Local integrated investigation pilot 2: Incorrect patient details on handover

This investigation focuses on the systems and procedures that are in place to help health and care staff to correctly identify patients. It explores how the incorrect identification of a patient can have an impact on their treatment. To do this it uses a real patient safety event involving a patient who was cared for by a nursing home, an Ambulance Trust and an Acute Trust (that is, a local hospital with an emergency department).

The safety event involved Mrs E, a woman aged 93 with dementia. Mrs E was taken by ambulance to her local emergency department (ED) after a fall in her nursing home, accompanied by an escort from the nursing home. Incorrect patient details (date of birth and spelling of surname) were used to try to book Mrs E into the ED. The ED staff were unable to find Mrs E’s details on the digital patient management systems available. A new patient record was created with the incorrect patient details. After having an X-ray in the radiology department, which confirmed that Mrs E did not have a fracture, she was discharged the same day.

The next day, after another fall in the nursing home, Mrs E was taken to the same ED by ambulance. She was booked in under the new patient record created the previous day, with the incorrect patient details. Mrs E had an X-ray which confirmed a fractured neck of femur (broken hip) and she was admitted to the hospital for surgery.

Mrs E had surgery the next day, during which the pathology department identified a problem with the accuracy of her personal identification information. Following surgery, Mrs E’s correct identification details were confirmed, and her past hospital notes were gathered. The two sets of patient records were merged.

The investigation focused on the key communication points in Mrs E’s care pathway at which her identification details were handed over. The systems and procedures in place within each care provider, including their local practice and guidance, were reviewed.

The investigation found the following:

• The nursing home care records available to staff had varying levels of risk of incorrect personal identification data (PID) associated with them.
• Although the Red Bag policy (a method of transferring a patient’s medical records, medication and personal belongings when they go into hospital) could not be followed in full due to the COVID-19 pandemic, the nursing home continued to provide the same patient documentation.
• When it was not possible to retrieve Mrs E’s NHS number from NHS Spine (the IT system through which patient information is shared across NHS organisations), this indicated an increased risk that the PID captured may not have been reliable.
• The Ambulance Trust did not consider the NHS number as a primary patient identifier.
• There was an increased risk of incorrect patient PID being recorded by the emergency operations centre (EOC) because it was using ‘emergency rules apply’ procedures. This risk, which had been assessed and accepted by the EOC, was transferred to the Acute Trust without its knowledge when Mrs E was booked in at the ED.
• Incorrect PID on the Ambulance Trust electronic patient record form was not corrected through cross-checking with provided nursing home documentation.
• The functionality and sensitivity of the Personal Demographic Service search (a search of the database of users of health services in England) meant potential matches were not offered when any inaccurate patient PID was entered.
• There was no evidence of a standardised and consistent patient ‘booking-in’ procedure in the ED. This was influenced by:
  • there being no formal Acute Trust ‘booking-in’ procedure
  • the individual practices of Acute Trust and Ambulance Trust staff
  • staff capacity
  • inconsistent use of available patient documentation provided
  • inconsistent use of additional PID sources such as nursing home escorts and external healthcare organisations.
• The Acute Trust (except pathology) did not consider the NHS number to be a primary patient identifier in reducing the safety risk of incorrect patient identification. Mrs E’s NHS number was missing; this did not prompt further action to verify her PID either during the booking-in procedure or when her care was transferred between internal departments.
• The combination of the sensitivity of the Acute Trust digital systems, and the reliance on staff to understand how their search functions worked, did not support positive patient identification when provided with aspects of incorrect PID.
• The Acute Trust does not currently have a system to help staff visually identify patients with dementia. Such a system may help staff to adapt their patient identification procedure accordingly.
• By promoting the use of information on the patient identification band when a verbal ‘ask, check, confirm’ process cannot be carried out, the Acute Trust’s positive patient identification policy enables the internal transfer of patients with incorrect PID.
• Ensuring that a patient identification band with accurate PID is placed on a patient with dementia on admission to the Acute Trust was identified by the investigation as the single safeguard to prevent the risk of incorrect PID ‘following’ patients, specifically those with dementia, when they are transferred between Acute Trust departments.
• The pathology information management system had an inherent safety control; it identified a PID issue due to Mrs E not having an NHS number.

The investigation also identified the following learning points that could potentially offer benefits at a national level:

• The correct identification of patients relies on staff checking patient details and therefore will not always occur effectively. There may be opportunities for further engineered or technological barriers to help mitigate the risk of incorrect identification.
• The investigation recognises that a single hospital trust may receive patients from multiple ambulance trusts, and ambulances from a single ambulance trust may attend several hospital trusts. Pathways and procedures potentially vary across different trusts and a consistently agreed approach may not exist.
• There may be variation across the country in how NHS numbers are used by trusts for identification of patients. The investigation found that the NHS number may not be being used as per national expectations.

Safety recommendations are directed to a specific organisation for action. They are based on information derived from the investigation and are made with the intention of preventing future, similar events.

1.1.1 This investigation focuses on the systems and procedures in place to support staff at a nursing home, an Ambulance Trust and an Acute Trust to correctly identify patients. It explores how the incorrect identification of a patient can potentially have an impact on their treatment.

1.1.2 To accurately identify a patient, healthcare staff need to ensure they have the correct patient details. The most reliable way to identify a patient in England, Wales and the Isle of Man is by using their unique NHS number. NHS numbers are given to people who are registered for NHS care and are the main way of identifying people (the primary identifier) within the NHS. CLOSER, the University College London centre for long-term health studies, states that ‘NHS Numbers are the only unique, national, patient identifier within the UK’s health and social care system’ (CLOSER, 2018).

1.1.3 When they are admitted to hospital, a patient will be allocated a hospital/medical records number. This number is only unique to the hospital that the patient is attending; it is not used across the wider NHS.

1.1.4 Issues with patient identification have been recognised as a widespread problem. The World Health Organization acknowledged patient identification as contributing to wrong patient procedures (that is, procedures such as surgery being performed on the wrong person) and recommended that at least two identifiers, such as name and date of birth, are used (World Health Organization, 2007).

1.1.5 The Acute Trust involved in this investigation carried out a search of the number of incidents relating to positive patient identification (PPI) in a 1-year period from October 2020 to October 2021. This search identified 192 reported PPI incidents.

1.2.1 Multiple digital systems were in use across the healthcare organisations that provided care. The digital systems had different functionality and interoperability – that is, they differed in terms of what they could do and their ability to communicate and share data with other digital systems – and were used for a number of purposes.

1.2.2 The main digital systems used during the safety event are described below.

Ambulance Trust digital triage system

1.2.3 The Ambulance Trust used the Advanced Medical Priority Dispatch System (AMPDS). This is a clinical triage system that is used in 6 (of 10) 999 services across England. Calls to 999 that are handled using the AMPDS are initially assessed by non-clinical trained call handlers. In England, AMPDS contains 36 protocols (sets of questions relating to different health issues) and uses standardised, universal question sets to triage calls and identify the appropriate response.

Personal Demographics Service (PDS)

1.2.4 The Personal Demographics Service (PDS) is a database that holds the demographic details of users of health and care services in England, including names, addresses, dates of birth and NHS numbers. It is managed by NHS Digital, the organisation that designs, develops and operates NHS IT and data services.

1.2.5 The PDS is used to confirm the identity of patients, link care records, support communication with patients and support the management of NHS services. It is a national authoritative source of patient demographics data for the whole of the NHS (NHS Digital, 2020).

NHS Spine

1.2.6 NHS Spine supports the IT infrastructure for health and social care in England. It joins together more than 23,000 healthcare IT systems in 20,500 organisations.

1.2.7 NHS Spine allows information to be shared securely by services across England. Most users access NHS Spine through the digital systems they use in their hospital or care setting. It can also be accessed directly through a web-based portal. NHS Digital develops and maintains NHS Spine (NHS Digital, 2021).

Acute Trust hospital patient management system

1.2.8 This is a digital system available to the NHS and used within the Acute Trust. It is used for all changes to patient demographic information and for the creation of new patient registrations to support nursing staff and health professionals to deliver care.

Acute Trust emergency department patient management system

1.2.9 This is the main software for emergency department (ED) attendances. It enables ED staff to see and manage the flow of patients through the department.

CRIS – radiology patient management system

1.2.10 CRIS is the software system used in the radiology department (where medical images such as X-rays are taken) to manage patient care and workflow.

Acute Trust operating theatre booking system

1.2.11 This system is used for scheduling in the operating theatre department.

Pathology information management system

1.2.12 The pathology department is where samples, such as blood, urine and tissue samples, are tested and analysed. The pathology information management system is used to manage the workflow in the department, including handling tests and managing data.

3.1.1 HSIB has connected with several acute trust hospitals and ambulance services to support a pilot of local integrated investigations. The trusts were asked to refer safety events that involved cross-boundary care (for example, care across ambulance services, acute hospitals and primary care services).

3.1.2 After the safety event described in section 2 was referred, HSIB reviewed the details using a defined process and the Chief Investigator authorised a local investigation. The investigation was launched within 5 working days of the referral being made. The investigation team promptly engaged with the healthcare organisations and Mrs E’s family to begin the investigation.

3.1.3 The HSIB local investigation did not replace any local trust or national processes for disclosing and investigating patient safety events.

The investigation focused on:

3.2.1 The key communication points in Mrs E’s care pathway, at which patient identification details were transferred during pre-hospital, admission and inpatient care. This included detailed investigation into:

• interaction between healthcare providers and handover of patient identification details
• the systems and processes used by each healthcare provider for patient identification
• the local healthcare providers’ guidance, policy, and initiatives in support of patient identification.

3.2.2 Gathering intelligence from healthcare organisations and staff to support analysis of the events.

3.2.3 Drawing conclusions about the factors that contributed to the events, without blame.

3.3.1 Several sources of evidence were gathered and reviewed by the investigation:

• Mrs E’s clinical records
• 999 telephone call recordings for each episode
• trust policies, procedures and practice
• national guidelines and standards
• literature relevant to the identified safety risks
• relevant HSIB national investigation reports.

3.3.2 The investigation gathered data from interviews with those involved in the safety event and observations of work in practice at the healthcare settings. The investigation was unable to carry out a key interview due to Ambulance Trust staff being unavailable.

3.4.1 The investigation used the Systems Engineering Initiative for Patient Safety (SEIPS) (see appendix 1) to analyse the evidence it had gathered. SEIPS allowed a detailed analysis of the local work system in consideration of factors such as technology, people and processes.

3.4.2 The investigation considered the management of risk using the concept of ‘hierarchy of controls’ (see appendix 2).

3.5.1 HSIB investigations are independent; they are not undertaken on behalf of patients, families, staff, organisations, or regulators. However, investigations ensure the participation of the various stakeholders and draft reports are shared with them to verify their accuracy.

3.5.2 Once all evidence has been gathered and analysed by the investigation, safety recommendations and safety observations are drafted. Where safety recommendations are made, these are directed to specific organisations or bodies who can influence and support change. The investigation engages with relevant stakeholders to agree safety recommendations before they are published.

3.5.3 Where an HSIB investigation identifies the potential for learning outside of the scope of an investigation, such as national learning in these local investigations, the learning is noted in the report and is fed into HSIB’s intelligence process for future learning.

4.1.1 Mrs E’s pre-admission assessment paper document, which contained an incorrect date of birth (DOB), was stored in a file. When Mrs E was admitted to the nursing home, care records (paper and electronic) were created from hospital discharge records with accurate personal identification data (PID). These were stored in the file alongside the incorrect pre-admission assessment.

4.1.2 The incorrect PID (DOB) within the pre-admission assessment was not identified or corrected. Existing control measures did not identify the incorrect PID during the telephone pre-admission assessment or prevent it from remaining unidentified within nursing home care records.

4.1.3 During episode 1, the nursing home 999 caller read Mrs E’s DOB from accurate nursing home care records. During episodes 2 and 3, the nursing home nurse in charge (NIC) read Mrs E’s DOB from the incorrect pre-admission assessment. The practice of nursing home staff members varied in terms of where they accessed PID during a 999 call.

4.1.4 The nursing home care records available to staff had varying levels of risk of incorrect PID associated with them. There was a greater risk of incorrect PID in the nursing home pre-admission assessment gathered during a telephone call, than in the nursing home care records that were generated by staff who had sight of hospital discharge records.

4.1.5 Use of care records with the lowest level of risk of incorrect PID would mitigate inaccurate PID unintentionally being transferred into the wider healthcare system. Additional control measures to ensure that care records with the lowest level of risk of incorrect PID are immediately available, and those with the highest risk are not, would provide a further safeguard (a control that has the intention of enhancing safety and reducing the likelihood of an incident).

4.2.1 In 2015 the National Institute for Health and Care Excellence (NICE) published a guideline, ‘Transition between inpatient hospital settings and community or nursing home settings for adults with social care needs’. This guideline aimed to ‘improve people’s experience of admission to, and discharge from, hospital by better coordination of health and social care services’ (National Institute for Health and Care Excellence, 2015).

4.2.2 To meet the requirement of the 2015 guideline, in 2016 NICE provided a ‘Hospital Transfer Pathway (Red Bag Pathway)’ which was designed to support ‘nursing homes, ambulance services and the local hospital’ (National Institute for Health and Care Excellence, 2016). In addition, in June 2018 NHS England and NHS Improvement (NHSE/I) published ‘A quick guide: hospital transfer pathway – ‘Red Bag’’ (NHS England and NHS Improvement, 2018).

4.2.3 The NHSE/I guide explains that the Red Bag ‘helps provide a prompt, safe and efficient transfer of clinical care, when a resident moves between a nursing home and other clinical settings’ and that it contains ‘standardised information [documentation] about the resident’s general health, any existing medical conditions they have, medication they are taking, as well as highlighting the current health concern’.

4.2.4 The investigation found conflicting guidance on what should happen with the Red Bag. The NHSE/I Red Bag quick guide states that ‘The bag stays with the resident from the time they leave the home to go to hospital, until they return to their nursing home’. The NHS England website states that ‘The bags … are handed to ambulance crews by carers and travel with patients to hospital where they are then handed to the doctor’ (NHS England, 2018a).

4.2.5 The Red Bag pathway does not comment on consideration of a nursing home resident having dementia, and any implications of this.

4.2.6 The investigation learned that the Red Bag pathway had been in use by healthcare organisations in the region. In relation to PID, the pathway was considered useful in the standardisation of documentation to be provided by the nursing home via the Ambulance Trust to the Acute Trust.

4.2.7 The investigation learned that due to the COVID-19 pandemic, there were changes to the normal Red Bag process. Due to infection control measures, the use of actual Red Bags to enable transfer of medications and personal belongings stopped. The investigation found no evidence of a formal policy to direct this change with consideration of the likely consequences.

4.2.8 Although the Red Bag pathway could not be followed in full due to the COVID-19 pandemic, the nursing home continued to provide the same patient documentation.

Verification of personal identification data

4.3.1 During episode 2, two pieces of incorrect PID were entered into the Ambulance Trust digital triage system by the emergency operations centre (EOC) 999-call handler. There was an incorrect spelling of Mrs E’s surname (the spelling was not requested) and an incorrect DOB (as provided by the nursing home). The nursing home address was entered correctly.

4.3.2 In line with the EOC call handling process, the 999 call handler did not ask for Mrs E’s NHS number. Mrs E’s NHS number was available as it was within Mrs E’s nursing home documentation, which was available to the NIC when making the 999 call.

4.3.3 The 2014 ‘NHS Number survey report’ stated:

‘… in order to meet the key needs of our health and social care system, the use of the NHS Number has to move from “good practice” to “core practice”. This requires the use of the NHS Number as early as possible in the care process, and established as the primary identifier when sharing information across organisations.’
(NHS England, 2014)

4.3.4 While recognising that in some emergency situations a person’s NHS number would not be known, there are occasions when it could be accessed. For example, the NHS number can be found on the NHS app, which is now widely used.

‘As many as 10.4 million people have now signed up to the NHS application (app), with over 6 million users since the COVID 19 vaccination status service was added in May 2021’
(Department of Health and Social Care, 2021).

4.3.5 In 2008, the National Patient Safety Agency, NHS Connecting for Health and Informing Healthcare issued a Safer Practice Notice (reference NPSA/2008/SPN001) which made recommendations about the use of the NHS number as the national identifier for all NHS patients.

4.3.6 In 2009 this notice was re-issued to chief executives of NHS organisations in England and Wales for action (National Patient Safety Agency, 2009). The notice was entitled:

‘Risk to patient safety of not using the NHS number as the national identifier for all patients’.

It stated that

‘to ensure correct patient identification, the NHS number should always be used in conjunction with other identifiers (usually first name, last name and date of birth) when identifying a patient’.

4.3.7 There is a national standard for the handover of patient care from ambulance to emergency care (Professional Record Standards Body, 2019), relating to ‘a standard for the information that is shared when care is transferred from ambulances to emergency departments.’ The ‘Ambulance handover standard final report’ includes ensuring the NHS number, along with other patient identifiers, is used. Accompanying implementation guidance has also been drafted as well as an ‘Ambulance transfer of care hazard log’. The latter recognises patient identification as a risk.

4.3.8 To ensure that the NHS number is used when a patient’s care is handed over from ambulance to emergency care, in line with the national standard, the NHS number would need to be established (when possible) by the ambulance trust. When an NHS number is not established by a call handler, either because it was not requested or was not known during a 999 call, it can be retrieved by a search of the patient demographic search (PDS) via NHS Spine, which is available to call handlers and ambulance crews. To retrieve an NHS number from NHS Spine, accurate PID must be used.

4.3.9 Retrieval of a patient’s NHS number from NHS Spine, alongside additional patient PID such as name, DOB and address, provides a layer of assurance of positive patient identification. An accurate NHS number alone would enable retrieval of all other associated patient PID.

4.3.10 When it was not possible to retrieve Mrs E’s NHS number on NHS Spine, this indicated an increased risk that the PID captured may not have been reliable.

4.3.11 There are recognised forms of standardised communication, used across healthcare and other safety-critical sectors, that make the transfer of information between people more reliable (NHS Institute for Innovation and Improvement, 2010; Nursing Times, 2016; Skybrary, n.d.). One example is ‘readback’, where the person receiving the information reads it back to the information giver to confirm that it is correct.

4.3.12 Readback of the information provided by a caller, which could include spelling, would add a further layer of PID verification and provide an opportunity to correct errors.

4.3.13 In summary, the retrieval of the NHS number during a PDS search via NHS Spine provides an additional layer of assurance that PID captured by the Ambulance Trust is accurate. When the NHS number cannot be retrieved, this indicates an increased risk that the PID provided may be inaccurate and shows where additional verification measures would increase reliability of the PID provided.

4.3.14 The Ambulance Trust did not consider the NHS number as a primary patient identifier, with the benefit of increased assurance of accurate patient PID.

4.3.15 Increased verification to ensure reliable PID would take additional time. The investigation learned that at the time of the safety event, because of the number of 999 calls waiting, the Ambulance Trust EOC was using ‘emergency rules apply’ procedures.

EOC ‘emergency rules apply’ procedures

4.3.16 The Ambulance Trust described their EOC ‘emergency rules apply’ procedures as a ‘dynamic based decision in support with the EOC Tactical commander’.

4.3.17 The investigation learned that ‘emergency rules apply’ procedures had been invoked for block periods of time and reviewed against call demand pressures. The Ambulance Trust explained that their review consisted of ‘Risk versus benefit’; the benefit of getting a patient name (accurate PID) for (ambulance) crew’s records, from an EOC perspective, is ‘far below that of answering other 999 calls waiting therefore the strategic decision is made to cease this practice for short intervals of time until the 999-call demand has reduced’.

4.3.18 From the perspective of an ambulance trust, there are minimal implications of incorrect/incomplete PID; the trust’s priority is to assess, treat and transport a patient in a timely manner for further appropriate care.

4.3.19 The risk of incorrect/incomplete PID did however have more significant implications and unintended consequences later on in Mrs E’s care pathway, specifically once Mrs E’s care was transferred to the Acute Trust.

4.3.20 The investigation found no evidence to suggest that the Ambulance Trust had a requirement to make other healthcare organisations aware of its ‘risk versus benefit’ assessments where an accepted increase in the risk of incorrect/incomplete patient PID could have an impact on patient care.

4.3.21 The increased risk of incorrect patient PID was assessed and accepted at the EOC during ‘emergency rules apply’. This risk was transferred to the Acute Trust without its knowledge when Mrs E was booked in at the emergency department. The risk materialised with the incorrect PID contributing to Mrs E not being identified correctly, a new patient record being created, and existing medical records from previous episodes of hospital care being not retrieved to fully inform the care provided during this safety event.

4.4.1 The information captured within the ePRFs over the three episodes of Mrs E’s care is shown in table 1.

4.4.2 During episode 1 the PDS lookup statement (see table 1) showed that the demographics captured matched those of Mrs E within NHS Spine, enabling the retrieval of her NHS number, which was not requested or provided during the 999 call.

4.4.3 The investigation learned from the Ambulance Trust that the PDS lookup statement in episode 2 (see table 1) ‘means there is a proxy setting error where the look up (PDS search) has not been able to connect to the NHS Spine to find the patient’. The investigation learned that this was not an uncommon event.

4.4.4 The investigation learned that there had been regular occurrences of the ambulance crew’s handheld digital device being unable to connect/communicate for extended periods. This meant that no PID information could be transferred from the EOC or via NHS Spine using the handheld PDS search option.

4.4.5 The investigation did not consider communication challenges in more detail as the Ambulance Trust reported that it was currently undergoing a procurement and replacement review of its handheld digital equipment. In addition, there is an ongoing national programme to upgrade the emergency radio network available to ambulance services (Home Office, 2019).

4.4.6 When connection issues affect access to the PDS search function, there is an increased reliance on the ambulance crew (people) to verify the PID.

4.4.7 The investigation learned that the PDS lookup statement in episode 3 (see table 1) ‘is where the wrong demographics have been placed/it can’t match to the correct patient and finds nothing’.

4.4.8 As set out in section 4.3, this did not result in additional verification measures (processes) to increase the reliability of the PID captured, including the use of the accurate PID provided within the nursing home patient documentation.

4.4.9 During episodes 2 and 3, the ambulance crew was not able to identify Mrs E by PDS search, yet the correct GP (episode 2 and 3) and next of kin (episode 2) details were captured in the ePRF. These were not entered by the 999 call handler.

4.4.10 The investigation learned that these details would have been entered by the ambulance crew either during discussion with nursing home staff or by reviewing the provided nursing home documentation containing accurate PID. The investigation was unable to interview the attending paramedic to determine this.

4.4.11 When Mrs E’s GP and next of kin details were entered by the ambulance crew this provided an opportunity to review the spelling of Mrs E’s surname and her DOB to confirm her PID and correct any inaccuracies.

4.4.12 The investigation learned that it would be usual practice by local ambulance crews to use documentation provided to match the ePRF PID with provided nursing home documentation. This places a reliance upon ‘people’ as a control measure to ensure accurate PID. The investigation was unable to find out why this may not have occurred during this safety event. Several factors were considered that could have contributed, including:

• Proximity – The nursing home in the safety event is geographically very close to the Acute Trust. This means there may have been minimal time for the ambulance crew to conduct the usual documentation checks and update the ePRF if needed before arriving at the ED.
• Priority – The priority for attending paramedics is to provide appropriate clinical care and onward transport to the ED as required. The short journey may have meant there was only enough time to carry out clinical care as the priority, with not enough time for documentation and PID confirmation checks.

4.4.13 The investigation learned that during the booking-in procedures in episode 2 and 3, the ED at the Acute Trust was not made aware that there had been no PDS verification of Mrs E’s PID. This included when Mrs E could not be identified on the hospital patient management system, and a new patient record was created.

4.4.14 In episode 3, one item of PID was incorrect (Mrs E’s DOB), and two were correct (her name and address). The PDS system did not offer any potential matches. The functionality and sensitivity of the PDS meant potential matches were not offered when any inaccurate PID was entered.

4.4.15 Improving the functionality and sensitivity of the PDS system (technology) to offer potential matches when there are two or more correct pieces of PID would support positive patient identification.

4.4.16 The Joint Commission (2018) states, ‘A systems approach is required to fully consider the interaction of technology, people and processes to ensure correct patient identification’.

4.4.17 The PDS is a national digital system and changes to it are outside the control of local healthcare organisations. PDS properties identified in this local investigation will inform HSIB intelligence for consideration in any future investigations.

4.4.18 When a successful (NHS number retrieval) PDS search via NHS Spine was not achieved by the Ambulance Trust, influenced by:

• the EOC being on ‘emergency rules apply’ procedures
• the ambulance crew PDS search being unsuccessful due to communication error
• the ambulance crew PDS search resulting in a ‘match was not found’ response.

This indicated an increased risk of incorrect PID being passed to, and used by, the Acute Trust later in the patient care pathway.

4.4.19 The intent of the following local safety recommendation is to mitigate the unintended consequence of transferring incorrect PID from the Ambulance Trust to the Acute Trust. The local safety recommendation provides flexibility regarding where additional PID verification by the Ambulance Trust could take place, for example at the EOC by call handlers, or by ambulance crews.

Background

4.5.1 The investigation considered the ED booking-in procedure using the concept of ‘varieties of human work’ (see appendix 3).

4.5.2 The investigation was informed that when a patient arrives by ambulance to the ED the ambulance crew administratively book in the patient with the ED receptionist/ED flow co-ordinator. The patient’s details are entered into the hospital patient management system, the patient is identified, and any previous care records (digital and paper) are then available.

4.5.3 At the time of the safety event, in the Acute Trust there was an ED minor injuries area (minors) and an ED major injuries area (majors). The ED majors area was split into red (COVID-19) and green (non-COVID-19) areas, with the ED majors staff employed across both. Infection control measures were in place which reduced the ability of staff to move easily between the two (red and green) ED majors areas.

4.5.4 The investigation observed the admission of acutely unwell patients into the ED (green) majors area. The ED majors reception area was observed to be cramped and busy. There were many staff gathered in this area including nurses, doctors, administrative staff, porters, ambulance crews and patients, with increased noise levels leading to the possibility of distractions or difficulty in communicating effectively.

4.5.5 The Acute Trust administrative booking-in procedure for ED majors patients is carried out either by an ED flow co-ordinator (as in episode 2), or, between 14:00 hours and 22:00 hours, by a dedicated ED majors receptionist (as in episode 3).

Booking-in policy/procedure

4.5.6 The investigation observed variation in the way that the patient
booking-in process was carried out, by both Ambulance Trust crews and Acute Trust ED staff.

4.5.7 The investigation observed the following:

• when the patient’s PID was requested by ED staff, ambulance crews reading PID from their handheld digital device and the ePRF

or

• when PID was requested by ED staff, ambulance crews reading PID directly from nursing home documentation provided for the patient

or

• as requested by ED staff, ambulance crews handing over their handheld digital device to ED staff for them to read the PID directly

or

• booking-in staff in the ED majors area being unavailable, with ambulance crews going to the ED minors reception to book in the patient, before returning to ED majors for the clinical handover.

4.5.8 The investigation was unable to identify an Acute Trust formal booking-in policy or procedure. The lack of a policy is a key enabler of the differences in booking in that were observed. The Acute Trust had a flow chart for patient booking in; this was limited to instructions on how to save the Ambulance Trust ePRF to the hospital patient management system and did not form part of an overarching policy.

4.5.9 Procedures are recognised tools that help to enable a consistent approach to tasks:

‘Procedures … standardise how things are done, reducing reliance on our memory, ensuring good practice is followed, and reducing risks (the chances of something going wrong).’
(Chartered Institute of Ergonomics and Human Factors, n.d.)

4.5.10 The investigation learned that Ambulance Trust face-to-face booking in of patients with ED reception staff was by ‘courtesy’. The PID for patients can be accessed through an Ambulance Trust digital system (which provides information regarding imminent ambulance arrivals) which is available to ED reception staff before an ambulance arrives.

4.5.11 Should the face-to-face courtesy of booking in a patient not be carried out, the opportunity for ED staff and the ambulance crew to interact and discuss patient PID would be removed. This would make the accurate identification of patients’ PID by Ambulance Trust 999 call handlers and ambulance crews even more important.

4.5.12 The investigation found that staff relied on learning through ‘on the job’ training and experience. The process of booking patients in at the ED was inconsistent; it was determined by the individual practices of Acute Trust and Ambulance Trust staff who were not supported by a formal booking-in procedure.

ED reception environment

4.5.13 The ED majors area reception, where patients were booked in, was staffed by either an ED flow co-ordinator or, between 14:00 hours and 22:00 hours, a dedicated ED majors receptionist. This allowed the ED flow co-ordinator to spend more time on their additional ED flow co-ordination duties.

4.5.14 The investigation observed that over a period of approximately 2 hours (in the morning) the flow co-ordinator was present at the ED majors reception desk for approximately 5 to 10 minutes.

4.5.15 When not at the ED majors reception desk, the flow co-ordinator was carrying out patient flow duties, for which they needed to look at the information flow boards located in a side office behind the reception. Here the flow co-ordinator could liaise with the immediate ED team, interact with other hospital departments and agencies via telephone, and monitor patient flow through the ED.

4.5.16 While the flow co-ordinator was not at the ED majors reception desk the investigation observed several ambulance crews arriving with patients, without appropriate ED staff (flow co-ordinator/receptionist) available to book patients in.

4.5.17 Ambulance crews were observed to wait for up to 5 minutes, asking ED staff members in the vicinity if there was anyone available to book in a patient. On several occasions, ambulance crews would then leave the ED majors reception. The investigation learned that because of the wait, the ambulance crews had booked the patient in at another location, such as the ED minors reception.

4.5.18 The flow co-ordinator could not see the ED majors reception booking-in station from the side office, and the ambulance crews could not see into the side office from the ED majors reception booking-in station. Even if the flow co-ordinator could see waiting ambulance crews, they were continuously carrying out other tasks and on telephone calls.

4.5.19 The investigation team observed that the flow co-ordinator’s capacity to carry out patient flow duties while also being consistently available to book patients in was limited. In addition, the layout and infrastructure within ED majors meant that the flow co-ordinator could not carry out all their duties without having to balance and prioritise one task against another in differing, although nearby, locations.

4.5.20 Prioritisation of tasks in a complex and fast-paced environment is understood as an essential part of ED roles, including the flow co-ordinator role. Increased workload, the layout and environment of the workplace and the need to prioritise can make it more difficult for staff members to complete all their tasks effectively.

4.5.21 The flow co-ordinator being unavailable to book patients in resulted in variation in the booking-in procedure. This increased the likelihood of inaccurate PID being transferred and inconsistent positive patient identification.

4.5.22 A dedicated ED majors receptionist would not have the additional tasks that a flow co-ordinator is responsible for, allowing a consistent, standard and repeatable approach to the booking in of ED majors patients. This would increase the likelihood of reliable PID verification during the booking-in procedure.

4.5.23 In the safety event, the nursing home escort was unaware that there were ever any difficulties with positively identifying Mrs E during the booking-in procedure. They felt they could have helped, even if only by directing staff to look at the information within the nursing home documentation. The nursing home escort did not recall seeing the nursing home documentation from the time of entering the hospital until it was provided when Mrs E was discharged later the same day.

4.5.24 When there were difficulties in finding Mrs E’s records on the patient management systems available, neither the nursing home (details of which were on the ePRF) nor the nursing home escort were asked to help to confirm Mrs E’s PID before the creation of a ‘new patient’ record.

4.5.25 Standardised and consistent ED patient ‘booking in’ was not evident. This was influenced by:

• the lack of a formal Acute Trust booking-in policy
• the individual practices of Acute Trust and Ambulance Trust staff
• staff capacity and ED infrastructure and layout
• inconsistent use of available patient documentation
• inconsistent use of additional PID sources such as nursing home escorts and external healthcare organisations.

Safety recommendation R/2022/172:

HSIB recommends that the Acute Trust, in collaboration with the Ambulance Trust, develops and implements a formal emergency department booking-in policy.

Safety observation O/2022/143:

It may be beneficial if the Acute Trust reviews the infrastructure and layout of the emergency department majors area in order to support the flow co-ordinator to reliably carry out their full responsibilities.

4.6.1 The investigation learned that during episode 2, when Mrs E had been booked in, hospital addressograph stickers were printed by the flow co-ordinator. The stickers were collected from the printer by the allocated ED nurse. They were placed on an ED folder and corresponding care documents, and one of the stickers was placed onto a blank white patient identification band which an ED nurse then put on Mrs E’s wrist.

4.6.2 The Acute Trust’s positive patient identification (PPI) policy says that

‘a hospital addressograph sticker is not to be attached to a Patient Identification Band’.

4.6.3 The sticker on Mrs E’s patient identification band contained an incorrect spelling of her surname, incorrect DOB, a ‘new patient’ hospital number, an ED episode number, the correct address of the nursing home and a barcode. The available NHS number field was empty.

4.6.4 The Information Standards Board for Health and Social Care Data Set Change Notice (DSCN) 04/2009 (NHS Connecting for Health, 2009) states that:

‘The four core identifiers that uniquely identify a patient when used in combination and which must be present on the identity band are: Last Name, First Name, Date of Birth and verified NHS Number.’

The Trust’s PPI policy states that:

‘The following details must be included on the patient identification band:

• Forename.
• Surname.
• Date of Birth.
• NHS unique patient identifier number.
• Hospital patient identifier number.’ [Not required by DSCN 04/2009]

4.6.5 Mrs E’s patient identification band did not have the NHS number and was therefore not in line with Acute Trust policy. The absence of the NHS number did not highlight that there may be a risk to positive patient identification and prompt further verification of Mrs E’s PID.

4.6.6 A heightened consideration among staff of the requirement for an NHS number would provide an opportunity to investigate PID issues, mitigating the risk of inaccurate patient details.

4.6.7 The NHS number field on Mrs E’s patient identification band remained empty, and therefore there was no indication that the NHS number was missing. A message such as ‘NHS number missing’ or ‘warning – confirm PID’ could act as an additional safeguard, highlighting a PPI safety risk and prompting staff to take further action to verify a patient’s PID.

4.6.8 A change to the current technology would be needed to enable a message to be printed on a patient identification band when there has been no NHS number captured. To prompt such a change, the Acute Trust would need to escalate the requirement and its safety benefits to digital system providers.

4.6.9 The Acute Trust (except the pathology department) did not consider the NHS number as a primary patient identifier in reducing the safety risk of incorrect patient identification. A missing NHS number did not prompt further action to verify Mrs E’s PID either during the booking-in procedure or when Mrs E was transferred between departments.

Safety recommendation R/2022/173:

HSIB recommends that the Acute Trust carries out additional personal identification data verification when an NHS number is not available.

4.6.13 Safety recommendation R/2021/131, from the HSIB investigation into Wrong site surgery - wrong patient: invasive procedures in outpatient settings, remains valid for this investigation’s inpatient setting. The investigation found that NHSE/I’s response to the safety recommendation was that it would not be acting on it at that time.

4.7.1 The investigation learned that during episode 2 the ED flow co-ordinator recalled asking the ambulance crew for Mrs E’s details, first her DOB and then her name, then searching for her records on the hospital patient management system. Entering the DOB did not identify a patient with the same surname as Mrs E. The flow co-ordinator recalled asking the ambulance crew to double check the DOB and being informed that this was the correct DOB as indicated on the ePRF on the crew’s handheld digital device.

4.7.2 The flow co-ordinator recalled asking whether the DOB could be checked with the patient and being informed that this was not possible because the patient had dementia.

4.7.3 Caring for patients with dementia in acute trusts is routine business: ‘People with dementia over 65 years of age are currently using up to one quarter of hospital beds at any one time’ (Alzheimer’s Society, 2009).

4.7.4 The ED flow co-ordinator asked for the NHS number, which would have enabled accurate patient identification with associated PID. The NHS number was not available as it had not been entered in the ePRF. ED staff were unable to identify Mrs E on the hospital patient management system, the ED patient management system, or NHS Spine using the details provided by the ambulance crew.

4.7.5 The investigation learned that because Mrs E had a suspected hip fracture, there was an urgency around booking her in for an X-ray. Subsequently Mrs E was booked in as a ‘new patient’ to which the ePRF was attached to provide an auditable trail of the PID provided.

4.7.6 The investigation observed and tested the various hospital digital systems used when booking in patients. From a short test of the hospital patient management system, which is used to book patients into the ED, it was evident that when entering PID in a different order and using fewer characters to spell her name, Mrs E could be identified. Mrs E’s PID could also be retrieved using her NHS number.

4.7.7 During one test scenario, the DOB field was left blank and Mrs E’s first name and only the first three (of nine) letters of her surname were entered. Mrs E’s records were immediately identifiable, as she was the only person that met the search criteria and therefore the only patient listed.

4.7.8 During another test scenario, the incorrect DOB, again along with Mrs E’s first name and the first three characters of her surname, were entered. On this occasion Mrs E’s records could not be identified. The investigation found the hospital patient management system is sensitive to incorrect data; any field that has incorrect data, such as the wrong DOB, leads to a patient’s record not being found even if all other fields are accurate.

4.7.9 A broader search using minimal fields and patient information would widen the search and may bring up a list of several patients, from which the correct patient record could be identified and selected. Entering a DOB alone would bring up all patients with a matching DOB that have records at the hospital, with the option to then select the patient required.

4.7.10 There is a reliance placed upon staff to understand the full functionality of hospital digital systems in order to search for and positively identify patients during handover from ambulance crews, when PPI difficulties are encountered due to inaccurate PID.

4.7.11 The investigation found no evidence that there was specific training regarding search functionality on the numerous digital systems available across the Acute Trust. It observed different levels of awareness among members of staff.

4.7.12 The functionality and sensitivity of the digital systems (technology), as outlined in section 4.4, meant that the system did not offer potential matches when any inaccurate PID was entered. Offering potential matches would increase the likelihood of positively identifying patients. However, there must be recognition of potential unintended consequences, with measures put in in place to mitigate the risk of the wrong patient record being selected from a list of possible matches.

4.7.13 The combination of the sensitivity of the digital systems, and the reliance on staff to understand the full search functionality of the systems, did not support the positive identification of Mrs E when aspects of incorrect PID were entered.

4.8.1 The Acute Trust has a PPI policy that sets out the use of white patient identification bands and coloured wristbands for various situations:

• White patient identification bands – with required patient details. To be worn by all patients.
• Blue wristband – patients with a risk of falls as identified by a falls risk assessment.
• Red wristband – patients with an allergy alert.

4.8.2 The different coloured wristbands, worn in addition to the white patient identification band, provide a visual prompt for staff, highlighting specific patient considerations for falls and allergies. This means that staff can take these patients’ needs into account while providing care.

4.8.3 The investigation did not identify any way for staff to immediately see that a patient has dementia. If staff were unaware that a patient had dementia, there may an increased risk of them not adapting the PPI procedure accordingly in line with the Acute Trust policy.

4.8.4 Other trusts have implemented methods to visually identify patients with dementia, such as ‘dementia friendly patient identification wrist bands’ (NHS England, 2018b).

4.8.5 A study is currently underway led by The Healthcare Improvement Studies (THIS) Institute, named DA VINCI (Developing a visual identification system for people with cognitive impairment in institutional settings).

4.8.6 The study ‘aims to collect information about the kinds of visual systems used to identify patients in NHS hospitals across the UK with cognitive impairment, so that care can be tailored to their needs’ with a goal ‘to produce a set of prioritised design principles that would ideally underpin any visual prompt system used to identify people with dementia in a hospital setting’ (The Healthcare Improvement Studies Institute, n.d.).

4.8.7 A visual system, such as a dementia friendly patient wristband, is not currently in use at the Acute Trust. Such a system may help staff adapt their PPI procedure accordingly.

Considerations relating to the identification of people with dementia

4.9.1 The Acute Trust PPI policy for identification of patients who lack capacity (including those with dementia) states that

tification band should be applied’

and

‘Once the identification band is in place, this should be utilised to verify the patient’s identification going forward’.

4.9.2 The PPI policy also states that:

‘If the patient is unable to support with the positive patient identification process (i.e. unable to answer appropriate questions) then the patient must be transferred with a staff member from the transferring department. The transferring staff member must confirm with the receiving department that the information on the identification band is correct. The information on the identification band can then be utilised for positive patient identification within the receiving department.’

4.9.3 The PPI safeguards (controls) used with patients who have dementia do not provide the same level of safeguard against incorrect PID as when the ‘ask, check, confirm’ procedure (see 4.9.8) can be used. Once a patient identification band is applied to a patient with dementia, subsequent PPI on transfer between internal departments is led by the content of the patient identification band.

4.9.4 The fact that there was incorrect PID on Mrs E’s patient identification band and ‘new patient’ records that were created from the outset when she visited the ED, meant incorrect PID was passed through the hospital system over the next 2 days and into surgery.

4.9.5 The Acute Trust PPI policy does not mitigate the risk of the internal transfer of patients with incorrect PID. This is because it supports the use of the information on the patient identification band when a verbal ‘ask, check, confirm’ cannot be carried out.

Acute Trust PPI policy

4.9.6 The Acute Trust PPI policy states:

‘If a Patient Identification Band is produced (printed/written) by a non-regulated person (i.e. receptionist, healthcare worker) it must be counter-checked by a registered professional before being applied to the patient. If any information is incorrect, an up-to-date identification band must then be issued and applied.’

4.9.7 The addressograph sticker for Mrs E’s patient identification band was printed by the flow co-ordinator. Therefore the responsibility for counter-checking the PID on the patient identification band prior to putting it on Mrs E was with the registered ED nurse.

4.9.8 To positively identify a patient the Acute Trust PPI policy states that the following ‘ask, check, confirm’ approach is used:

4.9.9 The policy states that if a patient:

‘… is unable to confirm their name [including correct spelling], date of birth and address then this information should be confirmed with a responsible relative or care provider (for example an appropriate care giver from a
nursing home).’

4.9.10 This is an example of an organisation’s policies being written without full consultation with other organisations/roles to understand the limitations that might affect how the policy is carried out. Mrs E’s nursing home escort did not know the PID for Mrs E. The investigation learned that nursing home escorts may accompany many residents, they may be new in their role, or they may have never met the resident before, for example if they are temporary staff.

4.9.11 The policy does not state what should happen if a patient’s PID cannot be confirmed with a responsible relative or care provider. Instead, it relies on individual nurses with varying experience and responsibility levels to determine how to appropriately confirm the patient’s PID.

4.9.12 The investigation learned of differences in the way different members of ED nursing staff approached counter-checking the patient identification band for a person with dementia.

• If a patient was unable to answer questions about their identity, and the nursing home escort did not know the PID, the nurse would be reliant upon the flow co-ordinator/receptionist getting it right, and therefore the accurate information being given by the ambulance crew.
• If a patient was unable to answer, due to lack of capacity or for other reasons such as drifting in and out of consciousness, the nurse would in the first instance refer to any paperwork that accompanied the patient into the hospital and confirm the patient identification band PID against this.
• If a patient was unable to answer questions about their identity and the nursing home escort did not know the PID, and there was documentation available, the nurse would not rely on the documentation. This was due to a previous experience where documentation for an incorrect nursing home resident had been provided via the ambulance crew. The nurse would call the nursing home, next of kin, family member or GP to carry out further PID verification checks.

4.9.13 These different approaches, with differing levels of PID verification, show how staff members take an individual approach where there is no specified standard setting out what to do when they encounter PID difficulties.

4.9.14 The spelling of Mrs E’s surname and her DOB were recorded incorrectly on her patient identification band. The procedure to positively identify Mrs E could not have been carried out in line with Acute Trust policy.

Radiology PPI policy

4.9.15 Patients attending the radiology department have their PID confirmed in line with the Acute Trust’s specific department of radiology control documentation which aligns to national Ionising Radiation (Medical Exposure) Regulations (IRMER) (The Royal College of Radiologists, 2017).

4.9.16 The radiology department guidance for ensuring correct PID involves asking the patient:

• What is your name?
• What is your date of birth?
• What is the first line of your address?

4.9.17 The radiology department guidance states that ‘Most incidents which relate to patient identification originate in A+E [ED]. Extra care should be taken when performing referrals from this source’.

4.9.18 The radiology department guidance states that:

‘If the patient is not able to confirm their own identity, e.g. too young, unconscious, incoherent, language difficulties, then an accompanying capable adult must answer on their behalf. The source of the information used to positively identify the patient should be indicated on CRIS [the radiology patient management system] in the Q&A section (e.g. relative, carer, and interpreter). If you cannot identify the patient then the patient should not undergo the radiological procedure until positive identification can be made.’

4.9.19 The radiology department guidance also states that for inpatients:

‘If the patient is unable to confirm their own identity a nurse or care assistant looking after the patient must confirm the ID. The name of the person confirming the ID should be entered onto CRIS in the Q&A section. The patient’s wristband [patient identification band] must never be the sole method used in ID.’

4.9.20 The investigation learned that during episode 2 the source of positive confirmation of Mrs E’s PID in the radiology department, as recorded on CRIS, was Mrs E. The radiographer was unable to recall the specific safety event.

4.9.21 The investigation found a conflict of accounts regarding the source of positive confirmation of Mrs E’s PID during episode 3. It was recorded on CRIS that the nursing home escort provided positive PID. The investigation learned that the nursing home escort did not know Mrs E’s PID and that the escort recalled that the PID confirmation was between the radiographer and Mrs E.

4.9.22 The procedure to positively identify Mrs E in the radiology department could not have been carried out in line with radiology department guidance.

Surgery

4.9.23 Mrs E was transferred from the SAU to the surgery department. The investigation learned that the handover of Mrs E’s care was likely to have been carried out using the Acute Trust policy for handing over patients who lack capacity. This would have entailed a porter, with a nurse from the pre-surgery ward, escorting Mrs E and vouching for her PID using the patient identification band, which contained the incorrect DOB and spelling of Mrs E’s surname.

4.9.24 The operating theatre booking system used to book patients for surgery would have been populated with the incorrect details from other digital patient management systems within the Acute Trust. These would have matched the incorrect details on Mrs E’s patient records and patient identification band. The operating theatre checklist was signed to confirm that the patient identification band and care records matched.

4.9.25 The investigation learned that the anaesthetist would have likely requested Mrs E’s previous care records to understand her medical history and to identify allergies and risks for Mrs E. Mrs E’s previous records were inaccessible; since episode 2, the only records available were those accessible through her ‘new patient’ record.

4.9.26 The investigation learned that no concern was raised regarding the lack of hospital care records for a local patient aged 93. Staff described occasions where limited care records are not unusual, such as when patients are from out of the area.

4.9.27 Within the surgery department, and throughout the safety event, ‘No known allergies’ was documented for Mrs E. The investigation learned that Mrs E did not have allergies that would have altered her care during this safety event.

Summary of issues relating to PPI

4.9.28 Delivering hospital care, exposing a patient to ionising radiation (that is, when doing an X-ray), administering medication, and performing surgery without appropriate access to a patient’s previous medical history represent a significant patient safety risk. The investigation did not identify effective safety measures across the hospital work system to mitigate the risk of incorrect PID for patients with dementia.

4.9.29 The systems and processes in place within the Acute Trust should provide adequate controls to support staff to carry out PID verification successfully and reduce the associated safety risks. The PPI safeguards (controls) for patients with dementia is for staff to use the patient identification band PID to ‘verify the patient’s identification going forward’. This does not provide the same level of safeguard against incorrect PID as when the ‘ask, check, confirm’ procedure can be used.

4.9.30 The Investigation found that applying an accurate patient identification band to a patient when they are admitted to the Acute Trust was the single safeguard to prevent the risk of incorrect PID following patients, specifically those with dementia, when they moved between internal Acute Trust departments.

4.9.31 A patient identification band with incorrect PID being placed on a patient with dementia creates a safety risk, as any subsequent patient identification is led by the content of the patient identification band.

4.10.1 The investigation learned that the pathology department’s patient identification procedures are governed by the Medicines and Healthcare products Regulation Agency. The investigation was informed that there is a ‘zero tolerance’ approach for incorrect PID, and procedures are based upon a principle of a unique patient identifier.

4.10.2 The investigation learned that the heightened awareness within pathology of the importance of PID accuracy was due to the poor outcome consequences of providing incorrect blood products to a patient. The immediacy of the outcome heightens staff members’ perception of risk and significance of the need for controls.

4.10.3 An initial blood group and save (blood sampling process – see 2.20) was done for Mrs E during episode 2. The investigation learned that this was processed as a ‘new patient’ because, as Mrs E’s NHS number was not available, it was not possible to identify any previous pathology records.

4.10.4 The investigation learned that in circumstances such as surgery when a patient may need to be given blood, a second ‘check sample’ of blood is required, known as a blood group and save crossmatch. This also involves a second (independent) pathology staff member checking the request form and the sample.

4.10.5 A blood group and save crossmatch was received by pathology as a precautionary measure in case blood was required during Mrs E’s surgery. The blood group and save crossmatch was labelled with the same incorrect details as the first sample, therefore the samples matched.

4.10.6 The investigation learned that the blood group and save crossmatch could not be automatically ‘linked’ to the first blood group and save because no NHS number had been noted. Blood samples can only be linked automatically via the pathology information management system using an NHS number, because of the need for interoperability with other healthcare digital systems.

4.10.7 To link the two blood samples would have required a manual override as the samples cannot be automatically linked using a local hospital number.

4.10.8 The pathology information management system had an inherent safety control – identifying a PID issue due to the patient not having an NHS number. This, combined with the pathology medical laboratory assistant’s curiosity about why a patient aged 93 from a local nursing home did not have an NHS number, prompted action to investigate, revealing the inaccurate PID.

4.10.9 Using the incorrect details given for the blood sample, the pathology staff member tried to find Mrs E’s records on a number of digital patient management systems in order to obtain her NHS number. Their search was unsuccessful, so they contacted the medical admissions team to tell them about the issue.

4.10.10 The medical admissions team could not identify an NHS number for a patient with the details provided. However, by using the hospital patient management system (the same system used by the ED flow co-ordinator/ED receptionist) they identified a patient whose name was spelled slightly differently, whose DOB was different by one month, and who had the same nursing home and GP details, and an NHS number.

4.10.11 The pathology staff member informed surgery of the possible PID conflict. At this point Mrs E was out of surgery and in the recovery area. The investigation learned that the ODP telephoned the GP and the nursing home to positively identify Mrs E. Mrs E’s correct PID was confirmed.

4.10.12 The investigation learned that Mrs E’s previous records were immediately requested and, once Mrs E was admitted to the post-surgery ward, her care records – both electronic and paper – were merged under Mrs E’s previous hospital number.

4.10.13 Although there were no negative outcomes for Mrs E caused by the incorrect PID, as no blood was required during her surgery, the incorrect PID did create a safety risk. The investigation learned that there are policies in other acute trusts where surgery would not proceed if the blood group and save crossmatch is not complete when there is a possibility that the patient will require a blood transfusion.

4.11.1 The analysis of this incident has identified main themes that contributed to the safety event. These themes relate to:

a) The absence of formalised procedures to support staff when positively identifying patients.

b) The inconsistent use of the NHS number as the primary identifier for patient identification.

c) The sensitivity and functionality of digital systems. If there are minor inaccuracies in the personal data entered, the systems provide limited support for positive identification of patients.

4.11.2 The investigation acknowledges that a number of the safety recommendations made in this report focus on standardisation and process and will involve a reliance on staff. It is recognised that these recommendations will be unlikely to eliminate incidents but will help to mitigate the risk of them occurring.

4.11.3 The fact that the safety recommendations are more administrative in nature potentially demonstrates the challenges trusts face in developing and implementing effective responses to recommendations that may be beyond their influence. This shows the importance of recommendations influencing national change, such as the development of systems with built-in barriers, which may be more effective in the future. The national learning in this report will contribute to HSIB’s process for identifying future national investigations.

The investigation found that:

• The nursing home care records available to staff had varying levels of risk of incorrect personal identification data (PID) associated with them.
• Although the Red Bag policy could not be followed in full due to the COVID-19 pandemic, the nursing home continued to provide the same patient documentation.
• When NHS Spine was unable to retrieve the patient’s NHS number, this indicated an increased risk that the personal identification data (PID) captured may not have been reliable.
• The Ambulance Trust did not consider the NHS number as a primary patient identifier.
• The increased risk of incorrect patient personal identification data (PID), that was assessed and accepted at the EOC during ‘emergency rules apply’, was transferred to the Acute Trust unbeknown to them when the patient was booked in at ED.
• Incorrect Ambulance Trust electronic patient record form (ePRF) patient identification data (PID) was not corrected with use of provided nursing home documentation.
• The functionality and sensitivity of the Personal Demographic Service (PDS) search meant potential matches were not offered when any inaccurate patient identification data (PID) was entered.
• A standardised and consistent patient ‘booking in’ procedure in the emergency department was not evident. This was influenced by:
  • no formal Acute Trust ‘booking in’ procedure
  • the individual practices of Acute Trust and Ambulance Trust staff
  • staff capacity
  • inconsistent use of available patient documentation provided
  • inconsistent use of additional personal identification data sources such as nursing home escorts and external healthcare organisations.
• The Acute Trust (except pathology) did not consider the NHS number as a primary patient identifier in reducing the safety risk of incorrect patient identification. When the NHS number was missing it did not prompt further positive patient identification (PPI) action to verify personal identification data (PID) either during the booking in procedure or during transfer between internal departments.
• The combination of the sensitivity of the Acute Trust digital systems, and the reliance upon staff to understand the full search functionality of them, did not support positive patient identification (PPI) when provided with aspects of incorrect personal identification data (PID).
• A visual system used to identify patients with dementia is not currently adopted by the Acute Trust. This may aid staff to adapt their PID procedure accordingly.
• The Acute Trust positive patient identification (PPI) policy supports the internal transfer of patients with incorrect personal identification data (PID) by promoting the use of the information on the patient identification band when a verbal ‘ask, check, confirm’ cannot be carried out.
• Ensuring that a patient identification band with accurate patient identification data (PID) is placed on a patient with dementia on admission to the Acute Trust was identified by the investigation as the ‘single’ safeguard to prevent the risk of incorrect PID following patients, specifically with dementia, through Acute Trust departments.
• The pathology information management system had an inherent safety control, identifying a personal identification data (PID) issue due to the patient not having an NHS number.

The investigation also found learning for potential national benefit:

• The correct identification of patients relies on staff checking patient details and therefore will not always occur effectively. There may be opportunities for further engineered or technological barriers to help mitigate the risk of incorrect identification.
• The investigation recognises that a single hospital trust may receive patients from multiple ambulance trusts, and ambulances from a single ambulance trust may attend several hospital trusts. Pathways and procedures potentially vary across different trusts and a consistently agreed approach may not exist.
• There may be variation across the country in how NHS numbers are used by trusts for identification of patients. The investigation identified that the NHS number may not be being used as per national expectations.

Safety recommendations are directed to a specific organisation for action. They are based on information derived from the investigation and are made with the intention of preventing future, similar events.

The NHS number is a unique identifier for people living in England (and Wales). There is a risk to the accurate identification of patients when the NHS number is not used as the primary patient identifier.

SEIPS was first described by Carayon et al (2006) as a framework for understanding the work systems, processes and outcomes in healthcare and the relationships between them (see figure A1). It is a systems engineering approach with human factors principles embedded within it.

Figure A1 SEIPS, adapted from Holden et al (2013)

SEIPS describes how components of the work system produce work processes that result in different outcomes. Work system factors are described below (Holden et al, 2013; Carayon et al, 2006):

• People: the people working in the particular system and the patient.
• Tasks: undertaken by people, and which can vary in complexity or variety.
• Tools and technology: used to undertake tasks, and which can vary in usability and functionality.
• Internal environment: the physical space around people (for example, layout, noise and temperature).
• Organisation: conditions external to people to support the organisation of, for example, resources and activity.
• External environment: factors outside of the healthcare institution, such as policy, societal or economic factors.

Processes can be physical, cognitive or behavioural, and lead to outcomes for patients, professionals or healthcare institutions. Interactions between the various components of the work system lead to different outcomes, both positive and negative. The framework includes feedback loops, which represent the adjustments systems make over time.

The concept of a hierarchy of controls (see figure A2) is commonly used to describe the properties associated with system controls. Certain methods of control provide more protection and are more effective than others. The hierarchy of controls approach implies that controls at the top of the hierarchy are likely to be more effective at managing risks than those lower down (National Institute for Occupational Safety and Health, 2015). While not developed for healthcare, the principles are useful to consider when developing recommendations to prevent future events.

Figure A2 Hierarchy of controls

Elimination: Redesign the activity such that the risk is removed or eliminated.

Substitution: Replace the activity with an activity that reduces the risk. Care is required to avoid introducing new hazards from the substitution.

Engineering controls: Design measures that help control or mitigate risks, such as barriers, guards and so on. Priority should be given to measures that provide collective protection rather than those that just protect individuals or a small group of people.

Administrative controls: Identifying and implementing the procedures to improve safety, such as undertaking risk assessments, preparing and communicating mitigating procedures, and increasing signage.

PPE: Personal protective equipment: local kit to mitigate the risks to those exposed to the hazard. People must be familiar with the function and limitation of each item of PPE for this to be an effective measure. Ideally, PPE is only considered after all previous measures higher in the hierarchy are identified as not being fully effective in controlling the risks.

The following description of varieties of human work is taken from the HSIB investigation for ‘Wrong patient details on blood sample’ (Healthcare Safety Investigation Branch, 2019).

In order to gain an insight into how best to explore the way staff work in the clinical environment, it is important to understand the varieties of human work. Figure A3 shows the varieties of human work described by Shorrock (2016). These show why the healthcare sector needs to adopt different approaches to fully understand healthcare work and incidents.

Figure A3 Varieties of human work (Shorrock, 2016)

‘Work as imagined’ refers to assumptions that may be made about how work is carried out by staff. However, people making these assumptions may be removed in time and space from the ‘front line’ and therefore unable to observe work being carried out in the workplace (Hollnagel et al, 2015).

The imagined way in which people work becomes ‘work as prescribed’ when it is set out in policy or processes that frontline staff are asked to follow and adhere to. This is often assumed to be the safest way to work (Shorrock, 2016).

Many traditional incident investigations will place emphasis on taking statements from staff in order to understand their actions. This ‘work as disclosed’ may be based on partial or incomplete versions of one or more of the other varieties of human work. Staff may be uncomfortable about, or fearful of, disclosing variations and adaptations made to ‘work as prescribed’ if they are worried about the possible repercussions of their actions. Staff may also not recognise where adaptations have been made as part of their daily practice.

‘Work as done’ refers to how people actually carry out their work. Understanding ‘work as done’ requires a practical focus on understanding and observing work in the environment in which it takes place in order to inform ideas about how work should be planned and managed. Catchpole and Jeffcott (2017) have identified that direct observation of staff within healthcare usually reveals a difference between what is disclosed and how work is actually done in practice. Without understanding ‘work as done’ it is not possible to accurately know how a system is functioning, and whether the gap between ‘work as imagined’ and ‘work as done’ poses a threat to organisational safety or represents the system drifting into an improved state (Shorrock, 2018).