Investigation report: Local integrated investigation pilot 1 - Incorrect patient identification

The Patient (Patient 1), a woman aged 75 years, was taken to an emergency department (ED) by ambulance in April 2021. This followed a 999 call from Patientn1’s Granddaughter to the emergency operations centre.

The emergency operations centre used the wrong NHS number for Patient 1. They used the NHS number of another individual (Patient 2), who had the same date of birth as Patient 1 and a similar name.

On arrival in the ED, Patient 1 was booked in under Patient 2’s NHS number. This NHS number continued to be used during Patient 1’s time in hospital.

Initially, Patient 1 received medication prescribed by an ED doctor, based on her own supply brought in by her family. Following a pharmacy review on day 7 of admission, the medications were changed to those taken by Patient 2.

The Patient declined to take the incorrect medication; it was unclear why. The error was identified by a pharmacist the following day as an incidental observation of an unfamiliar medication.

The investigation focused on the key communication points in Patient 1’s care pathway where details of the Patient’s identification were handed over. The systems and processes in place with each provider (that is, the Ambulance Trust and the Acute Trust), including their local practices and guidance, were reviewed.

The investigation found the following:

• The first names and surnames of people from South Asian communities are often used interchangeably, and not all names are necessarily used in all situations (as occurred in this case).
• When the exact date of a person’s birth is not known, some ethnic communities have a standard approach of recording the date of birth as 1 January, followed by the year. The Patient in the investigation was from a South Asian community, where this practice is common.
• There were no formal written procedures in the emergency operations centre for call assessors to follow in relation to patient identification.
• Patient identification was not included as a topic in the formal, standardised training for call assessors during their induction period (or subsequently).
• The NHS number was rarely used as a key identifier by call assessors answering 999 calls.
• The emergency operations centre regularly audited its calls, but the audit did not include specific questions on patient identification. It was therefore difficult to determine how frequently identification errors occur.
• Induction training for ambulance crews focused mainly on the clinical assessment of patients. Patient identification was not formally taught.
• In practice, ambulance crews varied in the way they learned and applied patient identification.
• There was no formal process between the Ambulance Trust and the Acute Trust to verify a patient’s identity.
• ED reception staff had different practices for entering patients into the patienttracking software, and there was no formal process.
• There were several different digital systems within the ED and the wider Acute Trust, with varying interoperability (that is, the ability of different IT systems to communicate and share information).
• Staff at the Acute Trust were unaware of the requirement to obtain three pieces of information to verify a patient’s identity, as detailed in the Trust’s patient identification policy, before giving the patient a wristband.
• The Trust’s patient identification policy did not include use of the patient’s NHS number.
• There was no formal identification process for patients being transferred from the ED to the medical assessment unit, or from the medical assessment unit to the ward.
• Once the Patient’s misidentification was discovered, her records were promptly amended and relevant staff and the Patient’s family were informed.

The investigation identified the following learning points for potential national benefit:

• The correct identification of patients relies on staff checking patient details, and therefore will not always occur effectively. There may be opportunities for further engineered or technological barriers to decrease the chance of incorrect identification.
• The design of the digital systems considered in this investigation did not always account for variations in how people identify themselves (for example, by different names). Those systems also did not make it clear to staff where patient demographics (that is, details such as the patient’s name, date of birth, address and NHS number) might be incorrect.
• The investigation recognises that a single hospital trust may receive patients from multiple ambulance trusts, and ambulances from a single trust may go to several hospital trusts. Pathways and processes potentially vary across different trusts and a consistently agreed approach may not exist.
• The use of NHS numbers to identify patients may vary across the country. The investigation found that the NHS number may not be being used according to national expectations.

Safety recommendations are directed to a specific organisation for action. They are based on information derived from the investigation and are made with the intention of preventing future similar events.

The NHS number is a unique identifier for people living in England (and Wales). There is a chance that a patient may be incorrectly identified when the NHS number is not used.

3.1.1 HSIB has connected with several acute trust hospitals and ambulance services to support a pilot of local integrated investigations. The trusts were asked to refer safety events that involved cross-boundary care (for example, care across ambulance services, acute hospitals and primary care services).

3.1.2 Following the referral of this safety event, HSIB reviewed the details through a defined process and the Chief Investigator authorised a local investigation. The investigation was launched within 5 working days of the referral, and the investigation promptly engaged with the trusts, the Patient and the Patient’s family to start the investigation.

3.1.3 The HSIB local investigation did not replace any local trust or national processes for disclosing and investigating patient safety events.

3.1.4 The investigation focused on the key communication points in the care pathway of the Patient, where patient identification details were transferred during pre-hospital, admission and inpatient care. This included:

• Conducting a detailed investigation of:
  • interactions between and within providers to relay patient identification details
  • systems and processes used by each provider relating to patient identification
  • guidance, policy and local practice in support of patient identification.
• Gathering intelligence from provider organisations and staff to help analyse the events.
• Seeking to understand any cultural elements around the safety event.
• Forming conclusions around the factors that contributed to the safety event, without allocating blame.

3.2.1 Several sources of evidence were gathered and reviewed by the investigation, including:

• the Patient’s clinical records
• the policies, procedures and practices of the Ambulance Trust and the Acute Trust
• the assessment of the safety event by the Ambulance Trust and the Acute Trust
• national guidelines and standards
• research literature relevant to the identified safety risks
• relevant HSIB national investigation reports.

3.2.2 The investigation gathered both interview and observational data from the healthcare settings involved in the safety event. A semi-structured interview plan was developed to gather information on safety risks, and an analysis was performed.

3.3.1 The investigation used the following methods to analyse the evidence:

• the Systems Engineering Initiative for Patient Safety (SEIPS) (see Appendix 1)
• hierarchy of controls (see Appendix 2)
• varieties of human work (see Appendix 3).

3.3.2 These methods allowed a detailed analysis of the local work system factors. They also provided insights into potential national issues influencing the local system.

3.4.1 HSIB investigations are independent; they are not undertaken on behalf of patients, families, staff, organisations or regulators. Investigations ensure that the various stakeholders participate, and draft reports are shared with the stakeholders to verify their accuracy.

3.4.2 Once all of the evidence has been gathered and analysed by the investigation, safety recommendations and safety observations are drafted. Where safety recommendations are made, these are directed to specific organisations or bodies that can influence and support change.

Relevant stakeholders are engaged with before publication to agree safety recommendations.

3.4.3 Where an HSIB investigation identifies the potential for learning outside the scope of the investigation, such as national learning in these local investigations, the learning is noted in the report and is fed into HSIB’s intelligence process for future learning.

4.1.1 The initial 999 call made by Patient 1’s Granddaughter was received by the emergency operations centre (EOC). As well as establishing the nature of a patient’s problem using NHS Pathways, the call assessor is responsible for completing a full patient demographic search. This is conducted using the NHS Spine.

4.1.2 The Patient was an older person (aged 75 years) whose date of birth was given as 1 January, followed by the year. The investigation was told that some ethnic communities have a standard approach of using this format when the exact date of birth is unknown. The Patient in the safety event was from a South Asian community, where this was common practice for people born in the 1930s and 1940s. Births were informally recorded according to the harvest season, with no full registration in their country of birth. When emigrating to the UK, the date of 1 January would be assigned and the year of birth would be estimated for a passport to be issued.

4.1.3 The investigation was told that the first names and surnames of patients in South Asian communities could be used interchangeably. In relation to Patient 1, three names were recorded on the NHS Spine, while the Granddaughter gave the Patient’s first two names to the call assessor.

4.1.4 The investigation found that the NHS work system, pathways and processes were not designed to manage patient demographic details for diverse populations.

EOC information-gathering process

4.1.5 When the 999 call was made, initial routine clinical questions were asked as part of the Patient’s triage to immediately exclude life-threatening conditions. Once it had been established that the Patient’s condition was not life-threatening, the call assessor established the reason for the call.

4.1.6 The Patient’s home address and postcode were requested and added by the call assessor to the ‘incident location’ section on the main screen of the patient demographic system (see figures 3 and 4). This ensured the address was provided to the ambulance crew.

4.1.7 Further clinical questions were then asked using NHS Pathways to ensure a full clinical assessment. At the end of this assessment, the call assessor asked for the Patient’s name and date of birth to complete the demographic search. The partial name given was added to the ‘patient demographics’ section of the screen (see figure 5).

4.1.8 The patient demographic system (PDS) tab was selected. This identified a different patient (Patient 2) with the same two first names and the same date of birth as Patient 1, but a different address. Patient 2’s details were selected using the ‘select’ tab (see figure 6) and the details were transferred to the ambulance crew.

4.1.9 The investigation attempted to identify work system factors that contributed to the call assessor selecting Patient 2’s details (organisational processes and software are considered later). The investigation did not identify any person factors (such as fatigue) or physical environment factors (such as noise). Each call assessor had their own headset to reduce noise and minimise distractions and interruptions. The workload was not thought to be excessive at the time of the safety event. The investigation noted that the task of selecting patient details is regularly undertaken by call assessors. It is recognised that familiar and undemanding tasks can make sustained attention a challenge; this has been noted in other investigations (Healthcare Safety Investigation Branch, 2020).

4.1.10 The investigation was informed that the expected process when a patient match could not be found would be for the ‘No’ tab to be selected and the data re-reviewed (see figure 7). The PDS tab would then be selected again.

4.1.11 The investigation was informed that call assessors aim to obtain the correct patient demographics within 60 seconds of the call being made. There is a protocol for patient demographic searches, but this does not contain a step-by-step written process on how to undertake a search.

Process implementation and training

4.1.12 When the PDS was implemented in April 2018, a newsletter describing the process for conducting patient demographic searches was circulated to personnel within the EOC. The newsletter stated that the search should be activated with three of the following pieces of information about the patient:

• name
• date of birth
• home address
• gender
• NHS number
• GP practice.

The investigation found that the newsletter was the primary method of introducing the process in 2018. While newsletters are easy to share, they cannot be assumed to prevent incidents as they are reliant on staff to follow a course of action influencing the way they work. Newsletters are transient and may be easily forgotten and do not include new staff. There may also be several other work system factors influencing performance, such as workload.

4.1.13 Call assessors receive 2 weeks’ training on NHS Pathways; this is a national training programme for all ambulance services using this system. A week’s local training on the 999 computer system is subsequently provided. The training was described by users as “intense, with a lot of information to get through”.

4.1.14 The investigation learned that patient identification was not originally taught during the local training as the training department was only able to use live data. The investigation learned that, since the safety event, the training department is now able to simulate cases within its test system. The local training now includes training on patient demographics and identification.

Safety action A/2021/049:

The Ambulance Trust training department has implemented training on patient demographics within its test system. Emergency operations centre staff receive this training during their formal induction.

Safety observation O/2021/136:

It may be beneficial if the Ambulance Trust adjusts its call audit tool to assess whether patient identification is correctly confirmed.

4.2.1 The investigation was told by the Ambulance Trust that, in the safety event, differing patient details were shown on the EPR under the ‘incident details’ and ‘patient details’ sections. The ‘same as incident’ button was selected, which copied over the incorrect patient demographic details from the ‘incident details’ section to the ‘patient details’ section. This decision by the ambulance crew assumed that the patient demographic information, as listed in the incident details section, was correct, as an NHS number was already on the system. A member of the ambulance crew said:

“If I’ve got an NHS number, I think that’s the right patient anyway, regardless of where they are.”

Available information

4.2.2 The investigation was told that it was rare for a patient’s address to be incorrect on the EPR. If the two addresses did not match, then it was usually because a patient had recently moved house or was staying with friends or family. This was reported as being more common during the COVID-19 pandemic. A member of the ambulance crew said:

“If the addresses are different, it’s usually the right patient, so that’s why you put the address across. When I go to someone’s house, it’s normally their house. So it tends to be uncommon that there’s two separate addresses – so I am usually so used to pushing [the button] to have the pair of them the same. It’s one of those things that you become complacent, until things go wrong.”

4.2.3 These findings demonstrate the use of heuristics in the patient identification process. Heuristics are mental ‘rules of thumb’ that help people to reach rapid conclusions. The situation involving the Patient’s address had likely been encountered before with no adverse results. On this occasion, and with hindsight, the situation was different and therefore the heuristic resulted in an unintended outcome.

4.2.4 The use of heuristics is a common part of human cognitive processes. To prevent them being misapplied, systems and processes need to support the decision maker with accessible, clear and correct information. The investigation found that the potential for incorrect patient demographics was not flagged to those using the software – again, this is an area where engineering solutions may be designed to support safety.

4.2.5 The investigation was told that if an ambulance crew cannot confirm the correct patient details then they can check different digital systems; the most commonly used systems in the Ambulance Trust are the Medical Interoperability Gateway and GP Connect (see section 1). The investigation heard that whether this information is up to date depends on whether the patient’s primary care records have been updated. The investigation was told that:

“A lot of the time, there are cases where it brings up an old address and it doesn’t always match their current one, and they’ve not changed the GP.”

Poor reliability of information is another factor that may mean heuristics are misapplied. The investigation did not review the primary care records for this patient as that was outside the scope of the investigation.

4.2.6 The investigation was told that there is no functionality within the EPR system for the ambulance crew to edit addresses or patient details. If the patient demographic details are incorrect, the ambulance crew selects the ‘wrong patient match’ button on the system. The investigation learned that it is not easy to reject a match if the patient has already been identified.

4.2.7 As a consequence of this safety event, the Ambulance Trust is planning to design a ‘Yes/No’ checkpoint, which will be included in the EPR for ambulance crews to confirm the correct information. This will provide an additional prompt for the system user before proceeding to the next stage. It will act as a type of engineering/technological barrier, but will still rely on the user to check and confirm and can be overridden. It therefore will not eliminate the risk of patient misidentification.

Handover process

4.3.1 The usual process when a patient arrives by ambulance at the ED is that the triage nurse allocates a space for the patient (or the patient remains in the ambulance, depending on the capacity of the department). The ambulance crew then administratively hands over the patient’s details to the receptionist, who inputs them into the system.

4.3.2 The investigation observed the handover process during a site visit. Reception staff were in an office by the ambulance entrance, near the ED triage nurse. The office was shared with reception staff from the ED minors department (for minor injuries or illness). The investigation was told that handovers between ambulance crews and reception staff are “brief but thorough”. On occasions, the investigation observed more than one ambulance crew waiting to hand over, meaning the door to the ED was open and noise levels were elevated.

4.3.3 The investigation heard that it was probable that the Patient’s information had been sent via the EPR ahead of the Patient’s arrival at the ED. The ambulance crew confirmed that their handover to reception staff usually included verifying the patient’s NHS number. This enabled the receptionist to ensure they were admitting the correct patient into the hospital system from the list of anticipated arrivals to the ED. The investigation observed that ambulance crews often take the electronic tablet into the reception area with them, and hand it to the receptionist to view. It was not known if this occurred during the safety event.

4.3.4 The receptionist recalled searching for the Patient on the NHS Spine and seeing two patients with the same date of birth, and slightly different names. They recall querying this with the ambulance crew, who confirmed they had the correct patient on their system due to the presence of an NHS number. The ambulance crew were unable to recall the patient or the safety event.

4.3.5 The investigation observed variations in the ways reception staff identified and inputted patient details into the system. There is no formal process (such as a standard operating procedure) for reception staff to follow when a patient arrives at the ED. As a result, HSIB makes the following local safety recommendation:

Safety recommendation R/2021/162:

HSIB recommends that the Acute Trust develops and implements a standardised approach to patient identification in the emergency department.

Safety observation O/2021/135:

It may be beneficial if the Acute Trust considers the interoperability of its IT systems (that is, the ability of different IT systems to communicate and share information) as part of its digital strategy and in future procurement.

4.4.1 The usual process when a patient is admitted to an assessment bay in the ED is that a handover takes place between an assessment nurse and ambulance crew before the crew leave the department.

4.4.2 The investigation heard that handovers are often brief and are inconsistent in terms of patient identification and the clinical details given. The name and age of the patient were described as the two main pieces of information handed over from the ambulance crew.

4.4.3 Barriers to a more effective handover were described as increased work pressures in the ED and staff shortages. The investigation was told that ambulance crews are expected to leave the department within a specific timeframe so they can go to their next call.

4.4.4 The investigation is aware of the existence of a national standard for ambulance handover to emergency care (Professional Record Standards Body, 2019), relating to ‘a standard for the information that is shared when care is transferred from ambulances to emergency departments’. The ‘Ambulance handover standard final report’, created by the PRSB includes ensuring the NHS number is used, along with other patient identifiers. An implementation guidance has also been drafted, as well as an ‘Ambulance transfer of care hazard log.’ The latter recognises patient misidentification as a risk.

4.4.5 In summary, evidence from the safety event suggests there was no defined, written process for verifying and confirming correct patient identification on handover from the Ambulance Trust to the Acute Trust, including in the ED reception and majors assessment bay (for emergency admissions but not immediately life threatening). Further work is required to incorporate the national standard for ambulance handover to emergency care. HSIB makes the following regional safety recommendation:

4.5.1 The usual process when a patient transfers from the ED to the MAU is that there is a telephone handover from an ED doctor to the nurse co-ordinator on the MAU. During this handover, the nurse co-ordinator is told the patient’s name, hospital number, reason for admission and whether the patient can wait in the waiting room or needs a bed. This information is handwritten onto a handover sheet and placed in the ward clerk’s tray.

4.5.2 The notes from the ED patient management and tracking software are printed and scanned in the ED and joined with the handover sheet when the patient arrives in the MAU. A nurse or healthcare assistant always transfers the patient. The ward clerk directs the patient to a bed space with the handover sheet and notes.

4.5.3 The investigation heard that there is no formal identification process for patients being transferred from the ED, as staff would assume that checks had been completed in the ED. The process is more formal when patients are admitted to the MAU directly from their GP, including a request for the patient’s address.

4.5.4 The investigation found that there had been occasions when a patient was transferred to the MAU for the ED without a wristband. In these instances, the ward clerk will print a wristband. Staff said that they would complete a formal identification by asking for the patient’s name and date of birth. The third indicator (the address), as described in the Trust’s patient identification policy (work as prescribed), was not checked (work as done) (Appendix 3).

4.6.1 No formal patient identification checks took place when the Patient was transferred from the MAU to the ward. Staff on the ward told the investigation that they do not routinely check the patient’s address on admission, and consider their demographic information to be correct when they are admitted to the ward.

4.6.2 Five days after the Patient’s admission to hospital, the Patient’s Granddaughter noticed that the Patient’s demographic details, which had been printed in the ED, had the wrong address and GP details (belonging to Patient 2). She informed the nurse caring for the Patient. The nurse crossed out the incorrect home address and GP practice and wrote the correct details. It was documented in the Patient’s notes that the information had been ‘changed on the front sheet for the ward clerk to change [on the IT system] in the day’.

4.6.3 The investigation was not able to establish whether this note was handed over to the ward clerk, as staff could not clearly recall the event. The investigation was told there had been previous occasions on which a patient’s address was incorrect. When this had happened previously, it was because the patient had moved address.

4.6.4 The misidentification was discovered on day 8 of the Patient’s admission, following a routine medicines reconciliation on day 7. Medicines reconciliation is the process of identifying the most accurate list of all medications a patient is taking and comparing that list against the hospital prescription. The National Institute for Health and Care Excellence (2016) recommends that medicines reconciliation should happen within 24 hours of admission to an acute setting or sooner if clinically indicated.

4.6.5 The investigation was not able to determine why the medicines reconciliation process did not help to identify the patient identification error. The Patient’s NHS and hospital numbers (which were for Patient 2) were checked, and the reconciliation process assumed that the medication was wrong instead of the Patient’s details. This was exacerbated because the assumed incorrect medications had been prescribed for several days.

4.6.6 As referred to in section 2.23, the safety event was detected following an incidental observation by a pharmacist of an unfamiliar medicine (an inhaler) on the Patient’s bedside table.

4.6.7 The investigation was initially advised that Patient 1 had received some doses of Patient 2’s medication. Further investigation found that this was not the case, as the Patient had declined to take the medication, in addition to some other care and treatment.

4.6.8 The investigation found that once the safety event had been discovered, it was dealt with promptly and the relevant staff were informed. The Patient’s family were also informed, and a formal apology was offered.

4.7.1 The analysis of this safety event has identified three main contributory themes. These themes relate to the following:

1. Policies and processes for patient identification:
   a The absence of some formal processes to support staff in identifying patients.
   b Inconsistencies in applying the existing processes in place, because of barriers within the system. This led to heuristics (mental rules of thumb) being used.
   c A lack of staff education with respect to the Trust’s policies and processes, leading to incorrect or insufficient numbers of identifiers being used.
   
2. Inconsistent use of the NHS number as the unique identifier for patients, because of perceived barriers in obtaining this information at Ambulance Trust and Acute Trust levels.
   
3. Issues with the design and interoperability of multiple digital systems, meaning that discrepancies are not flagged.

4.7.2 The investigation acknowledges that the safety recommendations made within this report focus on standardisation and processes, with a certain reliance on staff. It is recognised that, within the hierarchy of controls, these recommendations will be unlikely to eliminate patient misidentification events, but they should mitigate the risk of them occurring. The fact that the safety recommendations are more administrative in nature potentially demonstrates the challenges trusts face in developing recommendations that may be out of their influence to action. This shows the importance of recommendations that influence national change (such as developing engineering solutions for digital systems), which may be more effective in the future. The national learning in this report will be added as intelligence to HSIB’s process for identifying future national investigations.

The investigation found that:

• The first names and surnames of people from South Asian communities are often used interchangeably, and not all names are necessarily used in all situations (as occurred in this case).
• When the exact date of a person’s birth is not known, some ethnic communities have a standard approach of recording the date of birth as 1 January, followed by the year. The Patient in the investigation was from a South Asian community, where this practice is common.
• There were no formal written procedures in the emergency operations centre for call assessors to follow in relation to patient identification.
• Patient identification was not included as a topic in the formal, standardised training for call assessors during their induction period (or subsequently).
• The NHS number was rarely used as a key identifier by call assessors answering 999 calls.
• The emergency operations centre regularly audited its calls, but the audit did not include specific questions on patient identification. It was therefore difficult to determine how frequently identification errors occur.
• Induction training for ambulance crews focused mainly on the clinical assessment of patients. Patient identification was not formally taught.
• In practice, ambulance crews varied in the way they learned and applied patient identification.
• There was no formal process between the Ambulance Trust and the Acute Trust to verify a patient’s identity.
• ED reception staff had different practices for entering patients into the patient-tracking software, and there was no formal process.
• There were several different digital systems within the ED and the wider Acute Trust, with varying interoperability (that is, the ability of different IT systems to communicate and share information).
• Staff at the Acute Trust were unaware of the requirement to obtain three pieces of information to verify a patient’s identity, as detailed in the Trust’s patient identification policy, before giving the patient a wristband.
• The Trust’s patient identification policy did not include use of the patient’s NHS number.
• There was no formal identification process for patients being transferred from the ED to the medical assessment unit, or from the medical assessment unit to the ward.
• Once the Patient’s misidentification was discovered, her records were promptly amended and relevant staff and the Patient’s family were informed.

The investigation identified the following learning points for potential national benefit:

• The correct identification of patients relies on staff checking patient details, and therefore will not always occur effectively. There may be opportunities for further engineered or technological barriers to decrease the chance of incorrect identification.
• The design of the digital systems considered in this investigation did not always account for variations in how people identify themselves (for example, by different names). Those systems also did not make it clear to staff where patient demographics (that is, details such as the patient’s name, date of birth, address and NHS number) might be incorrect.
• The investigation recognises that a single hospital trust may receive patients from multiple ambulance trusts, and ambulances from a single trust may go to several hospital trusts. Pathways and processes potentially vary across different trusts and a consistently agreed approach may not exist.
• The use of NHS numbers to identify patients may vary across the country. The investigation found that the NHS number may not be being used according to national expectations.

Safety recommendations are directed to a specific organisation for action. They are based on information derived from the investigation and are made with the intention of preventing future similar events.

Safety recommendation R/2021/164:

HSIB recommends the Acute Trust work with the Ambulance Trust to develop and implement a standardised approach to verifying and confirming a patient’s identification during the handover process.

The NHS number is a unique identifier for people living in England (and Wales). There is a chance that a patient may be incorrectly identified when the NHS number is not used.

SEIPS was first described by Carayon et al (2006) as a framework for understanding the work systems, processes and outcomes in healthcare and the relationships between them (see figure A1). It is a systems engineering approach with human factors principles embedded within it.

SEIPS describes how components of the work system produce work processes that result in different outcomes. Work system factors are described below (Holden et al, 2013; Carayon et al, 2006):

• People: the people working in the particular system and the patient.
• Tasks: undertaken by people, and which can vary in complexity or variety.
• Tools and technology: used to undertake tasks, and which can vary in usability and functionality.
• Internal environment: the physical space around people (for example, layout, noise and temperature).
• Organisation: conditions external to people to support the organisation of, for example, resources and activity.
• External environment: factors outside of the healthcare institution, such as policy, societal or economic factors.

Processes can be physical, cognitive or behavioural, and lead to outcomes for patients, professionals or healthcare institutions. Interactions between the various components of the work system lead to different outcomes, both positive and negative. The framework includes feedback loops, which represent the adjustments systems make over time.

Appendix 2 Hierarchy of controls

The concept of a hierarchy of controls (see figure A2) is commonly used to describe the properties associated with system controls. Certain methods of control provide more protection and are more effective than others. The hierarchy of controls approach implies that controls at the top of the hierarchy are likely to be more effective at managing risks than those lower down (National Institute for Occupational Safety and Health, 2015). While not developed for healthcare, the principles are useful to consider when developing recommendations to prevent future events.

The following description of varieties of human work is taken from the HSIB investigation for ‘Wrong patient details on blood sample’ (Healthcare Safety Investigation Branch, 2019).

In order to gain an insight into how best to explore the way staff work in the clinical environment, it is important to understand the varieties of human work. Figure A3 shows the varieties of human work described by Shorrock (2016). These show why the healthcare sector needs to adopt different approaches to fully understand healthcare work and incidents.

‘Work as imagined’ refers to assumptions that may be made about how work is carried out by staff. However, people making these assumptions may be removed in time and space from the ‘front line’ and therefore unable to observe work being carried out in the workplace (Hollnagel et al, 2015).

The imagined way in which people work becomes ‘work as prescribed’ when it is set out in policy or processes that frontline staff are asked to follow and adhere to. This is often assumed to be the safest way to work (Shorrock, 2016).

Many traditional incident investigations will place emphasis on taking statements from staff in order to understand their actions. This ‘work as disclosed’ may be based on partial or incomplete versions of one or more of the other varieties of human work. Staff may be uncomfortable about, or fearful of, disclosing variations and adaptations made to ‘work as prescribed’ if they are worried about the possible repercussions of their actions. Staff may also not recognise where adaptations have been made as part of their daily practice.

‘Work as done’ refers to how people actually carry out their work. Understanding ‘work as done’ requires a practical focus on understanding and observing work in the environment in which it takes place in order to inform ideas about how work should be planned and managed. Catchpole and Jeffcott (2017) have identified that direct observation of staff within healthcare usually reveals a difference between what is disclosed and how work is actually done in practice. Without understanding ‘work as done’ it is not possible to accurately know how a system is functioning, and whether the gap between ‘work as imagined’ and ‘work as done’ poses a threat to organisational safety or represents the system drifting into an improved state (Shorrock, 2018).

ED, emergency department; EPR, electronic patient record; MAU, medical assessment unit.