CLAF. The cognitive load standard for healthcare interfaces.
CLAF — the Cognitive Load Audit Framework — is a scientifically validated standard for measuring, attributing, and reducing the avoidable cognitive burden healthcare software puts on clinical staff. It is the design standard the entire Penguin Ai platform, including Gwen, is built to. In healthcare, interface friction is a patient-safety issue, not a UX inconvenience.
The clinician who made clean, confident decisions at 8 AM is now hours of screens deep.
The cases have not gotten easier. The interface has not gotten lighter. Every redundant click, every stacked alert, every hunt across three tabs has quietly drawn down a finite reserve. Healthcare software has been graded on speed, features, and screens shipped — never on the one thing that decides whether a clinician can still think clearly at the end of a shift.
There is a superior path. CLAF measures the tax an interface imposes, proves where it comes from, and shows how to cut it.
Working memory is a tax on the brain.
A clinician starts each shift with a small, fixed account of mental capacity. Genuine reasoning — reading a sepsis trajectory, reconciling conflicting labs — deserves every unit. But poorly designed software levies a tax on that account before any real thinking begins.
The science is unambiguous: for complex reasoning, that account holds roughly four items at once2. Clinical interfaces routinely present far more on a single view, overdrawing the account several times over before the clinician has made a single decision.
CLAF answers one disciplined question
“How much of the mental load this interface imposes is avoidable — and how do we remove it?”
Three lenses, applied to every part of an interface
Three kinds of mental burden
Ask of any burden: would it disappear if the interface were redesigned for the same clinical task? If yes, it is extraneous — and CLAF targets it for removal.
Intrinsic load
Support it, never remove it.The difficulty built into the clinical task itself. Reasoning through a sepsis pathway is hard because the medicine is hard. This is the genuine cost of expert work.
Extraneous load
Eliminate this.The burden added by how the interface presents information — clutter, inconsistent navigation, alert volumes beyond working memory. Friction, not medicine. CLAF's primary target.
Germane load
Optimize its timing.The effort spent learning and building useful mental models. Productive during genuine learning, wasteful when an expert is forced to problem-solve navigation instead of practicing care.
What CLAF is not
CLAF did not invent a new theory. It productizes seventy years of settled science.
A lineage of cognitive science and clinical standards that was never before assembled into a single, repeatable healthcare audit.
Working memory holds about seven items, plus or minus two.1
Dual coding — the mind processes words and images through separate, limited channels.3
Cognitive Load Theory formalized: materials can impose demands exceeding working memory.4
Total load partitioned into intrinsic, extraneous, and germane — the line CLAF depends on most.5
The split-attention effect: related information scattered across panels forces costly mental integration.7
Physicians spend a large share of EHR time on documentation, much of it avoidable overhead.8
Seventy years of cognitive science becomes a measurable clinical standard.
Built to align with — and in places exceed — the standards you already carry.
ISO 924110
Ergonomics of human-system interaction — task suitability, error tolerance, conformity with user expectations.
WCAG 2.1 AA11
Perceivable, operable interfaces — contrast, use of color, and error identification.
ONC Safety-Enhanced Design12
Established under the 21st Century Cures Act Final Rule — the certification floor CLAF builds beyond.
AHRQ SAFER Guides13
Health IT safety, patient identification, and wrong-patient prevention.
The Joint Commission14
Patient-safety goals and Sentinel Event Alerts on the safe use of health information technology.
I-PASS15
Structured-handoff framework whose landmark trial cut medical errors by 23% and preventable adverse events by 30%.
An audit engine. Interface in, a defensible grade and a prioritized fix list out.
40 audit criteria across 8 clinical UX domains, scored by trained auditors, rolled into a single index that maps to a badge — with 25 evidence-based mitigation strategies ready to close the gaps.
Healthcare interface
The surface under audit
8 clinical UX domains
Where avoidable load hides
40 audit criteria
Each with a load type & risk level
Measure · Attribute · Mitigate
The three lenses, applied throughout
Cognitive Load Score
Raw measure — lower is better
CLAF Compliance Index
0–100 grade — higher is better
Compliance badge
What a buyer reads at a glance
25 mitigation strategies
Prioritized by clinical risk
Continuous improvement — findings feed back into the next audit
Eight domains — the surfaces where avoidable load hides.
Each criterion carries its load type, a clinical risk level, a defined measurement method, and clear pass and fail conditions. Alerting and decision support tie interface design most directly to patient-safety outcomes, so CLAF scrutinizes them most closely.
Visual Complexity
How much the screen asks the eye and mind to hold at once.
Information Architecture
Whether navigation matches how clinicians think, and patient context is preserved.
Interaction Design
Consistency, predictable behavior, and safe undo paths.
Alerting & Notification
Signal versus noise, and protection against alert fatigue.
Highest scrutiny
Documentation Burden
Required fields, copy-forward risk, and time taken from care.
Cognitive Transitions
Handoffs, context switching, and recovery after interruption.
Error Recovery
Clear messages and safe paths back from mistakes.
Decision Support
Whether guidance arrives actionable and at the right moment.
Highest scrutiny
On the mitigation side, CLAF carries 25 evidence-based strategies organized by the load they address — techniques that strip out extraneous friction, scaffold intrinsic complexity without hiding it, and channel germane effort toward useful learning. The output of an audit is never just a number. It is a number attached to a prioritized, evidence-backed plan.
The raw score works like golf. Lower is better.
A low Cognitive Load Score means the interface imposes little avoidable burden. That raw score is then inverted into the CLAF Compliance Index — the CCI — a grade from 0 to 100 where higher is better, the way most people instinctively read a grade.
Cognitive Load Score · raw
Lower is betterCLAF Compliance Index · 0–100
Higher is betterTwo numbers, opposite directions, on purpose. Less burden on the clinician, better grade for the product. Load down means grade up.
Exemplary
CCI 90+
Badge reads: “CLAF Certified, Exemplary”
Best in class. Avoidable load has been engineered out and is held there through continuous monitoring.
Compliant
CCI 75–89.9
Badge reads: “CLAF Certified, Compliant”
Meets the standard. Load is well managed, with any minor items tracked to a plan.
Developing
CCI 60–74.9
Badge reads: “CLAF Developing”
Not yet certified. Functional, but carries measurable avoidable load and sits on an active remediation plan.
Non-compliant
Below CCI 60
Badge reads: “Not certified”
Load reaches levels with documented workflow and safety risk. Flagged for priority remediation.
Defensible, not one reviewer's impression
Certification-grade results require two independent reviewers who score separately and reconcile through a documented calibration step, with their agreement formally measured for reliability. That is what makes a CLAF finding defensible to a board, a legal team, or an accreditation review.
One honest caveat
A CCI is a design-compliance grade, not a patient-safety percentage. A CCI of 80 does not mean a system is “80% safe.” Real-world safety also depends on staffing, training, and clinical context no interface review can capture. A high grade reduces identified cognitive-load risk — it does not guarantee safety, and CLAF never claims it does.
Six audiences, one instrument.
Executives
A single, defensible compliance grade you can put in front of health-system buyers. It turns “good UX” from a claim into risk-weighted proof.
Clinical leaders
Surface the hidden cognitive overhead your team has quietly adapted around — alert fatigue, after-hours charting, slow access to critical data — with objective measures, not “the interface is fine.”
Designers & engineers
Concrete, testable targets in place of subjective design debates. CLAF tells you which few high-risk fixes to tackle first; a compliant design system inherits criteria as passing evidence.
Spec writers
Write acceptance criteria as measurable pass-or-fail thresholds with a defined verification method, so “the interface should be clear” becomes an auditable requirement.
Auditors
A rigorous, repeatable instrument where every criterion ties to a load type, a clinical risk level, a measurement method, and a remediation expectation.
Researchers
A validated, longitudinal evidence base with a pulse-survey instrument and trend tracking that reveals where real-world signals diverge from audit predictions.
The framework distills into design discipline any team can apply.
Do. Keep each screen zone to a small number of primary elements — roughly five to nine — and reveal secondary detail on demand through progressive disclosure.
Don't. Dump every available data point on screen “for completeness,” or assume more information means better decisions.
Do. Use color only for consistent, established meaning, and always pair it with a second cue such as an icon or label.
Don't. Rely on color alone to signal status, or reuse the same color for different meanings.
Do. Keep most alerts quiet and ambient by default, reserve interrupting pop-ups for genuinely urgent cases, and give every alert a clear one-click action.
Don't. Default new alerts to interrupting modals without an urgency justification, or let alert creep bury the signals that matter.
Do. Keep frequently used functions shallow — about three steps or fewer — and keep “where am I” context visible at all times.
Don't. Bury high-use functions several levels deep, or force clinicians to learn a proprietary structure with no real-world analogue.
Do. Preserve in-progress work across screen switches and interruptions, and warn before a session times out mid-entry.
Don't. Lose in-progress entries during navigation, or time out silently during active data entry.
Do. Reserve confirmation dialogs for irreversible, high-stakes actions, and prefer undo as the main safety net.
Don't. Chain multiple confirmations for a single routine, reversible step.
Four myths worth retiring.
“Cognitive load is just UX jargon for complicated.”
It has a formal, decades-old scientific basis in Cognitive Load Theory. CLAF turns it into specific, measurable criteria with defined thresholds — not a gut-feel impression.4
“Reducing load means dumbing down the interface.”
The target is interface-imposed friction, never the genuine complexity of care. A well-designed interface shows the right information at the right moment — not less information.
“Training can expand working memory.”
Its capacity is a hard biological limit, roughly four to five items for complex reasoning. No amount of training expands it.2
“A score is a percent-safe guarantee.”
A high grade means the interface meets the framework's evidence-based criteria. It reduces identified cognitive-load risk; it does not certify safety in every real-world condition.
Questions buyers ask first.
What is CLAF, and why does it matter?
CLAF is a structured method for measuring and reducing the cognitive burden a healthcare interface places on clinicians. It turns roughly seventy years of cognitive science into concrete, measurable design criteria and a single compliance grade — giving teams a rigorous, defensible way to show their product does not add to clinician overload.
How does high cognitive load actually harm patients?
Working memory is limited. When an interface wastes it on friction, less is available for clinical reasoning. Documented pathways include alert fatigue, documentation errors, incomplete handoffs, and burnout — all of which raise patient-safety risk. Decision quality measurably degrades across a shift, and the interface is a significant variable in how quickly that gap opens.
My team says the software is fine. Why does CLAF matter?
Clinicians are extraordinarily good at adapting to bad tools, and that skill hides the cost. “Fine” often masks invisible overhead. Objective signals tell the real story: high alert-override rates, after-hours charting, and slow access to key data in emergencies — the kind of thing satisfaction surveys miss.
How is this different from accessibility, or WCAG?
You need both, and they are complementary. WCAG covers access — whether people can perceive and operate an interface. CLAF covers cognitive load — whether a clinician can reason under pressure once they can. The two overlap on contrast and legibility but address different failure modes and different users.
Is CLAF required by law?
No. It is a voluntary best-practice standard. But several of its criteria map directly to legally or accreditation-relevant areas — accessibility law, alert-fatigue safety goals, and error-recovery expectations — so adopting it is proactive alignment with regulation, not just a UX nicety.
How is it scored?
An interface is measured against 40 criteria across 8 domains. The raw measurement is a Cognitive Load Score, where lower is better, like golf. That score is inverted into the CLAF Compliance Index — a 0 to 100 grade where higher is better, weighted by clinical risk. Four badges sit on that index, with certification at 75 and above and Exemplary at 90 and above. Certification-grade scores require two independent, trained auditors whose agreement is measured for reliability.
How often should we audit?
Treat it as an ongoing practice, not a one-time certificate. Cognitive load shifts every time the interface changes, so re-check after a major redesign and monitor between formal reviews, with a fuller review at least annually.
What does a badge actually certify?
That an interface has been formally measured against the framework's evidence-based design criteria and meets the bar for its certified tier, weighted by clinical risk and validated by independent reviewers. It certifies design compliance and reduced identified cognitive-load risk. It is a design-quality grade, not a patient-safety percentage.
Does it slow my team down?
The reverse is the goal. A review is mostly an interface assessment the auditor performs directly. Clinician involvement is small — typically a short pulse survey and an optional card-sort exercise. CLAF specifies outcomes, not specific designs, so your team chooses how to meet each target.
How do I tell interface-caused load from genuine clinical complexity?
Ask one question: would this mental burden disappear if the interface were redesigned for the same clinical task? If yes, it is interface-imposed and eliminable. If no, it is inherent to the task and should be supported, not removed. A dosing calculation is inherent. Hunting across three screens to gather the inputs is not.
How does CLAF relate to ethical AI?
CLAF is the clinical-UX standard the Penguin Ai platform is built to, and one part of how we approach responsible, safety-first AI in healthcare — alongside our independent ethical-AI validation through URAC. Designing for human cognitive limits is core to building AI that supports clinical judgment rather than overwhelming it, and that keeps clinicians and operators in the loop on every recommendation.
Works Cited
- 1.Miller, G. A. (1956). The magical number seven, plus or minus two: Some limits on our capacity for processing information. Psychological Review, 63(2), 81–97.
- 2.Cowan, N. (2001). The magical number 4 in short-term memory: A reconsideration of mental storage capacity. Behavioral and Brain Sciences, 24(1), 87–114.
- 3.Paivio, A. (1971). Imagery and Verbal Processes. Holt, Rinehart and Winston.
- 4.Sweller, J. (1988). Cognitive load during problem solving: Effects on learning. Cognitive Science, 12(2), 257–285.
- 5.Paas, F., & van Merriënboer, J. J. G. (1993). The efficiency of instructional conditions: An approach to combine mental effort and performance measures. Human Factors, 35(4), 737–743.
- 6.Mayer, R. E. (2001). Multimedia Learning. Cambridge University Press.
- 7.Ayres, P., & Sweller, J. (2005). The split-attention principle in multimedia learning. In R. E. Mayer (Ed.), The Cambridge Handbook of Multimedia Learning. Cambridge University Press.
- 8.Sinsky, C., Colligan, L., Li, L., Prgomet, M., Reynolds, S., Goeders, L., & Blike, G. (2016). Allocation of physician time in ambulatory practice: A time and motion study in 4 specialties. Annals of Internal Medicine, 165(11), 753–760.
- 9.Arndt, B. G., Beasley, J. W., Watkinson, M. D., Temte, J. L., Tuan, W. J., Sinsky, C. A., & Gilchrist, V. J. (2017). Tethered to the EHR: Primary care physician workload assessment using EHR event log data and time-motion observations. Annals of Family Medicine, 15(5), 419–426.
- 10.International Organization for Standardization. (2020). ISO 9241-110: Ergonomics of human-system interaction, Part 110: Interaction principles. ISO.
- 11.World Wide Web Consortium (W3C), Web Accessibility Initiative. (2018). Web Content Accessibility Guidelines (WCAG) 2.1, Level AA. W3C Recommendation.
- 12.Office of the National Coordinator for Health Information Technology (ONC). (2020). 21st Century Cures Act Final Rule (Safety-Enhanced Design). U.S. Department of Health and Human Services.
- 13.Agency for Healthcare Research and Quality (AHRQ). (2019). SAFER Guides: Safety Assurance Factors for EHR Resilience. AHRQ Publication.
- 14.The Joint Commission. National Patient Safety Goals (Patient Identification; Handoff Communication) and Sentinel Event Alerts on the safe use of health information technology.
- 15.Starmer, A. J., Spector, N. D., Srivastava, R., West, D. C., Rosenbluth, G., Allen, A. D., & Landrigan, C. P. (2014). Changes in medical errors after implementation of a handoff program. New England Journal of Medicine, 371(19), 1803–1812.
CLAF™ is a trademark of Penguin Ai.