Implementing an EPR in the middle of a crisis: what I learned about safety, leadership and organisational readiness

Summary

In this blog, Darren Kilroy shares the challenges he experienced of moving a Trust to a new electronic patient record (EPR) system. He shares the safety issues that this change brought, what he learnt from the experience and suggestions of actions to address the identified safety risks.

Content

Major digital change in healthcare is often described as transformation. That word can sound positive, even exciting. But when the change involves an EPR, a fragile operational context and real concern about patients being lost in the system, the reality feels very different. In those moments, digital transformation is not just a technology project—it is a patient safety challenge.

I learned this directly during my time as Executive Medical Director at the Countess of Chester Hospital when I became the Senior Responsible Officer (SRO) for an EPR implementation that was already in process before I took up the role. The Trust was moving between two different software providers as a ‘fast follower' of a neighbouring organisation. Fast followers are NHS trusts partnered with Global Digital Exemplars to accelerate their adoption of advanced digital technologies and best practices. However, the assumptions made behind that plan quickly unravelled under operational, technical and safety pressures.

 The context could hardly have been more difficult. We were dealing with the Covid-19 pandemic, a clinically vulnerable population, tight timelines and the reality that the existing system was reaching the end of its supported life. We had to move to a new EPR, but moving safely was far more complex than the business case had suggested.

Safety risk sat at the centre

What stays with me most is not the technical detail but the weight of the safety risk. As the work progressed, concerns about data quality, data migration, waiting list accuracy and the possibility of patients being lost to follow-up became impossible to ignore.

This was not an abstract risk. Clinical colleagues were deeply worried about the prospect of harm to patients if the implementation went wrong, and some came to me in tears because they were so anxious about what might happen. That should cause us to pause. When experienced clinicians feel that level of psychological distress, we are not looking at a routine implementation problem; we are seeing a warning sign about system safety and organisational readiness.

Too often, EPR programmes are framed as technical delivery exercises with safety considered as one workstream among many. My experience was the opposite: safety should be the foundational principle. If boards and executives are not asking first how patients could be harmed during this implementation, then they are asking the wrong questions.

Leadership without preparation is not enough

I had significant leadership experience, but I had received no formal preparation to act as SRO for a programme of this scale or nature. Like many people in healthcare leadership roles, I was expected to learn in real time.

That is not a criticism of individuals. It is a criticism of the system that places healthcare executives into highly consequential digital leadership and safety roles without enough structured training, peer support or practical guidance. Looking back, one of the most important gaps was the lack of a formal support offer from the Centre for SROs and clinical leaders taking responsibility for major EPR change.

We should not accept this as normal. If organisations are expected to lead complex digital implementations safely, then their leaders need access to proper development, expert safety advice and networks of peers who have already navigated similar challenges. Patient safety depends on this, not as a nice-to-have but as a core condition of delivery.

Readiness is more than procurement

Another lesson was that organisational readiness cannot be reduced to contract signature, go-live dates and software configuration. We discovered that the ‘fast follower’ model did not straightforwardly fit our needs because the system for the neighbouring trust had been significantly customised for them. This meant a more standard version was required, with additional implications for infrastructure, software modules, timings and cost.

At the same time, data quality problems emerged at scale. As pathways were reviewed and records examined, issues surfaced around duplication, outdated information and uncertainty about the accuracy of waiting list positions. None of this is unusual in healthcare, but that is exactly the point: if these issues are common, they should be expected, planned for and properly resourced from the outset.

Readiness also includes training, operational resilience and visible clinical assurance. We had floorwalkers (which was in itself challenging during pandemic lockdowns), but in practice they were not sufficiently equipped to support frontline teams in the way the organisation needed. That matters because this type of support at the point of care can be the difference between a difficult implementation and an unsafe one.

Boards need clearer sight of digital safety

One of the strongest reflections I have is that boards need much better visibility of the safety case for digital change. In my role, I felt professionally exposed because I knew that my fundamental responsibility was to assure the board on patient safety. Yet the complexity of the risk, the uncertainty in the data and the pace of decision making made that assurance extremely hard to give with confidence.

Boards should expect to see a robust clinical safety case, explicit risk assessment, honest reporting on data quality, and clear evidence of mitigation for high-risk pathways before go-live decisions are made. Boards should also expect to understand the human impact on staff, because distress, uncertainty and cognitive overload are themselves safety issues in major change.

This is where patient safety thinking must become much more central to digital strategy. We need to stop treating digital implementation as if success is mainly about time, budget and deployment milestones. Success must include whether patients remained safe, whether staff were supported to identify emerging risks, how the hospital was able to continue delivering services to patients so that the waiting list didn’t become even longer putting more people at risk, and whether the organisation was able to learn and adapt quickly when assumptions proved wrong.

What needs to happen next

There are some practical changes that would make a real difference:

• National bodies should ensure there is structured preparation and support for SROs, medical directors and other senior leaders responsible for EPR implementation (and optimisation).
• EPR programmes should begin with a stronger and more explicit patient safety framework, including clinical safety expertise from the start rather than later in the process.
• Boards should require fuller assurance on data quality, pathway risk, training adequacy and contingency planning before agreeing key milestones. Board member training around these topics may be required first.
• Organisations should treat staff anxiety and frontline concern as valuable intelligence about safety risk, not as resistance to change.
• Digital transformation programmes should be evaluated not just on implementation metrics but on their impact on patient safety, equity and continuity of care.

Digital change in healthcare is unavoidable. Systems will continue to be replaced, upgraded and reconfigured. But if we want safer care, we need to be honest that an EPR implementation is never just an IT project. It is a live test of leadership, culture, preparedness and the extent to which an organisation truly puts patient safety first.

Related reading

• NHS England » Global Digital Exemplars
• Electronic patient record systems: Putting patient safety at the heart of implementation (Patient Safety Learning, 31 July 2024)
• Patient safety issues associated with electronic patient record systems – a thematic review (Health Services Safety Investigations Body, 27 November 2025)
• Electronic patient record systems in England: what do NHS staff think? (The Health Foundation, 24 March 2026)

About the author

Dr Darren Kilroy is Chief Medical Officer at RLDatix.