor’s injuries. The
district court awarded summary judgment to Cerner.
Upon our review, we hold that the district court erred in awarding summary
judgment to Cerner on both claims. On the record before us, a jury reasonably could
conclude that Cerner’s software contained two design defects that did not comply with
industry standards or satisfy reasonable consumer expectations. We also hold that the
district court misstated Virginia law on proximate causation, which provides that there can
be more than one cause of an injury and, contrary to the court’s holding, did not require
Lowe to eliminate other causes of the injury. Lowe presented sufficient evidence for a jury
to conclude that the software defects were a proximate cause of Taylor’s injuries. We also
3
USCA4 Appeal: 20-2270 Doc: 48 Filed: 11/29/2022 Pg: 4 of 35
hold that the court erred in awarding summary judgment to Cerner on Lowe’s failure to
warn claim. That evidence likewise was sufficient for a jury to conclude that Cerner failed
to warn users about the software design defects and that Cerner’s failure to do so was a
proximate cause of Taylor’s injuries. We therefore vacate the district court’s judgment and
remand the case for trial on both claims.
I.
We recite the facts, and reasonable inferences that can be drawn from those facts,
in the light most favorable to Lowe as the nonmoving party. Betton v. Belue, 942 F.3d 184,
191 (4th Cir. 2019). On April 5, 2016, Dr. Alexandria Booth performed surgery on 25-
year-old Taylor to remove his gall bladder. Because Taylor suffered from sleep apnea and
other medical conditions, Dr. Booth intended that Taylor receive “continuous pulse
oximetry” as he recovered from surgery. 1 Pulse oximetry measures a patient’s oxygen
level in the blood, and typically is measured by placing a monitoring device on the patient’s
finger. When a patient’s oxygen level is monitored continuously, an alarm sounds when
the patient’s oxygen level falls below a certain percentage. The alarm alerts hospital staff
and wakes the patient so that the situation can be addressed before injury occurs.
After Taylor’s surgery, Dr. Booth entered an order for “continuous pulse oximetry”
into the health record software developed by Cerner and used at VHC. Dr. Booth intended
Taylor’s anesthesiologist also intended that Taylor have continuous pulse oximetry
1
monitoring and issued a “postoperative evaluation” regarding Taylor and included a
handwritten note: “Admit to floor w/ continuous pulse oximetry. [staff] notified.” Dr.
Booth explained that “either [this handwritten] order wasn’t conveyed or it was ignored.”
4
USCA4 Appeal: 20-2270 Doc: 48 Filed: 11/29/2022 Pg: 5 of 35
that this order be effective from the time she entered the order, at 4:34 p.m. on April 5,
2016, until Taylor’s expected discharge from the hospital on April 6, 2016. As explained
in more detail below, the order for continuous pulse oximetry did not take effect until 10:00
a.m. on April 6, 2016. Thus, Taylor was not provided continuous oxygen monitoring
during the night of, or in the morning after, his surgery.
At 5:01 a.m. on April 6, 2016, the hospital nursing staff checked Taylor’s vital signs,
which were normal. Pursuant to hospital guidance, another check of Taylor’s vital signs
should have occurred around 9:00 a.m., but did not. Around 10:30 a.m., Dr. Booth found
Taylor unresponsive and in respiratory distress. Taylor suffered a “respiratory arrest,”
which caused “hypoxia,” a deficiency of oxygen reaching the tissues of the body, and brain
damage. As a result, Taylor cannot walk, bathe, or use the bathroom independently. The
parties do not dispute that if Taylor’s oxygen level had been monitored continuously, his
resulting hypoxia and brain damage would not have occurred.
Taylor’s grandmother, Lowe, filed an action alleging medical malpractice against
Dr. Booth’s employer and VHC. The parties to that action later entered into a settlement
agreement. Lowe also filed the present action against Cerner, seeking $50 million in
damages. 2 Lowe alleged that there were two design defects in Cerner’s electronic ordering
software, and that Cerner failed to warn users of those defects. Lowe asserted that these
defects, and Cerner’s failure to warn users of its product of those defects, caused Dr. Booth
2
Lowe initially filed suit in a Virginia circuit court, and Cerner removed the suit to
federal district court under that court’s diversity jurisdiction.
5
USCA4 Appeal: 20-2270 Doc: 48 Filed: 11/29/2022 Pg: 6 of 35
inadvertently to enter the continuous pulse oximetry order as beginning at 10:00 a.m. the
day after Taylor’s surgery, instead of immediately after the surgery.
As alleged by Lowe, the first defect relevant to this appeal related to the software’s
“order entry screen,” on which a physician enters specific information about the medical
care that the hospital staff is required to administer to the patient. On the order entry screen,
the “start time” for these orders appeared automatically as the date and time of entry. The
order entry screen also contained drop-down menus to direct the frequency and recurrence
of the particular care directed. For the frequency, Dr. Booth chose “daily,” and for the
recurrence, she selected “once.” Unbeknownst to Dr. Booth, her selection of “once”
triggered an automatic start time of 10:00 a.m. that VHC had implemented based on when
its pharmacy filled medication orders. Despite this 10:00 a.m. start time, however, the
order entry screen continued to display the start time for continuous pulse oximetry as April
5, 2016, at 4:34 p.m. This feature was “hardcoded” into the software developed by Cerner,
meaning that VHC could not alter the order entry screen’s start time display.
After inputting the above instructions on the order entry screen, Dr.
Booth next selected “add to order session,” which electronically moved those orders to the
“unsigned orders list.” The unsigned orders list contained the second, related design defect
alleged by Lowe.
The unsigned orders list displayed all the orders entered by a physician, and
Cerner’s software required that the physician approve the list before those orders would
take effect. The last of the 30 orders entered by Dr. Booth for Taylor’s care appeared on
the list as “Pulse oximetry: Continuous Once As Ordered; start on 4/6/2016 at 10:00.”
6
USCA4 Appeal: 20-2270 Doc: 48 Filed: 11/29/2022 Pg: 7 of 35
However, the unsigned orders list contained detailed information for each order in a
“stacked” format, displaying the details of only the first few orders. Thus, a physician was
required to scroll across “multiple computer screens” to review the details of each order.
If the physician did not review the details of each order, she nevertheless could
electronically sign, or approve, all the pending orders as a group.
Dr. Booth stated that she did not see the 10:00 a.m. start time for the pulse oximetry
order on the unsigned orders list, and instead relied on the start time shown on the order
entry screen. According to Dr. Booth, she did not expect the start time for the continuous
pulse oximetry order to “change[]” between the order entry screen and the unsigned orders
list. Therefore, Dr. Booth electronically accepted all the orders, including the continuous
pulse oximetry with the improper 10:00 a.m. start time.
Dr. Booth had practiced medicine as a surgeon for 16 years, and had been using
Cerner’s software at VHC for several years. Dr. Booth also stated that she had used a
different software program at another medical center and had not encountered the same
start time problem at that other location.
After Lowe filed suit against Cerner, the parties engaged in extensive discovery.
Cerner later moved for summary judgment, and Lowe moved for partial summary
judgment seeking to prevent Cerner from asserting at trial that any third-party’s conduct
was the sole or superseding cause of Taylor’s injuries. Lowe submitted for the court’s
consideration testimony and reports from several expert witnesses, including the deposition
testimony of Taylor’s surgeon, Dr. Booth. Lowe also presented testimony and reports
prepared by two of her designated expert witnesses in the field of use of electronic health
7
USCA4 Appeal: 20-2270 Doc: 48 Filed: 11/29/2022 Pg: 8 of 35
records: Ross Koppel, Ph.D., a professor of biomedical informatics, and Peter Elkin, M.D.,
a board-certified physician in clinical informatics and professor of biomedical informatics.
Both Lowe and Cerner also filed several Daubert motions and other motions in limine.
Without ruling on the parties’ evidentiary motions, the district court granted
Cerner’s motion for summary judgment and summarily denied Lowe’s motion for partial
summary judgment. Lowe later filed the present appeal.
II.
We review de novo the district court’s decision granting summary judgment. RXD
Media, LLC v. IP Application Dev. LLC, 986 F.3d 361, 372 (4th Cir. 2021). Summary
judgment is appropriate only “if the movant shows that there is no genuine dispute as to
any material fact and the movant is entitled to judgment as a matter of law.” Fed. R. Civ.
P. 56(a). Summary judgment may not be granted “merely because the court believes that
the movant will prevail if the action is tried on the merits.” Jacobs v. N.C. Admin. Off. of
the Courts, 780 F.3d 562, 568 (4th Cir. 2015) (citation omitted).
The district court may grant summary judgment only if it concludes that the
evidence would not permit a jury to return a verdict in favor of the nonmoving party.
Variety Stores, Inc. v. Wal-Mart Stores, Inc., 888 F.3d 651, 659 (4th Cir. 2018). In
considering a motion for summary judgment, a court improperly weighs the evidence when
it fails to credit contradictory evidence or fails to draw reasonable inferences in the light
most favorable to the nonmoving party. Id. at 659-60 (citations omitted).
8
USCA4 Appeal: 20-2270 Doc: 48 Filed: 11/29/2022 Pg: 9 of 35
The district court considered Lowe’s action under its diversity jurisdiction, and
properly concluded that the substantive law of Virginia is controlling. See Volvo Const.
Equip. N. Am., Inc. v. CLM Equip. Co., 386 F.3d 581, 599-600 (4th Cir. 2004). Under
Virginia law, a plaintiff may seek recovery of damages for injuries cause by a defective
product in accordance with common law principles of negligence. See Sardis v. Overhead
Door Corp, 10 F.4th 268, 280 (4th Cir. 2021) (applying Virginia law). Under those
principles, the plaintiff is required to establish that she suffered an injury caused by the
defendant’s breach of a duty owed to the plaintiff. See Evans v. Nacco Mats. Handling
Grp., Inc., 810 S.E.2d 462, 469 (Va. 2018) (explaining that plaintiff may proceed under
theory of negligence in proving design defect); Dorman v. State Indus., Inc., 787 S.E.2d
132, 139 (Va. 2016) (addressing causation in product liability action). In the present case,
the parties do not dispute that Turner suffered an injury and, thus, we do not address further
that element of the case.
In a product liability claim brought under Virginia negligence law, a plaintiff must
show that the product was unreasonably dangerous for a foreseeable use. 3 Sardis, 10 F.4th
at 280 (citing Evans, 810 S.E.2d at 469). A product may be deemed “unreasonably
3
A plaintiff must also show that the “dangerous condition existed when the goods
left the defendant’s hands.” Evans v. Nacco Mats. Handling Grp., 810 S.E.2d 462, 469
(Va. 2018) (quoting Featherall v. Firestone Tire & Rubber Co., 252 S.E.2d 358, 367
(1979)). Although the district court concluded that “most” of the alleged “defects” in
Cerner’s software “were created through choices made by VHC,” the record shows that the
start time display on the order entry screen and the ability to approve a group of orders
without reviewing all the data for each order were features of the software incorporated by
Cerner. Notably, Cerner does not defend the district court’s conclusion on this point.
9
USCA4 Appeal: 20-2270 Doc: 48 Filed: 11/29/2022 Pg: 10 of 35
dangerous if it is defectively manufactured, defectively designed, or unaccompanied by
adequate warnings” about the product’s dangerous qualities. Id. (quoting Morgen Indus.,
Inc. v. Vaughan, 471 S.E.2d 489, 492 (Va. 1996)).
In the present case, Lowe was required to present proof to satisfy the elements of
each claim that she asserted, namely, the claims of negligent design and of failure to warn. 4
With these general negligence principles in mind, we turn to consider each of Lowe’s
claims.
A.
Negligent Design Claim
1. Duty and Breach of Duty
To prevail on a negligent design claim, a plaintiff must show that the defendant has
a legally recognized duty to design a product to ensure that it is “reasonably safe for the
purpose for which it is intended.” Sardis, 10 F.4th at 280 (quoting Holiday Motor Corp.
v. Walters, 790 S.E.2d 447, 454-55 (Va. 2016)); see Dorman, 787 S.E.2d at 139. This
element of duty can be established by presenting evidence that the defendant’s product
failed to satisfy: (1) governmental safety standards, (2) industry standards, or (3)
reasonable consumer expectations. Sardis, 10 F.4th at 280 (citing Evans, 810 S.E.2d at
472). “If a plaintiff successfully establishes a duty to construct a product in a particular
4
We observe that Lowe also asserted a general negligence claim, which the district
court dismissed in its ruling on summary judgment. Because Lowe does not challenge that
ruling on appeal, we do not address it.
10
USCA4 Appeal: 20-2270 Doc: 48 Filed: 11/29/2022 Pg: 11 of 35
manner, the manufacturer breaches that duty if the product does not conform to that
standard.” Id.
The district court held that Lowe failed to identify an acceptable industry standard
that imposed a duty on Cerner. The court rejected the standard relied on by Dr. Koppel,
namely, the National Institute of Standards and Technology Internal or Interagency Report
7804 (NIST 7804). The court reasoned that NIST 7804 was not part of the governmental
safety standards set forth in the Health IT Certification Program promulgated by the Office
of the National Coordinator of Health Information Technology (ONC), with which Cerner
had complied. The court further reasoned that Dr. Koppel did not address the relationship
between NIST 7804 and the ONC standard.
Similarly, the court rejected the standard relied on by Dr. Elkin, namely, the
Healthcare Information and Management Systems Society’s (HIMSS) usability standard
for electronic health records. The court stated that Dr. Elkin failed to explain how HIMSS
differed from the ONC’s safety standards and concluded that even if HIMSS adequately
set forth an industry standard, Dr. Elkin did not explain how Cerner’s software violated the
HIMSS standard. The court held that Cerner complied with the HIMSS standard by
conducting its own safety and usability testing.
Finally, the district court held that Dr. Koppel and Dr. Elkin “offer[ed] exactly the
type of opinions rejected” by this Court in Alevromagiros v. Hechinger Co., 993 F.2d 417(4th Cir. 1993), because Lowe’s experts “generically argue[d]” that the software should
have contained design features to make it safer, without explaining how the software design
violated “prevailing safety standards.” The district court summarily concluded, without
11
USCA4 Appeal: 20-2270 Doc: 48 Filed: 11/29/2022 Pg: 12 of 35
reference to any evidence in the record, that “[n]one of the features and functionality
challenged” by Lowe were “unusual” and that “all are industry standard.”
Additionally, the district court concluded that Lowe failed to present sufficient
evidence to allow a jury to conclude that the software violated consumer expectations. The
court held that Dr. Koppel and Dr. Elkin did not “suggest[]” that Cerner’s software violated
consumer expectations. The court also stated that Cerner “received no customer
complaints similar to those raised here.”
On appeal, Lowe argues that the district court erred in holding that she failed to
present sufficient evidence to permit a jury to conclude that the software contained design
defects. According to Lowe, the court erroneously analyzed the industry standards
identified by Dr. Koppel and Dr. Elkin by comparing those to the prevailing government
standards set forth by ONC, when Lowe did not seek to establish a duty by relying on those
governmental safety standards. Lowe submits that Dr. Koppel and Dr. Elkin identified
acceptable industry standards that imposed a duty on Cerner to design its software free
from the defects identified by Lowe. She also argues that evidence presented by Dr.
Koppel and Dr. Booth was sufficient to permit a jury to conclude that Cerner’s software
violated reasonable consumer expectations.
Cerner, in response, does not defend the district court’s rationale that the industry
standards identified by Dr. Koppel and Dr. Elkin were unacceptable because they were not
part of ONC’s standards, or because those experts did not compare those safety standards
with the proposed industry standards. Instead, Cerner contends that Lowe’s evidence
showed only that the software violated “generic ‘industry standards,’” which were not
12
USCA4 Appeal: 20-2270 Doc: 48 Filed: 11/29/2022 Pg: 13 of 35
specific enough to establish a standard of care. Relying on two court decisions, Holiday
Motor Corp. v. Walters, 790 S.E.2d 447 (Va. 2016), and Alevromagiros v. Hechinger Co.,
993 F.2d 417 (4th Cir. 1993), Cerner submits that the industry standards identified by Dr.
Koppel and Dr. Elkin served only as generalized guidance and did not impose any duty on
Cerner to design its software in a different manner.
Cerner also contends that Lowe failed to put forth sufficient evidence to show that
Cerner’s software violated reasonable consumer expectations. Although Dr. Koppel relied
on literature describing recognized risks associated with the design of electronic record
systems, and Dr. Booth addressed her expectations about the software, Cerner contends
that this evidence described only “generic risks” associated with electronic health records.
According to Cerner, Lowe failed to show that the software violated objective industry
standards or reasonable consumer expectations and that, therefore, Cerner was entitled to
judgment as a matter of law. We disagree with Cerner’s position.
Initially, we agree with Lowe that the district court erred in rejecting as inadequate
the industry standards relied upon by Dr. Koppel and Dr. Elkin because the experts did not
explain why those standards were applicable even though they were not incorporated into
the ONC government safety certification program. A defendant’s failure to comply with
government safety standards is one of three alternative means by which a plaintiff may
demonstrate a design defect. See Evans, 810 S.E.2d at 470. Lowe did not dispute that
Cerner’s software had been certified by ONC as having “safety-enhanced design,” nor did
Lowe rely on these standards as setting forth the alleged duty owed by Cerner. Therefore,
we turn to address Lowe’s evidence of industry standards and consumer expectations.
13
USCA4 Appeal: 20-2270 Doc: 48 Filed: 11/29/2022 Pg: 14 of 35
a. Industry Standards
In his expert witness report, Dr. Koppel cited the NIST 7804 as a usability protocol
widely recognized in “user-interface design” for software. NIST itself explains that this
protocol “provide[s] detailed systematic steps for conducting validation studies . . . to help
ensure that the application’s user interface is free from critical usability issues and supports
error-free user interaction” with electronic health records.
Dr. Koppel opined that Cerner’s software contained a “use-error root cause,” as
defined by NIST 7804, including that the order entry screen contained “Inadequate
Feedback About Automation.” Dr. Koppel explained that Cerner’s order entry screen
failed to warn a physician that a start time other than the one displayed on the order entry
screen had been selected by the software. And Dr. Koppel further explained that although
the unsigned orders list could alert a physician about the altered start time, that list was
“convoluted” and contrary to “all rule[s] of usability.” Dr. Koppel concluded that it was
“an abrogation of design responsibility to create . . . an interface” in which 30 orders for a
patient were “stack[ed]” and were “not visible without extensive scrolling.”
In offering his expert opinion, Dr. Elkin relied upon a usability standard established
by HIMSS, a non-profit organization dedicated to improving health care by assessing the
best use of information technology and management systems. Contrary to the district
court’s conclusion, Dr. Elkin explained how Cerner’s software violated HIMMS usability
standards. Dr. Elkin identified one particularly relevant usability factor, the issue of
“forgiveness.” Dr. Elkin opined that software fails to meet industry forgiveness standards
when it does not provide cautionary information to users about their prospective or existing
14
USCA4 Appeal: 20-2270 Doc: 48 Filed: 11/29/2022 Pg: 15 of 35
entries that would help prevent errors or enable those users to “recover from errors easily.”
In view of these standards, Dr. Elkin identified at least two design defects: (1) the
imposition of a default start time that differed from the order entry time; and (2) a system
permitting a physician to approve numerous orders without reviewing them.
Upon consideration of this expert witness evidence, we first observe that the
standards identified and relied upon by Dr. Koppel and Dr. Elkin were more specific than
the evidence discussed in Holiday Motor and Alevromagiros. In Holiday Motor, the
Supreme Court of Virginia held that the plaintiffs’ expert witness failed to identify an
applicable industry standard relating to the design of a “soft top latching system” to protect
occupants of convertible automobiles “during [a] rollover crash.” 790 S.E.2d at 455, 457.
The court held that the plaintiff’s expert witness instead merely relied on “a general
engineering principle . . . applicable to all automobile components.” Id. at 457.
In Alevromagiros, we affirmed a district court’s entry of a directed verdict at the
close of the plaintiff’s evidence at trial in a product liability case alleging defective design
of a ladder under Virginia law. 993 F.2d at 419-20, 421. We explained that the plaintiff’s
only expert witness did not present sufficient testimony that the ladder was dangerous
because he did not test the ladder to determine whether it “conformed to the published
industry standards.” Id. at 421. We also observed that the expert witness improperly and
subjectively opined that the ladder lacked certain safety features such as “triangular
bracing,” which was not required by industry standards. Id. at 419, 421.
In contrast to these decisions cited by Cerner, Dr. Koppel and Dr. Elkin did not rely
solely on general software design principles but identified concrete usability standards
15
USCA4 Appeal: 20-2270 Doc: 48 Filed: 11/29/2022 Pg: 16 of 35
recognized in the industry of electronic health records. 5 Both witnesses confirmed the
applicability of these standards to the design of software for automated default start times
for medical orders, and to the prevention of related errors by physicians using that software.
Dr. Koppel and Dr. Elkin applied the NIST and HIMSS usability standards in examining
Cerner’s electronic ordering software, and specifically considered the different features of
the order entry screen and the unsigned orders list in concluding that they were defectively
designed.
Accordingly, we hold that the district court erred on the present summary judgment
record in rejecting the industry standards relied upon by Dr. Koppel and Dr. Elkin. Those
experts (1) articulated industry standards creating a duty on the part of Cerner to design its
software to avoid the identified failures in its system, and (2) opined that Cerner violated
those industry standards in designing the system. 6 See Variety Stores, 888 F.3d at 659.
b. Consumer Expectations
5
This conclusion is not altered by Cerner’s additional reliance on Sardis. 10 F.4th
at 287-88. In that case, we explained that the industry standard relied on by the expert
witness was not applicable to the product at issue, and that the expert presented no
additional objective analysis to support his conclusion that the product was defectively
designed. Id.
6
Because the district court did not address Cerner’s Daubert motions, we consider
Dr. Koppel’s and Dr. Elkin’s opinions as part of the record on appeal without expressing
any opinion regarding the reliability or admissibility of their testimony. See Sedar v.
Reston Town Ctr. Prop., LLC, 988 F.3d 756, 760 n.2 (4th Cir. 2021) (citing Daubert v.
Merrell Dow Pharm, Inc., 509 U.S. 579 (1993)).
16
USCA4 Appeal: 20-2270 Doc: 48 Filed: 11/29/2022 Pg: 17 of 35
We also hold that Lowe presented sufficient evidence for a jury to conclude that
Cerner’s software contained design defects that violated “reasonable consumer
expectations.” Under Virginia law, reasonable consumer expectations are standards
“deemed appropriate by society,” Redman v. John D. Brush & Co., 111 F.3d 1174, 1181
(4th Cir. 1997) (applying Virginia law), and can be established by direct evidence,
published literature, or industry practices regarding a safety standard expected by
reasonable users of the product. Evans, 810 S.E.2d at 470; Alevromagiros, 993 F.2d at
420. Thus, a consumer’s subjective expectation, standing alone, is not sufficient to
establish a reasonable consumer expectation. Evans, 810 S.E.2d at 470 (“The subjective
expectations of a single user, however, are not sufficient to establish the objective,
reasonable expectations of consumers as a class.”); Redman, 111 F.3d at 1181.
The record before us shows that Dr. Koppel cited several published articles that
identified certain risks in the design and use of electronic health record software. He also
addressed several published studies, including a particular study discussing the software in
an electronic order entry system in which the selection of a “daily” dose of medication
defaulted to an 8:00 a.m. start time, which, if ordered at 3:00 p.m., would cause an improper
administration of that medication. Additionally, Dr. Koppel cited at least one complaint
by a user of Cerner’s software in 2009, in which a physician’s orders “were circumvented
by the software, resulting in orders that ‘defaulted to [the following] morning.’”
Although Dr. Koppel did not ultimately opine that the literature and studies he relied
on established a reasonable consumer expectation, the evidence he presented plainly was
relevant to that inquiry. See Evans, 810 S.E.2d at 470. And, contrary to the district court’s
17
USCA4 Appeal: 20-2270 Doc: 48 Filed: 11/29/2022 Pg: 18 of 35
conclusion that Cerner “received no customer complaints similar to those raised” in the
present case, Dr. Koppel described at least one complaint of a similar nature received by
Cerner in 2009.
We also observe that Dr. Booth’s testimony buttressed Dr. Koppel’s evidence of
consumer expectations. Dr. Booth had worked for many years using electronic ordering
software and was familiar with a competitor’s ordering software used at another medical
center. She testified that Cerner’s software worked differently than she expected and
differently from her experience with the competitor’s software in its treatment of default
start times. This evidence supplemented Dr. Koppel’s testimony regarding applicable
design issues requiring notice of default start times. Thus, we hold that Lowe presented
sufficient evidence at this stage of the proceedings to show that Cerner violated reasonable
consumer expectations in the design of its software.
We therefore hold that the district court erred in awarding summary judgment to
Cerner on the elements of duty and breach of duty, given the evidence of industry standards
and reasonable consumer expectations and of Cerner’s failure to design a system in accord
with those standards. Thus, we turn to consider the final element of Lowe’s negligent
design claim, namely, the element of proximate causation.
2. Proximate Causation
In awarding summary judgment to Cerner, the district court stated that the record
showed “multiple possible causes” of Taylor’s injuries, demonstrated in part by Taylor’s
settlement agreement with VHC and Dr. Booth’s employer. Adopting the position
advanced by Cerner, the district court held that Lowe’s expert witnesses, Dr. Koppel and
18
USCA4 Appeal: 20-2270 Doc: 48 Filed: 11/29/2022 Pg: 19 of 35
Dr. Elkin, “failed to take serious account of, or to rule out, VHC, Dr. Booth, or the nursing
staff as potential causes” of Taylor’s harm. The court held that this failure was “fatal” to
Lowe’s claims of negligence, and that Lowe did not establish with “reasonable certainty”
that Taylor’s injuries were caused by Cerner’s negligently designed software.
Lowe contends that the district court erred in this application of Virginia negligence
law on proximate causation, and in concluding that Lowe failed to present sufficient
evidence to present a jury question on that issue. In particular, Lowe asserts that the district
court erred in holding that her expert witnesses, Dr. Koppel and Dr. Elkin, were required
to “rule out” the negligent actions of other tortfeasors as causes of Taylor’s injuries. Lowe
submits that contrary to the district court’s holding, Virginia law provides that multiple
proximate causes may contribute to an injury and, thus, that she was required to show only
that Cerner’s software design defects and Cerner’s failure to warn users of those defects
were themselves proximate causes contributing to Taylor’s injuries. 7 Lowe argues that
based on this well-established standard, she presented sufficient evidence of proximate
causation to permit a jury to find in her favor.
7
Lowe also argues that the district court erred in denying summarily her motion for
partial summary judgment, in which Lowe sought to prevent Cerner from raising a
superseding cause defense. Because the district court did not provide any rationale for its
ruling, we are unable to consider the ruling on appeal. Certain Underwriters at Lloyd’s v.
Axon Pressure Prods. Inc., 951 F.3d 248, 272 (5th Cir. 2020); see Thomas v. Berryhill, 916
F.3d 307, 312-13 (4th Cir. 2019) (holding that ALJ’s failure to provide sufficient
explanation prevented “meaningful appellate review” of the decision and required us to
vacation and remand). Accordingly, we vacate the district court’s ruling denying Lowe’s
motion for partial summary judgment. Upon remand, Lowe may renew its motion, and the
district court can consider it in accordance with the Virginia principles of proximate
causation set forth in this opinion.
19
USCA4 Appeal: 20-2270 Doc: 48 Filed: 11/29/2022 Pg: 20 of 35
In response, Cerner argues that there were numerous “obvious alternative causes”
of Taylor’s injuries, including VHC’s role in configuring the adaptable portion of the
software, Dr. Booth’s error in entering the continuous pulse oximetry order when
approving the unsigned orders list, VHC’s failure to train physicians using the software,
and VHC’s nursing staff errors in failing to recognize the need to provide Taylor with
continuous oxygen monitoring and in failing to check Taylor’s vital signs every four hours.
Cerner argues that because Lowe’s expert witnesses did not address these other causes of
Taylor’s injuries, Lowe failed, as a matter of law, to establish that Cerner was a proximate
cause of Taylor’s injuries. We disagree with Cerner’s position. As explained below, we
first address the requirements of proximate causation under Virginia law, and we next
review the sufficiency of Lowe’s evidence at the summary judgment stage to satisfy those
requirements.
A proximate cause of an event is an act or omission that in natural and continuous
sequence produces the event, and without which that event would not have occurred.
Kellermann v. McDonough, 684 S.E.2d 786, 793 (Va. 2009); Ford Motor Co. v. Boomer,
736 S.E.2d 724, 731 (Va. 2013) (explaining that proximate cause is a necessary antecedent
of injury). Under Virginia law, there may be more than one proximate cause of an injury.
Williams v. Le, 662 S.E.2d 73, 77 (Va. 2008). When the concurring negligence of more
than one cause produces a single injury, each negligent act is a proximate cause of that
injury and each of these multiple actors is liable for the injury. Id. In other words, under
Virginia law, it is not required that a plaintiff “show that an act, claimed to have been the
proximate cause of a certain result, was the only cause.” Schools v. Walker, 47 S.E.2d 418,
20
USCA4 Appeal: 20-2270 Doc: 48 Filed: 11/29/2022 Pg: 21 of 35
423 (Va. 1948) (emphasis added) (quoting Chesapeake & O. Ry. Co. v. Wills, 68 S.E. 395,
397 (Va. 1910)); accord White Consol. Ind. Inc. v. Swiney, 376 S.E.2d 283, 286 (Va. 1989).
Instead, it is sufficient that a plaintiff show “that the defendant’s act produced or set in
motion other agencies, which in turn produced or contributed to the final result.” Von Roy
v. Whitescarver, 89 S.E.2d 346, 352 (Va. 1955) (quoting Chesapeake & O. Ry. Co., 68 S.E.
at 397); accord Ford Motor Co., 736 S.E.2d at 731.
Under certain conditions, a proximate cause of an event also may be a superseding
cause of that event. Williams v. Joynes, 677 S.E.2d 261, 264 (Va. 2009). A superseding
cause is an intervening act that severs the link of proximate causation between an initial
act of negligence and the resulting harm. Id.; Hubbard v. Murray, 3 S.E.2d 397, 401 (Va.
1939). By entirely supplanting another act of negligence, a superseding cause relieves the
initial negligent actor from liability and, thus, becomes the only proximate cause of the
plaintiff’s injury. Joynes, 677 S.E.2d at 264; Le, 662 S.E.2d at 77; Jenkins v. Payne, 465
S.E.2d 795, 799 (1996). Critically, the defendant bears the burden of demonstrating the
existence of a superseding cause by showing that another’s negligence alone, “without any
contributing negligence by the defendant in the slightest degree, causes the injury.”
Jenkins, 465 S.E.2d at 799; see Atkinson v. Scheer, 508 S.E.2d 68, 72 (Va. 1998); Panousos
v. Allen, 425 S.E.2d 496, 499 (Va. 1993). An intervening act does not qualify as a
superseding cause when the intervening act was set in motion by the initial act of
negligence. Joynes, 677 S.E.2d at 264; Philip Morris Inc. v. Emerson, 368 S.E.2d 268,
277 (Va. 1988).
21
USCA4 Appeal: 20-2270 Doc: 48 Filed: 11/29/2022 Pg: 22 of 35
Here, the parties do not dispute that Taylor’s injuries resulted from a lack of oxygen,
and that continuous monitoring of Taylor’s oxygen level would have prevented his hypoxia
and brain damage. Under the summary judgment standard, Lowe bore the burden of
producing sufficient evidence from which a jury could find that Cerner’s negligently
designed software was a proximate cause of Taylor’s injuries. See Le, 662 S.E.2d at 77;
Ford Motor Co., 736 S.E.2d at 731. Lowe was not required to address any other proximate
causes of Taylor’s injuries, or to eliminate such other proximate causes as a source of those
injuries. Instead, Lowe was required to show only that negligence on Cerner’s part was a
necessary antecedent of Taylor’s injuries. See Ford Motor Co., 736 S.E.2d at 731.
Therefore, we hold that the district court erred in concluding that Lowe was required to
“rule out” other causes of Taylor’s injury.
Our conclusion is not altered by Cerner’s argument that other possible causes of
Taylor’s injuries affect whether Lowe established causation attributable to Cerner.
According to Cerner, Dr. Booth was negligent in using the software, the nursing staff was
negligent in failing to monitor Taylor’s oxygen level, and VHC was negligent in
configuring its order entry screen permitting Dr. Booth to select an option that altered her
desired start time. Any consideration of these alternative causes of injury is relevant only
to the extent that Cerner can show that a third-party tortfeasor’s conduct wholly supplanted,
or superseded, its own negligence in causing the injury. See Joynes, 677 S.E.2d at 264; Le,
662 S.E.2d at 77. And notably, Cerner, not Lowe, would bear the burden to show that a
third party’s negligence broke the link between Cerner’s negligence and the injury to
become the sole cause of Taylor’s injuries. See Atkinson, 508 S.E.2d at 72. To be relieved
22
USCA4 Appeal: 20-2270 Doc: 48 Filed: 11/29/2022 Pg: 23 of 35
of liability, Cerner would have to establish that its conduct did not contribute to cause
Taylor’s injuries “in the slightest degree.” 8 See Jenkins, 465 S.E.2d at 799. For these
reasons, we hold that the district court erred in setting forth the standards of proximate
causation under Virginia law.
Additionally, we hold that Lowe presented sufficient evidence at this stage of the
proceedings to permit a jury to find that Cerner’s negligence was a proximate cause of
Taylor’s injuries. Dr. Koppel addressed in his report the problems with electronic ordering
software in which “a doctor’s orders [are] circumvented by the software, resulting in orders
that ‘default[] to [the following] morning.’” As applied to the present case, Dr. Koppel
opined that Dr. Booth intended to order continuous pulse oximetry immediately, but that
the software “circumvented her order and her intentions.” Additionally, Dr. Koppel opined
that the “difference between what [Dr. Booth] thought she ordered and what the nurse saw
was due to a defective and/or invisible changing of [Dr. Booth’s] order” by the software
and the fact that a physician can “approve” a group of orders after viewing only “the first
couple of orders.”
Dr. Elkin discussed the risks inherent when an entry by a physician is “overwritten”
by a default value established in the electronic ordering software. Dr. Elkin explained that,
in this case, Dr. Booth intended an immediate start time, which was overridden
electronically to show a default start time without notifying Dr. Booth of the change.
8
Although Cerner did not argue in its brief filed in this Court that other causes
served as a superseding cause, Cerner did preserve this argument in the district court in its
opposition to Lowe’s motion for partial summary judgment.
23
USCA4 Appeal: 20-2270 Doc: 48 Filed: 11/29/2022 Pg: 24 of 35
According to Dr. Elkin, this design defect proximately caused the failure to continuously
monitor Taylor’s oxygen level.
Dr. Elkin also explained that on the unsigned orders list, the order for pulse oximetry
“was at the very bottom” of the list of 30 orders entered by Dr. Booth. He opined that
because Dr. Booth could approve all 30 orders at once, “without actually looking” at the
orders, Dr. Booth “was able to transmit the order without ever seeing the pulse oximetry
order.” This defect, in Dr. Elkin’s view, also caused the failure to monitor Taylor’s oxygen
level on a continuing basis.
In addition, Dr. Booth’s deposition testimony established that when she entered the
continuous pulse oximetry order, she (1) relied on the start time as the present time
displayed on the order entry screen, and (2) did not see the improper start time of 10:00 am
listed for pulse oximetry in the list of unsigned orders before ultimately confirming that
group of orders. From this evidence, a jury reasonably could conclude that the software
design defects, allowing an incorrect “start time” to appear on the order entry screen, and
permitting a physician to approve all her orders as a group without scrolling through the
data associated with each order, caused the failure to monitor continuously Taylor’s oxygen
level and resulted in his injuries. Accordingly, we conclude that the district court erred in
holding that Lowe failed to present sufficient evidence of proximate causation on the
negligent design claim.
Because the summary judgment record, fully considered and construed in Lowe’s
favor, was sufficient to establish all the elements of Lowe’s negligent design claim, we
hold that the district court erred in awarding summary judgment to Cerner on this claim.
24
USCA4 Appeal: 20-2270 Doc: 48 Filed: 11/29/2022 Pg: 25 of 35
We therefore vacate the court’s judgment on the negligent design claim and remand that
claim for trial. We next turn to consider Lowe’s failure to warn claim.
B.
Failure To Warn Claim
In asserting a failure to warn claim under Virginia law, a plaintiff must establish
that the manufacturer of a product knew or had reason to know that its product was likely
to be dangerous for its intended use. Funkhouser v. Ford Motor Co., 736 S.E.2d 309, 313
(Va. 2013). No duty exists, however, when the product’s user was or should have been
aware of a danger that was obvious. Austin v. Clark Equip. Co., 48 F.3d 833, 836 (4th Cir.
1995); see Funkhouser, 736 S.E.2d at 313. To show that a defendant breached its duty to
warn, a plaintiff must show that the defendant failed to exercise reasonable care to inform
the user of the product’s dangerous condition. Funkhouser, 736 S.E.2d at 313. Finally, a
plaintiff must show that the defendant’s failure to warn caused the plaintiff’s injuries.
Featherall v. Firestone Tire & Rubber Co., 252 S.E.2d 358, 369 (Va. 1979).
The district court held that Lowe failed to present sufficient evidence to support her
failure to warn claim and awarded judgment in Cerner’s favor on that claim. In particular,
the court held that Lowe “provided no evidence” that Cerner knew or had reason to know
that its software was dangerous for its intended use. Although the court acknowledged that
Lowe submitted evidence of a complaint from a physician who used the software in another
hospital in 2009, the court characterized that complaint as a “request” to change the “start
time” field on the order entry screen from a grey-colored font to a red or yellow display.
The court found that this complaint did not include an affirmative statement of patient harm
25
USCA4 Appeal: 20-2270 Doc: 48 Filed: 11/29/2022 Pg: 26 of 35
and that, therefore, the complaint was insufficient to put Cerner on notice that the software
could cause injury. The court further held that VHC, as the “user,” should have been aware
of the “defects” in Cerner’s software because VHC configured the software to include a
10:00 a.m. default start time and had used the software for many years without complaint. 9
Lowe argues on appeal that the record contained sufficient evidence to establish that
Cerner was on notice that its software was dangerous, triggering Cerner’s duty to warn.
Lowe also argues that the court failed to address the evidence that Dr. Booth, as a user of
the software, was unaware of the dangerous aspects of the software involving the default
start time. Thus, Lowe submits that Cerner was not relieved of its duty to warn because a
jury could conclude that the danger was not apparent to the user of the software.
In response, Cerner maintains that the district court correctly concluded that Cerner
was not on notice of the software’s alleged dangerous feature. According to Cerner, Lowe
did not establish a “substantial similarity” between the 2009 complaint made to Cerner and
the defect alleged by Lowe because the 2009 complaint did not include a report of harm to
a patient. Cerner also summarily asserts that the question whether Dr. Booth was aware of
9
We observe that the district court also concluded that VHC was a “sophisticated
billion-dollar hospital” and necessarily should have realized any “dangerous conditions”
in the software. In Cerner’s motion for summary judgment, however, it did not advance a
“sophisticated user” defense to argue that VHC had equal knowledge of the dangers of the
software and, thus, may have been responsible to protect its employees and other users of
the ordering software. See Willis v. Raymark Indus., 905 F.2d 793, 796 (4th Cir. 1990)
(applying Virginia law). If upon remand, Cerner asserts such a defense at trial, Cerner
bears the burden to establish that defense. See id.26
USCA4 Appeal: 20-2270 Doc: 48 Filed: 11/29/2022 Pg: 27 of 35
any dangerous aspect of the software is irrelevant to Cerner’s duty to warn. We disagree
with Cerner’s position.
A plaintiff can prove that a defendant has notice of a dangerous condition in its
product by showing evidence of a similar incident so long as that incident occurred under
“substantially the same circumstances” and was “caused by the same or similar defects and
dangers as those in issue.” Funkhouser, 736 S.E.2d at 313-14 (quoting Roll ‘R’ Way Rinks,
Inc. v. Smith, 237 S.E.2d 157, 160 (1977)). Here, the district court erred in construing the
2009 complaint as a mere request to change the font color of the software program’s start
time display. As previously described, in that 2009 complaint, a physician reported that
Cerner’s software circumvented the intended start time for a patient’s medication, resulting
in the patient failing to receive medication until the next day. Cerner’s representatives later
altered the appearance of the actual start time on that hospital’s software to a brighter color
“so the physician is more aware” of the start time entry. Although the 2009 complaint did
not state whether the patient suffered harm by failing to receive the intended first dose of
medication, the danger inherent in the software’s ability to override a physician’s intended
medical order was made apparent by this complaint. Thus, we conclude that the 2009
complaint was sufficient to show that Cerner was on notice that the software contained
dangerous features relating to the entry of medical orders.
The 2009 complaint also was evidence that Cerner had reason to know that
physician users of its software could be unaware that default start times embedded in the
program could override a physician’s intended start time for an order. Dr. Booth likewise
stated that she was unaware of the default start time dangers inherent in the software.
27
USCA4 Appeal: 20-2270 Doc: 48 Filed: 11/29/2022 Pg: 28 of 35
Because Dr. Booth was a physician working at VHC, which had purchased and
implemented the software, she was a user of the software for purposes of Cerner’s alleged
duty to warn. See Featherall, 252 S.E.2d at 366 (explaining that a duty to warn “extends
not only to the immediate purchaser but to other persons who might in the ordinary and
natural course of events be subjected to [the] danger”). Thus, the district court erred in
concluding that Lowe failed to present sufficient evidence at this stage of the proceedings
that Cerner had a duty to warn users of this danger inherent in its software, and that Cerner
breached that duty in this case. 10
We therefore turn to the element of proximate causation. Based on the principles
discussed above, we easily conclude from the present record that Cerner’s failure to warn
VHC and Dr. Booth about the software’s defects presented a question for the jury regarding
whether that failure to warn was a proximate cause of Taylor’s injuries. A jury reasonably
could infer that if Dr. Booth had been warned that an alternate default start time had been
triggered by the software, overriding her intended start time, continuous pulse oximetry
would have begun immediately after Taylor’s surgery, thereby preventing his injuries.
Accordingly, because Lowe presented sufficient evidence at this stage of the proceedings
to establish all the elements of a failure to warn claim, the district court erred in awarding
summary judgment in favor of Cerner on that claim.
10
We further conclude that the evidence was insufficient to support a failure to warn
claim based solely on the configuration of the unsigned orders list. However, the evidence
from Lowe’s expert witnesses and Dr. Booth concerning the unsigned orders list
nevertheless was relevant to the failure to warn claim addressing the start time override.
28
USCA4 Appeal: 20-2270 Doc: 48 Filed: 11/29/2022 Pg: 29 of 35
III.
For these reasons, we vacate the district court’s judgment on both Lowe’s negligent
design claim and her failure to warn claim, and we remand those claims to the district court
for trial.
VACATED AND REMANDED
29
USCA4 Appeal: 20-2270 Doc: 48 Filed: 11/29/2022 Pg: 30 of 35
WILKINSON, Circuit Judge, dissenting:
There is one reason, and one reason only, that the manufacturer is a defendant in
this suit. It has a deep pocket. Plaintiff’s settlement with Virginia Hospital Center (VHC)
within the limits established by Virginia medical-malpractice law was not enough. The
benefits provided by Medicare, presumably covering some medical expenses but not life-
care expenses, were not enough. So plaintiff’s recourse was to sue the manufacturer, not
because it was culpable but because it could pay out. I do not criticize plaintiff for pursuing
this course of action in a deeply tragic case, but I do take exception to the majority’s
application of several basic principles of products liability law.
Ruby Lowe filed suit against Cerner Health Services on behalf of her severely
injured grandson Michael Taylor. Cerner is in the business of making software that
transmits medical orders. Lowe must of course prove every element of her claim. Her case
runs aground on an inability to create an issue of triable fact as to proximate causation for
Taylor’s injury. Causation is an element both of plaintiff’s design-defect and failure-to-
warn claims. Some 32,000 pages of discovery and the designation of seven experts have
produced only pretty thin gruel. A record this thick often suggests a fishing expedition, as
I think it does here. I would thus affirm the judgment.
As to causation, this is a “many hands” case. Dr. Alexandra Booth and the hospital
staff provided the most immediate set of hands with respect to Taylor’s care. The
manufacturer’s involvement, if such there was, was remote and attenuated. Checking the
patient’s blood-oxygen level is a standard medical procedure. Monitoring blood-oxygen
30
USCA4 Appeal: 20-2270 Doc: 48 Filed: 11/29/2022 Pg: 31 of 35
levels is “routine”: Doctors and hospitals know how to do it, because they do it all the time.
Appellant Br. 14. They know to be careful, not sloppy.
In this very case, personnel throughout the hospital had been placing orders with the
manufacturer’s software for six years without mishap. J.A. 3880. It happened that on this
day, Booth failed when reviewing the orders for Taylor to notice the start time correctly
displayed on the software’s summary screen. J.A. 3867. She likewise filled out a field on
the ordering screen that she claims confused her, where “[n]one of those options ma[d]e
any sense,” and then signed off on a full slate of orders despite her professed apprehension
around language on the summary screen. J.A. 3866.
Similarly, multiple lapses made by hospital staff do not inspire confidence that a
correct order from Booth would have even been obeyed. First, hospital staff failed to
respond to a duplicative order from Taylor’s anesthesiologist concerning the same blood-
oxygen monitoring device that Booth had ordered for the following day. J.A. 3865. Second,
they failed to heed an order from Booth requesting that Taylor’s vital signs be checked
every four hours. (During a 5.5-hour period, which only ended when Booth herself visited
Taylor, no check was performed. J.A. 3867.) And third, hospital staff did not attempt to
confirm or corroborate the delayed start time in Booth’s order, despite that instruction
being inconsistent with two other orders that Booth had placed also concerning Taylor’s
oxygen levels. J.A. 3865–67.
It is understandable that those immediately responsible for Taylor’s care would seek
to place blame for this sad outcome everywhere but on themselves. One can appreciate also
how this could happen. Hospitals are busy places. Doctors and nurses have many patients
31
USCA4 Appeal: 20-2270 Doc: 48 Filed: 11/29/2022 Pg: 32 of 35
to monitor. Different shifts demand hand-offs. Things can get lost or fall through the
cracks. Fatigue at the end of a shift can set in. There is, in short, a lot to keep track of. There
was nothing malign or intentional about Booth’s mistake or the hospital’s faulty oversight
here. It was a simple, classic case of negligence. Unfortunately, negligence can cause
devastating consequences far out of proportion to the state of mind that brings them about.
It is true, as the majority observes, that Virginia law does not require plaintiff to
“rule out” all other causes in a multiple-cause case. Majority Op. 22. The Commonwealth
recognizes that “[t]here may be more than one proximate cause of an event.” Kellermann v.
McDonough, 684 S.E.2d 786, 793 (Va. 2009). But this general proposition of law does not
go as far as the majority takes it. In reality, the proposition refers to scenarios in which
multiple parties each furnished but-for causes. Thus, in a case involving two negligent
drivers, both drivers were found liable since “the collision . . . would not have occurred”
absent either’s errors. Von Roy v. Whitescarver, 89 S.E.2d 346, 352–53 (Va. 1955). Or, in
a case over tortious medical prescriptions, both the pharmacist and doctor could have been
liable since their “independent acts of negligence” operated in tandem. Sullivan v.
Robertson Drug Co., 639 S.E.2d 250, 252–53, 255 (Va. 2007). But the law of causation,
while nuanced and open to massaging, still requires at bottom more than a “conjecture,
guess, or random judgment” that the defendant’s acts brought about the ultimate injury.
Town of W. Point v. Evans, 299 S.E.2d 349, 351 (Va. 1983). Therefore, expert references
to HIMSS, NIST 7804, and “usability factors” notwithstanding, “[n]egligence and an
accident . . . do not make a case.” Wells v. Whitaker, 151 S.E.2d 422, 428 (Va. 1966)
(quoting Hawkins v. Beecham, 191 S.E. 640, 643 (Va. 1937)).
32
USCA4 Appeal: 20-2270 Doc: 48 Filed: 11/29/2022 Pg: 33 of 35
The causation analysis is even more problematic when one considers the weakness
of plaintiff’s design-defect claim. The two elements are not unrelated. The more severe the
defect, the easier it is for a plaintiff to survive summary judgment by “eliminat[ing] the
possibility that the blame attaches to some party other than” the manufacturer. Logan v.
Montgomery Ward & Co., 219 S.E.2d 685, 688 (Va. 1975). Here, plaintiff’s theory for a
design defect is tenuous. For all the opining of her seven experts, “[t]he manufacturer is
not an insurer and is not required to design and market an accident-proof product.”
Turner v. Manning, Maxwell & Moore, Inc., 217 S.E.2d 863, 868 (Va. 1975). That the
manufacturer’s supposed defects are speculatively linked, as here, only to a single injury
suggests that the majority is wrongly scouring for “the safest conceivable design,” not a
“reasonably safe product[].” Redman v. John D. Brush & Co., 111 F.3d 1174, 1177
(4th Cir. 1997). One accident in six years of frequent use does not a “hard coded” defect
make. J.A. 2879.
In products liability litigation, summary judgment is often the whole candle. If
plaintiffs lose, they’re out of court. If defendants lose, they may be forced to settle for an
exorbitant sum in order to avoid an even more ruinous award of damages. In a sad case like
this, a jury would understandably be drawn to Taylor’s tragic circumstances and do what
it could to help. Jurors might return home and—again understandably—believe they have
done a Good Turn for the day.
This to me suggests the need for real caution in summary judgment rulings. The law
tells us that jury verdicts are not to be based on “sympathy,” Rutherford v. Zearfoss, 272
33
USCA4 Appeal: 20-2270 Doc: 48 Filed: 11/29/2022 Pg: 34 of 35
S.E.2d 225, 228 (Va. 1980), or “speculation,” Shepherd v. Davis, 574 S.E.2d 514, 524
(Va. 2003). Yet a verdict here would show a high likelihood of being based on both.
This danger should be mitigated by returning the case to the district court for review
of defendant’s summary judgment motion in accordance with the standards the majority
now announces. Pushing a thin case to a jury with such a high potential for a sympathy
verdict is, at this point, wholly premature. If, as the majority holds, plaintiff is not required
to rule out all causes in addition to that of the defendant, the district court should at least
be given an opportunity to review the record under the correct standard. The district court
should also be given the chance before ruling on the summary-judgment motion to
determine whether the testimony of plaintiff’s experts would be admissible at trial under
the well-known criteria of Daubert v. Merrell Dow Pharmaceuticals, Inc., 509 U.S. 579(1993). It may be that the district court would ultimately send the case to trial, but a basic
concern for fair process as well as the role of district courts demands a review of the record
under the correct principles of law.
A sense of balance in this kind of case is crucial. The plaintiff’s bar provides a real
service in products liability cases. Well-founded suits have, in my judgment, helped to
ensure a safer world. No doubt the fear and apprehension of litigation have caused many a
manufacturer to keep a risky product off the market or at least to delay its introduction until
those risks have been minimized.
And yet safety does not cut just one way. The technological advances that often
come with new products can enhance safety too. Consider the automobiles of the 1950s.
With their shattering glass and shiny chrome and fancy fins, they were still death traps. It
34
USCA4 Appeal: 20-2270 Doc: 48 Filed: 11/29/2022 Pg: 35 of 35
was only technical advances in the form of shatterproof windshields, seat belts and
shoulder straps, roll bars, and the like that brought about safer travel. See Charles M.
Farmer & Adrian K. Lund, The Effects of Vehicle Redesign on the Risk of Driver Death,
16 Traffic Inj. Prevention 684, 684–90 (2015).
The point is easily expanded beyond automobiles. Fear of this sort of litigation has
the potential to deter products that might enhance patient care and recovery and even, in
some cases, hold down costs. See, e.g., Jacobs v. E.I. du Pont de Nemours & Co., 67 F.3d
1219, 1241 (6th Cir. 1995) (making the supplier liable for users’ mistakes would “stymie
the kind of beneficial scientific innovation” recurrent in “human endeavor”); Keith N.
Hylton, The Law and Economics of Products Liability, 88 Notre Dame L. Rev. 2457, 2497
(2013) (“[H]igh levels of uncertainty are likely to be met with withdrawal from the product
innovation process.”). A suit like this one runs the risk of retarding the safety and utility
that innovative technologies can bring.
Post hoc ergo propter hoc. (After which, because of which.) What part that nostrum
played in Roman law I do not know. The venerable Latin phrase, however, cannot be the
sole basis of modern tort liability. Causation requires more than the mere sequencing of
time.
What happened here is sad beyond measure. But holding an innocent party culpable
is not the law. I respectfully and reluctantly dissent. May fastening consequences where
they belong show us to a safer day.
35