Never Event category

Wrong site surgery; wrong site block 

Description of existing control

Administrative and behavioural control:

• NatSSIPs
• National campaign, ‘Stop before you block’

What are these incidents?

Nerve blocks are a type of regional analgesia in which local anaesthetic is injected near a specific nerve or bundle of nerves to block the sensation of pain. If nerve blocks are injected at the wrong site, they will not provide the necessary pain relief for surgery to continue, delaying the surgical procedure and requiring the patient to have another anaesthetic injection.

How are the controls supposed to work?

The WHO surgical safety checklist included in NatSSIPs2 mandates a stop at ‘sign-in’ where consent and surgical site marking are confirmed. However, evidence shows there is often a delay after this stop and before nerve block injection, which can negate the previous checking process control.

The ‘stop before you block’ campaign was launched in 2011 to mitigate this delay risk, with a toolkit to address the gaps in existing behavioural controls. The initiative introduced a stop moment before inserting the block needle in which the anaesthetist and the assistant must double check the surgical site marking and the site/side of the block.

Why do these incidents occur? Feedback from focus group and literature reviews on control effectiveness

An extensive review by HSIB (2018a) revealed this had limited impact due to local variation, and recommended that the guidance should be reviewed. A revised national campaign ‘Prep, Stop, Block’ was launched in 2022. The new guidance introduced an additional physical step: the equipment for the procedure should be handed to the anaesthetist at the ‘stop’ moment. This is a further behavioural control.

The focus group agreed that the most important check was immediately before the block was administered, but this is not consistently carried out. There are also issues with the block site not being near the surgical site and distractions interfering with the checking process. 

Future controls

None

Never Event category

Wrong site surgery; wrong eye injections

Description of existing control

Administrative and behavioural control:

• NatSSIPs

What are these incidents?

Intravitreal injections are used to administer medications to treat retinal conditions. Incidents have occurred where the wrong eye was injected. 

How are the controls supposed to work?

The WHO surgical safety checklist included in NatSSIPs2 mandates a stop at ‘sign-in’ where consent and surgical site marking are confirmed. This is a ‘people-focused’ barrier (administrative and behavioural control) – checklists, prompts and training requirements for staff to change their behaviour to mitigate the risk of the event occurring.

Why do these incidents occur? Feedback from focus group and literature reviews on control effectiveness

The focus group noted that while the WHO surgical safety checklist and the NatSSIPs variations mandated the use of checklists and prompts to mitigate the risk of wrong eye injections, incidents continued to occur. Variations in practice were highlighted with regards to site marking, particularly in an outpatient environment where there may be a reluctance to mark the face for cosmetic reasons; these marks take time to fade. Other contributory factors included lone working, distractions, and time pressures with quick turnover lists, pooled lists and undertaking lists in clinics that are not as familiar with the procedures.

While NatSSIPs2 has clarified and strengthened the guidance around consent, procedural verification and site marking, it remains an administrative and behavioural control.

Future controls

None

Never Event category

Wrong site surgery; wrong skin lesions

Description of existing control

Administrative and behavioural control:

• NatSSIPs

What are these incidents?

Excision (biopsy) of skin lesions is a relatively straightforward procedure done under a local anaesthetic. Incidents have occurred of the wrong skin lesion being excised.

How are the controls supposed to work?

The WHO surgical safety checklist included in NatSSIPs mandates a stop at ‘sign-in’ where consent and surgical site marking are confirmed. This is a ‘people-focused’ control (administrative and behavioural control) – checklists, prompts and training requirements for staff to change their behaviour to mitigate the risk of the event occurring.

Why do these incidents occur? Feedback from focus group and literature reviews on control effectiveness

Evidence shows the checklist is not used routinely for skin lesions, particularly in environments outside theatre, such as outpatients or primary care, or where there is a lone practitioner. The focus group highlighted time pressures as a consistent contributing factor in the removal of the wrong skin lesion; clinicians with quick turnover/pooled lists are often not familiar with the patient or the correct lesion to be removed/biopsied.

The presence of multiple lesions, especially those on the patient’s back and out of sight, can make verification of the site more complex as it is more difficult for the patient to verify the lesion to be removed

The focus group felt the barriers were neither strong nor systemic.

While NatSSIPs2 has clarified and strengthened the guidance around consent, procedural verification and site marking, it remains an administrative and behavioural control.

Future controls

The routine use of photographs to verify skin lesions that may not be visible with the patient could strengthen this administrative and behavioural control.

Never Event category

Wrong site surgery; wrong side spinal injections

Description of existing control

Administrative and behavioural control:

• NatSSIPs

What are these incidents?

Therapeutic epidural spinal injections involve injecting an anaesthetic and/or an anti-inflammatory medication, such as a steroid (cortisone), near the affected nerve. They are usually done under imaging so generally not in a clinic/primary care environment. Incidents of the wrong side being injected have occurred.

How are the controls supposed to work?

The WHO surgical safety checklist included in NatSSIPs2 mandates a stop at ‘sign-in’ where consent and surgical site marking are confirmed. This is a ‘people-focused’ control (administrative and behavioural control) – checklists, prompts and training requirements for staff to change their behaviour to mitigate the risk of the event occurring.

Why do these incidents occur? Feedback from focus group and literature reviews on control effectiveness

The focus group highlighted that quick, high turnover lists do not always allow adequate time for the patient consent and site marking process.

Evidence shows these types of procedures are often done in busy sessions with the patient’s consent obtained in and site marking done in the procedure room, which is not recommended good practice. Due to time constraints and lack of private areas outside the procedure room, the operating clinician often does not have the time to discuss the procedure with the patient away from the clinical area.

While NatSSIPs2 has clarified and strengthened the guidance around consent, procedural verification and site-marking, it remains an administrative and behavioural control.

Future controls

None

Never Event category

Wrong implant/prosthesis; wrong hip and knee prosthesis

Description of existing control

Administrative and behavioural control:

• NatSSIPs (new step added: safe use of implants in NatSSIPs2)
• National Joint Registry database, mandated through the NHS Standard Contract

What are these incidents?

An implant is an item intended to remain within the patient’s body long term. The term prosthesis is sometimes used, but this usually implies a replacement part. Orthopaedic joint replacement surgery involves combinations of components and processes for selecting and verifying the correct prostheses that are fundamentally different to those for other surgical procedures in which prostheses are involved, such as eye lens replacement. Most reported Never Events involving orthopaedic prostheses relate to hip and knees (HSIB, 2018), which are by far the most common joint replacement operations. Orthopaedic implants are rarely selected before the procedure and measurements are taken perioperatively to identify the size required; this involves a complex checking process.

How are the controls supposed to work?

NatSSIPs included a standard relating to prosthesis verification and detailed the expected checks by a theatre team. This is a people-focused barrier – a checklist and reminders to staff to mitigate the risk of mis-selection of implants.

Why do these incidents occur? Feedback from focus group and literature reviews on control effectiveness

The control had limited impact on the number of wrong implants reported, leading HSIB (2018b) to investigate the implantation of wrong prostheses during joint replacement surgery. Its report highlighted a number of issues, in particular variation in the quality of the implant verification processes across organisations, inadequate labelling standards for prosthesis verification, and differences in the automated message from the National Joint Registry (NJR) database when a potential error was identified.

Following this, the NJR amended the alert wording to identify use of incompatible components. However, there is no national guidance about when information is uploaded to the NJR and this is not always done live, so errors may only be identified after implantation.

The focus groups noted that the checking process at the point of prosthesis selection is complex, and that the current barriers are not ‘system focused’; instead they rely on people changing their behaviour through checklists and reminders.

NatSSIPs2 includes more specific guidance to minimise inappropriate variation in practice, and a categorisation of standards dependent on: the timing of the implant decision; known implant; restricted/evolving decision/choice; unplanned or unexpected implant insertion. Despite this, it remains a ‘people-focused’ control.

Future controls

Using barcode scanning for inventory management and scanning at the point of care can reduce the risk of wrong implants. Work is ongoing to develop guidance to support organisations to stand up programmes that support this type of end-to-end scanning (eg Scan4Safety).

Always using NJR live at the time of the procedure would provide a more effective barrier than retrospective data input.

Never Event category

Wrong implant/prothesis; insertion of incorrect intraocular lens

Description of existing control

Administrative and behavioural control:

• NatSSIPs

What are these incidents?

Cataract removal and implantation of an artificial lens is the most common NHS surgical procedure. Insertion of an incorrect intraocular lens was the most commonly reported Never Event in England between April 2016 and March 2017, leading to a HSIB report (HSIB, 2018c).

How are the controls supposed to work?

NatSSIPs is a ‘people-focused’ control (administrative and behavioural control) – checklists, prompts and training requirements for staff to change their behaviour to mitigate the risk of the event occurring.

Why do these incidents occur? Feedback from focus group and literature reviews on control effectiveness

The HSIB report identified significant variation in organisations’ processes at each stage of the patient pathway for cataract surgery, and particularly in how the WHO surgical safety checklist included in NatSSIPs2 was applied.

Intraocular lenses are often selected before the procedure using biometry measurements taken beforehand. With this, only the lens required for the procedure should be available in the procedure room. However, issues around wrong selection of the lens, changes of list order and time pressures in often quick, high turnover lists can lead to the wrong lens being implanted.

The focus group felt the controls were not strong enough as they depend on human behaviour and do not take account of the complexity of the pathway and distractions in pressurised procedure rooms with high turnover lists. There is also inconsistency in the use of paper and electronic records, especially to record biometry measurements.

Future controls

Using barcode scanning for inventory management and scanning at the point of care can reduce the risk of wrong implants. Work is ongoing to develop guidance to support organisations to stand up programmes that support this type of end-to-end scanning (eg Scan4Safety).

Never Event category

Wrong implant; intrauterine contraceptive devices (IUCDs)

Description of existing control

Administrative and behavioural control:

• NatSSIPs

What are these incidents?

Intrauterine devices (IUD), also known as intrauterine contraceptive devices (IUCD), are implanted in the uterus to prevent pregnancy. Copper IUDs and hormonal IUDs (Mirena) are available and incidents have occurred of the wrong IUD being implanted.

How are the controls supposed to work?

Confirmation of the IUD should be included in Sign In, part of NatSSIPs. NatSSIPs is a ‘people-focused’ control (administrative and behavioural control) – checklists, prompts and training requirements for staff to change their behaviour to mitigate the risk of the event occurring.

Why do these incidents occur? Feedback from focus group and literature reviews on control effectiveness

The focus group felt the controls were not strong as they depend on human behaviour and do not take account of the pressures and distractions of the environment that impact on a ‘people-focused’ barrier. For example, most of these procedures are undertaken in GP practices and clinics (including family planning clinics) by lone practitioners, with the type of IUD often selected at the time of the consultation with the patient and no opportunity for checking processes with other team members.

Future controls

Using barcode scanning for inventory management and scanning at the point of care can reduce the risk of wrong implants. Work is ongoing to develop guidance to support organisations to stand up programmes that support this type of end-to-end scanning (eg Scan4Safety).

Never Event category

Wrong implant; stents

Description of existing control:

Administrative and behavioural control:

• NatSSIPs

What are these incidents?

A stent is a small mesh tube typically used to hold open passages in the body, such as weak or narrowed arteries. Stents are often used to treat narrowed coronary arteries that provide the heart with oxygen-rich blood.

Stents can be used in an emergency situation where the size/type is chosen at the time, or pre-selected for an elective procedure.

How are the controls supposed to work?

For a pre-planned procedure, confirmation of the stent should be included in Sign In, part of NatSSIPs. For emergency procedures, confirmation of the stent is done during the procedure. NatSSIPs is a ‘people-focused’ control (administrative and behavioural control) – checklists, prompts and training requirements for staff to change their behaviour to mitigate the risk of the event occurring.

Why do these incidents occur? Feedback from focus group and literature reviews on control effectiveness

The focus group felt the controls were not strong as they depend on human behaviour and do not take account of the pressures and distractions of the environment that impact on a ‘people-focused’ barrier. For both pre-planned and emergency procedures, the checking process relies on a two-person check that could not be considered a strong control.

Future controls:

Using barcode scanning for inventory management and scanning at the point of care can reduce the risk of wrong stents. Work is ongoing to develop guidance to support organisations to stand up programmes that support this type of end-to-end scanning (eg Scan4Safety).

Never Event category

Retained foreign object; retained surgical swabs, vaginal swabs, needles and parts of instrumentation

Description of existing control

Administrative and behavioural control:

• NatSSIPs

What are these incidents?

‘Foreign object’ includes any items subject to a formal counting/checking process at the start of the procedure and before its completion (eg swabs, needles, instruments and guidewires) except where items have not been subject to the formal counting/checking process, or the items are intentionally retained.

Surgical swabs, surgical needles and instrumentation are routinely used during surgery. Where on rare occasions they are left by mistake in the patient’s body, they can be a source of infection.

In maternity, vaginal swabs and surgical tampons are used to absorb bodily fluids in several procedures undertaken in delivery suits and surgical theatres on maternity wards. They should be removed at the end of a procedure.

How are the controls supposed to work?

NatSSIPs2 includes new guidance on ‘reconciliation of items in prevention of foreign objects’. The focus group review and HSIB report (2019c) considered this new guidance remains a ‘people-focused’ barrier reliant on checklists, reminders and staff training. 

Mitigations to date have primarily been people focused; for example, attempts to standardise the counting process and removing distractions:

• two trained staff should perform the count and at least one should be registered; any unregistered staff should be assessed as competent 
• prompt on standardised surgical safety checklist as memory aid
• a count board must be used, with standard notation and documentation.

However, redesign and engineering solutions have been explored. For example:

• all packs and swabs used in invasive procedure fields must contain a radio-opaque strip

Why do these incidents occur? Feedback from focus group and literature reviews on control effectiveness

The focus groups discussed the common contributing factors highlighted from incidents, including variation in the quality of the counting and checking processes, volume and complexity of equipment; changes to team members and handovers; time pressures during the procedures; distractions in the procedure environment; and movement from one area to another, eg in maternity from a delivery room to an operating theatre.

Future controls

Work is ongoing to explore the use of radio-frequency identification (RFID) technology and the practicalities of designing swabs with clips or non-absorbent tails.

Never Event category

Retained foreign object; retained guidewire

Description of existing control

Administrative and behavioural control:

• NatSSIPs

What are these incidents?

A guidewire is a wire or spring used to guide the placement of a larger device, eg central line or chest drain. Guidewires vary in design and length, which affects how easy they are to handle, and they can be unintentionally left behind after the procedure (1 in every 300,000 procedures) and require urgent removal as they can move into the circulatory system. Retained guidewires are one of the most common Never Events in the UK.

How are the controls supposed to work?

NatSSIPs is a ‘people-focused’ control (administrative and behavioural control) – checklists, prompts and training requirements for staff to change their behaviour to mitigate the risk of the event occurring.

Why do these incidents occur? Feedback from focus group and literature reviews on control effectiveness

The focus groups highlighted the different environments where procedures involving guidewires take place, acknowledging that they are often used in procedures undertaken by lone practitioners and in pressured environments, eg emergency department, radiology. It may not be possible for NatSSIPs to be consistently applied and followed in pressured environments that do not routinely follow checking processes, eg ITU, emergency departments and wards. 

The focus group also highlighted the variation in the design of guidewires. Longer wires are harder to leave in situ but more difficult to handle than short wires and this increases the risk of perforation. There are currently no industry standards on guidewire length and it is left to manufacturers to decide this.

While NatSSIPs2 includes guidance on ‘reconciliation of items in prevention of foreign objects’, it remains an administrative and behavioural control.

Future controls

The focus group discussed the potential merit of standardising the use of longer wires, where the risk of perforation could be mitigated with specific markers along the length of the guidewire to show how far it has been inserted. This standardisation could increase familiarity with the equipment.

Engineered solutions, eg WireSafe®. WireSafe® is designed to prevent retention of guidewires used during central venous catheter (CVC) insertion. WireSafe® has a locking mechanism and contains the equipment required to complete the procedure after the guidewire has been removed: the stitch, needle holder, dressings. It is all but impossible for the clinician to access the equipment without using the guidewire to unlock the box. This forcing function, at the crucial point in the procedure, ensures that the clinician cannot continue with the procedure without first removing the guidewire.

It is not yet clear if WireSafe® can or should be mandated for use but it is a potential redesign and engineering control for this type of event.

Never Event category

Mis-selection of a strong potassium solution

A patient is intravenously given a strong potassium solution rather than the intended medication.

Description of existing control

Potassium solutions removed from all areas except ITU (elimination):

• Within ITU settings, potassium solution is regarded as a controlled drug with standardised process (that is, locked cupboard, signature required, not transferred between clinical areas) (redesign and engineering controls).

What are these incidents?

Potassium chloride concentrate solution is widely used and administered intravenously in diluted solutions to treat low potassium levels (hypokalaemia) in more seriously ill patients. However, it can be fatal if given inappropriately.

How are the controls supposed to work?

Potassium chloride concentrate ampoules can look very similar to those for sodium chloride, water for injection and other injectable medicines. Reports from the USA, Canada and UK identified incidents where potassium chloride concentrate was accidentally administered to patients with fatal results. A common cause of such incidents was a member of staff mistaking potassium chloride concentrate solution for sodium chloride (normal saline) solution when reconstituting a drug for injection and thereby administering an overdose of potassium.

In 2002, a National Patient Safety Alert was issued, requiring providers to remove potassium chloride concentrate and other strong potassium solutions from routine stock in wards and clinical departments. Potassium chloride concentrate should be restricted to pharmacy departments and those critical care areas where it is needed for urgent use. Within these restricted areas, it should be treated as a controlled drug and the redesigned restrictive pathways for all controlled drugs followed (that is, locked cupboard, transfer restrictions, sign-out process).

This acts as a strong barrier, eliminating the risk in most clinical areas through the removal of potassium chloride concentrate; and introducing redesign barriers in restricted areas via controlled drugs procedures.

Why do these incidents occur? Feedback from focus group and literature reviews on control effectiveness

The very low number of these types of Never Events suggests that the current controls are effective.

Future controls

None identified.

Never Event category

Administration of medication by the wrong route; intravenous chemotherapy by the intrathecal route

Description of existing control

Redesign and engineering control.

Intrathecal (spinal) chemotherapy is supplied by pharmacy in a ready to administer syringe with a connector that only permits the chemotherapy to be administered intrathecally.

This prevents the accidental intrathecal administration of chemotherapy intended for the intravenous (IV) route. The risk has been ‘designed out’.

What are these incidents?

Intrathecal administration is the injection of a drug into the spinal canal or subarachnoid space so that it reaches the cerebrospinal fluid (CSF). It is used for spinal anaesthesia, chemotherapy and or pain management. IV administration means ‘into the vein’. Deaths and severe harms have occurred in the NHS and worldwide from the wrong route administration of IV chemotherapy by the intrathecal route.

How are the controls supposed to work?

The former National Patient Safety Agency (NPSA) issued two alerts (2009, 2011) recommending the use of new connectors that cannot connect with IV Luer or infusion device connectors, for intrathecal, epidural and regional clinical procedures, when suitable devices became available.

This barrier is further strengthened by the drug being made up and transferred into the correct syringe in a pharmacy setting, which is a controlled environment away from busy wards.

Why do these incidents occur? Feedback from focus group and literature reviews on control effectiveness

No incidents have been reported in England since 2001 suggesting that the current controls are effective. Deaths continue to be reported in Europe and worldwide.

Future controls

None.

Never Event category

Administration of medication by the wrong route; oral/enteral medication or feed/flush by any parenteral route

Description of existing control

ENFit enteral syringes (usually purple) have connectors that prevent medication or feed/flush being administered via any parenteral route.

This is a sequential process:

Step 1: Administrative and behavioural control – reminders/ guidance to select the correct syringe

Step 2: Redesign and engineering control – physical barrier

What are these incidents?

Enteral routes of administration are those into the gastrointestinal tract (usually by mouth, sublingually or via an enteral feeding tube). The parenteral route is any route that is not enteral, but generally refers to administration by injection.

Unintentional administration of oral/enteral medication or feed by the wrong route can lead to serious harm.

How are the controls supposed to work?

ENFit (usually purple) syringes have been designed with specific ENFit connectors to prevent medication being administered via any parenteral route. These syringes therefore constitute a design control; however, the preceding step to ensure medication for enteral administration is only drawn up into ENFit syringes is not a robust control as it relies on human behaviour. The controls therefore differ from those to prevent IV chemotherapy being administered by the intrathecal route, as the medicine is not made up in pharmacy with the connector barrier added at this point. The ENFit connector syringe needs to be selected in the ward or clinical environment, which increases the risk of staff selecting the wrong syringe and administering medicine by the wrong route.

Step 1 requires the enteral medication to be drawn up into the ENFit syringe. At this point there is no nationally supported redesign control to ensure only an ENFit syringe is used, and this relies on behavioural controls such as visual prompts and staff education.

An ENFit bung or stopper can be inserted into the oral medication bottles to provide a redesign barrier at Step 1; the medication can then only be drawn up into an ENFit syringe. This is not nationally mandated practice however, as adding a bung to all oral medication bottles would be resource intensive for clinical teams.

Step 2, once the enteral medication is in an ENFit syringe, is a redesign control as the connector prohibits connection to administer via any parenteral route.  

Why do these incidents occur? Feedback from focus group and literature reviews on control effectiveness

The focus group highlighted reasons for staff selecting the wrong syringe to draw up medication intended for enteral administration, including inadequate availability of ENFit syringes, and storage of oral and IV syringes next to each other.

They felt that despite the existence of a system-based control at Step 2, the Step 1 process was not robust enough to make this a strong, systemic barrier overall.

Future controls

Most reported Never Events relate to morphine. The use of an ENFit stopper or bung on oral morphine bottles could be explored and if mandated would represent a redesign control for delivery of this specific drug.

Never Event category

Overdose of insulin due to abbreviations in an electronic prescribing system

A patient is given a 10-fold or greater overdose of insulin because the words ‘unit’ or ‘international units’ are abbreviated; using an electronic prescribing system, such an overdose was given in a care setting.

Description of existing control

Redesign and engineering control.

Electronic prescribing should have designed-in controls to mitigate the risk of overdose due to abbreviations.

What are these incidents?

For people with diabetes, balancing insulin needs with food, exercise and weight management is challenging, and relies on regular assessment of blood sugar needs.

This Never Event refers only to cases where an insulin overdose results from abbreviation of the words ‘unit’ or ‘international unit’ on the prescription, leading to confusion about the correct dose of insulin to be given.

A large insulin overdose can cause severe hypoglycaemia and this can be fatal.

How are the controls supposed to work?

Electronic prescribing, dispensing and administration systems are an evidence-based method to reduce patient harm from medicines. This is a system-focused control. Electronic systems should have built-in restrictions to prevent prescribers using abbreviations.

Why do these incidents occur? Feedback from focus group and literature reviews on control effectiveness

The focus group felt that without an electronic prescribing system the controls were not strong enough. For example, even though most acute hospitals use a pre-printed insulin prescription to try and prevent prescribers using the abbreviations ‘iu’ or ‘u’, this is not the case in all care settings. Also, pre-printed prescriptions on their own are not a reliably strong enough barrier to prevent a potential 10-fold dosing error as prescribers can still prescribe insulin on general prescriptions.

Future controls

All NHS trusts adopt electronic prescribing.

Never Event category

Overdose of insulin due to withdrawing insulin from an insulin pen

A healthcare professional withdraws insulin from an insulin pen and then administers this using a syringe and needle.

Description of existing control

Redesign and engineering control.

Safer insulin pens, pre-filled to ensure correct dosage.

What are these incidents?

For people with diabetes, balancing insulin needs with food, exercise and weight management is challenging, and relies on regular assessment of blood sugar needs.

This Never Event refers only to cases where an insulin overdose results from a healthcare professional withdrawing insulin from an insulin pen and then administering this to a patient using a syringe and needle.

A large insulin overdose can cause severe hypoglycaemia and this can be fatal.

How are the controls supposed to work?

Pre-filled insulin pens have been designed to allow more accurate and convenient administration of insulin and mitigate the risk of overdose. Use of these pens is particularly important for high-dose insulin (x5 strength), as they have in-built safety features. However, incidents have continued to occur and a HSIB report (HSIB, 2022) looked into the factors impacting the safe administration of high-strength insulin.

Why do these incidents occur? Feedback from focus group and literature reviews on control effectiveness

The insulin pen is a system-based control that designs out the risk of inadvertent overdose. Withdrawing insulin from the pen negates the safety measure.

The HSIB report noted that while the risk and the safety measures to mitigate it (that is, ensuring that high-strength insulin is only supplied in a pre-filled pen device, and that such insulin is only administered using that device) were well known, for these measures to be effective “staff caring for people on high-dose insulin must: (1) be aware that high-strength insulin exists; (2) have access to the relevant equipment for delivering high-dose insulin; and (3) have the relevant competencies”.

The focus group also highlighted issues around supply of needles for insulin pens, leading to staff finding workarounds including withdrawing insulin from the insulin pen and administering the insulin via a syringe.

However, despite the supply issues, they felt insulin pens still represent a strong, physical barrier (an engineering control); incidents can only occur if staff actively circumvent this barrier.

They noted that the increasing move to reusable insulin pens with refill cartridges will impact on the strength of this control. Refill cartridges for reusable insulin pens are similar to insulin vials and fall under the category below (overdose of insulin due to incorrect device). The engineered solution only applies to pre-filled insulin pens.

Future controls

None

Never Event category

Overdose of insulin due to incorrect device (that is, insulin syringe)

Description of existing control

Step 1: Administrative and behavioural control (reminders, visual prompts, staff education)

Step 2: Redesign and engineering control

What are these incidents?

While use of insulin pens has become increasingly common since the 1990s, insulin syringes remain a standard way of delivering insulin. Insulin syringes are specifically designed for insulin use, with markings down the side to show how many units of insulin are in the syringe. Standard syringes are not graduated by volume. No other syringe should be used for measuring insulin as without clear markings, too much insulin can easily be inadvertently administered.

How are the controls supposed to work?

This is a sequential process. Insulin comes in liquid form and if not in a pre-filled device it needs to be drawn up into an appropriate insulin syringe. This is step 1. There is no nationally supported redesign barrier to ensure only an insulin syringe is used, and this therefore relies on human behaviour (behavioural control).

Step 2. The markings on the insulin syringe reduce the risk of an incorrect dose being drawn up and administered.

Why do these incidents occur? Feedback from focus group and literature reviews on control effectiveness

In the UK, insulin syringes (U100) are designed only for use with insulin 100 units/mL. Newer, higher strength insulin is only available in pen devices. However, in the USA a 500 unit/mL preparation is available as a vial and comes with a dedicated insulin syringe (U500), and this may be imported into the UK (see HSIB report, 2022).

For insulin available in vials, the appropriate insulin syringe must be used to measure the appropriate dose; that is, U100 syringe for insulin 100 units/ml. For higher strength insulin preparations, the insulin must only be administered using the device in which it is supplied (see Never Event: withdrawing insulin from an insulin pen).

The focus group noted that insulin syringes as a medical device constitute a design barrier; however, the preceding step to ensure insulin is only drawn up into the appropriate insulin syringe is not robust as it relies on human behaviour.

The focus group noted that factors such as time pressures, distractions, availability of insulin syringes and storage of insulin devices contribute to staff inadvertently drawing up insulin into a non-insulin syringe. A standard syringe does not have the in-built safety mechanisms and therefore with their use the risk of inadvertent overdose is high.

Future controls

None identified.

Never Event category

Overdose of methotrexate for non-cancer treatment

A patient is given a dose of methotrexate, by any route, for non-cancer treatment that is more than the intended weekly dose; using an electronic prescribing system, such an overdose was given in a care setting.

Description of existing control

Redesign and engineering control (where electronic prescribing systems are in place).

Electronic prescribing systems should be configured with in-built controls to mitigate the risk of an overdose of methotrexate.

What are these incidents?

For autoimmune conditions and some cancer therapies, methotrexate is taken once a week. However, the Medicines Healthcare products Regulatory Agency (MHRA) reported that between 1 January 2006 and 30 July 2020 there were 11 Yellow Card reports in the UK of serious toxicity from inadvertent daily dosing of once-weekly methotrexate; 4 of these were received since January 2016.

Overdose of methotrexate can lead to serious adverse effects such as haematopoietic disorders (leukopenia, thrombocytopenia, anaemia and pancytopenia) and gastrointestinal reactions (mucositis, stomatitis, oral ulceration, gastrointestinal ulceration and gastrointestinal bleeding). In some reports overdosing proved fatal as a result of sepsis or septic shock, renal failure and aplastic anaemia.

How are the controls supposed to work?

Measures (including a National Patient Safety Alert in 2006 and MHRA Drug Safety Update in 2020) are in place to minimise the risk of inadvertent overdose from dosing of methotrexate more frequently than once weekly, but a few reports continue to be received. The initial controls introduced were people focused, including changes to product information; outer and inner packaging of all methotrexate products for once-weekly dosing carry a warning schedule and a space for the dispenser to write the day of the week for intake.

The introduction of electronic prescribing and medicines administration systems are an evidence-based method to reduce patient harm from medicines. This is a system-focused control. The electronic systems should be configured with restrictions to prevent the prescriber from inadvertently selecting daily instead of weekly. There should also be a further alert at administration stage to remind staff that the drug is for weekly dosing, not daily. This system, if correctly configured and installed on the electronic system, designs out the human errors of typos and misreading handwriting in paper-based systems.

Why do these incidents occur? Feedback from focus group and literature reviews on control effectiveness

The focus group noted that all NHS organisations should be moving to an electronic prescribing system to improve patient safety, but flagged that not all trusts act on its alerts. From the work of the ePresribing Risk and Safety Evaluation (ePRaSE) team at NHS England, around 50% of trusts with electronic systems correctly mitigate this error, 40% partially mitigate it and in around 10% there is no mitigation.

Future controls

None.

Never Event category

Mis-selection of high-strength midazolam during conscious sedation

Description of existing control

Substitution (high/low strength)

• Removal of high-strength midazolam as stock from designated areas where moderate sedation is given, substituting it with low-strength midazolam.
• Removal of low-strength midazolam as a stock item in areas where high-strength midazolam is regularly used, substituting it with high-strength midazolam.

What are these incidents?

Low-strength midazolam is used for moderate sedation. Inadvertent use of high-strength midazolam can cause prolonged sedation and risk of hypoventilation. NRLS data showed that mis-selection incidents have occurred where both strengths of medication are available as stock in clinical areas.

How are the controls supposed to work?

This is a systems-focused control: ensuring only one strength of midazolam is available by substituting high-strength midazolam for low-strength midazolam, or vice versa, in all relevant areas. 

In 2008, a Rapid Response Alert recommended the storage and use of high-strength midazolam (5 mg/mL in 2 mL and 10 mL ampoules, or 2 mg/mL in 5 mL ampoules) be restricted to those giving general anaesthesia, intensive care or palliative care, or areas where its use has been formally risk assessed in the organisation.

All other clinical areas store and use low-strength midazolam (1 mg/mL in 2 mL and 5 mL ampoules), not high strength.

Increasingly, however, high-strength midazolam is used in a range of clinical areas for the palliative care of patients, and is not restricted to designated ward areas. High-strength midazolam is therefore now the stock item in more areas, with low-strength midazolam only kept as a stock item in designated areas where moderate sedation is given.

Why do these incidents occur? Feedback from focus group and literature reviews on control effectiveness

Some limited areas do require both strengths of midazolam (eg emergency departments) so must decide which strength to keep in stock to mitigate the risk of mis selection.

This ensures that only one strength of midazolam is available as a stock item to mitigate the risk of mis-selection. 

The low number of these types of Never Events supports our assessment that this control is effective. 

Future controls

None

Never Event category

Failure to install functional collapsible shower or curtain rails (applies to mental health organisations only)

Description of existing control

Redesign and engineering control.

Curtain rail systems in mental health trusts must comply with NHS Estates guidance to mitigate the risk of harm.

What are these incidents?

Ligature risk refers to the risk of death from ligature asphyxiation, which occurs when a ligature is used to cut off the air supply to the brain. Showers and curtain rails can be used as ligature points. Mental health organisations are at higher risk of this Never Event.

How are the controls supposed to work?

This is a one-off action requiring infrequent checks, which strengthens the engineering control. Curtain rail systems in mental health trusts must comply with NHS Estates guidance; curtain/shower rails should collapse when sufficient weight is suspended from them, thus removing the ligature risk.

Why do these incidents occur? Feedback from focus group and literature reviews on control effectiveness

The focus group noted that NHS Estates was updating the current guidance relating to anti-ligature type curtain rail systems (EFA-2019-003_0.pdf (health-ni.gov.uk), and the update would include detail on maintenance schedules that follow the manufacturer’s instructions and relate to context and risk; for example, the appropriate environments where they should be fitted and body weight of the patients concerned.

The very low number of these types of Never Events suggests that the current controls are effective.

Future controls

None identified.

Never Event category

Falls from poorly restricted windows

Description of existing control

Redesign and engineering control.

British European standards for window restrictors.

What are these incidents?

This event type does not include falls/jumps where window restrictors have been intentionally broken. It refers to accidental falls from windows that have either no restrictors or poor-quality restrictors, so people, particularly young children or those who are confused, could inadvertently fall from them.

How are the controls supposed to work?

This is a one-off action requiring infrequent checks that strengthens the engineering control. Only window restrictors that meet the British European Standard can be used; the standards include a maintenance schedule and documentation to support the safety critical inspection process. The restrictors are designed to mitigate the risk of falling from windows, provided they are properly installed and regularly maintained. The restrictors are built-in barriers that prevent the window being fully opened, thus making it impossible for a person or child to accidentally fall from it.

Why do these incidents occur? Feedback from focus group and literature reviews on control effectiveness

The focus group noted that window restrictors meeting the British European Standard could vary in type and design and should be risk assessed for the environment (that is, ligature risk in a mental health unit).

An identified gap was maintenance of the window frame, as the window restrictor will only function effectively if the window frame is in a good condition. 

The very low number of these types of Never Events suggests that the current controls are effective.

Future controls

Wording of Never Event to be amended to ensure maintenance schedule includes window frames as well as window restrictors.

Never Event category

Chest or neck entrapment in bed rails

Description of existing control

Redesign and engineering control:

• Bed frames and rails redesigned as a complete unit, and must comply with MHRA guidance (updated in 2020).

What are these incidents?

When this Never Event was first developed, bed frames and bed rails were separate units, which risked incompatibility between the two and large gaps where a patient’s chest or neck could become trapped causing injury.

How are the controls supposed to work?

This is a one-off action requiring infrequent checks that strengthens the engineering control. Bed frames and bed rails have been redesigned into a single unit, so there will only be outstanding risk if the wrong size of mattress is used or the person is in the wrong size bed for their frame; for example, a child or small adult in an adult sized bed or an adult in a bariatric bed. This risk is mitigated with MHRA guidance (updated in 2020), which includes mattress types to be used and separate standards for children.

Why do these incidents occur? Feedback from focus group and literature reviews on control effectiveness

The focus group identified that this guidance could be further strengthened by providing guidance around bariatric beds.

They felt the very low number of these types of Never Events suggests that the current controls are effective. However, it is worth noting that a number of Never Events have been reported in 2023 and are being reviewed

Future controls

Updated guidance with standards around bariatric beds.

Never Event category

Transfusion or transplantation of ABO-incompatible blood components or organs

Unintentional transfusion of ABO-incompatible blood components.

Excludes: where ABO-incompatible blood components are deliberately transfused with appropriate management.

Unintentional ABO-mismatched solid organ transplantation.

Excludes: situations in which clinically appropriate ABO-incompatible solid organs are deliberately transplanted.

Description of existing control

Administrative and behavioural control.

Although both transfusion and transplantation use elements of electronic systems, there is still reliance on manual transcribing, checklists and cross-referencing key safety checks, and therefore human interaction.

What are these incidents?

A blood transfusion is a routine medical procedure in which donated blood is administered intravenously.

Organ transplantation is a procedure in which an organ removed from a living or deceased donor is placed in the body of a recipient, to replace a damaged or missing organ. The donor and recipient may be at the same location, or organs may be transported from a donor site to another location.

Living organ donation is usually done in a planned way whereas deceased donation is often undertaken out of hours where there are time pressures.

How are the controls supposed to work?

For blood transfusion the key steps with checks and balances in place are: sample taking, laboratory, documentation/administration.

1.    Positive patient identification is carried out at the sample taking stage and the sample is labelled.

2.    In the laboratory, the sample is then ‘tied’ to the laboratory information management system to ensure any blood products requested match the sample.

3.    When the blood component is then brought to the patient, the blood product documentation is checked again against the patient identification. Sometimes this is supported with bar coding technology, but it is often a manual process.

For organ donation there are two types:

• Living donation is a planned event supported by national guidance.
• Deceased donation is more complex. The donor is registered with their blood group electronically, creating an ‘organ offer’, and the transplant hub is identified of a potential recipient. Currently, the blood group has to be manually transcribed between systems, which represents a significant weakness in the control as it relies on human behaviour.

Why do these incidents occur? Feedback from focus group and literature reviews on control effectiveness

The focus group identified issues with the reliance on manual transcription of the blood group into the electronic system. Manual systems are at higher risk of human error, particularly when staff are working in busy, pressurised environments.

Future controls

Electronic scanning and barcoding technology strengthen the barriers, such as vein-to-vein blood tracking technology. However, there would likely still be a manual element at the first step when the sample information is added to the system.

Never Event category

Misplaced naso- or oro-gastric tubes

Description of existing control

Step 1: Confirmation of nasogastric (NG) placement with pH testing (administrative and behavioural barrier, reliant on subject interpretation of results). If pH strip test results unclear, move to

Step 2: Confirmation of NG placement via X-ray (redesign and engineering barrier)

What are these incidents?

NG tubes are passed through the nose, down the back of the throat and through the oesophagus into the stomach. They are used to give medication, fluids or liquid feed (known as enteral feed) to patients. There is a risk of serious harm and risk to life if NG tubes are incorrectly placed into the lungs rather than the stomach and fluid, medicine or feed is passed through them.

How are the controls supposed to work?

NG tubes have been the subject of numerous patient safety alerts in the last 15 years, each one aiming to strengthen the controls and reduce unwarranted variation in practice across the system. As per the 2016 alert and resource bundle, pH in the ‘safe range’ or X-ray is the only acceptable way to confirm initial placement of a NG tube. This is a staged approach; first the pH is checked to confirm it is in the appropriate range, and if the result of that is unclear or not in the safe range, proceed to X-ray. Trusts were also required to revise purchasing policies to ensure “pH test strips are CE marked and intended by the manufacturer to test human gastric aspirate” (substitution barrier).

Why do these incidents occur? Feedback from focus group and literature reviews on control effectiveness

The persistence of incidents after 2016 led HSIB to undertake a national investigation (HSIB, 2020c). Its report highlighted inconsistencies in local provision of training and competency checks for X-ray interpretation, and noted that the use of pH testing was complex and can be affected by the usability and availability of pH strips as well as staff competence in interpreting colour charts.

The focus group felt that restricting interpretation of X-rays to radiographers would make this a strong engineering barrier, but due to the risks of radiation exposure from X-ray, an X-ray should not be the first step. The first step should remain pH checking and as the interpretation of colour on pH testing strips is subjective, even with strengthening of the X-ray barrier the overall control strength would remain moderate.

Future controls

The Royal College of Radiologists and the College of Radiographers are considering guidance to make radiographers (who undertake the X-ray) responsible for interpretating X-rays taken to check the NG tube placement. This would enable immediate action to remove any misplaced tubes as, unlike radiologists, radiographers will be with the patient at the time they review the X-ray. Existing guidance already suggests the limitation of the review and interpretation of the X-ray to a locally chosen restricted group, but the guidance that is being considered is more specific. It would reduce the risk of missed communication about a misplaced tube as well as restrict interpretation to a staff group present in all types of trusts 24/7.

Research is ongoing into technological solutions to move to digitised reading of pH test strips.

Never Event category

Scalding of patients

Description of existing control

Redesign and engineering control:

• Thermostatic mixing valve built into taps and showers.

What are these incidents?

Scalds are damage to the skin caused by something wet, such as hot water or steam. This event type refers to patients being accidentally scalded while bathing in water that is too hot. It does not refer to scalds from kettle steam or other kitchen accidents.

How are the controls supposed to work?

This is a one-off action requiring infrequent checks that strengthens the engineering control. Organisations must have thermostatic mixing valves (TMVs) built into taps and showers, which determine the temperature of water coming out and ensure it is a safe temperature. TMVs must be checked every 3 to 6 months as part of regular maintenance schedules, and this is included in the NHS Premises Assurance Model (PAM).

Why do these incidents occur? Feedback from focus group and literature reviews on control effectiveness

The focus group felt the very low number of these types of Never Events suggests that the current controls are effective.

Future controls

None identified.

Never Event category

Unintentional connection of a patient requiring oxygen to an air flowmeter

Description of existing control

Elimination:

• Removal of air flowmeters from all clinical areas.
• Medical air outlets not in use capped off.

What are these incidents?

Air flowmeters attached to piped medical air outlets are primarily used to drive the administration of nebulised medication; typically for short periods to manage respiratory conditions. Most other uses of piped medical air do not require an air flowmeter. Due to the proximity of the piped medical air and oxygen outlets at the bedside, and the similarity in design of flowmeters, there is a significant risk when using air flowmeters that patients are inadvertently connected to medical air instead of oxygen.

How are the controls supposed to work?

The National Patient Safety Alert asked providers to purchase alternative devices that do not require medical air to be delivered via an air flowmeter, such as nebulisers. Following this, all medical air flowmeters except those tethered to equipment for niche use should be discarded, and all medical air outlets no longer required should be reversibly capped off. These actions eliminate the risk and create a strong barrier.

Why do these incidents occur? Feedback from focus group and literature reviews on control effectiveness

The focus group considered the findings of the piped supply of medical air and oxygen HSIB report published in 2019’. Safety intelligence data gathered from incident reporting since the first National Patient Safety Alert was published in 2016 showed a continuous reduction in the number of gas misconnections from 50 in 2018/19 to 8 in 2022/23. The focus group noted this was a good indicator the barriers were effective.

Future controls

None identified.