A Risk Management Framework for Triadic Telemedicine (RMFTT): A Conceptual Development Study

Alexander Gamus; Gabriel Chodick; Yoram Blachar; Tamar Shalom

doi:10.20944/preprints202609.2566.v1

Submitted:

28 September 2026

Posted:

29 September 2026

You are already at the latest version

Abstract

Background: The triadic model of assisted telemedicine, in which a trained nurse or caregiver facilitates the clinical encounter between a patient and a remote physician, holds considerable potential for improving access, diagnostic accuracy, and continuity of care. However, the distinctive risk architecture of this three-party model remains poorly characterized. Existing telemedicine risk literature addresses predominantly dyadic consultations, leaving the triadic context without a dedicated, integrative framework. Objective: This study aims to address the absence of a dedicated risk management framework for the triadic telemedicine context by proposing the Risk Management Framework for Triadic Telemedicine (RMFTT)—a structured, domain-specific tool for identifying, assessing, mitigating, and monitoring the principal risks inherent to nurse-facilitated assisted telemedicine. Methods: This conceptual framework development study employs a narrative literature review of PubMed, Scopus, Web of Science, and Google Scholar publications from January 2015 to June 2026, organized across five risk domains: clinical and diagnostic risk, communication risk, legal and liability risk, data privacy and cybersecurity risk, and workforce competency risk. Extracted evidence is synthesized using a structured risk architecture matrix, distinguishing risk type, source, likelihood, and consequence severity within the triadic telemedicine context. Results: The synthesis yields the Risk Management Framework for Triadic Telemedicine (RMFTT), two-axis conceptual model mapping five risk domains against four risk management stages: identification, assessment, mitigation, and monitoring. Each domain is populated with literature-derived risk indicators and corresponding mitigation strategies tailored to the triadic care setting. Conclusions: To our knowledge, no dedicated risk management framework has previously been proposed for the triadic telemedicine context. The RMFTT provides the first structured, domain-specific tool for identifying, assessing, mitigating, and monitoring risk across the five principal dimensions of assisted triadic telemedicine. It offers actionable guidance for clinicians, nurse-facilitators, health system managers, and policymakers, and establishes a foundation for subsequent empirical validation across diverse healthcare settings.

Keywords:

triadic telemedicine

;

assisted telemedicine

;

risk management

;

patient safety

;

telenursing

;

digital health

;

conceptual framework

Subject:

Public Health and Healthcare - Public Health and Health Services

Introduction

The rapid global expansion of telemedicine, accelerated by the COVID-19 pandemic, has fundamentally reshaped the delivery of healthcare. Telemedicine has evolved from a niche service for geographically isolated populations into a mainstream modality of healthcare delivery, with increasing integration across primary care, specialty services, chronic disease management, mental health, and post-acute follow-up [1,2,3]. Within this expanding landscape, telemedicine has demonstrated meaningful benefits across a broad range of clinical applications while simultaneously introducing new challenges for clinical governance, patient safety, and quality assurance.

Yet the speed and scale of this expansion have outpaced the development of structured risk management frameworks. Research gaps remain regarding whether telemedicine can fully replace in-person services without compromising care quality, and existing models and frameworks do not sufficiently incorporate the multidimensional risks crucial in the healthcare context, underscoring the need for a more comprehensive framework [4,5]. While safety concerns in dyadic telemedicine, involving a single patient interacting directly with a remote physician, have begun to attract scholarly attention, the risk architecture of more complex, multi-party configurations remains largely uncharacterized.

Among these configurations, the triadic model of assisted telemedicine presents a particularly distinctive and underexamined risk profile. In this model, a trained nurse or caregiver acts as an on-site facilitator, mediating the clinical encounter between the patient and a remote physician. This arrangement introduces a third actor into the consultation—one who simultaneously handles patient data, performs preliminary clinical assessments, operates connected diagnostic devices, and manages the communication flow between patient and physician. To illustrate: an elderly patient with diabetes in a rural clinic connects remotely with her internist; a trained nurse-facilitator—referred to in the American literature as a “telepresenter”[6]—on site measures vital signs, operates a digital stethoscope, and ensures the patient’s concerns are clearly communicated, functions that the remote physician cannot perform but depends upon for clinical decision-making. Each of these functions carries its own risk dimension, and their interaction within a single consultation creates a compounded risk architecture that differs fundamentally from either face-to-face care or standard dyadic telemedicine.

Prior work has established the structural foundations and adoption dynamics of the triadic model, as well as its communicative dimensions [7,8]. The present study builds on that foundation by addressing the risk dimension, an aspect that has received no dedicated treatment in the triadic telemedicine literature and that remains underserved in the broader telehealth patient safety field. Despite growing recognition that patient safety is a central challenge of telemedicine expansion, existing risk frameworks have been developed for dyadic configurations and cannot adequately capture the compounded risk architecture introduced by a three-party consultation involving a nurse-facilitator intermediary.

This gap is not merely academic. Barriers to telemedicine implementation, including limited broadband access, digital literacy gaps, reimbursement uncertainties, and workflow misalignments, disproportionately affect rural and underserved populations, raising equity concerns—precisely the populations for whom the triadic facilitated model is most relevant and most frequently deployed. Without a structured risk management approach, the expansion of assisted telemedicine into these settings risks exposing the most vulnerable patients to compounded clinical, communicative, legal, and cybersecurity harms.

The present study addresses this gap by proposing the Risk Management Framework for Triadic Telemedicine (RMFTT)—an integrated, domain-specific risk management framework tailored to the assisted triadic telemedicine context. Drawing on a narrative review of published literature from January 2015 to June 2026, the RMFTT organizes risk across five domains and maps each domain against four risk management stages: identification, assessment, mitigation, and monitoring. The framework is designed to be actionable for clinicians, nurse-facilitators, health system managers, and policymakers, and to serve as a foundation for subsequent empirical validation across diverse healthcare settings.

Background and Rationale

Risk management in healthcare: conceptual foundations

Clinical risk management is defined as the systematic process of identifying, assessing, mitigating, and monitoring risks that may cause harm to patients, staff, or organizations within the healthcare environment [9]. Adverse events in healthcare are primarily attributable to system failures rather than individual error, a recognition that has shifted risk management from reactive incident response toward proactive governance frameworks embedded in organizational culture and clinical workflow [10]. The World Health Organization’s 2021–2030 Global Patient Safety Action Plan explicitly frames risk management as a mandatory strategic objective for all health systems [11]. Within this context, effective risk management necessitates not only a systematic identification of hazard sources but also an understanding of how risks interact and propagate across the care chain.

The application of risk management principles to digital health and telemedicine is comparatively recent and remains methodologically immature. A systematic review of risk management and patient safety in digital health found that healthcare systems’ multiple interconnected factors form a dense network whose imbalance can compromise patient safety, and that expansion of proactive risk management programs is urgently needed [12]. Despite this recognition, the literature on telemedicine risk management remains fragmented, tending to examine individual risk categories in isolation rather than integrating them into coherent, actionable frameworks applicable to specific telemedicine configurations.

The telemedicine risk landscape: scope and limitations of current frameworks

A systematic review and meta-analysis covering telemedicine adoption between 2020 and 2025 identified that implementation challenges and the impact on clinical outcomes, access, and quality remain under investigation, with barriers including digital literacy gaps, reimbursement uncertainties, and workflow misalignments disproportionately affecting underserved populations [1]. Patient safety risks in telehealth are systemic, affecting not only healthcare professionals but also the environment and organizational context, and despite its central relevance, patient safety remains an underexplored aspect of telehealth with notable gaps in regulatory frameworks and a lack of comprehensive monitoring guidelines [13].

Several risk frameworks have been proposed for telemedicine and e-health more broadly. A comprehensive risk management framework for e-health care delivery proposed a systematic process covering risk identification, assessment, mitigation, and continuous review, but identified that current frameworks fail to adequately address the specific risks of e-health—highlighting the urgent need for a more specialized approach [4]. An emergent research and policy framework for telehealth encompassed regulatory, delivery system, and outcomes dimensions, but did not address multi-party configurations [5]. Yet none of these frameworks has been developed for multi-party telemedicine configurations, and none addresses the risk architecture introduced by a professional intermediary operating between the patient and the remote physician.

The triadic model and its distinctive risk architecture

The triadic model of assisted telemedicine represents a structurally distinct configuration in which a trained nurse or caregiver acts as an on-site facilitator, mediating the clinical encounter between the patient and the remote physician. In the United States, this facilitating role is commonly referred to as the “telepresenter” or “patient-site presenter”—a trained professional who serves as the arms and hands of the remote physician, performing physical assessments, operating diagnostic peripherals, and managing the communication flow of the encounter [6]. Throughout this paper, the primary term used is “nurse-facilitator,” while acknowledging that the RMFTT applies across the full spectrum of facilitator types, with risk profiles calibrated accordingly. This configuration addresses a fundamental limitation of self-administered telemedicine by extending reach to patients with mobility, cognitive, or technological constraints through point-of-care diagnostics and guided self-care. The structural and communicative dimensions of this model have been established in prior work [7,8]. Real-world implementation experience from nurse-facilitated telemedicine programs further supports the clinical and operational feasibility of assisted telemedicine models in primary care and chronic disease management settings [13].

However, the facilitator role simultaneously generates a distinctive and previously uncharacterized risk architecture. The facilitator is at once a clinical actor, a data handler, a communication broker, and a decision-support agent—functions that in face-to-face care are distributed across a physically co-located team with established protocols and lines of accountability. In the triadic model, these functions converge in a single role operating at geographic remove from the supervising physician, often in resource-limited settings, and without standardized competency frameworks or risk governance protocols. Remote encounters about acute or worrisome symptoms require decision-making under conditions of uncertainty and urgency, and the rapid pace of telehealth’s technological growth creates urgency in identifying safe systems to guide developers and clinicians [14]. Existing patient safety frameworks do not adequately account for this configuration.

Rationale for the RMFTT

The absence of a dedicated risk management framework for triadic telemedicine is consequential rather than merely academic. The populations for whom the triadic model is most relevant—elderly patients, those with cognitive or functional limitations, and residents of underserved areas—carry the greatest clinical risk burden and are the least equipped to self-identify or escalate safety failures during remote consultations. A scoping review of governance strategies for patient safety identified that improvement efforts should combine clinical governance, safety culture, communication, competency, and accountability into an integrated organizational framework [10]. The RMFTT is designed to provide precisely this integration, tailored to the specific structural and operational features of the assisted triadic telemedicine model.

Methods

Study design

This study employs a conceptual framework development design, informed by a structured narrative literature review. Conceptual framework development is an established methodology in health systems research for synthesizing heterogeneous bodies of evidence into an integrated, theoretically grounded model when the phenomenon of interest is complex, multidimensional, and lacks an existing organizing structure [15]. This approach is appropriate for the present study, given that risk management in triadic telemedicine has not previously been examined as a unified construct. The five risk domains addressed by the RMFTT draw on distinct bodies of literature—clinical safety, communication science, health law, cybersecurity, and workforce development—which require conceptual integration rather than meta-analytic pooling [15].

The review was conducted and reported in line with the Scale for the Assessment of Narrative Review Articles (SANRA) [16]. A systematic-review methodology such as PRISMA was not adopted, as the aim was conceptual synthesis rather than exhaustive ascertainment of all eligible studies.

The study proceeds through three sequential phases: a structured literature search and mapping phase, a conceptual synthesis phase, and a framework construction phase. Severity classifications represent qualitative expert synthesis derived from the reviewed literature and are intended as heuristic rather than quantitative risk estimates.

Phase 1—Literature search and mapping

Literature was identified through PubMed, Scopus, Web of Science, and Google Scholar for English-language publications from January 2015 to June 2026, using domain-specific combinations of telemedicine and risk-relevant terms. The search was not intended to be exhaustive; sources were selected purposively for relevance to the five risk domains and for methodological quality, prioritizing systematic and narrative reviews, implementation studies, and conceptual or framework papers, alongside selected regulatory and governance documents. Where triadic-specific evidence was sparse, particularly for workforce competency, transferable evidence from dyadic telemedicine, nurse-led care, and remote patient monitoring was incorporated and identified as such. Gray literature, including policy documents and regulatory guidance from the World Health Organization and relevant international health agencies, was included where it provided material evidence on risk governance standards not yet reflected in the peer-reviewed literature.

Following independent domain searches, extracted sources were organized thematically within each domain. Themes were identified inductively from source content and mapped onto the four RMFTT management stages—identification, assessment, mitigation, monitoring—to guide framework cell population. Where evidence was transferable from dyadic or nurse-led care contexts rather than triadic-specific, this was noted explicitly in the synthesis.

Phase 2—Conceptual synthesis

Extracted findings were organized using a structured risk architecture matrix distinguishing four analytical dimensions for each identified risk: risk type (the nature of the potential harm), risk source (the actor or system component from which the risk originates), risk likelihood (assessed qualitatively as high, moderate, or context-dependent), and risk consequence severity (assessed as high, moderate, or low). This four-dimension analytical structure draws on established risk assessment principles in healthcare and digital health governance, including the ISO 14971 standard for the application of risk management to medical devices [17]. The severity and likelihood ratings represent preliminary author judgements based on the synthesized literature and are intended as heuristic starting points for empirical refinement rather than validated quantitative estimates.

Phase 3—Framework construction

The RMFTT was constructed as a two-axis conceptual model. The horizontal axis organizes the five risk domains: clinical and diagnostic risk (D1), communication risk (D2), legal and liability risk (D3), data privacy and cybersecurity risk (D4), and workforce competency risk (D5). The vertical axis organizes four risk management stages: identification, assessment, mitigation, and monitoring. The resulting 20-cell matrix constitutes the operational structure of the framework, with each cell populated by literature-derived risk indicators and corresponding management strategies derived from the Phase 2 synthesis.

Scope and delimitations

The present study is delimited to the triadic model of assisted telemedicine—defined as a three-party remote clinical encounter in which a trained nurse or caregiver facilitates interaction between a patient and a remote physician, as established in the foundational literature on this model [7,8]. The framework is designed to be applicable across health system contexts. This study does not constitute an empirical validation of the RMFTT. The framework is presented as a theoretically grounded conceptual model requiring subsequent empirical testing, and the research program explicitly positions an observational or mixed-methods validation study as the next phase of inquiry. The five risk domains are grounded in universal features of the triadic model that apply across health system contexts, including rural primary care systems in Europe, nurse-facilitated telemedicine programs in low- and middle-income countries, and aged-care facility telemedicine models increasingly prevalent worldwide.

Results of the Narrative Review

Overview

The narrative review drew on 38 references: 20 providing domain-specific evidence across the five risk domains, and 18 informing the conceptual, methodological, and policy foundations of the framework. Table 1 presents the domain-by-domain references cited, principal source types, and key themes. Across all five domains, the review identified little evidence specific to the triadic model. Evidence gaps were consistent and domain-specific: no primary studies of diagnostic accuracy with a nurse-facilitator intermediary were identified (D1); all communication sources addressed dyadic or face-to-face contexts, making D2 the domain with the highest degree of evidence extrapolation; no legal framework addressing the triadic accountability architecture was found (D3); multi-party data exposure in the triadic configuration was not directly addressed in any identified source (D4); and triadic facilitator-specific competency literature was almost entirely absent (D5)—a scarcity treated as a primary finding of the review rather than merely a limitation.

Domain 1—Clinical and Diagnostic Risk: Review Findings

The evidence for Domain 1 was drawn from three publications. A systematic review of remote diagnosis in telemedicine (2016–2023) mapped the procedures, input variables, and open research issues in remote diagnostic models [18]. The dominant theme across this domain was the conditional nature of diagnostic accuracy in telemedicine—high concordance with in-person diagnosis was consistently demonstrated for conditions relying primarily on patient history and structured questioning, while accuracy declined significantly for conditions requiring physical examination, tactile assessment, or observation of findings not adequately captured by standard video. A systematic review with meta-analysis of telemedicine for musculoskeletal disorders found remote diagnoses highly concordant with in-person diagnoses where physiotherapists served as evaluators, but noted that broader providers including orthopedic surgeons and primary care physicians were underrepresented, limiting generalizability [19].

Domain 2—Communication Risk: Review Findings

Evidence for Domain 2 was drawn from five publications, primarily from the triadic communication literature in face-to-face consultations, the telehealth communication quality literature, and conceptual work on facilitated clinical encounters. A scoping review of patient safety risk in synchronous telehealth, encompassing 15 systematic reviews and 315 studies, identified that patient safety risks in telehealth are systemic, affecting not only healthcare professionals but also the environment and organizational context, with notable gaps in regulatory frameworks and a lack of comprehensive guidelines regarding implementation and monitoring [13]. Communication-specific risk indicators—information filtering, role ambiguity, and patient voice suppression—were identified consistently across the triadic communication literature but have not yet been studied in the telemedicine-specific triadic context.

Domain 3—Legal and Liability Risk: Review Findings

The evidence for Domain 3 was drawn from four publications, combining empirical legal analysis, regulatory review, and expert commentary. A review of ethical and legal challenges of telemedicine across 24 eligible studies found that legal and ethical issues concerned informed consent and autonomy (cited in 87% of included studies), patient privacy (78%) and confidentiality (57%), data protection and security (74%), and malpractice and professional liability (70%), concluding that ethical and legal issues related to telehealth practice still require standard and specific rules of application [20]. Professional ethics guidance further holds that physicians and organizations providing telemedicine should routinely monitor the telehealth landscape to identify and address adverse consequences as the technology evolves, and should encourage the dissemination of both favorable and unfavorable outcomes [21].

Domain 4—Data Privacy and Cybersecurity Risk: Review Findings

The evidence for Domain 4 was drawn from three publications: platform security evaluations, breach incident analyses, and digital health governance frameworks. A systematic literature review validating telehealth outcome categories for patient safety, covering publications through 2024, identified that integrating telehealth into established care processes presents significant safety evaluation challenges, with existing literature on telehealth outcomes to support evaluation remaining limited [22]. The multi-party data exposure risk specific to the triadic model—arising from the simultaneous presence of three participants on potentially different devices and networks—was not directly addressed in any identified source, though its component risks (unsecured transmission, consent gaps, facilitator data handling errors) were each well-evidenced in the broader telehealth security literature.

Domain 5—Workforce Competency Risk: Review Findings

The evidence for Domain 5 was drawn from five publications, none situated specifically in a nurse-facilitated or assisted telemedicine context. A scoping review of telehealth training and education for allied health professionals concluded that establishing clear training and education standards is crucial, and that ensuring the workforce possesses the required skills, knowledge, and behaviors to provide safe, efficient, and effective telehealth services requires a clear organizational strategy and determination of roles and responsibilities [23]. A modified Delphi study developing telemedicine entrustable professional activities for nurses in long-term care—the closest published analogue to the triadic facilitator role identified in the review—established that developing clear standards of practice is necessary to cater to nurses’ roles and scope in different telemedicine services, with continuing and context-specific education essential to increase nurses’ readiness [24]. A recent scoping review of workforce preparation for telehealth practice, encompassing 31 studies across medicine, nursing, and allied health, confirmed that telehealth services are safe and effective if delivered by appropriately qualified personnel, but found that competence in face-to-face care does not automatically transfer to telehealth delivery and that dedicated training remains essential [25].

The RMFTT Framework: Domain-by-Domain Construction

This section presents the domain-by-domain construction of the RMFTT, built on the evidence synthesized above. Table 2 summarizes the matrix.

Domain 1—Clinical and Diagnostic Risk

Identification

Clinical and diagnostic risk in triadic telemedicine arises primarily from the structural constraints of remote physical assessment and from the mediating role of the nurse-facilitator in the clinical information chain. Remote encounters about acute or worrisome symptoms are time sensitive, requiring decision-making under conditions of uncertainty and urgency, and inadequate telehealth systems can compromise patient safety [14]. Three principal risk indicators are identifiable: limitations of remote physical examination; triage accuracy gaps arising from the nurse-facilitator’s preliminary assessment; and missed clinical signs by an inadequately trained or insufficiently supervised nurse-facilitator.

Assessment

The severity of clinical and diagnostic risk in triadic telemedicine is assessed as high. Misdiagnosis remains one of the most frequently cited patient-safety concerns in telemedicine, particularly when clinical assessment is constrained by the limitations of remote examination [14,18]. Likelihood is assessed as context-dependent, varying with the clinical acuity of the presenting condition, the diagnostic capability of available point-of-care devices, and the competency level of the nurse-facilitator.

Mitigation

Three mitigation strategies are indicated: AI-augmented diagnostic support tools integrated into the nurse-facilitator’s workflow; structured triage templates guiding the nurse-facilitator through standardized symptom and vital signs assessment; and clearly defined escalation protocols establishing the threshold at which the telemedicine consultation must be suspended in favor of emergency or in-person care.

Monitoring

Adverse event reporting systems should capture diagnostic errors, near-misses, and escalation failures attributable to the triadic consultation process. Regular diagnostic accuracy audits comparing nurse-facilitator triage decisions against subsequent physician diagnoses and clinical outcomes provide a continuous quality signal. Outcome benchmarking against comparable dyadic telemedicine or face-to-face care programs enables longitudinal safety assessment.

Domain 2—Communication Risk

Identification

Communication risk in triadic telemedicine is structurally distinct from that in dyadic consultations. Triadic communication refers to the presence of a third party in clinical encounters, with the third party assuming a variety of roles, some helpful, some introducing unintended barriers to patient voice and information accuracy [26,27]. Three principal risk indicators are identifiable: role ambiguity; information filtering by the nurse-facilitator; and patient voice suppression, particularly among elderly, cognitively impaired, or lower health literacy patients.

Assessment

Severity is assessed as moderate to high, given that communication failures in clinical encounters are a well-documented contributor to diagnostic error and adverse outcomes. Key communication challenges in telehealth include the delivery and receipt of information across remote channels, multi-tasking demands on clinicians, difficulties in confirming patient understanding, and managing the follow-up process after the consultation ends, all of which are amplified in the triadic model [28]. Likelihood is assessed as moderate, increasing significantly in consultations involving patients with cognitive impairment, language barriers, or low digital literacy.

Mitigation

Three mitigation strategies are indicated: role clarity agreements formally documenting the nurse-facilitator’s communicative function; conversational capacity training addressing the communication pitfalls specific to three-party clinical encounters;[29] and patient voice protocols providing explicit opening invitations for the patient to speak directly to the physician at defined points in the consultation.

Monitoring

Consultation recording review enables retrospective assessment of communication quality, including identification of information filtering events and patient voice suppression instances. Patient feedback surveys administered after triadic consultations provide a direct signal of whether patients felt heard and adequately represented. Role conflict incident logs capture cases where ambiguity in the nurse-facilitator’s communicative role contributed to consultation breakdown or patient complaint.

Domain 3—Legal and Liability Risk

Identification

The triadic model introduces a distinctive legal risk architecture by distributing clinical responsibility across three actors without a universally established framework for assigning accountability when adverse outcomes occur. In principle, the regime of legal liability for medical malpractice is the same for telemedicine as for traditional physical care; however, the standard of care requires that the overall quality of remote care be at least as good as its comparable physical alternative [30]. Three principal risk indicators are identifiable: accountability gaps arising from the three-actor distribution of clinical responsibility; jurisdictional ambiguity in cross-border or cross-regional deployments; and undefined nurse scope of practice in the triadic role.

Assessment

Severity is assessed as high, given the potential for adverse patient outcomes and significant organizational liability. Legal and ethical issues in telemedicine—including informed consent, privacy, data protection, and malpractice liability—still require standard and specific rules of application [20]. Likelihood is assessed as system-dependent, varying significantly with the regulatory maturity of the health system in which the triadic model is deployed.

Mitigation

Three mitigation strategies are indicated: clear liability frameworks formally documenting institutional accountability for each stage of the triadic consultation; defined nurse scope of care specifying which clinical actions the nurse-facilitator is authorized to perform; and comprehensive informed consent documentation covering all three parties and their respective roles in the consultation.

Monitoring

Complaint tracking systems should capture cases involving triadic consultation specifically. Regulatory update alerts ensure institutional protocols are revised whenever national telemedicine legislation changes. Telemedicine implementation continues to be influenced by evolving licensure requirements, reimbursement policies, and regulatory frameworks across jurisdictions, requiring ongoing organizational monitoring and adaptation [3,5]. Periodic malpractice case review provides the most direct monitoring signal.

Domain 4—Data Privacy and Cybersecurity Risk

Identification

The triadic model amplifies data privacy and cybersecurity risks by introducing a third access point, the on-site nurse-facilitator, who handles patient data, operates connected diagnostic devices, and transmits biometric measurements through a shared digital session. Three principal risk indicators are identifiable: multi-party data exposure arising from the simultaneous presence of three participants potentially using different devices and network environments; unsecured data transmission; and consent gaps for session recordings specific to the three-party model.

Assessment

Severity is assessed as high. Healthcare organizations continue to experience significant cybersecurity threats and data breaches, reflecting persistent vulnerabilities associated with digital health infrastructure, human factors, legacy systems, and interconnected technologies. Recent systematic review evidence suggests that cybersecurity vulnerabilities in healthcare arise from a complex interaction among technological, organizational, and human factors, requiring a sociotechnical approach to risk mitigation [31]. Likelihood is assessed as platform-dependent, varying with the security architecture of the telemedicine system in use.

Mitigation

Three mitigation strategies are indicated: GDPR and HIPAA-compliant platform selection verified through Business Associate Agreements and independent security certification; end-to-end encrypted transmission of all data exchanged during triadic consultations including diagnostic device outputs; and recording consent policies specifically designed for the triadic model covering patient, nurse-facilitator, and physician consent for session recording, data storage, and authorized access.

Monitoring

Monitoring of Domain 4 requires breach incident logging; bi-annual platform security audits; consent compliance monitoring; regulatory update tracking; and nurse-facilitator-specific data hygiene checks. Effective cybersecurity governance requires documented risk assessment procedures, breach notification protocols, and maintenance of administrative, physical, and technical safeguards including access controls, encryption, and audit controls [32].

Domain 5—Workforce Competency Risk

Identification

Workforce competency risk is the domain most specific to the triadic model and the one with the most limited evidence base, a scarcity that is itself a significant finding, reflecting the absence of established training and competency standards for the nurse-facilitator role. Developing clear standards of practice is necessary to cater to nurses’ roles and scope in different telemedicine services, to ensure continuous uptake and benefit from telemedicine, with continuing and context-specific education essential to increase nurses’ readiness [24]. Three principal risk indicators are identifiable: undertrained nurse-facilitators deployed without adequate preparation; role drift describing the gradual expansion of nurse-facilitator clinical actions beyond formally sanctioned scope; and digital literacy deficits compromising technical performance.

Assessment

Severity is assessed as high, given that nurse-facilitator competency underpins the safety performance of all other domains simultaneously. Likelihood is assessed as high in the current evidence landscape, given the documented absence of standardized competency frameworks for the triadic facilitator role.

Mitigation

Three mitigation strategies are indicated: competency frameworks specifically designed for the triadic nurse-facilitator role drawing on the Entrustable Professional Activities (EPA) methodology; mandatory digital literacy training as a prerequisite for deployment in the triadic role; and supervision protocols establishing regular check-ins between nurse-facilitators and supervising nurses or physicians as a safeguard against role drift. In the United States, the Veterans Affairs Telepresenter Certificate Program—developed in partnership with the University of Florida College of Nursing—trained over 900 healthcare professionals in telepresenting competencies, demonstrating the feasibility and scalability of structured nurse-facilitator training programs [6].

Monitoring

Competency re-assessments at defined intervals ensure nurse-facilitator readiness is maintained rather than assumed. A scoping review of telehealth competency evaluation tools identified that reliable, validated instruments for assessing telehealth-specific competencies remain scarce, representing a priority development area for the field [33]. Training completion rate tracking provides an organizational-level signal of program implementation fidelity. Near-miss incident reports are the most sensitive early warning indicator of emerging competency risk and should be encouraged through a non-punitive reporting culture.

Cross-Domain Integration

A review of the five domains reveals three cross-cutting structural patterns. First, workforce competency (D5) functions as the foundational enabling domain within the framework: because nurse-facilitator performance shapes the identification, assessment, mitigation, and monitoring of risk across every other domain, inadequate facilitator training simultaneously amplifies clinical diagnostic risk (D1), communication failures (D2), legal liability exposure (D3), and data handling errors (D4) (Figure 1).

This dependency structure suggests that investment in nurse-facilitator competency development delivers risk reduction benefits across the entire framework simultaneously. Similar relationships between workforce capability, system performance, and patient safety outcomes have been described in human factors and socio-technical systems research, where safety is understood as an emergent property of interactions among people, technologies, and organizational processes [34]. Second, communication risk (D2) and clinical risk (D1) are structurally interdependent: information filtering by the nurse-facilitator directly degrades the diagnostic information available to the physician, creating a direct pathway from communication failure to clinical error. Third, legal risk (D3) is activated by failures in any of the other four domains, functioning as a downstream consequence risk rather than an independent upstream cause, a finding with direct implications for institutional governance design, suggesting that legal risk management should be integrated into, rather than siloed from, clinical and operational risk governance.

Discussion

Principal findings

This study presents the Risk Management Framework for Triadic Telemedicine (RMFTT)—a structured, domain-specific conceptual framework mapping five risk dimensions against four management stages in the context of nurse-facilitated assisted telemedicine. The framework makes three principal contributions. First, it identifies the triadic model’s distinctive risk architecture—one that differs qualitatively from both face-to-face care and dyadic telemedicine by virtue of the distributed clinical, communicative, legal, and data-handling functions concentrated in the nurse-facilitator role. Second, it demonstrates that these five risk domains are structurally interdependent, with workforce competency (D5) as the foundational enabling domain. Third, it provides an actionable matrix of risk indicators and management strategies directly operationalizable by health system managers, nurse educators, clinical governance teams, and policymakers.

Positioning the RMFTT within the existing literature

The RMFTT builds on and extends a growing body of work on risk and patient safety in telemedicine. Recent work has confirmed that telemedicine risk is multidimensional, with multiple perceived risk categories influencing adoption [35]. Yet this and comparable frameworks have been developed for telemedicine in general, without distinguishing the risk profile of multi-party configurations. The global push to scale up telemedicine services is challenged by complex, multilevel, multifaceted implementation and a lack of consensus on the evidence-based essential building blocks of implementation [3]. The RMFTT addresses this gap by providing a structured, literature-informed set of building blocks specific to the assisted triadic model—a configuration whose risk architecture has not previously been characterized in the literature. The novelty of the RMFTT lies less in the individual mitigation tools than in their systematic organization around risks emerging from the interaction among patient, nurse-facilitator, and physician.

Implications for practice

For nurse-facilitators, the RMFTT provides an explicit account of the risk functions they carry within the triadic consultation. These functions are currently performed without the benefit of standardized training, formal role definition, or risk governance protocols in most health systems. The identification of role drift as a key workforce competency risk, and the corresponding mitigation strategies centered on competency frameworks and supervision protocols, respond directly to the documented absence of standardized competency frameworks for the nurse-facilitator role identified in the narrative review of Domain 5.

For health system managers and clinical governance teams, the RMFTT’s four-stage structure maps directly onto existing clinical governance frameworks and quality management cycles, facilitating integration rather than requiring the creation of parallel governance structures.

For policymakers, the legal and liability domain (D3) carries particular urgency. The three-party distribution of clinical responsibility in the triadic model creates accountability gaps that current regulatory frameworks in most jurisdictions have not yet addressed. The RMFTT’s articulation of these gaps—accountability ambiguity, undefined nurse scope, and jurisdictional complexity—as identifiable and addressable risk indicators provides a structured basis for regulatory development. The recent enactment of the Uniform Telehealth Act in Washington State (2024) illustrates the kind of regulatory evolution that the RMFTT’s legal domain is designed to support [36].

Limitations

Several limitations warrant acknowledgment. First, the RMFTT is a conceptual framework derived from a narrative literature review and has not been empirically validated. Risk indicators, likelihood assessments, and mitigation strategies represent informed conceptual judgements rather than empirically tested propositions. Empirical validation, through observational studies, expert consensus processes, or prospective implementation evaluation, is identified as the next phase of this research program.

Second, the evidence base for several domains, particularly Domain 5 (workforce competency) and aspects of Domain 2 (communication risk specific to the triadic context), is sparse. This scarcity is itself a finding of significance, confirming the novelty of the research area. However, it means that some framework cells draw on transferable evidence from adjacent contexts rather than triadic-specific primary research.

Third, the RMFTT addresses risk management rather than risk quantification. It does not assign numerical probability or severity scores to individual risk indicators, nor provide a composite risk index. Development of validated risk scoring instruments is identified as a priority for future empirical work.

Future research directions

The RMFTT generates a structured agenda for empirical research. The most immediate priority is the development and validation of a standardized competency assessment tool for the triadic nurse-facilitator role, building on emerging telepresenter competency frameworks. A second priority is a prospective observational study examining communication dynamics and information filtering rates in real-world triadic consultations, directly operationalizing the risk indicators identified in Domain 2. A third priority is a comparative legal analysis of accountability frameworks for triadic telemedicine across health systems. Collectively, these empirical studies would constitute the validation phase of the RMFTT.

Conclusions

The triadic model of assisted telemedicine, in which a trained nurse or caregiver facilitates the clinical encounter between a patient and a remote physician, represents a promising and increasingly relevant configuration of remote care, particularly for populations whose mobility, cognitive capacity, or technological constraints place standard self-administered telemedicine beyond their reach. Yet the expansion of this model into clinical practice has outpaced the development of structured risk governance. To our knowledge, no dedicated risk management framework has previously been proposed for the triadic telemedicine context. The RMFTT provides the first structured, domain-specific tool for identifying, assessing, mitigating, and monitoring the principal risks inherent to assisted triadic telemedicine.

The RMFTT organizes risk across five domains—clinical and diagnostic, communication, legal and liability, data privacy and cybersecurity, and workforce competency—and maps each domain against four management stages. Its construction reveals that these domains are not independent risk silos but structurally interdependent elements of a coherent risk architecture, with nurse-facilitator workforce competency functioning as the foundational enabling domain whose adequacy determines the safety performance of the model as a whole, and with communication failure constituting a direct upstream pathway to clinical diagnostic risk.

Three conclusions of particular practical and policy significance emerge from this analysis. First, the nurse-facilitator role carries a concentration of risk functions that cannot be managed adequately without purpose-built competency frameworks, supervision protocols, and formal role definitions. Second, the legal and liability architecture of triadic telemedicine remains underdeveloped in most health systems, with accountability gaps and undefined nurse scope of practice representing addressable policy failures rather than inherent characteristics of the model. Third, the data privacy and cybersecurity risk specific to the triadic configuration requires monitoring mechanisms that extend beyond standard dyadic telemedicine compliance frameworks.

The RMFTT is presented as a theoretically grounded conceptual tool requiring empirical validation. Its immediate value lies in providing health system managers, clinical governance teams, nurse educators, and policymakers with a structured, literature-derived basis for designing, auditing, and improving triadic telemedicine programs. Its longer-term value lies in establishing the conceptual architecture for a program of empirical research that will progressively replace conceptual inference with measured evidence.

This study forms part of an ongoing program of research developing the conceptual foundations of triadic telemedicine practice. Building on prior work that established the structural foundations, adoption dynamics, and communicative dimensions of the model,[7,8] the RMFTT extends this program to its risk dimension, contributing the conceptual architecture required to equip the field for the empirical phase that follows.

Author Contributions

A.G. conceptualized the study, led theoretical model development, and drafted the manuscript. T.S. contributed to study design, literature synthesis, and critical revision. G.C. contributed to conceptual development and critical revision. Y.B. contributed to study design and critical revision. All authors reviewed and approved the final manuscript.

Artificial Intelligence Disclosure: AI-assisted tools (Claude, ChatGPT, Perplexity) were used during manuscript preparation for language editing, writing support, literature identification, and structural drafting. All intellectual content, framework conceptualization, domain definitions, and final conclusions were developed, critically reviewed, and approved by the authors, who take full responsibility for the accuracy, integrity, and originality of the manuscript. This disclosure is provided in accordance with ICMJE recommendations and Healthcare (MDPI) publication ethics policies.:

Competing Interests: The authors declare no competing interests.

Ethics Approval and Consent to Participate: This manuscript presents a theoretical and conceptual framework and did not involve new human participant research, identifiable patient data, or collection of new clinical data. Therefore, institutional review board approval and informed consent were not required for the present study. Any prior empirical studies referenced in the manuscript were conducted under ethics approvals as reported in the original publications.

Funding

This research received no external funding.

References

Rabbani, M.G.; Alam, A.; Prybutok, V.R. Digital health transformation through telemedicine (2020–2025): barriers, facilitators, and clinical outcomes—a systematic review and meta-analysis. *Encycl.* **2025**, *5* 206. [CrossRef]
Katz, C.; Ruiz, J.M.; Saigi-Rubio, F.; Novillo-Ortiz, D. The state of the art of telemedicine implementation architecture: rapid umbrella review of systematic reviews. *J. Med. Internet Res.* **2025**, *27* e70276. [CrossRef]
OECD. *Beyond the Pandemic: Towards Sustainable Telemedicine Implementation*; OECD Health Working Papers No. 173; OECD Publishing: Paris, France, 2025. [Google Scholar] [CrossRef]
Moonsamy, A.; Ahmed, M. Developing a comprehensive risk management framework for e-health care delivery. In *Health Information Science. HIS 2023*; Lecture Notes in Computer Science; Li, Y., Huang, Z., Sharma, M., Chen, L., Zhou, R., Eds.; Springer: Singapore, 2023. [Google Scholar] [CrossRef]
Freedman, S.; Golberstein, E.; Huang, T.Y.; Whaley, C.M. Telemedicine and patient safety: an emergent research and policy framework. *EGEMS* **2017**, *5* 23. [CrossRef]
Kobb, R.; Jean-Baptiste, G.; Bonds, H.; Love, R.; Harris, C.M.; Morgan, T. Standardizing competencies and enhancing professionalism through a telepresenter certificate program. *Telehealth Med. Today* **2024**, *9*. [CrossRef]
Gamus, A.; Chodick, G.; Blachar, Y.; Shalom, T. Triadic model of assisted telemedicine: review of adoption challenges globally and in Israel. *Telemed. J. E Health* **2025**, *31* 1414–1421. [CrossRef]
Gamus, A.; Chodick, G.; Blachar, Y.; Shalom, T. Conversational capacity in triadic telemedicine: a conceptual framework and evidence synthesis. *Telemed. J. E Health* **2026**. [CrossRef]
La Russa, R.; Ferracuti, S. Clinical risk management: as modern tool for prevention and management of care and prevention occupational risk. *Int. J. Environ. Res. Public Health* **2022**, *19* 831. [CrossRef]
Buja, A.; Damiani, G.; Manfredi, M.; Zampieri, C.; Dentuti, E.; Grotto, G.; et al. Governance for patient safety: a framework of strategy domains for risk management. In *J. Patient Saf.* **2022**, *18*; pp. e769–e800. [CrossRef]
World Health Organization. *Global Patient Safety Action Plan 2021–2030: Towards Eliminating Avoidable Harm in Health Care*; WHO: Geneva, Switzerland, 2021; Available online: https://www.who.int/publications/i/item/9789240032705 (accessed on 1 September 2026).
Ferrara, M.; Bertozzi, G.; Di Fazio, N.; Aquila, I.; Di Fazio, A.; Maiese, A.; et al. Risk management and patient safety in the artificial intelligence era: a systematic review. *Healthc.* **2024**, *12* 549. [CrossRef]
Oliveira, J.S.R.d.; Fernandez, R.S.; Molina, M.R.; Pinto, A.C.P.N.; Rocha-Filho, C.R.; Ferreira, T.M.; et al. Patient safety risk associated with synchronous telehealth: a scoping review. *PLoS ONE* **2025**, *20* e0336992. [CrossRef]
Haimi, M.; Wheeler, S.Q. Safety in teletriage by nurses and physicians in the United States and Israel: narrative review and qualitative study. *JMIR Hum. Factors* **2024**, *11* e50676. [CrossRef]
Jabareen, Y. Building a conceptual framework: philosophy, definitions, and procedure. *Int. J. Qual. Methods* **2009**, *8* 49–62. [CrossRef]
Baethge, C.; Goldbeck-Wood, S.; Mertens, S. SANRA—a scale for the quality assessment of narrative review articles. *Res. Integr. Peer Rev.* **2019**, *4* 5. [CrossRef]
International Organization for Standardization. *ISO 14971:2019; Medical Devices—Application of Risk Management to Medical Devices*. ISO: Geneva, Switzerland, 2019. Available online: https://www.iso.org/standard/72704.html (accessed on 1 September 2026).
Mohsin, S.S.; Salman, O.H.; Jasim, A.A.; Al-Nouman, M.A.; Kairaldeen, A.R. A systematic review on the roles of remote diagnosis in telemedicine system: coherent taxonomy, insights, recommendations, and open research directions for intelligent healthcare solutions. *Artif. Intell. Med.* **2025**, *160* 103057. [CrossRef]
Vincent, R.; Charron, M.; Lafrance, S.; Cormier, A.A.; Kairy, D.; Desmeules, F. Investigating the use of telemedicine by health care providers to diagnose and manage patients with musculoskeletal disorders: systematic review and meta-analysis. *J. Med. Internet Res.* **2024**, *26* e52964. [CrossRef]
Solimini, R.; Busarò, F.P.; Gibelli, F.; Sirignano, A.; Ricci, G. Ethical and legal challenges of telemedicine in the era of the COVID-19 pandemic. *Med.* **2021**, *57* 1314. [CrossRef]
Chaet, D.; Clearfield, R.; Sabin, J.E.; Skimming, K. Ethical practice in telehealth and telemedicine. *J. Gen. Intern. Med.* **2017**, *32* 1136–1140. [CrossRef]
Palojoki, S.; Lehtonen, L.; Vuokko, R. Validation of telehealth outcome categories for patient safety: systematic literature review. *JMIR Med. Inform.* **2025**, *13* e75486. [CrossRef]
Anil, K.; Bird, A.; Bridgman, K.; Erickson, S.; Freeman, J.; McKinstry, C.; et al. Telehealth training and education for allied health professionals: a scoping review. In *Telemed. Rep.* **2025**, *6*; pp. 76–90. [CrossRef]
Tan, A.J.Q.; McKenna, L.; Bramley, A.; van Houwelingen, T.; Tan, L.L.C.; Lim, Y.J.; et al. Telemedicine entrustable professional activities for nurses in long-term care: a modified Delphi study. *Nurse Educ. Today* **2024**, *140* 106264. [CrossRef]
Brownie, S.; Parkinson-Zarb, L.; Cochrane, L.; Bonacaro, A.; Mudigere, S.; Broman, P. Preparing the workforce for telehealth practice: a scoping review. *Front. Health Serv.* **2026**, *6* 1807317. [CrossRef]
Critoph, D.J.; Taylor, R.M.; Spathis, A.; Duschinsky, R.; Hatcher, H.; Clyne, E.; et al. Triadic communication with teenagers and young adults with cancer: a systematic literature review. *BMJ Open* **2024**, *14* e080024. [CrossRef]
Laidsaar-Powell, R.C.; Butow, P.N.; Bu, S.; Charles, C.; Gafni, A.; Lam, W.W.; et al. Physician-patient-companion communication and decision-making: a systematic review of triadic medical consultations. In *Patient Educ. Couns.* **2013**, *91*; pp. 3–13. [CrossRef]
White, S.J.; Nguyen, A.D.; Roger, P.; Tse, T.; Cartmill, J.A.; Hatem, S.; et al. Tailoring communication practices to support effective delivery of telehealth in general practice. *BMC Prim. Care* **2024**, *25* 232. [CrossRef]
Baldt, B. Triadic communication and its pitfalls exemplified by an oncological ward round consultation. In *Wien. Med. Wochenschr.* **2022**; Volume *174*, pp. 153–160. [CrossRef]
Holcapek, T.; Solc, M.; Sustek, P. Telemedicine and the standard of care: a call for a new approach? *Front. Public Health* **2023**, *11* 1184971. [CrossRef]
Ewoh, P.; Vartiainen, T. Vulnerability to cyberattacks and sociotechnical solutions for health care systems: systematic review. *J. Med. Internet Res.* **2024**, *26* e46904. [CrossRef]
Elendu, C.; Omeludike, E.K.; Oloyede, P.O.; Obidigbo, B.T.; Omeludike, J.C. Legal implications for clinicians in cybersecurity incidents: a review. *Med.* **2024**, *103* e39887. [CrossRef]
Garber, K.; Jones, H.; Chew, C.; Moore, J.; Rutledge, C.; Boehning, A.; et al. Telehealth competency evaluation tools: a scoping review. *Telemed. J. E Health* **2026**, *32* 785–802. [CrossRef]
Carayon, P.; Wooldridge, A.; Hose, B.Z.; Salwei, M.; Benneyan, J. Challenges and opportunities for improving patient safety through human factors and systems engineering. In *Health Aff.* **2018**, *37*; pp. 1862–1869. [CrossRef]
Wu, T.C.; Ho, C.T. Reconstructing risk dimensions in telemedicine: investigating technology adoption and barriers during the COVID-19 pandemic in Taiwan. *J. Med. Internet Res.* **2025** *27*, e53306. [CrossRef]
Uniform Telehealth Act, ch. 212, Laws of 2024 (Engrossed Substitute Senate Bill 5481); Wash. Rev. Code ch. 18.134. Effective 6 June 2024. Available online: https://app.leg.wa.gov/RCW/default.aspx?cite=18.134 (accessed on 1 September 2026).

Figure 1. Conceptual dependency structure of the RMFTT: D5 (Workforce competency) functions as the foundational enabling domain, with unidirectional arrows indicating its direct conditioning influence on D1 (Clinical & diagnostic), D2 (Communication), D3 (Legal & liability), and D4 (Data & cybersecurity).

Table 1. RMFTT Narrative Review Summary. Note: Reference numbers in parentheses indicate the sources cited for each domain across its full treatment in the manuscript—the Results synthesis, the corresponding Framework Construction subsection, and the Discussion. Each domain’s findings paragraph summarizes a subset of these sources, with the remainder cited where the framework is developed and discussed.

Domain	References cited	Primary source types	Key themes	Evidence gap
D1 Clinical & diagnostic	3 (18, 19, 14)	Systematic reviews, meta-analyses	Conditional diagnostic accuracy; triage error rates; physical exam limitations	No triadic-specific diagnostic accuracy studies identified
D2 Communication	5 (12, 25, 26, 27, 28)	Qualitative studies, scoping reviews, conceptual frameworks	Information filtering; role ambiguity; patient voice suppression	No telehealth-specific triadic communication studies identified
D3 Legal & liability	5 (20, 21, 29, 35, 38)	Legal reviews, regulatory analysis, expert commentary	Accountability gaps; informed consent; malpractice risk; scope of practice	No legal framework specific to triadic accountability
D4 Data & cybersecurity	3 (22, 30, 31)	Security breach analyses, compliance reviews, governance frameworks	Multi-party data exposure; GDPR/HIPAA compliance; platform vulnerabilities	No triadic-specific multi-party data security framework
D5 Workforce competency	6 (6, 23, 24, 32, 36, 37)	Scoping reviews, Delphi studies, competency frameworks, certificate programs	Training gaps; role drift; digital literacy deficits; EPA frameworks; telepresenter competencies	Minimal triadic facilitator-specific competency literature
General/Cross-cutting	21	Reviews, risk-management & governance frameworks, policy & methods sources	Risk-management foundations; triadic-model rationale; conceptual & human-factors framing
Total	38

Table 2. RMFTT Summary Matrix: five risk domains mapped against four management stages.

Domain	Identification	Assessment	Mitigation	Monitoring
D1 Clinical & diagnostic	Remote exam limits; triage gaps; missed signs	Severity: high; Source: nurse + system	AI decision support; structured templates; escalation protocols	Adverse event logs; diagnostic audits; outcome benchmarks
D2 Communication	Role ambiguity; information filtering; patient voice suppression	Severity: moderate-high; Source: all three actors	Role clarity agreements; conversational capacity training; voice protocols	Consultation recording review; patient surveys; role conflict logs
D3 Legal & liability	Accountability gaps; jurisdictional ambiguity; undefined nurse scope	Severity: high; Source: org + policy	Liability frameworks; defined nurse scope; informed consent docs	Complaint tracking; regulatory alerts; malpractice case review
D4 Data & cybersecurity	Multi-party data exposure; unsecured transmission; consent gaps	Severity: high; Source: tech + user	GDPR/HIPAA compliance; encryption; recording consent policy	Breach incident logs; platform audits; consent compliance checks
D5 Workforce competency	Undertrained facilitators; role drift; digital literacy deficits	Severity: high; Source: facilitator	Competency frameworks; mandatory digital training; supervision protocols	Competency re-assessments; training completion rates; near-miss reports

Disclaimer/Publisher’s Note: The statements, opinions and data contained in all publications are solely those of the individual author(s) and contributor(s) and not of MDPI and/or the editor(s). MDPI and/or the editor(s) disclaim responsibility for any injury to people or property resulting from any ideas, methods, instructions or products referred to in the content.

Copyright: This open access article is published under a Creative Commons CC BY 4.0 license, which permit the free download, distribution, and reuse, provided that the author and preprint are cited in any reuse.