Most radiology departments think they're compliant with ACR critical results communication requirements. In our experience, most aren't. Not because anyone is negligent — but because the gap between what the ACR Practice Parameter actually says and what departments have documented is wider than anyone realizes until a Joint Commission surveyor walks in the door.
Here's what the ACR Practice Parameter on Communication (AC:CCRC) actually mandates, where community hospital departments fall short, and what a proper audit trail looks like.
What AC:CCRC Actually Requires
The ACR Practice Parameter for Communication of Diagnostic Imaging Findings (AC:CCRC, revised 2020) sets out a tiered communication framework. Routine findings go in the finalized report. Significant unexpected findings require direct communication to the ordering provider. Critical findings require immediate verbal notification followed by documented confirmation.
The operational word is "documented." AC:CCRC Section V.C states that critical results communication must include a record of: the finding, the time of identification, the identity of the radiologist who communicated it, the identity of the provider who received it, the time of that receipt, and the method of communication. Six fields. All required. Most radiology departments capture two or three of them reliably.
Practical note: "We called the floor" is not documentation. A timestamped HL7 ORU message with provider receipt confirmation is documentation. The difference matters when a surveyor asks for your quality data.
The Joint Commission's NPSG.02.03.01 runs parallel to AC:CCRC and carries the same documentation burden — with the added requirement that your department define what constitutes a critical finding in writing, and that your threshold list be reviewed at least annually. In our tracking, fewer than 40% of community hospital radiology departments have a formal, dated critical-finding threshold document on file.
Where Community Hospitals Routinely Fall Short
Community hospital radiology operates under constraints that academic centers don't face. A department running 3 radiologists across a 24/7 schedule has no subspecialty coverage buffer. The overnight read queue mixes routine screening studies with emergent trauma CTs. When a critical finding surfaces at 2 a.m., the communication workflow depends entirely on whatever informal system the department built around a gap the PACS vendor didn't design for.
The failure modes we've seen cluster into three categories.
1. No Timestamped Record of Triage Decision
A radiologist identifies a suspected intracranial hemorrhage. The finding is real. The communication happens. But there is no system record of when the AI triage model or the radiologist first flagged the study as critical, separate from the time the final report was signed. AC:CCRC requires the time of identification, not the time of report finalization — and for studies read under time pressure, these can be 45 minutes apart. The delta matters for audit purposes and, more importantly, for patient safety analysis.
2. No Confirmation of Receipt
Standard PACS worklist systems push HL7 ORU messages to the EHR in-basket. They do not confirm that a provider opened the message, acknowledged the finding, or took action. That's not a technology problem — it's a workflow design gap. AC:CCRC requires documented receipt, not documented sending. A 2023 Joint Commission Sentinel Event analysis found that 28% of closed critical-results communication failures involved findings that were transmitted but not confirmed received. The audit trail ended at transmission.
3. Threshold Lists That Don't Match Practice
A department writes a critical-finding threshold list for accreditation. Then the clinical environment changes: new CT protocols, a hospitalist service that wants broader notification, a trauma program that adds new study types. The threshold list doesn't get updated. Fast forward 18 months and the department is communicating findings that aren't on the list and not communicating some that are. Neither is defensible in a quality review.
The Audit Log as a Compliance Asset
Here's the thing about a properly structured audit trail: it isn't just a compliance checkbox. It's the only way to run meaningful quality improvement on your critical results workflow.
A timestamped log of every triage event should capture, at minimum: study acquisition time, triage classification time, model or radiologist flagging the finding, notification send time, provider identity, receipt confirmation time, and radiologist override decision if the AI classification was modified. With that data, you can calculate detection-to-notification time across your full study volume — not just for cases that resulted in complaints or audits.
In community hospitals that run this analysis, the numbers are usually worse than expected. Average detection-to-notification time on overnight reads is frequently in the 4-8 hour range when the full study population is counted, not just the cases the department already knows about. That's the number ACR wants to see trend downward. That's the number Joint Commission will ask about. And it's only available if the audit log was built to capture it from the start.
Connecting the Log to Your Quality Program
AC:CCRC and Joint Commission both require that critical results communication be included in your department's quality management program. That means periodic review, trend analysis, and corrective action documentation when thresholds are missed. The log is the data source. Without it, your quality program is a paper exercise.
Practically, a monthly ACR-format critical results report should include: total critical findings flagged, detection-to-notification time distribution (mean, median, 90th percentile), cases exceeding your department's target notification window, radiologist false-positive override rate, and cases where notification was sent but receipt was not confirmed. That's five metrics. All five require a structured event log. None of them come out of a standard PACS worklist export.
FDA 510(k) Clearance and the Audit Trail for AI Tools
If your department is using an AI triage tool that makes critical-finding classifications, there's an additional documentation requirement that doesn't appear in AC:CCRC but surfaces in FDA guidance on AI-assisted clinical decision support: the model version identifier must be recorded with each triage event. When the model is updated — and FDA-cleared AI triage tools do receive software updates — you need to be able to distinguish between decisions made by version 1.4 and decisions made by version 1.5 for your retrospective safety analysis.
This is not theoretical. FDA's 2021 AI/ML action plan explicitly calls out the need for real-world performance monitoring tied to model versioning. If a pattern of false negatives emerges after a model update, your audit log is the evidence base for your post-market surveillance report. Fact: departments that can't tie triage decisions to specific model versions cannot complete a compliant FDA post-market surveillance analysis for AI-assisted diagnostic tools.
What Good Documentation Infrastructure Looks Like
Pull it together and the documentation infrastructure for a compliant critical results program has four components.
- A threshold list — formal, dated, reviewed annually, signed by the radiology chief
- A triage event log — timestamped, model-version-tagged, capturing the full detection-to-notification chain
- A receipt confirmation mechanism — HL7 ORU with acknowledgment logic or an EHR in-basket flag that records open/acknowledge events
- A monthly quality report — auto-generated from the log, covering the five metrics above, distributed to the department quality committee
None of this requires replacing existing PACS or EHR infrastructure. It requires a triage layer that sits between PACS worklist and radiologist workflow, generates the event log as a byproduct of normal operation, and integrates with existing HL7 feeds to close the receipt confirmation gap.
We've seen departments that built this infrastructure on top of standard PACS installations go into Joint Commission surveys with complete, exportable critical results data for the prior 24 months. The surveys went differently than they had before. Not dramatically, not overnight, just demonstrably better.
Starting Point for a Gap Assessment
If you want to know where your department stands before doing a full infrastructure review, pull three things: your most recent critical-finding threshold document (check the date on it), your detection-to-notification time data for the last 90 days, and your last monthly critical results quality report. If any of those don't exist or can't be produced within 15 minutes, you know where the gaps are.
The ACR doesn't require perfect systems. It requires documented ones. The Joint Commission doesn't expect zero delays — it expects that you can show you measured them, analyzed them, and are actively working to reduce them. That's a different standard than most departments apply to themselves, and it's achievable without changing how radiologists read.
