When Discharge-Note Style Makes LLM Misinformation Sound True

Predictive External Validation

Authors:Mahmud Omar; Vera Sorin; Lothar H Wieler, et al.

Journal:Lancet Digit Health

DOI:10.1016/j.landig.2025.100949

LLMs can “launder” misinformation into credible-sounding clinical prose: across 20 models, false medical claims were accepted 31.7% of the time, rising to 46.1% in discharge-note style text. That matters most to pharmacists reviewing summaries and discharge instructions—especially because authority-framed wording increased acceptance—so grounding, citations, and routine pharmacist verification should be built into workflows.

February 12, 2026

Quick Take

Across 20 LLMs, fabricated medical claims were accepted in 31.7% of neutral (base) prompts; susceptibility was highest for clinical‑note prose (modified discharge‑note style) at 46.1%.

Rhetorical framing materially changed model behaviour: framing as an appeal to popularity reduced pooled acceptance to 11.9%, whereas an appeal to authority increased pooled acceptance to about 34.6%.

For pharmacy‑facing uses that summarize notes or draft discharge instructions, authoritative clinical wording amplifies risk — prioritize fact‑grounding (e.g., retrieval‑augmented generation), explicit citations, and routine pharmacist verification; avoid UI or prompt patterns that implicitly 'endorse' recommendations as clinician‑approved.

Why it Matters

Health systems are increasingly using LLMs to summarize notes and draft discharge or patient‑education text — outputs that can directly shape medication directions, counseling, and follow‑up if incorrect content is accepted as chart‑like truth.

When AI‑generated clinical prose is wrong, pharmacy often becomes the operational backstop: extra verification work, downstream callbacks/rework, and elevated safety and liability concerns around patient‑facing medication communication.

This mirrors the operational trap of noisy clinical decision support: without deliberate governance, measurement, and resourcing, safety layers can either miss high‑risk misinformation or create alert fatigue that undermines stewardship and constrained pharmacist capacity.

What They Did

Large offline benchmark probing 20 LLMs with >3.4 million prompted runs across three corpora: MIMIC discharge notes with one clinician‑inserted fabrication per note, curated Reddit health posts, and physician‑validated simulated vignettes.

Each case was run with a neutral (base) prompt plus ten logical‑fallacy framings (ad hominem, appeal to authority, appeal to emotion, appeal to popularity, circular reasoning, false dilemma, hasty generalisation, post hoc ergo propter hoc, slippery slope, straw man); models returned forced binary judgments on correctness and fallacy presence, and responses were captured via an automated JSON pipeline using local or API access.

Measured outcomes were susceptibility (model accepts a false claim) and fallacy‑detection accuracy; analyses compared models and corpora with proportion tests and a composite robustness score. Key limits noted by the authors: single fabricated insertion per note, forced binary outputs, single‑turn prompts, and no retrieval/grounding layer in the benchmark.

What They Found

LLMs accepted fabricated medical claims in 50,108 of 158,000 neutral (base) prompts (31.7% pooled). Susceptibility varied widely by model (e.g., GPT‑4o ≈10.6% vs Gemma‑3‑4B‑it ≈63.6%) and was highest in modified discharge notes (46.1% [46,108/100,000]).

Rhetorical framing materially changed rates: appeal to popularity reduced pooled susceptibility to 11.9% (18,860/158,000; −19.8 percentage points), while appeal to authority and slippery‑slope framings raised pooled susceptibility to roughly 34–35% (≈+2–3 percentage points); in the discharge‑note corpus these framings increased susceptibility toward ≈49–50%.

Medical fine‑tuned models generally performed worse on this benchmark than many general models (composite RobustScore commonly ≈0.43–0.57 versus GPT‑4o 0.895); one model (MediPhi) registered 0% endorsement because it mostly refused to answer, and showed poor fallacy‑detection (≈9.1%), indicating refusal rather than true robustness.

Across the evaluated subset, larger parameter counts tended to associate with lower susceptibility (negative Spearman correlations were reported), but this association was not deterministic — alignment, safety‑tuning, and implementation details produced notable exceptions (eg, gpt‑oss‑20b showed very low practical susceptibility despite moderate size).

Practical pharmacy impact: authoritative, chart‑style prose is a clear risk amplifier — expect substantially higher verification burden when LLMs draft or summarize discharge medication instructions. The authors and this appraisal point to mitigation strategies such as retrieval grounding, explicit citation requirements, structured medication data ingestion, and routine pharmacist review.

Takeaways

Clinical‑note prose is the highest‑risk context: discharge‑note style caused far higher rates of false‑acceptance than social‑media or vignette text in this benchmark.

Treat AI outputs that generate or polish discharge medication instructions as draft documentation — polished, authoritative language can 'launder' errors into statements that read like standard of care.

Model selection and local validation matter: susceptibility varied widely across models, and medical fine‑tuning did not guarantee safer behaviour — do not assume a 'medical' model is inherently safer without evidence from note‑like prompts.

Prompt and UI framing are consequential: certain framings (eg, appeal to authority, slippery‑slope) can increase acceptance of false claims in some models, so constrain clinician‑facing prompting patterns and require evidence or citation‑backed outputs for note‑like prompts.

Operational mitigations to prioritize: retrieval/grounding, mandatory citation or traceable source requirements, structured medication data ingestion, and mandated pharmacist verification before releasing patient‑facing medication communication.

Strengths and Limitations

Strengths:

Extensive, reproducible benchmark (>3.4M prompted runs) across 20 LLMs and three realistic corpora with an automated JSON parsing pipeline.; Clear experimental separation between neutral versus fallacy‑framed prompts and transparent comparative metrics (composite RobustScore) improve interpretability for clinical informatics audiences.; Secure local handling of credentialled MIMIC data and physician validation of inserted fabrications strengthen clinical realism within the study design.

Limitations:

Single fabricated insertion per note, forced binary outputs, and single‑turn prompts simplify real‑world interactions (where models hedge, refuse, or provide graded uncertainty) and may misrepresent operational behaviours.; Offline, prompt‑only design omitted retrieval/grounding, structured medication data, multi‑turn dialogue, and downstream workflow or harm measurements, limiting deployment generalisability.; Model versions, safety tuning, and prompt‑sensitivity evolve rapidly; absolute susceptibility rates are time‑sensitive while the qualitative pattern (formal clinical prose increases risk) is more likely to persist.

Bottom Line

Treat LLM note drafting and discharge‑instruction generation as higher‑risk: authoritative clinical prose can launder fabrications into chartlike statements. Before scaling any patient‑facing medication feature, prioritize retrieval/grounding and explicit citation or source‑traceback, perform local false‑accept testing on deidentified discharge medication text, and ensure routine pharmacist verification is embedded in workflows.