Writing a Safety Flag on a Customer Record Without Defaming Them

Why this matters

A safety flag exists so the next tech walks in knowing what the last one learned the hard way. Written badly, it does two kinds of damage at once: it fails to tell that tech what to actually do, and it puts a sentence in your system you would not want read aloud by the customer, their daughter, or a lawyer. The note that says "crazy, drunk, do not send women" protects nobody and reads badly to everyone else who will ever see it. The fix is not to stop flagging. It is to write flags that are facts.

Who ends up reading a flag

Write for the worst reader, not the intended one. A flag on a customer record gets read by:

• The next tech, often a new hire, on a phone, in the driveway. They need the behavior and the instruction on one screen.
• The office, who will paraphrase it on the phone when the customer asks why two people are coming.
• The customer. There is no general federal right for a consumer to see a small business's internal notes, but a state privacy law can create one. California's privacy statute gives California consumers a right to know what personal information a covered business holds, and its coverage turns on thresholds (an indexed revenue figure, the number of consumers whose data you handle, or revenue from selling data) that most small trade shops sit under. Other states' comprehensive privacy laws carry similar thresholds, mostly keyed to consumer counts. Check your own state; do not assume you are under.
• A court. If the customer sues over anything (a bad repair, an injury, a refusal of service), the record is discoverable. A flag becomes an exhibit.
• Whoever is looking over the tech's shoulder. Field tablets get held up in kitchens. Assume the screen is seen.

Only the first two are people you are writing for. Every flag has to survive the other three.

What defamation needs, in shop terms

Defamation is state law and the elements vary, but the common shape is: a false statement of fact, communicated to someone other than the person it is about, that harms their reputation, made with at least carelessness about whether it was true. Three things follow for a flag.

• Truth is the core defense. A statement you can prove ("raised his voice and stood within arm's length") sits in a different category from one you cannot ("is violent").
• Labels are the risk zone. "Hoarder", "alcoholic", "senile", "unstable" are diagnoses or character judgments. They sound like facts, you cannot prove them, and they read worst to a third party.
• Internal does not mean private. Some states treat a note shared between coworkers as communication to a third party. Many recognize a qualified privilege for good-faith statements to people who share a legitimate interest, such as coworkers who need to stay safe, and that privilege is generally lost when the statement was made with malice or reckless disregard for the truth. A factual, need-to-know flag is the kind of statement the privilege exists for. A sneering one is the kind that loses it.

This is not legal advice. If a customer has demanded their records, has threatened suit over a note, or you are deciding whether to refuse service outright, stop working from this card and talk to your attorney, with the note, its date, who wrote it, and who has seen it in hand.

The four tests every flag passes

Observed. Something a person on your team saw or heard directly. "Neighbor says he has guns" is hearsay; if it is worth recording at all, it is recorded as what the neighbor said, attributed to the neighbor.

Dated and sourced. The date of the event and the initials of the person who saw it. A flag with no date never expires and cannot be corrected; a flag with a source can be checked with the person who wrote it.

Behavioral, not characterological. Describe what happened, not what kind of person they are. The test is whether a camera could have recorded it. A camera can record "customer said 'you are not leaving until this is fixed' and stood in the doorway." A camera cannot record "aggressive."

Actionable. The flag ends in an instruction: two-tech dispatch, office confirms by phone the day before, no entry to the garage, tech leaves if X happens. A flag that informs without instructing makes each tech improvise, which is the problem it was written to solve.

Turning labels into observations

Two rows need a note. Harassment details belong in an incident report the owner holds, not in the field-visible flag; the flag carries "conduct incident on file, two-tech dispatch, owner approval to book." See related: The Customer Harassment Report and Response SOP. Payment history is a commercial fact, not a safety one, and belongs in billing notes rather than a red banner the tech reads on arrival.

What stays out of a flag entirely

The sharpest edit a flag gets is deletion.

• Health and diagnoses. "Has dementia", "on oxygen", "bipolar." Nobody on a service crew is qualified to diagnose, and a recorded diagnosis is both unprovable and among the most sensitive data you can hold. Where a health fact changes how you work, record the operational fact: "Oxygen concentrator in bedroom, no open flame or torch work in that room; confirm with household before any power shutoff." See related: Customers Who Depend on Medical Equipment at Home.
• Protected characteristics. Race, religion, national origin, disability, age, sex. A flag that mentions one invites the reading that it was the reason for the flag. State public-accommodation laws often reach any business that serves the public, California's among the broadest, and a record showing you treated a customer differently on one of those grounds is exactly the evidence such a claim needs.
• Sex-based dispatch rules. "Do not send women" moves the problem onto your own staff: routing work by sex because of a customer's conduct can be an employment-discrimination issue under Title VII, which reaches employers with 15 or more employees, and under state laws, many of which reach much smaller shops. The safer instruction is conduct-based and protects everyone: two techs, or a named tech the customer has not harassed, with the owner's approval.
• Rumor and speculation. "Probably dealing." If something you saw suggests a lab or a weapon, it goes to the owner through the incident channel, not onto the record. See related: Signs of a Clandestine Drug Lab in the Home.
• Venting. Anything typed in the truck within ten minutes of a bad call gets reread the next morning before it is saved.

Worked example: rewriting a flag that went in hot

A two-person HVAC crew finishes a no-cool call. The lead, M.R., types this in the driveway, then the owner rewrites it the next morning after asking M.R. what happened, in order.

FLAG (before)
Crazy old guy, drunk at 10am. Threatened Mike,
wouldn't let him leave. Hoarder house, can barely
get to the air handler. DO NOT SEND WOMEN. Owes
money from last year too.

FLAG (after)  Entered 2026-06-10 M.R., approved J.O.
- 2026-06-09: customer stood in utility room
  doorway approx 1 min, said "you're not leaving
  till it's cold in here," moved when asked.
  Strong alcohol odor at 10:15.
- Access: path to air handler is one person wide
  between stacked boxes. No room to carry a coil.
- DISPATCH: two techs. Office confirms by phone
  day before. Book before noon.
- ON SITE: keep the exit behind you. If blocked
  again, leave and call the office.
- Conduct incident on file with owner (2025).
Review by 2027-06-10.

Run the first version through the tests. "Crazy" and "drunk" are labels. "Threatened" is a conclusion with no words attached. "Hoarder house" is a label wrapped around a genuinely useful access fact. "Do not send women" is a sex-based rule. The debt is a billing matter. Nothing is dated or sourced, and the only instruction in it is the one most likely to cause a second problem.

The owner's questions produced the facts: a strong alcohol odor at 10:15; the customer stood in the only doorway out of the utility room and said the quoted line; he moved aside after about a minute when M.R. said they were going to the truck for a part; the path to the air handler is a single-width gap between stacked boxes; and on a visit the previous spring he had made two remarks about a female tech's appearance that nobody wrote down at the time.

Why each change was made:

• The doorway line is quoted, so no later reader has to interpret "threatened." It is the fact that matters for safety, and quoting it is also the version you could prove.
• The access line is the useful half of "hoarder" with the judgment removed. It is what a coil-replacement crew needs to plan staffing and whether the job can be done at all.
• The dispatch rule is conduct-based and protects any tech the shop sends, so it creates no assignment question for your staff.
• The earlier remarks go to an incident record held by the owner. They were never written down at the time, and the field flag is not where you reconstruct a year-old event from memory.
• The flag names who saw it and who approved it, and carries a review date.

What changes the answer: had the doorway incident involved contact, a weapon, or a threat to harm, the flag would read "do not dispatch, owner decision required," and the event would go into an incident report, and possibly to the police, the same day. See related: Flagging High-Risk Calls at Booking.

Expiry and review

A flag without an end date becomes permanent folklore. A workable default is a 12-month review for conduct flags and a check at every visit for access flags, because access changes: the boxes get cleared, the customer moves to a ground-floor room. At review the owner renews the flag with a fresh observation, softens it, or deletes it. Delete rather than hide: a disabled flag still sits in the record and still reads as the shop's opinion.

People change too. A man who blocked a doorway while drinking may be sober, recovering from a stroke, or living with a caregiver a year later. A stale flag sends two techs to a household that now needs one patient one, and the customer notices.

How to check your flags are holding up

Once a year, pull every active flag and read each one as the customer's adult son would, reading it over his father's shoulder. Confirm for each: it carries a date and a source; every adjective has been replaced by something a camera could record; it ends in an instruction; it holds no diagnosis, no protected characteristic and no sex-based rule; and its review date is in the future. Count the ones that fail. In a shop that has never done this, most failing on the first pass is normal; the second year is where the habit shows.

References

• See related: Flagging High-Risk Calls at Booking
• See related: The Customer Harassment Report and Response SOP
• See related: The Hostile or Impaired Customer: A Decision Tree
• U.S. Equal Employment Opportunity Commission guidance on Title VII of the Civil Rights Act of 1964 and sex-based job assignment
• California Consumer Privacy Act as amended by the California Privacy Rights Act, and your own state's consumer privacy statute where one exists