HSSIB Investigation Report: Patient safety issues associated with electronic patient record (EPR) systems – a thematic review (27 November 2025)

Summary

This report is a thematic review of investigation reports by HSSIB and its predecessor organisation – the Healthcare Safety Investigation Branch (HSIB) – that included consideration of electronic patient record (EPR) systems. Its intention is to identify themes arising from these investigations and to share any additional safety learning.

You can read Patient Safety Learning's response to this report here.

Content

Key findings

Choosing an EPR system capable of meeting the needs of an organisation

• Where EPR systems did not have the functions an organisation needed or did not support the user (patients and staff), they had contributed to patient safety incidents.
• There were inconsistencies in the terms used in the design of health IT systems and their functions, such as usability and functionality, and limited guidance to support understanding of these concepts in EPR system design.
• Organisations did not always have a clear understanding of their requirements/needs for an EPR system, limiting their ability to match requirements to system capabilities (the things a system can do).
• When procuring EPR systems, organisations sometimes faced challenges understanding system capabilities and whether they met required national standards, such as for interoperability (the ability to work with other IT systems) and clinical risk management.
• National and regional support for organisations to identify their local requirements/needs to inform EPR system procurement was limited.
• Some EPR system procurement decisions were perceived by staff to be influenced by factors other than system capabilities, such as cost savings.

Implementing an EPR system that meets the needs of users

• Variation in governance processes for implementing EPR systems at national, regional and organisation levels meant associated risks to patient safety were not always identified and mitigated.
• Implementation of an EPR system was found to be a complex project that did not always effectively engage users to ensure it was safe and successful.
• Local configuration of EPR systems had the potential to introduce new risks to patient safety, with investigations identifying where this had occurred without the organisation recognising and mitigating against these risks.
• Factors contributing to an organisation’s ability to locally configure EPR systems included the capacity and capability of digital teams, the level of involvement of users in testing, support from manufacturers, and awareness and application of digital standards for clinical risk management.
• When users were involved in EPR system implementation they were not always representative of those using the system in practice, with difficulties faced releasing staff from clinical work to contribute to implementation.
• Several organisations faced challenges relating to the availability of working hardware and Wi-Fi connectivity to support the use of EPR systems in different clinical environments.
• Staff training in how to use an EPR system was often perceived to be limited. It did not always reflect how a system would be used in the ‘real world’, nor what to do if the EPR system failed.

Seeking feedback and ongoing EPR system optimisation

• Staff reported limited routes for raising concerns about poor functionality and usability of EPR systems, and limited action when concerns were reported that could impact on patient safety.
• Ongoing management of EPR systems, including upgrades and changes, did not always align with the digital standards for clinical risk management.
• EPR systems were not always kept up to date in line with national guidance and standards, or to reflect changes to internal care processes.
• Factors contributing to limited ongoing optimisation of EPR systems after initial implementation included the need to manage a range of local digital priorities, limited collaboration between digital and clinical teams, cost of upgrades, and limited resourcing for ongoing work and infrastructure.
• There were limited opportunities for organisations to share their experiences of implementing and optimising EPR systems for the benefit of other organisations.