Ongoing risk of harm linked to electronic patient record systems

The report, published today, is a thematic review of our investigations associated with EPR systems (including those published by our legacy organisation). The review aimed to identify where EPR systems had been considered in reports, the problems associated with them and their impact on patient safety. The review also revisited the safety recommendations and safety observations we have made that relate to EPR systems.

Safety risks

The review highlights that EPR systems can improve patient care and support safety but that there are reoccurring issues with the design and implementation of the systems that can also create safety risks. Common issues include poor usability and interoperability between EPR systems and other software, outdated hardware and infrastructure affecting system performance, and limited resources to support the safe ongoing use of EPR systems.

Our review gives specific examples of where EPR system problems have caused patient harm and had a detrimental impact on safety, on organisational efficiencies and on wider national efforts to digitise healthcare. The safety of patients was put at risk by EPR systems where they created conditions within which a patient did not receive care, their care was delayed, or they received incorrect care including from being misidentified.

In a specific case referenced in the report, a four year old girl received five incorrect doses of blood thinning medication as the prescription was wrongly entered on the electronic prescribing and medicines administration (ePMA) system. The system did not identify the error and this incident contributed to bleeding around her brain.

Common themes

To identify the common themes, we reviewed all of our reports (2018 to 2025) and identified recurring themes that illustrated how specific aspects of EPR systems may have contributed to patient safety issues.

The themes are set out under three headings, with several key findings under each:

• Choosing an EPR system capable of meeting the needs of an organisation – where EPR systems did not have the functions an organisation needed or did not support the user (patients and staff), they had contributed to patient safety incidents.
• Implementing an EPR system that meets the needs of users – variation in governance processes for implementing EPR systems at national, regional and organisation levels meant associated risks to patient safety were not always identified and mitigated.
• Seeking feedback and ongoing EPR system optimisation – staff reported limited routes for raising concerns about poor functionality and usability of EPR systems, and limited action when concerns were reported that could impact on patient safety.

The review underscores the need for further action to strengthen digital safety. It also offers local learning prompts to support provider organisations in identifying and addressing risks associated with procuring, implementing and optimising EPR systems.