Human Factors in Digital Healthcare: Designing Integrated Records for Success

What human factors, SEIPS and clinical safety can teach us about integrated records 

The promise of integration

Across the NHS, there is a strong drive towards greater interoperability, shared information and more connected care. The potential benefits are substantial: better continuity, fewer duplicated assessments, faster access to relevant information, improved coordination and a clearer view of a patient’s journey across organisational boundaries.

The scale matters. A programme spanning more than 300 general practices would not represent one organisation adopting one system. It would connect hundreds of separately governed workplaces, serving different populations, operating from different estates and beginning from different digital, cultural and operational baselines. Complexity rises rapidly, but so does the opportunity to improve care.

The central question is therefore not whether integration is desirable. It is whether the programme is being treated primarily as a technical migration, or as a transformation of the whole work system.

A reminder from recent events

Recent events show why that distinction matters. A 2026 investigation reported by The BMJ found that at least 214 NHS staff had been dismissed and around 2,000 sanctioned following inappropriate access to patient information since 2022. The same investigation reported that some organisations had not undertaken recent proactive audits or held no usable information about them.[1]

High-profile cases give those figures a human context. Nottingham University Hospitals dismissed 11 staff and warned 14 others following inappropriate access to the records of the three people killed by Valdo Calocane.[2] Reporting on the Southport attack described almost 50 staff being sanctioned after accessing victims’ records without a legitimate reason.[1] The records of Oliver McGowan were also examined after his family’s request identified extensive access over the years following his death; most reviewed access had a legitimate explanation, while a smaller number of cases remained under investigation.[3]

NHS England has responded with unequivocal messaging. Its guidance states that curiosity or concern is not a legitimate reason to access a record and that unlawful access can lead to dismissal, regulatory referral or criminal prosecution. It also asks organisations to use appropriate technical controls, including role-based access, multi-factor authentication and, where systems permit, real-time flags for suspicious activity.[4][5]

Those messages are necessary, but they do not close the risk. The issue is more than privacy, data protection or organisational reputation. Information can reveal addresses, contact details, relationships, vulnerabilities, diagnoses, safeguarding concerns and patterns of attendance. In the wrong hands, data can become an enabler of intimidation, harassment, coercive control or stalking.

The policing context illustrates the direct-harm dimension. Public reporting has described a former officer using police systems to conduct unauthorised searches relating to an ex-partner, her friends and her new partner as part of stalking behaviour.[6] The Independent Office for Police Conduct has also reviewed serious and sensitive stalking cases, including police abuse of position, and highlighted shortcomings in risk assessment and management.[7]

These examples are not presented to suggest that most staff misuse access. They demonstrate that when a legitimate system user becomes an insider threat, the consequence may extend well beyond a confidentiality breach.

The human factors challenge

Robert Wachter’s The Digital Doctor made a point that remains highly relevant: digitisation does not simply replace paper with a screen. It changes work, communication, relationships and decision-making. Health IT sits within a sociotechnical system, not outside it.[8][9]

That means a technically functional system can still produce poor outcomes if it does not fit the people, tasks, environments and organisational arrangements into which it is introduced. Equally, a system that works effectively in one practice may function very differently in another. The software may be nominally identical while the work system is not. A useful starting point is understanding Human Factors in Healthcare, which examines how people interact with tasks, technology, teams, environments and organisational conditions.

Looking through a SEIPS lens 

The Systems Engineering Initiative for Patient Safety, or SEIPS, offers a practical way to examine this. SEIPS considers the interaction between people, tasks, tools and technologies, the internal environment and organisational conditions, all operating within a wider external environment. These interactions shape work processes and, ultimately, outcomes.[10] Teams that need a shared foundation can begin with our Introduction to Human Factors training, covering systems thinking, human performance and the conditions that shape work as done.

People: more than the member of staff at the keyboard 

People includes clinicians, administrators, reception teams, temporary staff, learners, contractors, system administrators, clinical safety officers, leaders and information governance specialists. They will have different responsibilities, experience, confidence, motivations, pressures and legitimate information needs.

It also includes patients and service users. Their needs should not be treated as a downstream consideration. Different communities may have different privacy concerns, health literacy, accessibility needs, experiences of domestic abuse, safeguarding risks, digital access and levels of trust in institutions. A design that appears proportionate for one group may create avoidable anxiety or exposure for another.

Human-centred design therefore asks not only, “Can the user access the record?” but also, “Whose needs are represented, whose vulnerabilities are visible, and who bears the consequences if access is misused or misunderstood?”

Tasks: the reality behind the workflow 

Practices do not necessarily record the same work in the same way. Some rely heavily on structured templates; others use more free text. Coding practices, local conventions, delegation, review processes and the threshold for recording contextual detail may differ. Staff also begin from different ideas of what “normal” documentation looks like.

When records become visible across organisational boundaries, users may assume consistency that does not exist. A field left blank may mean “not assessed”, “not present”, “recorded elsewhere” or simply “not part of the local workflow”. A shared interface can conceal differences in provenance and context.

Task analysis should therefore examine what staff are trying to achieve, where information originates, how it is coded, how exceptions are handled, what interruptions occur, and what happens when the system does not support the work as imagined.

Promethean HD’s digital and technology assessment and implementation planning can help organisations clarify requirements, examine work as done and create board-ready assurance before and after go-live.

Tools and technology: the system is more than the software 

Different practices may have different hardware, network capacity, screen sizes, authentication arrangements, peripheral devices and technical support. A workflow designed on a fast dual-screen workstation may be cumbersome on a small laptop or a single monitor. Slow response times, repeated log-ons and poorly designed navigation may encourage workarounds or shared viewing practices.

Technical design also establishes the boundaries of access. Role-based permissions, contextual restrictions, break-glass processes, patient flags, just-in-time prompts, masking of especially sensitive information, automatic timeout, multi-factor authentication and real-time anomaly detection can all influence behaviour. Each has benefits and trade-offs. Overly restrictive access may delay care; access that is too broad increases exposure.

The design question is not simply whether an individual has authority to enter the system. It is whether access to this patient, this information and this function is justified for this task, at this time, in this context. The same whole-system principles apply to ambient voice technology in the NHS, where technical performance, workflow, checking behaviour and clinical governance interact.

Internal environment: where work actually happens 

General practice work takes place in consultation rooms, reception areas, shared offices, hot-desking spaces and remote settings. Screens may be visible to others. Conversations may be overheard. Staff can be interrupted while records remain open. Room layout, privacy, noise, lighting, workstation position and competing demands all shape safe use.

These conditions vary between sites. Standardising software does not standardise the physical or cognitive environment in which it is used.

Organisation and external environment

Local leadership priorities, staffing stability, safety culture, information governance maturity, training capacity and attitudes towards digital systems all affect implementation. One practice may view the change as an opportunity; another may experience it as an externally imposed programme competing with immediate operational pressures.

The external environment introduces further forces: NHS policy, government expectations, financial constraint, supplier markets, regulation, workforce pressures and the drive to reduce duplication or save money. Those objectives are legitimate, but they can create pressure to privilege speed and standardisation over local discovery and adaptation.

A SEIPS analysis does not argue against standardisation. It makes visible the conditions standardisation must accommodate if it is to work reliably.

Clinical safety: where do DCB0129 and DCB0160 fit?

DCB0129 defines clinical risk management requirements for manufacturers of health IT systems. DCB0160 applies to health and care organisations deploying and using those systems. NHS guidance describes digital clinical safety assurance as a clinical risk management activity and requires a suitably trained Clinical Safety Officer.[11][12]

These standards provide a disciplined route for identifying hazards, understanding causes and consequences, documenting controls and assessing residual risk. NHS England began a review of both standards in 2026, citing greater digitisation, emerging technology, cyber threats and changing clinical workflows.[11]

The key reflection is whether inappropriate access and its consequences are being considered only as information governance issues, or also as potential clinical and safety hazards where harm to a patient or service user is reasonably foreseeable. Not every privacy breach is a clinical safety incident. However, where exposure could enable coercion, stalking, violence, avoidance of care or deterioration in trust that affects care, the safety implications deserve explicit consideration.

At this scale, assurance should not be satisfied by a generic hazard log. DCB0160 activity should be sensitive to local deployment: different populations, workflows, estates, hardware, training arrangements and access models. A control that is effective in one practice may be unavailable, impractical or counterproductive in another.

A proportionate approach to safety cases in healthcare can also help teams make their claims, evidence, controls, assumptions and residual risks explicit before major change.

What policing teaches us about controls 

Policing commonly combines national systems, such as the Police National Computer, with local intelligence and operational systems. This creates a familiar tension between the legitimate need to make information available and the obligation to prevent misuse.

Controls typically include individual log-ons, vetting, policies, procedures, training, guidance, confidentiality reminders, supervisory expectations and audit trails. These controls matter. Yet many are behavioural or administrative. They operate after a person has already been granted legitimate entry to the wider system and depend upon that person following the rules when choosing which record to open.

Audit can identify suspicious activity. Investigation, misconduct processes and prosecution can impose consequences. However, these are detective or recovery controls. They generally act after the record has been viewed, copied, disclosed or used. By then, the harm may already have occurred.

The lesson is not that training, policy or accountability are unnecessary. It is that they should not carry more risk than they can reliably control.

Cafazzo’s hierarchy of intervention effectiveness 

Cafazzo and St-Cyr’s work on the evolution of human factors in healthcare challenges over-reliance on attempts to change individual behaviour and argues for stronger attention to design.[13] The associated hierarchy of intervention effectiveness places education, policy, reminders and double checks below more system-focused approaches such as simplification, standardisation, automation, constraints and forcing functions.[14]

Applied to record access, a poster saying “do not look” is weaker than a system that limits visibility according to role, relationship, task and context. A policy is weaker than an access pathway requiring a recorded justification for unusually sensitive records. Retrospective audit is important, but a real-time challenge or anomaly alert may interrupt the behaviour before it progresses. No single control is sufficient, and stronger controls must be designed so that they do not obstruct urgent and legitimate care.

The aim is defence in depth: controls at several levels, weighted towards prevention and good system design rather than relying primarily on memory, vigilance and fear of punishment.

Learning from defence and military Human Factors Integration 

Defence provides a useful contrast because Human Factors Integration is positioned as part of capability development, not an optional review at the end. Ministry of Defence JSP 912 mandates HFI in defence acquisition projects and describes capability as the product of interacting elements, including the people who operate, maintain and support systems in demanding environments.[15][16]

The strength of this approach is its timing. HFI informs requirements, trade-offs, procurement, design, training, staffing, support and assurance across the lifecycle. It asks whether the total system will perform in the real operational environment, not merely whether the equipment meets a technical specification.

Healthcare can learn from that mindset. If human factors is introduced after procurement, after configuration and after rollout, the available interventions are narrower and often more dependent on training and workarounds. If HFI is embedded during concept development and commercial decision-making, requirements can include usability, workload, accessibility, misuse resistance, monitoring, local adaptation and safe degradation from the outset.

Designing for success 

Integrated records offer benefits worth pursuing. Better information can support safer decisions, smoother transitions and more coordinated care. Across hundreds of practices, even modest improvements could have significant reach. 

But scale magnifies both benefit and exposure. The right response is not to retreat from integration. It is to treat integration as a whole-system design challenge.

That means involving patients and frontline users early; studying work as done; applying SEIPS across contrasting practice contexts; integrating DCB0129 and DCB0160 assurance with information governance and security; using a hierarchy of controls; and placing Human Factors Integration at the centre of programme governance.

Accountability still matters. Deliberate misuse must have consequences. But punishment is not a substitute for design. The strongest systems do not merely tell people to do the right thing. They make the right action clearer, easier and more likely, while making inappropriate action harder, more visible and less consequential.

Good outcomes at this scale will not happen by luck. They need to be designed.

A technically compliant implementation can still create avoidable risk when workflows, access models, equipment, environments, staffing and local variation are treated as secondary considerations. Human factors is most valuable before decisions become difficult or expensive to change.

Promethean HD provides digital and technology assessment and implementation planning for healthcare organisations. We can help teams clarify requirements, examine work as done, assess usability and clinical-safety risks, involve users and patients, and create board-ready assurance before and after go-live.

Discuss your digital healthcare programme.

References

[1] Wise, J. (2026). ‘More than 200 NHS staff sacked over inappropriate access of patient data, investigation finds’. BMJ, 394, e100793. https://doi.org/10.1136/bmj-2026-100793

[2] Mahase, E. (2026). ‘Nottingham attacks: Doctors and NHS staff fired and reprimanded for accessing victims’ medical records’. BMJ, 393, e342385. https://doi.org/10.1136/bmj-2026-342385

[3] Webb, S. (2026). ‘NHS investigates staff for accessing teenager’s medical records’. Digital Health, 25 September. https://www.digitalhealth.net/2026/09/nhs-staff-under-investigation-for-accessing-dead-teenagers-records/

[4] NHS England (2026). Stopping unlawful access to records. Last edited 18 September 2026. https://digital.nhs.uk/data-and-information/information-governance/guidance/stopping-unlawful-access-to-records

[5] NHS England (2026). ‘NHS warns “snooping” staff face sack or prison for inappropriate access of patient data’. 8 July. https://www.england.nhs.uk/2026/07/snooping-staff-face-sack-prison-inappropriate-access-patient-data/

[6] Vergnault, O. (2025). ‘Former copper sentenced after stalking his ex using police systems’. Yahoo News UK, 13 September. https://uk.news.yahoo.com/former-copper-sentenced-stalking-ex-151532254.html

[7] Independent Office for Police Conduct (2024). Review of IOPC cases involving stalking. Published 27 September. https://www.policeconduct.gov.uk/publications/review-iopc-cases-involving-stalking

[8] Wachter, R.M. (2015). The Digital Doctor: Hope, Hype, and Harm at the Dawn of Medicine’s Computer Age. New York: McGraw-Hill Education. ISBN 978-0-07-184946-3. Publisher record

[9] Institute of Medicine (2012). Health IT and Patient Safety: Building Safer Systems for Better Care. Washington, DC: The National Academies Press. https://doi.org/10.17226/13269

[10] Carayon, P., Schoofs Hundt, A., Karsh, B-T., Gurses, A.P., Alvarado, C.J., Smith, M. and Flatley Brennan, P. (2006). ‘Work system design for patient safety: the SEIPS model’. Quality and Safety in Health Care, 15(Suppl 1), i50–i58. https://doi.org/10.1136/qshc.2005.015842

[11] NHS England (2026). Review of digital clinical safety standards: DCB0129 and DCB0160. https://digital.nhs.uk/data-and-information/information-standards/information-standards-and-data-collections-including-extractions/publications-and-notifications/standards-and-collections/review-of-digital-clinical-safety-standards-dcb0129-and-dcb0160

[12] NHS England (2025). Digital clinical safety assurance. Version 1.2, 3 March. https://www.england.nhs.uk/long-read/digital-clinical-safety-assurance/

[13] Cafazzo, J.A. and St-Cyr, O. (2012). ‘From discovery to design: the evolution of human factors in healthcare’. Healthcare Quarterly, 15(Special Issue), 24–29. https://doi.org/10.12927/hcq.2012.22845

[14] Petersen, E., Thampinathan, S., Cafazzo, J.A. & Pozzobon, L.D. (2026). Embedding human factors and systems thinking in patient safety education: the CARE Tool. BMJ Open Quality, 15, e003968. https://doi.org/10.1136/bmjoq-2025-003968

[15] Ministry of Defence (2024). JSP 912: Human Factors Integration in defence systems, Part 1: Directive. https://www.gov.uk/government/publications/human-factors-integration-in-defence-systems-jsp-912

[16] Ministry of Defence (2024). JSP 912: Human Factors Integration in defence systems, Part 2: Guidance. https://www.gov.uk/government/publications/human-factors-integration-in-defence-systems-jsp-912