This commentary examines the current health care information technology (HIT) policy that removes liability from HIT vendors when patients are harmed due to HIT failure (for example, if a computerized provider order entry system suggests an incorrect medication dose). It explores the legal basis for the current policy, and suggests a rebalance of responsibility between the vendors and health professionals.