Why it matters
Anything used in patient care has to be safe. We expect that of the medicines and equipment we use, and digital software is no different. When it goes wrong, patients can come to harm, sometimes for years before anyone notices.
A real example from general practice
A heart-risk calculator gave wrong answers for seven years
In 2016 the MHRA found that the QRISK2 calculator inside one GP clinical system had been miscalculating cardiovascular risk scores, possibly since 2009. Some clinical codes had been missed when the system was built. Potentially, up to 270,000 patients were affected.5
Most scores were only slightly out. But where a wrong score landed on the wrong side of the 10% threshold for offering a statin, the treatment decision could change, and harm was possible either way. A patient who needed a statin might not be offered one, raising their risk of heart attack or stroke. A patient at low risk might take one they didn't need, with the risk of side effects.
Illustrative chart showing how an incorrectly calculated QRISK2 score could underestimate cardiovascular risk
The national study
A 2025 national study found most NHS digital tools had no documented clinical safety assurance, despite it being a legal requirement.4
70%of digital tools in use across NHS trusts and ICBs had no documented clinical safety assurance
- 14,747
- tools counted in 178 organisations
- 13 of 204
- organisations had every tool assured
- 10,000+
- tools estimated to be in use without assurance
DCB0160: the two-minute version
- DCB0160 is the NHS standard for organisations that use health software, including GP practices. It’s a legal requirement.1
- The supplier’s clinical safety work (known as DCB0129) doesn’t cover you. You check what could go wrong with the tool in your own practice, so DCB0160 can only be completed by the local team.
- You need a Clinical Safety Officer (CSO) to sign off your clinical safety work. They don’t have to work directly in your practice, but they need to be named and accountable for signing off your DCB0160 work.2
- The DCB0160 documents are your clinical risk management system (CRMS: one practice-wide document on how you manage clinical safety for any tool), a clinical risk management plan (CRMP) for each individual tool, a hazard log and a clinical safety case report (CSCR).
- This process carries on for as long as you use the tool. It isn’t a one-off.
DCB0160 applies if a tool could affect a clinical decision, a patient’s record or access to care. For example, a staff rota doesn’t need it. See which tools need what.
Our example practice
Oakfield Surgery
A fictional practice we use throughout the toolkit: a practice of 9,000 patients with five GPs, two nurses, a practice manager and a care navigation (reception) team. Like every practice, Oakfield must keep an online consultation tool open throughout core hours, a contract requirement since October 2025. Oakfield is switching to a new tool, Kestrel Consult, and needs to show it's clinically safe in the way they run it. In simple terms, patients send requests for appointments through the practice website, a care navigator sorts them, and the duty doctor reviews anything needing specific clinical input.
Kestrel Consult and the other product names in Oakfield's examples are made up.
The trampoline analogy
The words and phrases used in clinical safety sound technical, but the principles are something anybody can relate to. It’s the same process any parent goes through without thinking when they put a trampoline in the garden: what could go wrong, why could it go wrong, how bad would it be, and what are you going to do to stop it happening or limit the harm if it does. Click through the steps one by one. Each shows the process for a garden trampoline, then the same process for Oakfield Surgery’s new online consultation tool.
The steps follow a chain: a cause leads to an effect, which creates a hazard for a person, which could lead to harm. Controls work on the causes; mitigations work on the harm.1
1 of 9
The system
The thing you’re putting in place. On its own it can’t harm anyone, but in the wrong circumstances it could.
In the gardenThe trampoline in the garden.
At Oakfield SurgeryThe online consultation form.
2 of 9
Causes
What could make the hazard happen. There is usually more than one, often about the technology itself or how people use it.
In the gardenThree children bouncing at once. Someone trying a flip.
At Oakfield SurgeryThe form doesn’t highlight red-flag symptoms. Some patients think the form is fine for urgent problems.
3 of 9
Effect
What goes wrong first, before anyone is actually harmed.
In the gardenThe bounces become unpredictable.
At Oakfield SurgeryA request with red-flag symptoms that needs urgent action sits in the routine queue.
4 of 9
Hazard
The situation where a person could come to harm. It always involves a person, usually the patient.
In the gardenA child loses control while bouncing and could fall off or collide with another child.
At Oakfield SurgeryA patient with red-flag symptoms is not directed to an urgent assessment in time.
5 of 9
Harm
What happens to the person or patient. One hazard can lead to harms of different likelihood and severity.
In the gardenAn upset child, a bruise, a broken arm, or at worst a head injury or death.
At Oakfield SurgeryPatient worry, repeated calls to the practice, delayed treatment, or at worst serious harm or death.
6 of 9
Risk
How likely the harm is, combined with how serious it would be. Scored from 1 to 5 using a risk matrix, which tells you whether the risk is acceptable.
In the gardenQuite likely, and could be fairly serious. Score: 3. Not acceptable yet.
At Oakfield SurgeryPossible, and could be very serious. Score: 3. Not acceptable yet.
7 of 9
Controls that prevent
These act on the causes, so the hazard is less likely to happen in the first place. They reduce likelihood.
In the gardenOne child at a time, no flips, and a safety net round the edge.
At Oakfield SurgeryA banner at the start of the form tells patients to call 999 or 111 for red-flag symptoms. Red-flag answers stop the form from going any further and direct the patient to 999 or 111.
8 of 9
Mitigations that limit harm
These act after the hazard, so if it still happens the harm is less severe. They reduce severity.
In the gardenAn adult watching who knows first aid. Soft ground and padding.
At Oakfield SurgeryA practice protocol that a clinician reviews every symptom request within two hours. A further safety-netting message when the form is sent.
9 of 9
Residual risk
The risk that is left once controls and mitigations are in place. You write it down and decide whether you can accept it.
In the gardenMuch less likely now. Score: 2. Acceptable, so the children can play.
At Oakfield SurgeryVery unlikely now. Score: 2. Acceptable, so Oakfield can go ahead.
Scoring a risk
Each hazard is scored before and after controls, by combining likelihood with severity. Choose a square to see what it means.1
3Reduce it if you reasonably can
Medium likelihood (possible) and Considerable severity (a more serious injury or harm needing treatment).
Try it with Oakfield's hazard H1
A patient with red-flag symptoms is not directed to an urgent assessment in time.
Real incidents
Harm usually comes from how a tool fits the day’s work, not just from the software crashing.3 Turn each card to see the lesson.
An AI summary invents a diagnosis
An AI tool summarising incoming documents added type 2 diabetes, medicines and other invented details to a young man's GP record. He was then invited to diabetic eye screening. A nurse spotted it when he said he wasn't diabetic.
An AI summary invents a diagnosis
Why it happened: NHS England said a staff member had been distracted and saved the unreviewed draft instead of the corrected version.
The lesson: "A human checks every output" only works as a control if checking is easy and someone audits that it happens.
In your hazard log- Cause
- the AI adds a diagnosis that isn’t in the letter
- Effect
- a wrong code is filed
- Hazard
- the patient is recalled or treated for a condition they don’t have
- Harm
- patient anxiety; side effects of unnecessary tests or treatment
- Controls
- reviewer opens the source document before filing; monthly sample audit of AI summaries
Source: Fortune, July 2025
A risk calculator gives wrong scores for years
The QRISK2 calculator built into SystmOne used wrongly mapped clinical codes when pulling data from the record, so scores could be wrong back to 2009. The supplier estimated 260,000 to 270,000 patients were affected, around 100 per practice.
A risk calculator gives wrong scores for years
Why it happened: Codes were left out and mis-mapped when a third-party tool was built into the clinical system. The MHRA told practices to stop using it, and practices had to review statin decisions.
The lesson: Tools that pull data from the record are only as good as that link, and the clean-up lands on practices.
In your hazard log- Cause
- a built-in calculator uses the wrong data from the record
- Effect
- a wrong score is shown
- Hazard
- a patient is offered the wrong treatment, or none
- Harm
- a preventable heart attack or stroke, or statin side effects
- Control
- after system updates, spot-check a few scores against the official online calculator
Source: Digital Health, June 2016; MIMS, May 2016
A wrong default dose reaches a child
A four-year-old needed 1,520 units of a blood thinner twice daily but was prescribed 15,000 units through an electronic prescribing system. She received five doses over three days, which contributed to bleeding around her brain.
A wrong default dose reaches a child
Why it happened: The system was set up to favour adult strengths and didn’t flag the dose. The national safety investigator found these problems keep recurring and that staff training is often too thin.
The lesson: Defaults and set-up choices are clinical decisions, in GP prescribing as much as in hospitals.
In your hazard log- Cause
- the default dose is wrong for this patient
- Effect
- the wrong dose is prescribed
- Hazard
- the patient takes too much or too little
- Harm
- bleeding or clotting, from too much or too little
- Controls
- review defaults at set-up; weight-based dose checks for children; training covers how to change a default dose
Source: HSSIB thematic review, Nov 2025; Pharmaceutical Journal
A date bug gives wrong Down’s syndrome risks
After the year 2000 began, the PathLAN laboratory system at Sheffield’s Northern General Hospital worked out women’s ages wrongly, so over 150 women across nine hospitals were told their babies were at low risk of Down’s syndrome when they weren’t. Four babies were born with Down’s syndrome, and two pregnancies were ended after late testing.
A date bug gives wrong Down’s syndrome risks
Why it happened: The inquiry blamed over-reliance on the software. Nobody checked whether the risk figures still looked right after the date change.
The lesson: A calculation you can’t see is easy to trust. Check outputs against a few known answers, especially after updates or date and system changes.
In your hazard log- Cause
- the system works out ages wrongly after a date change
- Effect
- wrong risk figures are reported
- Hazard
- a woman at high risk is told she is low risk and isn’t offered further testing
- Harm
- decisions about continuing the pregnancy made late, or without the right information
- Control
- check a sample of results against a manual calculation after every update
Source: The Register, Sept 2001
Six habits for every user
- Know what the tool is for, and what it isn’t for.
- Get trained, and make sure it’s recorded.
- Know how it fails and what to do when it does.
- Tell patients when it affects them.
- Check the output before acting on it.
- Report anything that goes wrong, including near misses.
References
- DCB0160: Clinical risk management in the deployment and use of health IT systems. NHS England standards directory
- Guidance on the use of AI-enabled ambient scribing products in health and care settings. NHS England
- Patient safety issues associated with electronic patient record systems: a thematic review. HSSIB, November 2025
- Digital health technology compliance with clinical safety standards in the National Health Service in England: national cross-sectional study. Oskrochi Y, Roy-Highley E, Grimes K, Shah S. Journal of Medical Internet Research, 2025
- QRisk2 in TPP “fixed” but up to 270,000 patients affected. Digital Health News, June 2016
Sources on this page last checked 3 November 2026.