vaayaa Inclusive Education
Healthcare risk assessment

Clinical Psychology and Psychotherapy Risk Assessment: Patient Safety, Records and Escalation Controls

A worked example of how a psychological therapy service finds, scores and controls risks to client safety, confidentiality, consent, staffing and continuity, from missed risk signals to record errors and system outages.

Updated November 2026 8 hazards assessed Review every 6 months Highest risk: Critical to Medium
See the Clinical Psychology and Psychotherapy course

Executive summary

This assessment shows how a community psychological therapy service can identify, score and control the risks that matter most to client safety, privacy and continuity. Eight risks were selected because they are plausible in everyday clinical work and because harm to a client is the most serious outcome. The highest inherent score sits with missed escalation of suicide or self harm risk, which is rated Critical before controls. Most risks fall to Medium or Low once existing and additional controls are in place. The first actions are a structured risk screen with set triggers, a rule on who may lead risk sessions, secure messaging and a tested downtime plan. The service is a teaching example, so every score illustrates method rather than a real organization or client group. Specialist clinical and legal review is needed before any real use.

Focus area
Clinical psychology and psychotherapy practice
Setting
Community psychological therapy service with registered clinicians, assistant staff, video sessions and electronic clinical records
Method
Five by five likelihood and impact risk register with residual review

Scope

This assessment covers a community psychological therapy service, from first contact and assessment through treatment, risk review, records, handovers and discharge. It looks at risks to client safety, privacy, consent, staff competence and service continuity. Jurisdiction, service size, funding and systems are assumptions made for teaching. It does not give clinical, legal or professional advice to any real service.

Context

The service has registered psychologists and psychotherapists, assistant psychologists, a clinical lead, a service director, a receptionist and an on-call clinician for out of hours concerns. Sessions take place in shared consulting rooms, waiting areas and by video. Clinical notes, risk plans and outcome measures are held in an electronic record with paper backup. Each risk is scored before controls to show its natural level, then again after the existing controls and the controls that should be added.

Objectives, assets and stakeholders

The objective is to keep clients safe, respect their privacy and consent, deliver effective psychological treatment, and maintain a service that keeps working when staff or systems are unavailable. The assets in scope are client records and safety plans, clinical time and skills, consulting rooms and shared spaces, the video and record systems, and the reputation of the service. Stakeholders include clients and their families, referrers, registered clinicians and assistant staff, the clinical lead and service director, the information governance lead, professional bodies and suppliers. Each risk has one owner role, and the clinical lead keeps the register current and reports to the service director each quarter. Nothing in this register replaces the clinical judgment of the treating clinician.

Risk matrix: before and after controls

Each cell shows hazard numbers placed by likelihood and impact. Compare the two grids to see how controls move each hazard.

Before controls

Inherent risk

Risk before controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain
4 Likely Likelihood 4, impact 4, score 16, high: H04 Likelihood 4, impact 5, score 20, critical: H01
3 Possible Likelihood 3, impact 3, score 9, medium: H03 H08 Likelihood 3, impact 4, score 12, high: H05 Likelihood 3, impact 5, score 15, high: H02
2 Unlikely Likelihood 2, impact 3, score 6, medium: H07 Likelihood 2, impact 5, score 10, high: H06
1 Rare

After controls

Residual risk

Risk after controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain
4 Likely
3 Possible
2 Unlikely Likelihood 2, impact 2, score 4, low: H03 H08 Likelihood 2, impact 3, score 6, medium: H04 H05 Likelihood 2, impact 4, score 8, medium: H01 H02
1 Rare Likelihood 1, impact 3, score 3, low: H07 Likelihood 1, impact 4, score 4, low: H06
  • Low 1 to 4
  • Medium 5 to 9
  • High 10 to 16
  • Critical 17 to 25

Hazard register

A summary first, then the detail for each hazard.

Summary of hazards with scores before and after controls
No.HazardBeforeAfterOwner
H01 Missed or delayed escalation of suicide or self harm risk 20 Critical 8 Medium Clinical lead
H02 Failure to recognize symptom deterioration or treatment drop out 15 High 8 Medium Supervising psychologist
H03 Inadequate informed consent and inaccurate treatment records 9 Medium 4 Low Clinical governance lead
H04 Breach of confidentiality in records, email and messaging 16 High 6 Medium Information governance lead
H05 Unsafe handover, cover gaps and unsupervised trainee practice 12 High 6 Medium Clinical lead
H06 Boundary violations and dual relationships 10 High 4 Low Clinical lead
H07 Infection transmission and exposure in shared clinic spaces 6 Medium 3 Low Practice manager
H08 Failure of video, record or outcome tool supplier 9 Medium 4 Low Service manager
H01

Missed or delayed escalation of suicide or self harm risk

Safety Before 20 After 8

A client's risk to self or others rises between sessions, or warning signs in notes, messages or calls are not recognized and escalated in time, so urgent help is delayed.

Who or what is affected: Clients, families, clinicians and on-call staff

Causes

Limited time in sessions, reliance on self report, and unclear thresholds for escalation between staff.

Consequences

Serious harm or death, emergency admission, formal review of the case and loss of public trust.

Existing controls

  • Each client has a written risk formulation reviewed at every session.
  • An on-call clinician can be reached outside office hours.

Control gaps

Risk updates are recorded as notes and are not always reviewed by a second clinician.

Additional controls

  • Prevent: Use a structured risk screen at intake and at each review, with set triggers for escalation.
  • Detect: Review flagged messages and missed appointments daily and log any change in risk.
Likelihood 4 x impact 5 before; 2 x 4 after Owner: Clinical lead Target: Within 30 days Early warning: Two or more missed sessions with a reported rise in risk or distress.
H02

Failure to recognize symptom deterioration or treatment drop out

Safety Before 15 After 8

Symptoms or daily functioning worsen, or a client stops attending, and the change is not noticed because outcome measures are completed but not discussed or compared with earlier results.

Who or what is affected: Clients, supervisors and referring services

Causes

Scores completed without discussion, heavy caseloads and avoidance of difficult feedback.

Consequences

Harm continues unnoticed, treatment fails, the client drops out and presents in crisis later.

Existing controls

  • Routine outcome measures are completed at intake and every few sessions.
  • Clinicians discuss progress in weekly supervision.

Control gaps

Measures are scored on paper and results are not checked against the previous review.

Additional controls

  • Detect: Flag any client whose score worsens on two consecutive measures for review within a week.
  • Respond: Agree a step up plan with the client, such as more frequent sessions or referral for a higher level of care.
Likelihood 3 x impact 5 before; 2 x 4 after Owner: Supervising psychologist Target: Within 45 days Early warning: Two consecutive worsening scores on the same outcome measure.
H03

Inadequate informed consent and inaccurate treatment records

Legal and compliance Before 9 After 4

Clients begin treatment without a clear understanding of the approach, risks, limits of confidentiality and their right to withdraw, or session notes are late, incomplete or inaccurate.

Who or what is affected: Clients, clinicians and the service in any review or complaint

Causes

Long forms, time pressure and consent treated as a one off signature.

Consequences

Complaints, challenged consent, unsafe decisions and difficulty defending the record.

Existing controls

  • A written consent form is signed before the first treatment session.
  • Notes are written within an agreed period after each session.

Control gaps

Consent is not revisited when the treatment plan or the risks change.

Additional controls

  • Prevent: Use a plain language consent checklist covering confidentiality limits, risks and withdrawal rights, and review it at each new phase.
  • Detect: Audit a sample of notes each quarter for completeness, timing and consent records.
Likelihood 3 x impact 3 before; 2 x 2 after Owner: Clinical governance lead Target: Within 60 days Early warning: A client file with no signed consent or with notes older than the agreed period.
H04

Breach of confidentiality in records, email and messaging

Technology and data Before 16 After 6

Session notes, letters or results are sent to the wrong person, left on shared screens, or shared through unsecured email or messaging, exposing sensitive personal information.

Who or what is affected: Clients, families, referrers and staff

Causes

Busy clinicians, mistyped addresses and shared devices in consulting rooms.

Consequences

Distress to clients, a reportable incident, loss of trust and disciplinary action.

Existing controls

  • Records are held in a password protected clinical system with individual log ins.
  • Staff complete confidentiality training each year.

Control gaps

Letters are printed and posted without a second check of the address.

Additional controls

  • Prevent: Use an approved secure messaging route and block personal email for clinical content.
  • Detect: Review access logs each month and check for unusual record views or exports.
Likelihood 4 x impact 4 before; 2 x 3 after Owner: Information governance lead Target: Within 30 days Early warning: Repeated misdirected letters or emails reported by staff in one month.
H05

Unsafe handover, cover gaps and unsupervised trainee practice

People Before 12 After 6

A client's risk, plan or open tasks are not passed on when a clinician leaves, goes on leave or is absent, or a trainee is left to manage a session without adequate supervision.

Who or what is affected: Clients, covering clinicians and assistant staff

Causes

Short notice absences, high caseloads and handovers done by memory or email.

Consequences

Missed risk, repeated assessment, client frustration and poorer care.

Existing controls

  • A handover template lists open risks and next steps.
  • Trainees are supervised by a registered clinician.

Control gaps

The handover template is not used consistently and cover rules are not written down.

Additional controls

  • Prevent: Set a rule that no trainee leads risk sessions without an approved supervision plan.
  • Recover: Hold a same day case handover call when cover changes and file the note in the record.
Likelihood 3 x impact 4 before; 2 x 3 after Owner: Clinical lead Target: Within 30 days Early warning: A case handed over with no written handover note on file.
H06

Boundary violations and dual relationships

Reputational Before 10 After 4

A clinician develops a personal, financial or social relationship with a client, or shares personal contact details or social media connections, which harms the therapeutic frame and the client's safety.

Who or what is affected: Clients, clinicians and the reputation of the service

Causes

Small local communities, blurred roles on social media and isolation in private practice.

Consequences

Harm to the client, professional sanctions, legal claims and loss of trust in the service.

Existing controls

  • A written professional boundaries policy is given to all staff at induction.
  • Clinicians declare any existing link with a client before accepting a referral.

Control gaps

Declared links are not checked against the caseload each year.

Additional controls

  • Prevent: Require supervisor approval before any client is accepted where a personal link is declared.
  • Respond: Provide a confidential route to raise concerns and act promptly on any allegation.
Likelihood 2 x impact 5 before; 1 x 4 after Owner: Clinical lead Target: Within 60 days Early warning: A declared personal link that is not recorded on the client file.
H07

Infection transmission and exposure in shared clinic spaces

Safety Before 6 After 3

Shared waiting areas, reception surfaces and face to face rooms can spread infection, and clients who are unwell may attend without being asked about symptoms at booking.

Who or what is affected: Clients, staff and visitors

Causes

Crowded waiting rooms, cleaning done by rota and symptoms not asked about at booking.

Consequences

Staff absence, client infection, closure of rooms and complaints.

Existing controls

  • Hand gel is available and waiting areas and rooms follow a cleaning schedule.
  • Staff may move a session to video when a client reports symptoms.

Control gaps

The cleaning log is not checked by a manager and symptom questions are not asked at booking.

Additional controls

  • Prevent: Ask clients to rearrange face to face sessions when they report symptoms, with clear guidance on what to do.
  • Detect: Check cleaning logs weekly and record any missed tasks.
Likelihood 2 x impact 3 before; 1 x 3 after Owner: Practice manager Target: Within 30 days Early warning: Cleaning log entries missed for two consecutive weeks.
H08

Failure of video, record or outcome tool supplier

Supplier Before 9 After 4

The video platform, electronic record or outcome tool suffers an outage, data loss or security failure, so sessions cannot run, notes are lost or risk information is not available when needed.

Who or what is affected: Clients, clinicians and administrative staff

Causes

A single supplier, internet outages and updates applied without testing.

Consequences

Cancelled sessions, lost clinical information and a delayed response to risk.

Existing controls

  • The supplier provides a service level agreement and a support line.
  • Notes are saved in the system as they are written.

Control gaps

The downtime procedure has not been practised and contact numbers are out of date.

Additional controls

  • Recover: Keep a written downtime procedure with paper risk forms and a contact list for clients.
  • Detect: Test the video link and record access before the start of each clinic day.
Likelihood 3 x impact 3 before; 2 x 2 after Owner: Service manager Target: Within 45 days Early warning: Two or more system outages in one month during clinic hours.

Rating method and evaluation

Each risk is rated on two five-point scales. Likelihood runs from Rare to Almost certain, and impact runs from Insignificant to Catastrophic, judged on client harm, privacy and service loss. Multiplying the two gives a score from 1 to 25 in four bands: Low from 1 to 4, Medium from 5 to 9, High from 10 to 16 and Critical from 17 to 25. Inherent risk is the score before any controls are applied. Residual risk is the score after the existing and additional controls are in place, and it can never be higher than the inherent score. Where the inherent score is 10 or more, the residual score must be lower, so a control must be shown to work. Critical and High risks need senior attention and a dated plan. Medium risks need routine controls with a named owner, and Low risks are accepted and monitored. Ratings are challenged by the clinicians who do the work, through supervision and case review, and by a second reader for any risk touching client safety. Ratings are reviewed whenever a monitoring indicator reaches its threshold or an incident occurs.

Likelihood, impact and rating bands

Likelihood

  • 5 Almost certain: Expected to happen in most circumstances.
  • 4 Likely: Will probably happen in many circumstances.
  • 3 Possible: Could happen at some time.
  • 2 Unlikely: Not expected, but it could happen.
  • 1 Rare: Only in exceptional circumstances.

Impact

  • 1 Insignificant: No lasting effect. Handled within routine work.
  • 2 Minor: Small effect that is quickly corrected.
  • 3 Moderate: Noticeable effect that needs managed effort to correct.
  • 4 Major: Serious effect on people, delivery or reputation.
  • 5 Catastrophic: Severe or lasting effect that threatens the whole activity.

Bands (likelihood x impact)

  • Low (1 to 4): Accept and monitor.
  • Medium (5 to 9): Manage with routine controls.
  • High (10 to 16): Senior attention and a treatment plan.
  • Critical (17 to 25): Act first. Do not proceed until reduced.

Monitoring, escalation and review

Review this assessment every 6 months, and sooner when an indicator below reaches its threshold.

Early-warning indicators and escalation thresholds
Indicator to watchEscalate when
Clients with a risk rating raised but no documented review within 48 hours.Escalate to the clinical lead the same day, and to the service director if the review is still open after 72 hours.
Clients with two consecutive worsening outcome scores and no case review recorded.Escalate to the supervising psychologist within a week, and to the clinical lead if no review is recorded after 14 days.
Misdirected or insecure messages reported in the month.Escalate to the information governance lead at once, and to the data protection officer where the service policy requires it.
Cases handed over without a written handover note on file.Escalate to the clinical lead at the end of the week, and to the service director if a client's safety is affected.
Cleaning log entries missed for two consecutive weeks.Escalate to the practice manager, and to the service manager if the gap continues for a further week.

Contingency arrangements

If a client is assessed as at imminent risk, the clinician follows the agreed emergency plan, stays with the client where safe, contacts the on-call clinician and arranges urgent help through the local emergency route. A serious incident is recorded, the service director is informed the same day, and the record is preserved. If the record or video system fails, paper downtime forms are used, a clinician checks that each client's current risk is known, and the supplier is contacted. Clients are told promptly and plainly what is happening and how to reach help.

Prioritized action plan

  1. Introduce a structured risk screen with set escalation triggers, owner clinical lead, within 30 days.
  2. Make two consecutive worsening outcome scores a trigger for case review, owner supervising psychologist, within 45 days.
  3. Restrict risk sessions to registered clinicians and use one handover template, owner clinical lead, within 30 days.
  4. Confirm secure messaging routes and check address details before posting letters, owner information governance lead, within 30 days.
  5. Write a downtime plan with paper forms and test it with the supplier, owner service manager, within 45 days.

Conclusion

Safe psychological care depends on steady habits: structured risk review, honest outcome measurement, clear consent, careful handovers, secure records and tested downtime plans. The highest scores sit with missed risk escalation and confidentiality breaches, and each has controls that lower the residual score. Treat the register as a living record, review it every six months and after any incident, and seek qualified clinical, legal and professional advice for any real case or service decision.

Assumptions and limitations

Assumptions

  • The service is a community psychological therapy practice with registered clinicians supervised within a clinical governance structure.
  • Jurisdiction, funding model and professional registration arrangements are not specified, so duties are described in general terms only.
  • Clients are adults seen in person and by video, and records are held electronically with paper backup.

Limitations

  • The scores are examples for learning and do not describe any real service or client group.
  • Clinical, legal and professional duties vary by place and change over time, so specialist review is needed.
  • This is educational content and does not replace a formal site-specific risk assessment or licensed clinical supervision.

Related frameworks to study

  • Hierarchy of controls
  • Structured clinical risk formulation models
  • Plan, do, check, act improvement cycle
  • Professional codes of ethics for psychological practice

Healthcare Risk Assessment

China, India, United States, Indonesia, Pakistan, Nigeria, Brazil, Bangladesh, Russia, Japan, Mexico, Philippines, Vietnam, Egypt, Turkey, Germany, United Kingdom, France, Italy, Canada, South Korea, Australia, Spain.

For Learning Reference Only: This assessment demonstrates how risk assessment principles are applied in a practical setting, providing a useful reference for learning and understanding. Actual assessments may be adapted to suit specific site conditions and circumstances.

Keep learning

Study the subject behind this assessment.

Clinical Psychology and Psychotherapy course Read the best practices for this course

More Healthcare risk assessments

Hourly Active: 45,552 Learners