Electronic patient record systems – risk from loss of functionality

We have launched an investigation that explores risks to patient safety where access to, the use of, or functionality of electronic patient record (EPR) systems has been lost. That loss may be short- or long-term, and be planned or unplanned.

We have also launched an investigation to examine the risks associated with electronic referrals for ongoing care.

An EPR system is software used to collect, store, access and manage clinical information about an individual patient, in an individual organisation. An EPR system may consist of several components including management of a patient’s records, ordering of medicines and tests, and to review results. A single piece of software may provide one, some, or all of these components.

In November 2025 we published a thematic review of Healthcare Safety Investigation Branch and HSSIB investigation reports. Through that review, we identified that healthcare provider management of the implementation (procurement, configuration, integration and optimisation) of EPR systems created risks to patient safety and had contributed to incidents. Where loss of functionality of EPR systems had occurred, these included planned loss for system upgrades and unplanned loss from incidents such as cyberattack.

Informed by the findings of the thematic review, we reviewed evidence sources and engaged with stakeholders to identify where HSSIB might support improvements in patient safety. Stakeholders included national bodies involved in digitisation of the NHS in England, charities and those representing the patient and public voice.

This investigation will consider incidents where EPR systems have had a period of loss of functionality that has required recognition and response. The investigation will examine how organisations, as part of their implementation of an EPR system:

• Prepare for a loss of functionality as part of their business continuity.
• Monitor for and respond to loss of functionality events.
• Ensure staff are aware of and prepared to respond to periods of loss of functionality.
• Learn from events to develop EPR system and organisational resilience.

It is intended that the investigation will examine incidents across several settings, producing a report that summarises learning. The investigation will launch in January 2026 with the report anticipated to be published in spring 2027.

We are keen to hear from anybody with an interest in this subject matter. This includes patients, families, carers and health and care professionals who may wish to share their experience. If you would like to speak to us about these investigations before we publish the reports, please email investigations@hssib.org.uk.