Infected Blood Inquiry: risk management recommendations

In the final series of articles on the Infected Blood Inquiry, we consider the recommendations.

Sir Brian observes that there is a danger in Inquiries making too many recommendations.

He acknowledges that some participants may regret that he may not have chosen one which is their particular concern. Some of the lessons to be learned which were set out in the previous chapter might also have resulted in additional recommendations made formally by the Inquiry. This should not, however, prevent anyone from applying the lessons identified there, avoiding in future the mistakes which have been identified, and using the content of that chapter as a basis for taking further action, and does not diminish the importance of learning those lessons. You can read our earlier article on the lessons to be learned here. [this is our second article]

12 recommendations were made, and we pick out below the ones of most relevance from a general risk perspective.


  • All those responsible for medical education should take steps to ensure that those “lessons to be learned” which relate to clinical practice do indeed become part of every doctor’s training.
  • However, it is above all the hard and awful facts of what happened that doctors need to understand so that the errors are not repeated. A package of training materials, with excerpts from oral and written testimony would underpin what can happen in healthcare and must be avoided in future.

Achieving a safety culture

Sir Brian starts this section be explaining that the account in the chapters of this Report sets out the history of a failure to focus on risk, a failure to put safety first, a failure to listen to voices advising a different course. It also contains a history of systemic failures…. it's noticeable that similar failings have been identified throughout healthcare in other inquiries and suggest a wider problem still.

He then goes on to make the point that in the NHS there are three particular aspects which demand action:

  1. First, changing the culture, such that safety is embedded as a first principle, and is regarded as an essential measure of the quality of care. Though performance, efficiency, and expense are all important, it should be the safety of care in any health institution that is the aspect in which all its staff take particular pride.
  2. Second, a more rational approach to regulation and safety management, resolving the problems created by the current systems for trying to deliver safer care: which are fragmented, overlapping, confusing, and poorly understood.
  3. Third, ensuring a coherent approach to data – for patients to whom that data relates, and by a body (preferably just one, but if more than one is necessary, then as few as possible) which, with the appropriate consent of the patients concerned, can make use of that data to help identify threats and trends, and better inform protection for others.

To understand the link between these three, he flags that it is important to recognise: first, that there have, over the last five decades, been multiple high-profile failures of care which have themselves been the subject of earlier public inquiries and recommendations and second, that it has long been pointed out that the regulatory framework for the NHS is overly complex and disjointed.

It's his view that, if safety is to be regulated properly, it needs to be easy for an ordinary user of the system to know to whom they can express any concerns they may have about it, who will take up their cause, and what they can expect from them. At the same time, those who are busy working within the system, especially those in leadership roles or on the boards of hospital trusts and health boards, need to have clarity as to what, precisely, is expected of them.

Sir Brian quotes from:


Leading nicely into this section Sir Brian stated in concluding the section on achieving a safety culture that the culture will not change unless candour is assured as best we can.

He has a lot to say on this topic!

He notes how on 6 December 2023 the Lord Chancellor announced to Parliament that the Deputy Prime Minister had that day signed what was to be known as the “Hillsborough Charter” on behalf of the Government. The Charter had been proposed by Bishop James Jones, former Bishop of Liverpool, in his report on the Hillsborough disaster. The Lord Chancellor acknowledged in his response on behalf of the Government that it had taken too long for the Government to respond.

There are six undertakings in that Charter and Sir Brian observes that all bar the first one are applicable here:

  1. {Not applicable}
  2. Place the public interest above our own reputation.
  3. Approach forms of public scrutiny … with candour, in an open, honest and transparent way, making full disclosure of relevant documents, material and facts. Our objective is to assist the search for the truth. We accept that we should learn from the findings of external scrutiny and from past mistakes.
  4. Avoid seeking to defend the indefensible or to dismiss or disparage those who may have suffered where we have fallen short.
  5. Ensure all members of staff treat members of the public and each other with mutual respect and with courtesy. Where we fall short, we should apologise straightforwardly and genuinely.
  6. Recognise that we are accountable and open to challenge. We will ensure that processes are in place to allow the public to hold us to account for the work we do and for the way in which we do it. We do not knowingly mislead the public or the media.

He observes that Bishop James Jones’ approach applies with equal force to disasters in the health context, which are likely to arise out of a series of individual experiences revealing some systemic or individual failing and goes on to note that it is a sad fact that very few inquiries into aspects of the health service or parts of it have ended without recognition that the culture needed to change.

Concerningly, he explains that, from a number of the submissions made to him, that some core participants were not aware that a duty of candour existed, and in particular were unaware of the terms in which it is expressed…He thinks that it would be helpful if after the words “open and transparent” were added the words “and forthcoming” because to him candour is more than being open and transparent, valuable though both qualities are.

He then notes a “gap” observing that though there are some in leadership roles in NHS Trusts and health boards who are subject to professional duties as doctors or nurses, and though it may rightly be said that organisational duties have ultimately to be performed by individuals, there are many leaders who are as yet subject to no individual accountability for candour within their organisation.

He notes the recently declared review of the duty of effectiveness of the duty of candour for health and social care providers. 

There is a damning conclusion to this part of the report:

“Over 20 years after Bristol, and over ten since Mid Staffordshire, it appears from this that too little has changed. This demonstrates how difficult it can be to change culture. Professor Kennedy rightly observed that “Cultural and institutional change takes time and can be slow, requiring patience and forbearance.” Nonetheless, he anticipated that changes in the culture would follow the implementation of the recommendations he made. He had seen the recommendations as forming an interlocking whole. It is a sad indictment of the system’s ability to effect a change of culture over such a long timescale that the same concerns continue to surface. The concerns discussed above have been recognised in inquiry after inquiry. They have led to a strengthening of whistleblower protection, have led to a statutory duty of candour upon health service bodies in England, Scotland and Wales, have led to stern warnings from the Parliamentary and Health Service Ombudsman – but have not yet effected a change in culture”.

He doesn't propose a culture in which there is no blame but rather one where the blame falls in the right place. For him the culture should be one in which the reporting of the concerns of which Sir Robert Francis speaks is recognised as a human, professional and statutory duty. The duty is to report matters which it is reasonable to think may have an adverse impact on patient safety. A failure to do so, when the substance of what might be reported is known to one or more people, but has not been reported by them, may be regarded as a breach of professional duty, and might usefully underpin the statutory duty of candour. However, the duty also rests on those to whom a report is made. In the case of someone in a leadership role, they may choose to escalate a report, resolve it, or deal with it as appropriate, but in any case, they should consider it properly. 

He notes that industry dealing with offshore safety; the handling of hazardous chemicals, aerospace, maritime, and nuclear power enterprises systematise safety checks, and highlight cases where they may not have been performed. These industries have each adopted a safety management system but concludes that the NHS has not.

The existing professional duties of candour in healthcare are good starting points, so far as those currently subject to such duties are concerned. However, others who are not covered by these obligations should be subject to reciprocal duties. It should be considered a serious disciplinary matter on the part of the person in authority to whom a report of a sentinel event is reported not to consider it adequately.

This would make whistleblowing an obligation: but more than that, it would make the person to whom a report of a sentinel event is made, accountable for what is then done in response to it. It entrenches the principle that safety is the responsibility of all. It makes patient safety a hallmark of quality care. In effect, it gives teeth to the duty of candour in healthcare.

Why is the status quo not enough? The answer is that despite the focus on patient safety, there are still recurring safety risks and serious incidents in healthcare. This can be seen in repeated concerns in the last decade such as in the Morecambe Bay Investigation (Kirkup, 2015), First Do No Harm: The report of the Independent Medicines and Medical Devices Safety Review (2020), the Ockenden review of maternity services at Shrewsbury and Telford Hospital NHS Trust (2020); and Reading the signals: Maternity and Neonatal Services in East Kent Report (Kirkup, 2022). These investigations and reports have identified similar problems to those which this Inquiry has laid bare: not only a problematic culture, which does not put patient safety first; but too many bodies, with no one having an overall role with executive power or central influence; too much fragmentation leading to a confusion of approach and paralysis of decision-making.

His view is, in summary, that a powerful consensus has been building over the last three years that an appropriate safety management system is needed for healthcare in England.

He also considers candour in the context of the civil service.

“I doubt that the last word has yet been said on whether a statutory personal duty of candour should be introduced across the Civil Service. No one can sensibly dispute that people in public life should observe basic moral principles: they are as applicable to government ministers and officials as they are to clinicians.”

“It must be a concern that unless a duty of candour “has teeth” it might similarly be broken in future; and it is my concern that unless I draw attention to this I shall not be fulfilling my duty of making appropriate recommendations to the Government.”   

“Though the Civil Service does not itself deal directly with patient care, its actions, and those of the ministers it supports can compound any failures of care, especially where they do so by expressing mistaken, inadequate, or ill-considered views of the facts, or simply by delaying responses to concerns or fresh information. I have recommended that those in leadership positions in the health service, who would not otherwise be within the scope of a statutory duty of candour, should be made subject to it, and made accountable for their personal handling of concerns about the safety of healthcare amongst those they lead.” Recognition of a corresponding duty of leaders in the Civil Service is also recommended.

Medical records

Sir Brian starts by explaining that because moves are already under way to give patients greater access to their own records, that development in itself needs no recommendation from this Inquiry

The message delivered generally to the Inquiry is one of deep concern about the failings of NHS record keeping to date. It is important for there to be faith in the new system. There should accordingly be a formal audit of the success of the system, as operated in each of the four health administrations, by the end of 2027, which reports in a public forum as to its level of success in the percentage of the population who are:

  1. Able to access their medical records online
  2. Able to identify any corrections that need to be made to the data which has been recorded in their records, and can succeed in any reasonable case in securing those corrections
  3. Satisfied that they have sufficient control over the use of their data for purposes beyond their immediate treatment such as for research

It should also measure and report the degree of confidence which health professionals have in the degree of detail, accuracy and timeliness of any record they enter, and be able to assess that little material which should be recorded has been omitted. It should evaluate how far the savings in time which are identified in the Government strategy have been achieved in England, and whether all the national governments’ digital initiatives have met their objectives and can be shown (on balance) to have improved the safety of patient care.

Destruction policies should be kept under review.

Other points he makes in this volume with regard to medical records include:

  • From the evidence it is apparent that there are a number of possible reasons why medical records have been destroyed or lost:
    • Reorganisations in the NHS
    • Records management across multiple locations with separate repositories, later transferred to centralised records, with opportunities for human error
    • Multiple changes in computer systems removing access to earlier systems
    • Changes in name, address etc
    • Haemophilia centre patient records being kept separately from the main hospital records
    • Physical damage caused by water or fire
  • In particular, concerns relate to inconsistency between what is recorded in the notes and the information that was given, or not given, to a patient; and inaccurate information being recorded in the records. The Inquiry has heard substantial evidence about the differences between what individuals recall being told, or not told, orally and what is recorded in their medical records. There are examples of matters recorded in medical records which simply have been wrong. One common concern for a number of witnesses of this is the accuracy, or otherwise, of references to alcohol use, particularly for those with Hepatitis C
  • There are a handful of examples that raise serious issues of intentional interference in medical records. Due to the passage of time, it is difficult to reach any firm conclusions on what happened in these individual situations. They do however raise concerns that there may have been a closing of ranks in certain situations resulting in somebody thinking it would be wise to remove items from medical records
  • It is critical to the future of the NHS that patients can generally trust what they are told, and trust that the NHS has their best interests at heart. Keeping accurate and complete records, and making them available on request, demonstrates the openness, transparency and rigour which patients and those close to them associate with a careful, caring system of healthcare.
  • Although there are suspicions that some health authorities or individuals hid, removed or destroyed records that might be an embarrassment, there is no evidence sufficient to make a general finding of that nature. The possibility that there may have been occasions in the past when records may have been left incomplete deliberately or have been filleted nonetheless still remains.

Our content explained

Every piece of content we create is correct on the date it’s published but please don’t rely on it as legal advice. If you’d like to speak to us about your own legal requirements, please contact one of our expert lawyers.

Mills & Reeve Sites navigation
A tabbed collection of Mills & Reeve sites.
My Mills & Reeve navigation
Subscribe to, or manage your My Mills & Reeve account.
My M&R


Register for My M&R to stay up-to-date with legal news and events, create brochures and bookmark pages.

Existing clients

Log in to your client extranet for free matter information, know-how and documents.


Mills & Reeve system for employees.