Worked examples

Oakfield Surgery: online consultations

The hazard log

Here is the hazard log Oakfield produced after a one-hour workshop with the CSO, practice manager, care navigators and reception, a nurse and a salaried GP who regularly does duty doctor sessions. Switch between the score before and after controls to see what made the difference.

1. H1

   A patient with red-flag symptoms is not directed to an urgent assessment in time

   Cause

   The patient chooses an admin or "ask a question" route but includes red-flag symptoms. The form’s questions don’t pick up the red flag. The patient goes back and changes answers after a red-flag warning.

   Effect

   A request describing red-flag symptoms is triaged as routine

   Harm

   Delayed treatment of a serious condition, such as sepsis, a heart attack or a suicidal crisis; at worst, death

   Before controlsAfter controls
   3

   Reduce if you can. Medium likelihood × Major severity.

   2

   Acceptable. Very low likelihood × Major severity.

   Controls that prevent it

   • A banner at the start of the form tells patients to call 999 or 111 for red-flag symptoms
   • Red-flag answers stop the form from going further and direct the patient to 999 or 111
   • The supplier confirms in writing that changing answers after a red-flag warning is logged and flagged
   • Requests sent as “ask the GP a question” go straight to the duty GP, so any symptoms in them are seen quickly

   Mitigations that limit harm

   • Every request that mentions symptoms is reviewed by the duty doctor within two hours in core hours
   • A safety-netting message about red-flag symptoms is shown when the form is sent

   Owner: CSO

2. H2

   A patient whose problem needs an earlier or different assessment waits for a routine appointment

   Cause

   The tool books some requests straight into a routine slot, or sends the patient a booking link, using the patient’s answers to set questions. Nobody reads the free text before the appointment.

   Effect

   Important detail written in the free text, such as weight loss or a new lump, sits unread until the routine appointment

   Harm

   Delayed diagnosis, for example of cancer, and delayed treatment

   Before controlsAfter controls
   3

   Reduce if you can. Medium likelihood × Major severity.

   2

   Acceptable. Very low likelihood × Major severity.

   Controls that prevent it

   • Only admin and clearly routine request types are set to auto-book; anything with symptoms goes to a person first
   • Free text containing set words (for example lump, bleeding, weight loss) is sent to the duty doctor instead of being auto-booked

   Mitigations that limit harm

   • A care navigator reads the free text of every auto-booked request the same working day and escalates anything worrying

   Owner: CSO

3. H3

   A patient’s request is not actioned when it needs to be, while they believe the practice is dealing with it

   Cause

   The form stays open in the evening and at weekends with nobody watching it. On busy days or during leave, nobody owns the queue. A request is assigned to a clinician who has gone home.

   Effect

   A request sits unread for hours or days

   Harm

   Delayed assessment and treatment; the problem may get worse

   Before controlsAfter controls
   3

   Reduce if you can. High likelihood × Considerable severity.

   2

   Acceptable. Low likelihood × Considerable severity.

   Controls that prevent it

   • Symptom requests can only be sent in core hours; outside them, the form directs patients to 111 or 999
   • A named owner for the queue every session, on the rota

   Mitigations that limit harm

   • An end-of-day check that the queue is empty or handed over
   • The first job on a Monday is any request that arrived at the weekend

   Owner: Practice manager

4. H4

   The right patient isn’t assessed, and decisions are made using the wrong patient’s record

   Cause

   A parent or carer submits for someone else using their own details, or the patient’s details don’t match the record

   Effect

   The request is attached to the wrong patient’s record

   Harm

   Missed or delayed care for the patient who needed it; the wrong treatment or advice for the other

   Before controlsAfter controls
   3

   Reduce if you can. Medium likelihood × Considerable severity.

   2

   Acceptable. Low likelihood × Considerable severity.

   Controls that prevent it

   • The form asks who the request is for and collects the patient’s own details
   • Staff check name, date of birth and NHS number before filing

   Mitigations that limit harm

   • Requests made on someone else’s behalf are flagged for a second check before a clinician acts on them

   Owner: Practice manager

5. H5

   A patient who can’t use the form, because of age, disability, language or no internet, is assessed later than they need to be

   Cause

   As more same-day appointments are released through the online form, fewer are left for patients who phone or walk in

   Effect

   Patients who can’t use the form find no appointments left

   Harm

   Delayed care for patients already more likely to come to harm

   Before controlsAfter controls
   3

   Reduce if you can. Medium likelihood × Considerable severity.

   2

   Acceptable. Low likelihood × Considerable severity.

   Controls that prevent it

   • A fixed share of same-day appointments is kept for phone and walk-in requests
   • Reception can fill in the form on a patient’s behalf

   Mitigations that limit harm

   • Access data and complaints by route reviewed at the quarterly clinical governance meeting

   Owner: Practice manager

The CSO signed a three-page clinical safety case report. Oakfield then switched over with an extra duty clinician for the first fortnight, sampled ten requests a week for the first month, and reviewed the hazard log after three months.

AI scribe

An AI scribe transcribes the consultation and drafts the notes. Same method: start from the supplier’s hazard log and add your own. For example:

Asking the patient’s permission matters too, but it’s a data protection and confidentiality question rather than a clinical safety hazard. See the section on telling patients.

NHS England expects practices using AI scribes to have a CSO and complete DCB0160, as well as a DPIA from the information governance side.¹

A calculator built into your clinical system

Calculators inside the clinical system or prescribing software, such as QRISK or creatinine clearance, feel like part of the furniture, but they’re health IT too. The QRISK2 error went unnoticed for years. Two hazards a practice might log:

Sources on this page last checked 3 November 2026.