Draft for review by a Clinical Safety Officer. Adapt it to your practice before use.
Hazard Log (DCB0160) · Assess stage
Hazard log
Oakfield Surgery (a made-up practice)
This is a spreadsheet. Download the Excel version to use it: the drop-down lists are built in, and the risk scores are worked out for you from the grid.
| ID | Cause | Effect | Hazard | Harm | Likelihood before | Severity before | Risk before | Evidence for the score before | Controls and mitigations | Control owner | Evidence the controls are in place | Likelihood after | Severity after | Risk after | Evidence for the score after | Status | Last reviewed |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| H1, H2... | What could make it happen, usually the technology or how it’s used. Often more than one | What goes wrong with the information first | The situation where a person, usually the patient, could come to harm | What could happen to the patient | From the risk grid | From the risk grid | Worked out for you | Why you chose this likelihood and severity: incidents, supplier data, local experience | Controls that stop the cause leading to the hazard; mitigations that limit harm if it happens. Include supplier controls | Named person or role | How you know: setting checked, training record, audit, test | With controls in place | With controls in place | Worked out for you | Why the controls bring the score down, and by how much | Open or closedOpen / Closed | Date |
| H1 | The patient chooses an admin or "ask a question" route but includes red-flag symptoms. The form’s questions don’t pick up the red flag. The patient goes back and changes answers after a red-flag warning. | A request describing red-flag symptoms is triaged as routine | A patient with red-flag symptoms is not directed to an urgent assessment in time | Delayed treatment of a serious condition, such as sepsis, a heart attack or a suicidal crisis; at worst, death | Medium | Major | 3 | Supplier’s DCB0129 hazard log rates under-triage as its top risk. In a one-week sample of 50 requests, 2 described possible red flags under an admin route. | Controls: A banner at the start of the form tells patients to call 999 or 111 for red-flag symptoms. Red-flag answers stop the form from going further and direct the patient to 999 or 111. The supplier confirms in writing that changing answers after a red-flag warning is logged and flagged. Requests sent as “ask the GP a question” go straight to the duty GP, so any symptoms in them are seen quickly. Mitigations: Every request that mentions symptoms is reviewed by the duty doctor within two hours in core hours. A safety-netting message about red-flag symptoms is shown when the form is sent. | CSO | Form screenshots and test cases on file. Duty doctor rota and audit spreadsheet. | Very low | Major | 2 | Red-flag stop tested with 10 test cases before go-live, all stopped. Duty doctor review times audited monthly: 96% within two hours in the first month. | Open: controls in place | 02/03/2026 |
| H2 | The tool books some requests straight into a routine slot, or sends the patient a booking link, using the patient’s answers to set questions. Nobody reads the free text before the appointment. | Important detail written in the free text, such as weight loss or a new lump, sits unread until the routine appointment | A patient whose problem needs an earlier or different assessment waits for a routine appointment | Delayed diagnosis, for example of cancer, and delayed treatment | Medium | Major | 3 | Audit of 30 auto-booked requests found 3 with free text a GP judged should have been seen sooner. | Controls: Only admin and clearly routine request types are set to auto-book; anything with symptoms goes to a person first. Free text containing set words (for example lump, bleeding, weight loss) is sent to the duty doctor instead of being auto-booked. Mitigations: A care navigator reads the free text of every auto-booked request the same working day and escalates anything worrying. | CSO | Auto-book settings export and keyword list on file. Same-day read recorded in the care navigation log. | Very low | Major | 2 | Repeat audit after the change: 0 of 30. Auto-book settings exported from the tool and checked by the CSO. | Open: controls in place | 02/03/2026 |
| H3 | The form stays open in the evening and at weekends with nobody watching it. On busy days or during leave, nobody owns the queue. A request is assigned to a clinician who has gone home. | A request sits unread for hours or days | A patient’s request is not actioned when it needs to be, while they believe the practice is dealing with it | Delayed assessment and treatment; the problem may get worse | High | Considerable | 3 | Before the change, 15% of requests arrived outside core hours, and 4 in one month waited more than a working day. | Controls: Symptom requests can only be sent in core hours; outside them, the form directs patients to 111 or 999. A named owner for the queue every session, on the rota. Mitigations: An end-of-day check that the queue is empty or handed over. The first job on a Monday is any request that arrived at the weekend. | Practice manager | Supplier settings screenshot. Queue owner rota. End-of-day check log. | Low | Considerable | 2 | Form hours confirmed in the supplier settings. End-of-day checks signed off on the care navigation log, audited monthly. | Open: controls in place | 02/03/2026 |
| H4 | A parent or carer submits for someone else using their own details, or the patient’s details don’t match the record | The request is attached to the wrong patient’s record | The right patient isn’t assessed, and decisions are made using the wrong patient’s record | Missed or delayed care for the patient who needed it; the wrong treatment or advice for the other | Medium | Considerable | 3 | Supplier’s hazard log lists patient-matching errors. Two near misses in the first month, both requests from parents. | Controls: The form asks who the request is for and collects the patient’s own details. Staff check name, date of birth and NHS number before filing. Mitigations: Requests made on someone else’s behalf are flagged for a second check before a clinician acts on them. | Practice manager | Care navigation protocol v2. Training record. Incident log. | Low | Considerable | 2 | Filing check added to the care navigation protocol; all care navigators trained. No further near misses in three months. | Open: controls in place | 02/03/2026 |
| H5 | As more same-day appointments are released through the online form, fewer are left for patients who phone or walk in | Patients who can’t use the form find no appointments left | A patient who can’t use the form, because of age, disability, language or no internet, is assessed later than they need to be | Delayed care for patients already more likely to come to harm | Medium | Considerable | 3 | In the first fortnight, all same-day appointments had gone by 9:30 on four days, mostly to online requests. | Controls: A fixed share of same-day appointments is kept for phone and walk-in requests. Reception can fill in the form on a patient’s behalf. Mitigations: Access data and complaints by route reviewed at the quarterly clinical governance meeting. | Practice manager | Appointment template. Clinical governance minutes. | Low | Considerable | 2 | Appointment template shows the reserved slots. Quarterly review minuted at clinical governance. | Open: controls in place | 02/03/2026 |
The risk grid
| Likelihood ↓ / Severity → | Minor | Significant | Considerable | Major | Catastrophic |
|---|---|---|---|---|---|
| Very high | 3 | 4 | 4 | 5 | 5 |
| High | 2 | 3 | 3 | 4 | 5 |
| Medium | 2 | 2 | 3 | 3 | 4 |
| Low | 1 | 2 | 2 | 3 | 4 |
| Very low | 1 | 1 | 2 | 2 | 3 |
1 to 2: acceptable. 3: reduce if you reasonably can. 4: must reduce before go-live. 5: unacceptable.