The dangerous error may be an existing record entry that an agent carries forward, rather than something it invents. Heidi II could interrupt that chain if consequential assumptions are checked against their origins before action. Its launch, however, does not establish how reliably it will detect inherited errors across real clinical workflows.
This is an analysis of a failure mechanism to test, not a report that Heidi II has generated the incidents described below. Product context is based on Heidi's announcement of 28 September 2026; the fictional scenarios are our own.
A clinical-looking source is not necessarily a correct source
A benchmarking study published in The Lancet Digital Health in 2026 examined 20 large language models presented with fabricated medical information. False recommendations inserted into hospital notes were accepted substantially more often than misinformation presented in social-media material. The research tested model susceptibility to misleading inputs, not Heidi II, agent execution or patient outcomes. See the original cross-sectional benchmarking analysis.
The useful implication is that credible presentation and clinical context do not guarantee factual reliability. A hospital document can be authentic as a document while containing an incorrect statement. A system can quote it faithfully and still pass an error into its next step.
That distinction broadens the safety question beyond hallucinations. Preventing invented content does not necessarily prevent inappropriate reliance on content that was already wrong. The related iatroX article on polished clinical notes examines a different entry point: uncertainty lost while the original encounter is being documented.
Follow an error that nobody newly invented
Consider a fictional historical note stating that a specialist team will arrange a follow-up. In fact, the team had asked the originating practice to organise it. The error enters the record through an ordinary misunderstanding, before any agent is involved.
A later summary presents the specialist team as responsible. A task-management workflow therefore removes the case from the practice's outstanding list. A subsequent note records that no action is required locally. Each step appears consistent with the previous one, and the resulting documents may look like several independent confirmations.
They are not independent. They descend from the same incorrect account of responsibility. The hypothetical error chain consists of an inaccurate source, a compressed interpretation, an operational decision and a completion record that reinforces the original premise.
An agent might prevent this by locating the specialist's original instruction and surfacing the disagreement. It might also preserve the inconsistency rather than choosing a single story. Those are desirable behaviours to evaluate, not features we have verified in a live Heidi II deployment.
Repetition can create the appearance of corroboration
A reviewer may encounter the same statement in a note, a summary and a task description. Without provenance, the repeated statement can look better supported than it is. In the fictional case, however, none of those repetitions adds new evidence about who actually accepted responsibility.
We would therefore distinguish the number of places a claim appears from the number of independent sources supporting it. A second model receiving the same flawed summary is not automatically an independent check. Nor is a fresh explanation that restates the same assumption in different words.
Independent checking should target the contested fact. The relevant evidence might be the originating correspondence, an acknowledgement from the receiving service or a clinician's documented clarification. The appropriate source depends on the question being resolved.
Identify the points where propagation can be interrupted
The first opportunity is before summarisation: preserve the source and distinguish direct instructions from interpretations. The next is when a summary becomes a task: make visible why the action follows and what assumptions remain unresolved. Another opportunity occurs before external execution, when the proposed destination and consequence can still be reviewed.
A final opportunity remains after completion. The system should not treat an operational success as proof that the underlying premise was correct. Sending a message successfully demonstrates transmission, not the appropriateness of its contents or the accuracy of the record on which it relied.
This sequence suggests a practical evaluation map. Instead of asking only whether the final answer contains an error, ask where a source error becomes more influential and which boundary should detect it. That makes the assessment useful for engineering, clinical review and organisational learning.
Correction must reach dependent work
Suppose the fictional practice discovers the original misunderstanding and corrects the note. The important question is what happens next. Does the correction reach a pending summary, the outstanding-work list and the next scheduled routine? Can users identify work that has already been completed under the old assumption?
A local text edit may be necessary without being sufficient. We would expect an evaluation to distinguish correcting the source, updating dependent interpretations, cancelling pending actions and managing the consequences of actions already taken. Some consequences require human communication rather than a software reversal.
These are proposed tests for connected workflows. The September 2026 launch materials do not provide a complete public specification of how every such dependency behaves, so it would be inappropriate to claim either that Heidi II handles all of them or that it cannot.
Design a controlled error-propagation test
An approved test environment could contain a deliberately inaccurate historical entry, a later correcting document and a plausible task derived from the original entry. Evaluators would vary where the correction appears and whether the task is merely prepared, authorised or partly completed.
Success would involve recognising the discrepancy, preserving its provenance and preventing unsupported continuation. Appropriate escalation should count as a useful response when the information cannot be reconciled safely. Silent selection of a convenient version should not receive the same score as an explicit, justified resolution.
The assessment should also include correct records. Otherwise a system could appear safe by refusing everything or challenging every statement indiscriminately. Human reviewers would need to distinguish sensible caution from unnecessary interruption.
We have not run this protocol against Heidi II. Results should be reported only after a documented run, with the record variants, task definitions and outcome criteria described.
Compare with the actual alternative
Manual workflows can also carry an incorrect statement forward. The fair comparison is therefore not between an imperfect agent and an imaginary error-free practice. It is between the proposed workflow and the existing process, including how each detects, corrects and contains inherited mistakes.
Automation could improve the situation by making sources easier to inspect and contradictions harder to overlook. It could worsen it if the same unsupported assumption is applied more widely before anyone notices. Both possibilities depend on implementation and deserve direct measurement.
The same scrutiny applies to iatroX reference and learning outputs. A linked source should invite inspection, not end the investigation. An answer is more useful when the reader can identify which claim the source supports and where uncertainty remains, rather than merely count citations.
Frequently asked questions
Does error propagation require the agent to hallucinate?
No, an agent could transmit an existing error while remaining faithful to its input. The problem is the unchecked movement from source content to interpretation and action.
Did the Lancet Digital Health study evaluate Heidi II?
No, the 2026 study benchmarked language models against fabricated medical information. It does not establish a Heidi II error rate or clinical outcome.
Is using a second model an independent safety check?
Not automatically, especially when both models rely on the same incorrect source. A meaningful check needs to address the disputed information rather than simply regenerate a similar answer.