The postmortem, shared with us by a regional health system that asked not to be named, describes a failure mode that ought to worry anyone running models in production. During a routine EHR upgrade, two laboratory result fields changed internal identifiers. The mapping layer feeding the sepsis model silently began receiving nulls for lactate and white blood cell count.

The model did not crash. It imputed, scored, and fired alerts at almost exactly its previous rate — because alert volume is dominated by vitals and demographics, not by the two labs that carry most of the discriminative signal. Every operational dashboard stayed green. Sensitivity, measured retrospectively, fell by roughly a third.

The gap was caught by a nurse who noticed the model had stopped flagging a class of patient she had come to expect it to flag. That is the part the postmortem dwells on: the detection came from clinical intuition, not from monitoring.

The system has since added input-distribution monitoring at the feature level and a synthetic canary patient that runs hourly through the full pipeline. Both are cheap. Neither existed before, at an organization that considered itself relatively mature in AI governance.