Ruby Lowe v. Cerner Corporation

• Court: Court of Appeals for the Fourth Circuit
• Decided: November 29, 2022
• Docket: 20-2270
• Status: Unpublished

Opinion

USCA4 Appeal: 20-2270 Doc: 48 Filed: 11/29/2022 Pg: 1 of 35

UNPUBLISHED

UNITED STATES COURT OF APPEALS FOR THE FOURTH CIRCUIT

No. 20-2270

RUBY L. LOWE, Power of Attorney for Michael A. Taylor, disabled,

Plaintiff - Appellant,

v.

CERNER CORPORATION,

Defendant - Appellee.

Appeal from the United States District Court for the Eastern District of Virginia, at Alexandria. Claude M. Hilton, Senior District Judge. (1:19−cv−00625−CMH−TCB)

Argued: September 13, 2022 Decided: November 29, 2022

Before WILKINSON, Circuit Judge, and KEENAN and MOTZ, Senior Circuit Judges.

Vacated and remanded by unpublished opinion. Senior Judge Keenan wrote the majority opinion, in which Senior Judge Motz joined. Judge Wilkinson wrote a dissenting opinion.

ARGUED: Mikhael D. Charnoff, PERRY CHARNOFF PLLC, Arlington, Virginia, for Appellant. David Brent Dwerlkotte, SHOOK, HARDY & BACON, L.L.P., Kansas City, Missouri, for Appellee. ON BRIEF: Scott M. Perry, PERRY CHARNOFF PLLC, Arlington, Virginia, for Appellant. Amy M. Crouch, SHOOK, HARDY & BACON L.L.P., Kansas City, Missouri; Roman Lifson, Belinda D. Jones, CHRISTIAN & BARTON, L.L.P., Richmond, Virginia, for Appellee. USCA4 Appeal: 20-2270 Doc: 48 Filed: 11/29/2022 Pg: 2 of 35

Unpublished opinions are not binding precedent in this circuit.

2 USCA4 Appeal: 20-2270 Doc: 48 Filed: 11/29/2022 Pg: 3 of 35

BARBARA MILANO KEENAN, Senior Circuit Judge:

In this product liability negligence action, Ruby L. Lowe, on behalf of her injured

grandson Michael A. Taylor, filed suit against Cerner Health Services, Inc. (Cerner), the

developer and seller of a software system used for entry of medical orders for patient care.

Cerner sold its software system to the Virginia Hospital Center (VHC, or the hospital),

where Taylor was a patient. Taylor suffered brain damage and resulting physical

impairments at VHC after failing to receive “continuous pulse oximetry” as intended by

his physician, who had entered an order for that care into the Cerner system used by VHC.

Lowe asserted negligence claims against Cerner under Virginia law, alleging that

the Cerner software was negligently designed (the negligent design claim), and that Cerner

negligently failed to warn system users of those design defects (the failure to warn claim).

Lowe asserted that Cerner’s negligent acts caused the failure to properly monitor Taylor’s

oxygen level, and that proper monitoring would have prevented Taylor’s injuries. The

district court awarded summary judgment to Cerner.

Upon our review, we hold that the district court erred in awarding summary

judgment to Cerner on both claims. On the record before us, a jury reasonably could

conclude that Cerner’s software contained two design defects that did not comply with

industry standards or satisfy reasonable consumer expectations. We also hold that the

district court misstated Virginia law on proximate causation, which provides that there can

be more than one cause of an injury and, contrary to the court’s holding, did not require

Lowe to eliminate other causes of the injury. Lowe presented sufficient evidence for a jury

to conclude that the software defects were a proximate cause of Taylor’s injuries. We also

3 USCA4 Appeal: 20-2270 Doc: 48 Filed: 11/29/2022 Pg: 4 of 35

hold that the court erred in awarding summary judgment to Cerner on Lowe’s failure to

warn claim. That evidence likewise was sufficient for a jury to conclude that Cerner failed

to warn users about the software design defects and that Cerner’s failure to do so was a

proximate cause of Taylor’s injuries. We therefore vacate the district court’s judgment and

remand the case for trial on both claims.

I.

We recite the facts, and reasonable inferences that can be drawn from those facts,

in the light most favorable to Lowe as the nonmoving party. Betton v. Belue, 942 F.3d 184,

191 (4th Cir. 2019). On April 5, 2016, Dr. Alexandria Booth performed surgery on 25-

year-old Taylor to remove his gall bladder. Because Taylor suffered from sleep apnea and

other medical conditions, Dr. Booth intended that Taylor receive “continuous pulse

oximetry” as he recovered from surgery. 1 Pulse oximetry measures a patient’s oxygen

level in the blood, and typically is measured by placing a monitoring device on the patient’s

finger. When a patient’s oxygen level is monitored continuously, an alarm sounds when

the patient’s oxygen level falls below a certain percentage. The alarm alerts hospital staff

and wakes the patient so that the situation can be addressed before injury occurs.

After Taylor’s surgery, Dr. Booth entered an order for “continuous pulse oximetry”

into the health record software developed by Cerner and used at VHC. Dr. Booth intended

Taylor’s anesthesiologist also intended that Taylor have continuous pulse oximetry 1

monitoring and issued a “postoperative evaluation” regarding Taylor and included a handwritten note: “Admit to floor w/ continuous pulse oximetry. [staff] notified.” Dr. Booth explained that “either [this handwritten] order wasn’t conveyed or it was ignored.”

4 USCA4 Appeal: 20-2270 Doc: 48 Filed: 11/29/2022 Pg: 5 of 35

that this order be effective from the time she entered the order, at 4:34 p.m. on April 5,

2016, until Taylor’s expected discharge from the hospital on April 6, 2016. As explained

in more detail below, the order for continuous pulse oximetry did not take effect until 10:00

a.m. on April 6, 2016. Thus, Taylor was not provided continuous oxygen monitoring

during the night of, or in the morning after, his surgery.

At 5:01 a.m. on April 6, 2016, the hospital nursing staff checked Taylor’s vital signs,

which were normal. Pursuant to hospital guidance, another check of Taylor’s vital signs

should have occurred around 9:00 a.m., but did not. Around 10:30 a.m., Dr. Booth found

Taylor unresponsive and in respiratory distress. Taylor suffered a “respiratory arrest,”

which caused “hypoxia,” a deficiency of oxygen reaching the tissues of the body, and brain

damage. As a result, Taylor cannot walk, bathe, or use the bathroom independently. The

parties do not dispute that if Taylor’s oxygen level had been monitored continuously, his

resulting hypoxia and brain damage would not have occurred.

Taylor’s grandmother, Lowe, filed an action alleging medical malpractice against

Dr. Booth’s employer and VHC. The parties to that action later entered into a settlement

agreement. Lowe also filed the present action against Cerner, seeking $50 million in

damages. 2 Lowe alleged that there were two design defects in Cerner’s electronic ordering

software, and that Cerner failed to warn users of those defects. Lowe asserted that these

defects, and Cerner’s failure to warn users of its product of those defects, caused Dr. Booth

2 Lowe initially filed suit in a Virginia circuit court, and Cerner removed the suit to federal district court under that court’s diversity jurisdiction.

5 USCA4 Appeal: 20-2270 Doc: 48 Filed: 11/29/2022 Pg: 6 of 35

inadvertently to enter the continuous pulse oximetry order as beginning at 10:00 a.m. the

day after Taylor’s surgery, instead of immediately after the surgery.

As alleged by Lowe, the first defect relevant to this appeal related to the software’s

“order entry screen,” on which a physician enters specific information about the medical

care that the hospital staff is required to administer to the patient. On the order entry screen,

the “start time” for these orders appeared automatically as the date and time of entry. The

order entry screen also contained drop-down menus to direct the frequency and recurrence

of the particular care directed. For the frequency, Dr. Booth chose “daily,” and for the

recurrence, she selected “once.” Unbeknownst to Dr. Booth, her selection of “once”

triggered an automatic start time of 10:00 a.m. that VHC had implemented based on when

its pharmacy filled medication orders. Despite this 10:00 a.m. start time, however, the

order entry screen continued to display the start time for continuous pulse oximetry as April

5, 2016, at 4:34 p.m. This feature was “hardcoded” into the software developed by Cerner,

meaning that VHC could not alter the order entry screen’s start time display.

After inputting the above instructions on the order entry screen, Dr.

Booth next selected “add to order session,” which electronically moved those orders to the

“unsigned orders list.” The unsigned orders list contained the second, related design defect

alleged by Lowe.

The unsigned orders list displayed all the orders entered by a physician, and

Cerner’s software required that the physician approve the list before those orders would

take effect. The last of the 30 orders entered by Dr. Booth for Taylor’s care appeared on

the list as “Pulse oximetry: Continuous Once As Ordered; start on 4/6/2016 at 10:00.”

6 USCA4 Appeal: 20-2270 Doc: 48 Filed: 11/29/2022 Pg: 7 of 35

However, the unsigned orders list contained detailed information for each order in a

“stacked” format, displaying the details of only the first few orders. Thus, a physician was

required to scroll across “multiple computer screens” to review the details of each order.

If the physician did not review the details of each order, she nevertheless could

electronically sign, or approve, all the pending orders as a group.

Dr. Booth stated that she did not see the 10:00 a.m. start time for the pulse oximetry

order on the unsigned orders list, and instead relied on the start time shown on the order

entry screen. According to Dr. Booth, she did not expect the start time for the continuous

pulse oximetry order to “change[]” between the order entry screen and the unsigned orders

list. Therefore, Dr. Booth electronically accepted all the orders, including the continuous

pulse oximetry with the improper 10:00 a.m. start time.

Dr. Booth had practiced medicine as a surgeon for 16 years, and had been using

Cerner’s software at VHC for several years. Dr. Booth also stated that she had used a

different software program at another medical center and had not encountered the same

start time problem at that other location.

After Lowe filed suit against Cerner, the parties engaged in extensive discovery.

Cerner later moved for summary judgment, and Lowe moved for partial summary

judgment seeking to prevent Cerner from asserting at trial that any third-party’s conduct

was the sole or superseding cause of Taylor’s injuries. Lowe submitted for the court’s

consideration testimony and reports from several expert witnesses, including the deposition

testimony of Taylor’s surgeon, Dr. Booth. Lowe also presented testimony and reports

prepared by two of her designated expert witnesses in the field of use of electronic health

7 USCA4 Appeal: 20-2270 Doc: 48 Filed: 11/29/2022 Pg: 8 of 35

records: Ross Koppel, Ph.D., a professor of biomedical informatics, and Peter Elkin, M.D.,

a board-certified physician in clinical informatics and professor of biomedical informatics.

Both Lowe and Cerner also filed several Daubert motions and other motions in limine.

Without ruling on the parties’ evidentiary motions, the district court granted

Cerner’s motion for summary judgment and summarily denied Lowe’s motion for partial

summary judgment. Lowe later filed the present appeal.

II.

We review de novo the district court’s decision granting summary judgment. RXD

Media, LLC v. IP Application Dev. LLC, 986 F.3d 361, 372 (4th Cir. 2021). Summary

judgment is appropriate only “if the movant shows that there is no genuine dispute as to

any material fact and the movant is entitled to judgment as a matter of law.” Fed. R. Civ.

P. 56(a). Summary judgment may not be granted “merely because the court believes that

the movant will prevail if the action is tried on the merits.” Jacobs v. N.C. Admin. Off. of

the Courts, 780 F.3d 562, 568 (4th Cir. 2015) (citation omitted).

The district court may grant summary judgment only if it concludes that the

evidence would not permit a jury to return a verdict in favor of the nonmoving party.

Variety Stores, Inc. v. Wal-Mart Stores, Inc., 888 F.3d 651, 659 (4th Cir. 2018). In

considering a motion for summary judgment, a court improperly weighs the evidence when

it fails to credit contradictory evidence or fails to draw reasonable inferences in the light

most favorable to the nonmoving party. Id. at 659-60 (citations omitted).

8 USCA4 Appeal: 20-2270 Doc: 48 Filed: 11/29/2022 Pg: 9 of 35

The district court considered Lowe’s action under its diversity jurisdiction, and

properly concluded that the substantive law of Virginia is controlling. See Volvo Const.

Equip. N. Am., Inc. v. CLM Equip. Co., 386 F.3d 581, 599-600 (4th Cir. 2004). Under

Virginia law, a plaintiff may seek recovery of damages for injuries cause by a defective

product in accordance with common law principles of negligence. See Sardis v. Overhead

Door Corp, 10 F.4th 268, 280 (4th Cir. 2021) (applying Virginia law). Under those

principles, the plaintiff is required to establish that she suffered an injury caused by the

defendant’s breach of a duty owed to the plaintiff. See Evans v. Nacco Mats. Handling

Grp., Inc., 810 S.E.2d 462, 469 (Va. 2018) (explaining that plaintiff may proceed under

theory of negligence in proving design defect); Dorman v. State Indus., Inc., 787 S.E.2d

132, 139 (Va. 2016) (addressing causation in product liability action). In the present case,

the parties do not dispute that Turner suffered an injury and, thus, we do not address further

that element of the case.

In a product liability claim brought under Virginia negligence law, a plaintiff must

show that the product was unreasonably dangerous for a foreseeable use. 3 Sardis, 10 F.4th

at 280 (citing Evans, 810 S.E.2d at 469). A product may be deemed “unreasonably

3 A plaintiff must also show that the “dangerous condition existed when the goods left the defendant’s hands.” Evans v. Nacco Mats. Handling Grp., 810 S.E.2d 462, 469 (Va. 2018) (quoting Featherall v. Firestone Tire & Rubber Co., 252 S.E.2d 358, 367 (1979)). Although the district court concluded that “most” of the alleged “defects” in Cerner’s software “were created through choices made by VHC,” the record shows that the start time display on the order entry screen and the ability to approve a group of orders without reviewing all the data for each order were features of the software incorporated by Cerner. Notably, Cerner does not defend the district court’s conclusion on this point.

9 USCA4 Appeal: 20-2270 Doc: 48 Filed: 11/29/2022 Pg: 10 of 35

dangerous if it is defectively manufactured, defectively designed, or unaccompanied by

adequate warnings” about the product’s dangerous qualities. Id. (quoting Morgen Indus.,

Inc. v. Vaughan, 471 S.E.2d 489, 492 (Va. 1996)).

In the present case, Lowe was required to present proof to satisfy the elements of

each claim that she asserted, namely, the claims of negligent design and of failure to warn. 4

With these general negligence principles in mind, we turn to consider each of Lowe’s

claims.

A. Negligent Design Claim

1. Duty and Breach of Duty

To prevail on a negligent design claim, a plaintiff must show that the defendant has

a legally recognized duty to design a product to ensure that it is “reasonably safe for the

purpose for which it is intended.” Sardis, 10 F.4th at 280 (quoting Holiday Motor Corp.

v. Walters, 790 S.E.2d 447, 454-55 (Va. 2016)); see Dorman, 787 S.E.2d at 139. This

element of duty can be established by presenting evidence that the defendant’s product

failed to satisfy: (1) governmental safety standards, (2) industry standards, or (3)

reasonable consumer expectations. Sardis, 10 F.4th at 280 (citing Evans, 810 S.E.2d at

472). “If a plaintiff successfully establishes a duty to construct a product in a particular

4 We observe that Lowe also asserted a general negligence claim, which the district court dismissed in its ruling on summary judgment. Because Lowe does not challenge that ruling on appeal, we do not address it.

10 USCA4 Appeal: 20-2270 Doc: 48 Filed: 11/29/2022 Pg: 11 of 35

manner, the manufacturer breaches that duty if the product does not conform to that

standard.” Id.

The district court held that Lowe failed to identify an acceptable industry standard

that imposed a duty on Cerner. The court rejected the standard relied on by Dr. Koppel,

namely, the National Institute of Standards and Technology Internal or Interagency Report

7804 (NIST 7804). The court reasoned that NIST 7804 was not part of the governmental

safety standards set forth in the Health IT Certification Program promulgated by the Office

of the National Coordinator of Health Information Technology (ONC), with which Cerner

had complied. The court further reasoned that Dr. Koppel did not address the relationship

between NIST 7804 and the ONC standard.

Similarly, the court rejected the standard relied on by Dr. Elkin, namely, the

Healthcare Information and Management Systems Society’s (HIMSS) usability standard

for electronic health records. The court stated that Dr. Elkin failed to explain how HIMSS

differed from the ONC’s safety standards and concluded that even if HIMSS adequately

set forth an industry standard, Dr. Elkin did not explain how Cerner’s software violated the

HIMSS standard. The court held that Cerner complied with the HIMSS standard by

conducting its own safety and usability testing.

Finally, the district court held that Dr. Koppel and Dr. Elkin “offer[ed] exactly the

type of opinions rejected” by this Court in Alevromagiros v. Hechinger Co., 993 F.2d 417

(4th Cir. 1993), because Lowe’s experts “generically argue[d]” that the software should

have contained design features to make it safer, without explaining how the software design

violated “prevailing safety standards.” The district court summarily concluded, without

11 USCA4 Appeal: 20-2270 Doc: 48 Filed: 11/29/2022 Pg: 12 of 35

reference to any evidence in the record, that “[n]one of the features and functionality

challenged” by Lowe were “unusual” and that “all are industry standard.”

Additionally, the district court concluded that Lowe failed to present sufficient

evidence to allow a jury to conclude that the software violated consumer expectations. The

court held that Dr. Koppel and Dr. Elkin did not “suggest[]” that Cerner’s software violated

consumer expectations. The court also stated that Cerner “received no customer

complaints similar to those raised here.”

On appeal, Lowe argues that the district court erred in holding that she failed to

present sufficient evidence to permit a jury to conclude that the software contained design

defects. According to Lowe, the court erroneously analyzed the industry standards

identified by Dr. Koppel and Dr. Elkin by comparing those to the prevailing government

standards set forth by ONC, when Lowe did not seek to establish a duty by relying on those

governmental safety standards. Lowe submits that Dr. Koppel and Dr. Elkin identified

acceptable industry standards that imposed a duty on Cerner to design its software free

from the defects identified by Lowe. She also argues that evidence presented by Dr.

Koppel and Dr. Booth was sufficient to permit a jury to conclude that Cerner’s software

violated reasonable consumer expectations.

Cerner, in response, does not defend the district court’s rationale that the industry

standards identified by Dr. Koppel and Dr. Elkin were unacceptable because they were not

part of ONC’s standards, or because those experts did not compare those safety standards

with the proposed industry standards. Instead, Cerner contends that Lowe’s evidence

showed only that the software violated “generic ‘industry standards,’” which were not

12 USCA4 Appeal: 20-2270 Doc: 48 Filed: 11/29/2022 Pg: 13 of 35

specific enough to establish a standard of care. Relying on two court decisions, Holiday

Motor Corp. v. Walters, 790 S.E.2d 447 (Va. 2016), and Alevromagiros v. Hechinger Co.,

993 F.2d 417 (4th Cir. 1993), Cerner submits that the industry standards identified by Dr.

Koppel and Dr. Elkin served only as generalized guidance and did not impose any duty on

Cerner to design its software in a different manner.

Cerner also contends that Lowe failed to put forth sufficient evidence to show that

Cerner’s software violated reasonable consumer expectations. Although Dr. Koppel relied

on literature describing recognized risks associated with the design of electronic record

systems, and Dr. Booth addressed her expectations about the software, Cerner contends

that this evidence described only “generic risks” associated with electronic health records.

According to Cerner, Lowe failed to show that the software violated objective industry

standards or reasonable consumer expectations and that, therefore, Cerner was entitled to

judgment as a matter of law. We disagree with Cerner’s position.

Initially, we agree with Lowe that the district court erred in rejecting as inadequate

the industry standards relied upon by Dr. Koppel and Dr. Elkin because the experts did not

explain why those standards were applicable even though they were not incorporated into

the ONC government safety certification program. A defendant’s failure to comply with

government safety standards is one of three alternative means by which a plaintiff may

demonstrate a design defect. See Evans, 810 S.E.2d at 470. Lowe did not dispute that

Cerner’s software had been certified by ONC as having “safety-enhanced design,” nor did

Lowe rely on these standards as setting forth the alleged duty owed by Cerner. Therefore,

we turn to address Lowe’s evidence of industry standards and consumer expectations.

13 USCA4 Appeal: 20-2270 Doc: 48 Filed: 11/29/2022 Pg: 14 of 35

a. Industry Standards

In his expert witness report, Dr. Koppel cited the NIST 7804 as a usability protocol

widely recognized in “user-interface design” for software. NIST itself explains that this

protocol “provide[s] detailed systematic steps for conducting validation studies . . . to help

ensure that the application’s user interface is free from critical usability issues and supports

error-free user interaction” with electronic health records.

Dr. Koppel opined that Cerner’s software contained a “use-error root cause,” as

defined by NIST 7804, including that the order entry screen contained “Inadequate

Feedback About Automation.” Dr. Koppel explained that Cerner’s order entry screen

failed to warn a physician that a start time other than the one displayed on the order entry

screen had been selected by the software. And Dr. Koppel further explained that although

the unsigned orders list could alert a physician about the altered start time, that list was

“convoluted” and contrary to “all rule[s] of usability.” Dr. Koppel concluded that it was

“an abrogation of design responsibility to create . . . an interface” in which 30 orders for a

patient were “stack[ed]” and were “not visible without extensive scrolling.”

In offering his expert opinion, Dr. Elkin relied upon a usability standard established

by HIMSS, a non-profit organization dedicated to improving health care by assessing the

best use of information technology and management systems. Contrary to the district

court’s conclusion, Dr. Elkin explained how Cerner’s software violated HIMMS usability

standards. Dr. Elkin identified one particularly relevant usability factor, the issue of

“forgiveness.” Dr. Elkin opined that software fails to meet industry forgiveness standards

when it does not provide cautionary information to users about their prospective or existing

14 USCA4 Appeal: 20-2270 Doc: 48 Filed: 11/29/2022 Pg: 15 of 35

entries that would help prevent errors or enable those users to “recover from errors easily.”

In view of these standards, Dr. Elkin identified at least two design defects: (1) the

imposition of a default start time that differed from the order entry time; and (2) a system

permitting a physician to approve numerous orders without reviewing them.

Upon consideration of this expert witness evidence, we first observe that the

standards identified and relied upon by Dr. Koppel and Dr. Elkin were more specific than

the evidence discussed in Holiday Motor and Alevromagiros. In Holiday Motor, the

Supreme Court of Virginia held that the plaintiffs’ expert witness failed to identify an

applicable industry standard relating to the design of a “soft top latching system” to protect

occupants of convertible automobiles “during [a] rollover crash.” 790 S.E.2d at 455, 457.

The court held that the plaintiff’s expert witness instead merely relied on “a general

engineering principle . . . applicable to all automobile components.” Id. at 457.

In Alevromagiros, we affirmed a district court’s entry of a directed verdict at the

close of the plaintiff’s evidence at trial in a product liability case alleging defective design

of a ladder under Virginia law. 993 F.2d at 419-20, 421. We explained that the plaintiff’s

only expert witness did not present sufficient testimony that the ladder was dangerous

because he did not test the ladder to determine whether it “conformed to the published

industry standards.” Id. at 421. We also observed that the expert witness improperly and

subjectively opined that the ladder lacked certain safety features such as “triangular

bracing,” which was not required by industry standards. Id. at 419, 421.

In contrast to these decisions cited by Cerner, Dr. Koppel and Dr. Elkin did not rely

solely on general software design principles but identified concrete usability standards

15 USCA4 Appeal: 20-2270 Doc: 48 Filed: 11/29/2022 Pg: 16 of 35

recognized in the industry of electronic health records. 5 Both witnesses confirmed the

applicability of these standards to the design of software for automated default start times

for medical orders, and to the prevention of related errors by physicians using that software.

Dr. Koppel and Dr. Elkin applied the NIST and HIMSS usability standards in examining

Cerner’s electronic ordering software, and specifically considered the different features of

the order entry screen and the unsigned orders list in concluding that they were defectively

designed.

Accordingly, we hold that the district court erred on the present summary judgment

record in rejecting the industry standards relied upon by Dr. Koppel and Dr. Elkin. Those

experts (1) articulated industry standards creating a duty on the part of Cerner to design its

software to avoid the identified failures in its system, and (2) opined that Cerner violated

those industry standards in designing the system. 6 See Variety Stores, 888 F.3d at 659.

b. Consumer Expectations

5 This conclusion is not altered by Cerner’s additional reliance on Sardis. 10 F.4th at 287-88. In that case, we explained that the industry standard relied on by the expert witness was not applicable to the product at issue, and that the expert presented no additional objective analysis to support his conclusion that the product was defectively designed. Id. 6 Because the district court did not address Cerner’s Daubert motions, we consider Dr. Koppel’s and Dr. Elkin’s opinions as part of the record on appeal without expressing any opinion regarding the reliability or admissibility of their testimony. See Sedar v. Reston Town Ctr. Prop., LLC, 988 F.3d 756, 760 n.2 (4th Cir. 2021) (citing Daubert v. Merrell Dow Pharm, Inc., 509 U.S. 579 (1993)).

16 USCA4 Appeal: 20-2270 Doc: 48 Filed: 11/29/2022 Pg: 17 of 35

We also hold that Lowe presented sufficient evidence for a jury to conclude that

Cerner’s software contained design defects that violated “reasonable consumer

expectations.” Under Virginia law, reasonable consumer expectations are standards

“deemed appropriate by society,” Redman v. John D. Brush & Co., 111 F.3d 1174, 1181

(4th Cir. 1997) (applying Virginia law), and can be established by direct evidence,

published literature, or industry practices regarding a safety standard expected by

reasonable users of the product. Evans, 810 S.E.2d at 470; Alevromagiros, 993 F.2d at

420. Thus, a consumer’s subjective expectation, standing alone, is not sufficient to

establish a reasonable consumer expectation. Evans, 810 S.E.2d at 470 (“The subjective

expectations of a single user, however, are not sufficient to establish the objective,

reasonable expectations of consumers as a class.”); Redman, 111 F.3d at 1181.

The record before us shows that Dr. Koppel cited several published articles that

identified certain risks in the design and use of electronic health record software. He also

addressed several published studies, including a particular study discussing the software in

an electronic order entry system in which the selection of a “daily” dose of medication

defaulted to an 8:00 a.m. start time, which, if ordered at 3:00 p.m., would cause an improper

administration of that medication. Additionally, Dr. Koppel cited at least one complaint

by a user of Cerner’s software in 2009, in which a physician’s orders “were circumvented

by the software, resulting in orders that ‘defaulted to [the following] morning.’”

Although Dr. Koppel did not ultimately opine that the literature and studies he relied

on established a reasonable consumer expectation, the evidence he presented plainly was

relevant to that inquiry. See Evans, 810 S.E.2d at 470. And, contrary to the district court’s

17 USCA4 Appeal: 20-2270 Doc: 48 Filed: 11/29/2022 Pg: 18 of 35

conclusion that Cerner “received no customer complaints similar to those raised” in the

present case, Dr. Koppel described at least one complaint of a similar nature received by

Cerner in 2009.

We also observe that Dr. Booth’s testimony buttressed Dr. Koppel’s evidence of

consumer expectations. Dr. Booth had worked for many years using electronic ordering

software and was familiar with a competitor’s ordering software used at another medical

center. She testified that Cerner’s software worked differently than she expected and

differently from her experience with the competitor’s software in its treatment of default

start times. This evidence supplemented Dr. Koppel’s testimony regarding applicable

design issues requiring notice of default start times. Thus, we hold that Lowe presented

sufficient evidence at this stage of the proceedings to show that Cerner violated reasonable

consumer expectations in the design of its software.

We therefore hold that the district court erred in awarding summary judgment to

Cerner on the elements of duty and breach of duty, given the evidence of industry standards

and reasonable consumer expectations and of Cerner’s failure to design a system in accord

with those standards. Thus, we turn to consider the final element of Lowe’s negligent

design claim, namely, the element of proximate causation.

2. Proximate Causation

In awarding summary judgment to Cerner, the district court stated that the record

showed “multiple possible causes” of Taylor’s injuries, demonstrated in part by Taylor’s

settlement agreement with VHC and Dr. Booth’s employer. Adopting the position

advanced by Cerner, the district court held that Lowe’s expert witnesses, Dr. Koppel and

18 USCA4 Appeal: 20-2270 Doc: 48 Filed: 11/29/2022 Pg: 19 of 35

Dr. Elkin, “failed to take serious account of, or to rule out, VHC, Dr. Booth, or the nursing

staff as potential causes” of Taylor’s harm. The court held that this failure was “fatal” to

Lowe’s claims of negligence, and that Lowe did not establish with “reasonable certainty”

that Taylor’s injuries were caused by Cerner’s negligently designed software.

Lowe contends that the district court erred in this application of Virginia negligence

law on proximate causation, and in concluding that Lowe failed to present sufficient

evidence to present a jury question on that issue. In particular, Lowe asserts that the district

court erred in holding that her expert witnesses, Dr. Koppel and Dr. Elkin, were required

to “rule out” the negligent actions of other tortfeasors as causes of Taylor’s injuries. Lowe

submits that contrary to the district court’s holding, Virginia law provides that multiple

proximate causes may contribute to an injury and, thus, that she was required to show only

that Cerner’s software design defects and Cerner’s failure to warn users of those defects

were themselves proximate causes contributing to Taylor’s injuries. 7 Lowe argues that

based on this well-established standard, she presented sufficient evidence of proximate

causation to permit a jury to find in her favor.

7 Lowe also argues that the district court erred in denying summarily her motion for partial summary judgment, in which Lowe sought to prevent Cerner from raising a superseding cause defense. Because the district court did not provide any rationale for its ruling, we are unable to consider the ruling on appeal. Certain Underwriters at Lloyd’s v. Axon Pressure Prods. Inc., 951 F.3d 248, 272 (5th Cir. 2020); see Thomas v. Berryhill, 916 F.3d 307, 312-13 (4th Cir. 2019) (holding that ALJ’s failure to provide sufficient explanation prevented “meaningful appellate review” of the decision and required us to vacation and remand). Accordingly, we vacate the district court’s ruling denying Lowe’s motion for partial summary judgment. Upon remand, Lowe may renew its motion, and the district court can consider it in accordance with the Virginia principles of proximate causation set forth in this opinion. 19 USCA4 Appeal: 20-2270 Doc: 48 Filed: 11/29/2022 Pg: 20 of 35

In response, Cerner argues that there were numerous “obvious alternative causes”

of Taylor’s injuries, including VHC’s role in configuring the adaptable portion of the

software, Dr. Booth’s error in entering the continuous pulse oximetry order when

approving the unsigned orders list, VHC’s failure to train physicians using the software,

and VHC’s nursing staff errors in failing to recognize the need to provide Taylor with

continuous oxygen monitoring and in failing to check Taylor’s vital signs every four hours.

Cerner argues that because Lowe’s expert witnesses did not address these other causes of

Taylor’s injuries, Lowe failed, as a matter of law, to establish that Cerner was a proximate

cause of Taylor’s injuries. We disagree with Cerner’s position. As explained below, we

first address the requirements of proximate causation under Virginia law, and we next

review the sufficiency of Lowe’s evidence at the summary judgment stage to satisfy those

requirements.

A proximate cause of an event is an act or omission that in natural and continuous

sequence produces the event, and without which that event would not have occurred.

Kellermann v. McDonough, 684 S.E.2d 786, 793 (Va. 2009); Ford Motor Co. v. Boomer,

736 S.E.2d 724, 731 (Va. 2013) (explaining that proximate cause is a necessary antecedent

of injury). Under Virginia law, there may be more than one proximate cause of an injury.

Williams v. Le, 662 S.E.2d 73, 77 (Va. 2008). When the concurring negligence of more

than one cause produces a single injury, each negligent act is a proximate cause of that

injury and each of these multiple actors is liable for the injury. Id. In other words, under

Virginia law, it is not required that a plaintiff “show that an act, claimed to have been the

proximate cause of a certain result, was the only cause.” Schools v. Walker, 47 S.E.2d 418,

20 USCA4 Appeal: 20-2270 Doc: 48 Filed: 11/29/2022 Pg: 21 of 35

423 (Va. 1948) (emphasis added) (quoting Chesapeake & O. Ry. Co. v. Wills, 68 S.E. 395,

397 (Va. 1910)); accord White Consol. Ind. Inc. v. Swiney, 376 S.E.2d 283, 286 (Va. 1989).

Instead, it is sufficient that a plaintiff show “that the defendant’s act produced or set in

motion other agencies, which in turn produced or contributed to the final result.” Von Roy

v. Whitescarver, 89 S.E.2d 346, 352 (Va. 1955) (quoting Chesapeake & O. Ry. Co., 68 S.E.

at 397); accord Ford Motor Co., 736 S.E.2d at 731.

Under certain conditions, a proximate cause of an event also may be a superseding

cause of that event. Williams v. Joynes, 677 S.E.2d 261, 264 (Va. 2009). A superseding

cause is an intervening act that severs the link of proximate causation between an initial

act of negligence and the resulting harm. Id.; Hubbard v. Murray, 3 S.E.2d 397, 401 (Va.

1939). By entirely supplanting another act of negligence, a superseding cause relieves the

initial negligent actor from liability and, thus, becomes the only proximate cause of the

plaintiff’s injury. Joynes, 677 S.E.2d at 264; Le, 662 S.E.2d at 77; Jenkins v. Payne, 465

S.E.2d 795, 799 (1996). Critically, the defendant bears the burden of demonstrating the

existence of a superseding cause by showing that another’s negligence alone, “without any

contributing negligence by the defendant in the slightest degree, causes the injury.”

Jenkins, 465 S.E.2d at 799; see Atkinson v. Scheer, 508 S.E.2d 68, 72 (Va. 1998); Panousos

v. Allen, 425 S.E.2d 496, 499 (Va. 1993). An intervening act does not qualify as a

superseding cause when the intervening act was set in motion by the initial act of

negligence. Joynes, 677 S.E.2d at 264; Philip Morris Inc. v. Emerson, 368 S.E.2d 268,

277 (Va. 1988).

21 USCA4 Appeal: 20-2270 Doc: 48 Filed: 11/29/2022 Pg: 22 of 35

Here, the parties do not dispute that Taylor’s injuries resulted from a lack of oxygen,

and that continuous monitoring of Taylor’s oxygen level would have prevented his hypoxia

and brain damage. Under the summary judgment standard, Lowe bore the burden of

producing sufficient evidence from which a jury could find that Cerner’s negligently

designed software was a proximate cause of Taylor’s injuries. See Le, 662 S.E.2d at 77;

Ford Motor Co., 736 S.E.2d at 731. Lowe was not required to address any other proximate

causes of Taylor’s injuries, or to eliminate such other proximate causes as a source of those

injuries. Instead, Lowe was required to show only that negligence on Cerner’s part was a

necessary antecedent of Taylor’s injuries. See Ford Motor Co., 736 S.E.2d at 731.

Therefore, we hold that the district court erred in concluding that Lowe was required to

“rule out” other causes of Taylor’s injury.

Our conclusion is not altered by Cerner’s argument that other possible causes of

Taylor’s injuries affect whether Lowe established causation attributable to Cerner.

According to Cerner, Dr. Booth was negligent in using the software, the nursing staff was

negligent in failing to monitor Taylor’s oxygen level, and VHC was negligent in

configuring its order entry screen permitting Dr. Booth to select an option that altered her

desired start time. Any consideration of these alternative causes of injury is relevant only

to the extent that Cerner can show that a third-party tortfeasor’s conduct wholly supplanted,

or superseded, its own negligence in causing the injury. See Joynes, 677 S.E.2d at 264; Le,

662 S.E.2d at 77. And notably, Cerner, not Lowe, would bear the burden to show that a

third party’s negligence broke the link between Cerner’s negligence and the injury to

become the sole cause of Taylor’s injuries. See Atkinson, 508 S.E.2d at 72. To be relieved

22 USCA4 Appeal: 20-2270 Doc: 48 Filed: 11/29/2022 Pg: 23 of 35

of liability, Cerner would have to establish that its conduct did not contribute to cause

Taylor’s injuries “in the slightest degree.” 8 See Jenkins, 465 S.E.2d at 799. For these

reasons, we hold that the district court erred in setting forth the standards of proximate

causation under Virginia law.

Additionally, we hold that Lowe presented sufficient evidence at this stage of the

proceedings to permit a jury to find that Cerner’s negligence was a proximate cause of

Taylor’s injuries. Dr. Koppel addressed in his report the problems with electronic ordering

software in which “a doctor’s orders [are] circumvented by the software, resulting in orders

that ‘default[] to [the following] morning.’” As applied to the present case, Dr. Koppel

opined that Dr. Booth intended to order continuous pulse oximetry immediately, but that

the software “circumvented her order and her intentions.” Additionally, Dr. Koppel opined

that the “difference between what [Dr. Booth] thought she ordered and what the nurse saw

was due to a defective and/or invisible changing of [Dr. Booth’s] order” by the software

and the fact that a physician can “approve” a group of orders after viewing only “the first

couple of orders.”

Dr. Elkin discussed the risks inherent when an entry by a physician is “overwritten”

by a default value established in the electronic ordering software. Dr. Elkin explained that,

in this case, Dr. Booth intended an immediate start time, which was overridden

electronically to show a default start time without notifying Dr. Booth of the change.

8 Although Cerner did not argue in its brief filed in this Court that other causes served as a superseding cause, Cerner did preserve this argument in the district court in its opposition to Lowe’s motion for partial summary judgment.

23 USCA4 Appeal: 20-2270 Doc: 48 Filed: 11/29/2022 Pg: 24 of 35

According to Dr. Elkin, this design defect proximately caused the failure to continuously

monitor Taylor’s oxygen level.

Dr. Elkin also explained that on the unsigned orders list, the order for pulse oximetry

“was at the very bottom” of the list of 30 orders entered by Dr. Booth. He opined that

because Dr. Booth could approve all 30 orders at once, “without actually looking” at the

orders, Dr. Booth “was able to transmit the order without ever seeing the pulse oximetry

order.” This defect, in Dr. Elkin’s view, also caused the failure to monitor Taylor’s oxygen

level on a continuing basis.

In addition, Dr. Booth’s deposition testimony established that when she entered the

continuous pulse oximetry order, she (1) relied on the start time as the present time

displayed on the order entry screen, and (2) did not see the improper start time of 10:00 am

listed for pulse oximetry in the list of unsigned orders before ultimately confirming that

group of orders. From this evidence, a jury reasonably could conclude that the software

design defects, allowing an incorrect “start time” to appear on the order entry screen, and

permitting a physician to approve all her orders as a group without scrolling through the

data associated with each order, caused the failure to monitor continuously Taylor’s oxygen

level and resulted in his injuries. Accordingly, we conclude that the district court erred in

holding that Lowe failed to present sufficient evidence of proximate causation on the

negligent design claim.

Because the summary judgment record, fully considered and construed in Lowe’s

favor, was sufficient to establish all the elements of Lowe’s negligent design claim, we

hold that the district court erred in awarding summary judgment to Cerner on this claim.

24 USCA4 Appeal: 20-2270 Doc: 48 Filed: 11/29/2022 Pg: 25 of 35

We therefore vacate the court’s judgment on the negligent design claim and remand that

claim for trial. We next turn to consider Lowe’s failure to warn claim.

B. Failure To Warn Claim

In asserting a failure to warn claim under Virginia law, a plaintiff must establish

that the manufacturer of a product knew or had reason to know that its product was likely

to be dangerous for its intended use. Funkhouser v. Ford Motor Co., 736 S.E.2d 309, 313

(Va. 2013). No duty exists, however, when the product’s user was or should have been

aware of a danger that was obvious. Austin v. Clark Equip. Co., 48 F.3d 833, 836 (4th Cir.

1995); see Funkhouser, 736 S.E.2d at 313. To show that a defendant breached its duty to

warn, a plaintiff must show that the defendant failed to exercise reasonable care to inform

the user of the product’s dangerous condition. Funkhouser, 736 S.E.2d at 313. Finally, a

plaintiff must show that the defendant’s failure to warn caused the plaintiff’s injuries.

Featherall v. Firestone Tire & Rubber Co., 252 S.E.2d 358, 369 (Va. 1979).

The district court held that Lowe failed to present sufficient evidence to support her

failure to warn claim and awarded judgment in Cerner’s favor on that claim. In particular,

the court held that Lowe “provided no evidence” that Cerner knew or had reason to know

that its software was dangerous for its intended use. Although the court acknowledged that

Lowe submitted evidence of a complaint from a physician who used the software in another

hospital in 2009, the court characterized that complaint as a “request” to change the “start

time” field on the order entry screen from a grey-colored font to a red or yellow display.

The court found that this complaint did not include an affirmative statement of patient harm

25 USCA4 Appeal: 20-2270 Doc: 48 Filed: 11/29/2022 Pg: 26 of 35

and that, therefore, the complaint was insufficient to put Cerner on notice that the software

could cause injury. The court further held that VHC, as the “user,” should have been aware

of the “defects” in Cerner’s software because VHC configured the software to include a

10:00 a.m. default start time and had used the software for many years without complaint. 9

Lowe argues on appeal that the record contained sufficient evidence to establish that

Cerner was on notice that its software was dangerous, triggering Cerner’s duty to warn.

Lowe also argues that the court failed to address the evidence that Dr. Booth, as a user of

the software, was unaware of the dangerous aspects of the software involving the default

start time. Thus, Lowe submits that Cerner was not relieved of its duty to warn because a

jury could conclude that the danger was not apparent to the user of the software.

In response, Cerner maintains that the district court correctly concluded that Cerner

was not on notice of the software’s alleged dangerous feature. According to Cerner, Lowe

did not establish a “substantial similarity” between the 2009 complaint made to Cerner and

the defect alleged by Lowe because the 2009 complaint did not include a report of harm to

a patient. Cerner also summarily asserts that the question whether Dr. Booth was aware of

9 We observe that the district court also concluded that VHC was a “sophisticated billion-dollar hospital” and necessarily should have realized any “dangerous conditions” in the software. In Cerner’s motion for summary judgment, however, it did not advance a “sophisticated user” defense to argue that VHC had equal knowledge of the dangers of the software and, thus, may have been responsible to protect its employees and other users of the ordering software. See Willis v. Raymark Indus., 905 F.2d 793, 796 (4th Cir. 1990) (applying Virginia law). If upon remand, Cerner asserts such a defense at trial, Cerner bears the burden to establish that defense. See id.

26 USCA4 Appeal: 20-2270 Doc: 48 Filed: 11/29/2022 Pg: 27 of 35

any dangerous aspect of the software is irrelevant to Cerner’s duty to warn. We disagree

with Cerner’s position.

A plaintiff can prove that a defendant has notice of a dangerous condition in its

product by showing evidence of a similar incident so long as that incident occurred under

“substantially the same circumstances” and was “caused by the same or similar defects and

dangers as those in issue.” Funkhouser, 736 S.E.2d at 313-14 (quoting Roll ‘R’ Way Rinks,

Inc. v. Smith, 237 S.E.2d 157, 160 (1977)). Here, the district court erred in construing the

2009 complaint as a mere request to change the font color of the software program’s start

time display. As previously described, in that 2009 complaint, a physician reported that

Cerner’s software circumvented the intended start time for a patient’s medication, resulting

in the patient failing to receive medication until the next day. Cerner’s representatives later

altered the appearance of the actual start time on that hospital’s software to a brighter color

“so the physician is more aware” of the start time entry. Although the 2009 complaint did

not state whether the patient suffered harm by failing to receive the intended first dose of

medication, the danger inherent in the software’s ability to override a physician’s intended

medical order was made apparent by this complaint. Thus, we conclude that the 2009

complaint was sufficient to show that Cerner was on notice that the software contained

dangerous features relating to the entry of medical orders.

The 2009 complaint also was evidence that Cerner had reason to know that

physician users of its software could be unaware that default start times embedded in the

program could override a physician’s intended start time for an order. Dr. Booth likewise

stated that she was unaware of the default start time dangers inherent in the software.

27 USCA4 Appeal: 20-2270 Doc: 48 Filed: 11/29/2022 Pg: 28 of 35

Because Dr. Booth was a physician working at VHC, which had purchased and

implemented the software, she was a user of the software for purposes of Cerner’s alleged

duty to warn. See Featherall, 252 S.E.2d at 366 (explaining that a duty to warn “extends

not only to the immediate purchaser but to other persons who might in the ordinary and

natural course of events be subjected to [the] danger”). Thus, the district court erred in

concluding that Lowe failed to present sufficient evidence at this stage of the proceedings

that Cerner had a duty to warn users of this danger inherent in its software, and that Cerner

breached that duty in this case. 10

We therefore turn to the element of proximate causation. Based on the principles

discussed above, we easily conclude from the present record that Cerner’s failure to warn

VHC and Dr. Booth about the software’s defects presented a question for the jury regarding

whether that failure to warn was a proximate cause of Taylor’s injuries. A jury reasonably

could infer that if Dr. Booth had been warned that an alternate default start time had been

triggered by the software, overriding her intended start time, continuous pulse oximetry

would have begun immediately after Taylor’s surgery, thereby preventing his injuries.

Accordingly, because Lowe presented sufficient evidence at this stage of the proceedings

to establish all the elements of a failure to warn claim, the district court erred in awarding

summary judgment in favor of Cerner on that claim.

10 We further conclude that the evidence was insufficient to support a failure to warn claim based solely on the configuration of the unsigned orders list. However, the evidence from Lowe’s expert witnesses and Dr. Booth concerning the unsigned orders list nevertheless was relevant to the failure to warn claim addressing the start time override.

28 USCA4 Appeal: 20-2270 Doc: 48 Filed: 11/29/2022 Pg: 29 of 35

III.

For these reasons, we vacate the district court’s judgment on both Lowe’s negligent

design claim and her failure to warn claim, and we remand those claims to the district court

for trial.

VACATED AND REMANDED

29 USCA4 Appeal: 20-2270 Doc: 48 Filed: 11/29/2022 Pg: 30 of 35

WILKINSON, Circuit Judge, dissenting:

There is one reason, and one reason only, that the manufacturer is a defendant in

this suit. It has a deep pocket. Plaintiff’s settlement with Virginia Hospital Center (VHC)

within the limits established by Virginia medical-malpractice law was not enough. The

benefits provided by Medicare, presumably covering some medical expenses but not life-

care expenses, were not enough. So plaintiff’s recourse was to sue the manufacturer, not

because it was culpable but because it could pay out. I do not criticize plaintiff for pursuing

this course of action in a deeply tragic case, but I do take exception to the majority’s

application of several basic principles of products liability law.

Ruby Lowe filed suit against Cerner Health Services on behalf of her severely

injured grandson Michael Taylor. Cerner is in the business of making software that

transmits medical orders. Lowe must of course prove every element of her claim. Her case

runs aground on an inability to create an issue of triable fact as to proximate causation for

Taylor’s injury. Causation is an element both of plaintiff’s design-defect and failure-to-

warn claims. Some 32,000 pages of discovery and the designation of seven experts have

produced only pretty thin gruel. A record this thick often suggests a fishing expedition, as

I think it does here. I would thus affirm the judgment.

As to causation, this is a “many hands” case. Dr. Alexandra Booth and the hospital

staff provided the most immediate set of hands with respect to Taylor’s care. The

manufacturer’s involvement, if such there was, was remote and attenuated. Checking the

patient’s blood-oxygen level is a standard medical procedure. Monitoring blood-oxygen

30 USCA4 Appeal: 20-2270 Doc: 48 Filed: 11/29/2022 Pg: 31 of 35

levels is “routine”: Doctors and hospitals know how to do it, because they do it all the time.

Appellant Br. 14. They know to be careful, not sloppy.

In this very case, personnel throughout the hospital had been placing orders with the

manufacturer’s software for six years without mishap. J.A. 3880. It happened that on this

day, Booth failed when reviewing the orders for Taylor to notice the start time correctly

displayed on the software’s summary screen. J.A. 3867. She likewise filled out a field on

the ordering screen that she claims confused her, where “[n]one of those options ma[d]e

any sense,” and then signed off on a full slate of orders despite her professed apprehension

around language on the summary screen. J.A. 3866.

Similarly, multiple lapses made by hospital staff do not inspire confidence that a

correct order from Booth would have even been obeyed. First, hospital staff failed to

respond to a duplicative order from Taylor’s anesthesiologist concerning the same blood-

oxygen monitoring device that Booth had ordered for the following day. J.A. 3865. Second,

they failed to heed an order from Booth requesting that Taylor’s vital signs be checked

every four hours. (During a 5.5-hour period, which only ended when Booth herself visited

Taylor, no check was performed. J.A. 3867.) And third, hospital staff did not attempt to

confirm or corroborate the delayed start time in Booth’s order, despite that instruction

being inconsistent with two other orders that Booth had placed also concerning Taylor’s

oxygen levels. J.A. 3865–67.

It is understandable that those immediately responsible for Taylor’s care would seek

to place blame for this sad outcome everywhere but on themselves. One can appreciate also

how this could happen. Hospitals are busy places. Doctors and nurses have many patients

31 USCA4 Appeal: 20-2270 Doc: 48 Filed: 11/29/2022 Pg: 32 of 35

to monitor. Different shifts demand hand-offs. Things can get lost or fall through the

cracks. Fatigue at the end of a shift can set in. There is, in short, a lot to keep track of. There

was nothing malign or intentional about Booth’s mistake or the hospital’s faulty oversight

here. It was a simple, classic case of negligence. Unfortunately, negligence can cause

devastating consequences far out of proportion to the state of mind that brings them about.

It is true, as the majority observes, that Virginia law does not require plaintiff to

“rule out” all other causes in a multiple-cause case. Majority Op. 22. The Commonwealth

recognizes that “[t]here may be more than one proximate cause of an event.” Kellermann v.

McDonough, 684 S.E.2d 786, 793 (Va. 2009). But this general proposition of law does not

go as far as the majority takes it. In reality, the proposition refers to scenarios in which

multiple parties each furnished but-for causes. Thus, in a case involving two negligent

drivers, both drivers were found liable since “the collision . . . would not have occurred”

absent either’s errors. Von Roy v. Whitescarver, 89 S.E.2d 346, 352–53 (Va. 1955). Or, in

a case over tortious medical prescriptions, both the pharmacist and doctor could have been

liable since their “independent acts of negligence” operated in tandem. Sullivan v.

Robertson Drug Co., 639 S.E.2d 250, 252–53, 255 (Va. 2007). But the law of causation,

while nuanced and open to massaging, still requires at bottom more than a “conjecture,

guess, or random judgment” that the defendant’s acts brought about the ultimate injury.

Town of W. Point v. Evans, 299 S.E.2d 349, 351 (Va. 1983). Therefore, expert references

to HIMSS, NIST 7804, and “usability factors” notwithstanding, “[n]egligence and an

accident . . . do not make a case.” Wells v. Whitaker, 151 S.E.2d 422, 428 (Va. 1966)

(quoting Hawkins v. Beecham, 191 S.E. 640, 643 (Va. 1937)).

32 USCA4 Appeal: 20-2270 Doc: 48 Filed: 11/29/2022 Pg: 33 of 35

The causation analysis is even more problematic when one considers the weakness

of plaintiff’s design-defect claim. The two elements are not unrelated. The more severe the

defect, the easier it is for a plaintiff to survive summary judgment by “eliminat[ing] the

possibility that the blame attaches to some party other than” the manufacturer. Logan v.

Montgomery Ward & Co., 219 S.E.2d 685, 688 (Va. 1975). Here, plaintiff’s theory for a

design defect is tenuous. For all the opining of her seven experts, “[t]he manufacturer is

not an insurer and is not required to design and market an accident-proof product.”

Turner v. Manning, Maxwell & Moore, Inc., 217 S.E.2d 863, 868 (Va. 1975). That the

manufacturer’s supposed defects are speculatively linked, as here, only to a single injury

suggests that the majority is wrongly scouring for “the safest conceivable design,” not a

“reasonably safe product[].” Redman v. John D. Brush & Co., 111 F.3d 1174, 1177

(4th Cir. 1997). One accident in six years of frequent use does not a “hard coded” defect

make. J.A. 2879.

In products liability litigation, summary judgment is often the whole candle. If

plaintiffs lose, they’re out of court. If defendants lose, they may be forced to settle for an

exorbitant sum in order to avoid an even more ruinous award of damages. In a sad case like

this, a jury would understandably be drawn to Taylor’s tragic circumstances and do what

it could to help. Jurors might return home and—again understandably—believe they have

done a Good Turn for the day.

This to me suggests the need for real caution in summary judgment rulings. The law

tells us that jury verdicts are not to be based on “sympathy,” Rutherford v. Zearfoss, 272

33 USCA4 Appeal: 20-2270 Doc: 48 Filed: 11/29/2022 Pg: 34 of 35

S.E.2d 225, 228 (Va. 1980), or “speculation,” Shepherd v. Davis, 574 S.E.2d 514, 524

(Va. 2003). Yet a verdict here would show a high likelihood of being based on both.

This danger should be mitigated by returning the case to the district court for review

of defendant’s summary judgment motion in accordance with the standards the majority

now announces. Pushing a thin case to a jury with such a high potential for a sympathy

verdict is, at this point, wholly premature. If, as the majority holds, plaintiff is not required

to rule out all causes in addition to that of the defendant, the district court should at least

be given an opportunity to review the record under the correct standard. The district court

should also be given the chance before ruling on the summary-judgment motion to

determine whether the testimony of plaintiff’s experts would be admissible at trial under

the well-known criteria of Daubert v. Merrell Dow Pharmaceuticals, Inc., 509 U.S. 579

(1993). It may be that the district court would ultimately send the case to trial, but a basic

concern for fair process as well as the role of district courts demands a review of the record

under the correct principles of law.

A sense of balance in this kind of case is crucial. The plaintiff’s bar provides a real

service in products liability cases. Well-founded suits have, in my judgment, helped to

ensure a safer world. No doubt the fear and apprehension of litigation have caused many a

manufacturer to keep a risky product off the market or at least to delay its introduction until

those risks have been minimized.

And yet safety does not cut just one way. The technological advances that often

come with new products can enhance safety too. Consider the automobiles of the 1950s.

With their shattering glass and shiny chrome and fancy fins, they were still death traps. It

34 USCA4 Appeal: 20-2270 Doc: 48 Filed: 11/29/2022 Pg: 35 of 35

was only technical advances in the form of shatterproof windshields, seat belts and

shoulder straps, roll bars, and the like that brought about safer travel. See Charles M.

Farmer & Adrian K. Lund, The Effects of Vehicle Redesign on the Risk of Driver Death,

16 Traffic Inj. Prevention 684, 684–90 (2015).

The point is easily expanded beyond automobiles. Fear of this sort of litigation has

the potential to deter products that might enhance patient care and recovery and even, in

some cases, hold down costs. See, e.g., Jacobs v. E.I. du Pont de Nemours & Co., 67 F.3d

1219, 1241 (6th Cir. 1995) (making the supplier liable for users’ mistakes would “stymie

the kind of beneficial scientific innovation” recurrent in “human endeavor”); Keith N.

Hylton, The Law and Economics of Products Liability, 88 Notre Dame L. Rev. 2457, 2497

(2013) (“[H]igh levels of uncertainty are likely to be met with withdrawal from the product

innovation process.”). A suit like this one runs the risk of retarding the safety and utility

that innovative technologies can bring.

Post hoc ergo propter hoc. (After which, because of which.) What part that nostrum

played in Roman law I do not know. The venerable Latin phrase, however, cannot be the

sole basis of modern tort liability. Causation requires more than the mere sequencing of

time.

What happened here is sad beyond measure. But holding an innocent party culpable

is not the law. I respectfully and reluctantly dissent. May fastening consequences where

they belong show us to a safer day.