vaayaa Inclusive Education
Healthcare risk assessment

Health Information Management and Medical Records Risk Assessment: Record Accuracy, Privacy and Continuity

A worked example showing how a health information team finds, scores and controls risks to accurate medical records, patient identity, privacy, system availability and safe handover of clinical information.

Updated November 2026 8 hazards assessed Review every 6 months Highest risk: Critical to Medium
See the Health Information Management and Medical Records course

Executive summary

This assessment shows how a hospital health information team can find, rate and control the risks that threaten accurate medical records and the safe use of the information in them. Eight risks were chosen because they are plausible in daily records work, from incomplete notes and identity mix-ups to privacy breaches, system outages and supplier dependence. Access and privacy risks and patient identification carry the highest inherent scores, so they receive the strongest controls. Each risk is scored before controls and again after existing and added controls. Most fall to Low or Medium once the added controls are in place, but identity errors and system outages stay at Medium because the impact on patients remains serious. The first actions are mandatory allergy fields, role-based access, a tested downtime procedure and a standard handover tool. The scores are a teaching example, so they illustrate method rather than describe a real service.

Focus area
Health information management and medical records
Setting
Health information management team in a hospital and outpatient clinics that create, store and release medical records
Method
Five by five likelihood and impact risk register

Scope

This assessment covers paper and electronic medical records in a general hospital and its outpatient clinics, from registration and clinical documentation to release, retention and disposal. It addresses record accuracy, links to patient safety, privacy, system continuity and supplier dependence. Jurisdiction, legal duties and the clinical systems in use are not specified, so they are treated as assumptions. It does not give clinical or legal advice.

Context

The team includes a records manager, coding staff, registration clerks, an information systems lead and clinicians who document care. A hosted electronic record platform is supplied by an outside vendor, and older files sit in paper archives. Records are created at registration, updated during treatment and released to clinicians, insurers and patients on request. Each risk is scored before controls to show its natural level, then again after the existing controls and the additional controls recommended here.

Objectives, assets and stakeholders

The objective is to keep medical records accurate, complete, available when needed and private, so that patients receive safe care and the service meets its duties to patients and regulators. The assets in scope are the electronic record system, paper archives, the clinical notes and results held in them, coding data, consent records and the trust placed in the service. Stakeholders include patients and families, clinicians, nurses, coders, the information governance team, the vendor and regulators. Each risk has one owner role, and the records manager reports the register to the clinical governance committee each quarter.

Risk matrix: before and after controls

Each cell shows hazard numbers placed by likelihood and impact. Compare the two grids to see how controls move each hazard.

Before controls

Inherent risk

Risk before controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain
4 Likely Likelihood 4, impact 3, score 12, high: H06 Likelihood 4, impact 4, score 16, high: H01 Likelihood 4, impact 5, score 20, critical: H02
3 Possible Likelihood 3, impact 3, score 9, medium: H07 Likelihood 3, impact 4, score 12, high: H04 H05 Likelihood 3, impact 5, score 15, high: H03
2 Unlikely Likelihood 2, impact 4, score 8, medium: H08
1 Rare

After controls

Residual risk

Risk after controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain
4 Likely
3 Possible
2 Unlikely Likelihood 2, impact 2, score 4, low: H07 Likelihood 2, impact 3, score 6, medium: H01 H04 H05 H06 Likelihood 2, impact 4, score 8, medium: H02 H03
1 Rare Likelihood 1, impact 3, score 3, low: H08
  • Low 1 to 4
  • Medium 5 to 9
  • High 10 to 16
  • Critical 17 to 25

Hazard register

A summary first, then the detail for each hazard.

Summary of hazards with scores before and after controls
No.HazardBeforeAfterOwner
H01 Incomplete or inaccurate clinical documentation 16 High 6 Medium Clinical records manager
H02 Unauthorized access and privacy breach 20 Critical 8 Medium Information governance lead
H03 Patient identification and record mix-up 15 High 8 Medium Registration services manager
H04 Electronic record system outage 12 High 6 Medium Information systems lead
H05 Consent and disclosure errors 12 High 6 Medium Information governance lead
H06 Handover gaps and staffing shortfalls 12 High 6 Medium Ward nurse manager
H07 Coding and billing inaccuracies 9 Medium 4 Low Coding manager
H08 Hosted platform and supplier dependence 8 Medium 3 Low Procurement and contracts lead
H01

Incomplete or inaccurate clinical documentation

Operational Before 16 After 6

Notes are late, missing key details or recorded against the wrong episode, so clinicians act on an incomplete picture of the patient's history, allergies or current treatment.

Who or what is affected: Patients, treating clinicians and the records team

Causes

Heavy workloads, templates that are skipped under pressure and unclear documentation standards.

Consequences

Repeat tests, delayed treatment, wrong decisions and a complaint or claim.

Existing controls

  • Clinical notes must be signed before a ward round closes.
  • Monthly audit samples a small set of charts for completeness.

Control gaps

Audit samples are small, and nobody checks whether templates are completed in full.

Additional controls

  • Prevent: Make allergy and medication fields mandatory before the record can be closed.
  • Detect: Run weekly reports of unsigned notes and open episodes older than 48 hours.
Likelihood 4 x impact 4 before; 2 x 3 after Owner: Clinical records manager Target: Within 45 days Early warning: Unsigned clinical notes older than 48 hours on any ward.
H02

Unauthorized access and privacy breach

Technology and data Before 20 After 8

Staff or outsiders view, copy or send records without a clinical or legal reason, or shared log in details let a person reach records they should not see, exposing sensitive information.

Who or what is affected: Patients, staff and the wider public

Causes

Shared logins, broad access rights and curiosity about known people.

Consequences

Harm to patient trust, disciplinary action, complaints and regulator attention.

Existing controls

  • Staff sign in with individual accounts.
  • Access to restricted records needs a reason to be entered.

Control gaps

Access rights are rarely removed when staff change roles, and logs are not reviewed.

Additional controls

  • Prevent: Apply role-based access so each user sees only what the role needs.
  • Detect: Review access logs for unusual searches on high profile or related patient records.
Likelihood 4 x impact 5 before; 2 x 4 after Owner: Information governance lead Target: Within 30 days Early warning: A user who opens a high number of records outside their assigned patient list.
H03

Patient identification and record mix-up

Safety Before 15 After 8

Two patients with similar names or dates of birth are merged or confused, so results, letters or medication details are filed to the wrong record and acted on for the wrong person.

Who or what is affected: Patients, nurses, doctors and pharmacists

Causes

Similar names, rushed registration in emergencies and weak duplicate checks.

Consequences

Wrong treatment, delayed diagnosis, incident reports and serious harm.

Existing controls

  • Two identifiers are checked before a sample is taken.
  • Duplicate patient alerts appear at registration.

Control gaps

Duplicate alerts are overridden without a second check, and merges are not reviewed.

Additional controls

  • Prevent: Require a photo or wristband check at admission and before any transfusion or medicine.
  • Respond: Stop the record, notify the records manager and reconcile results within one working day.
Likelihood 3 x impact 5 before; 2 x 4 after Owner: Registration services manager Target: Within 30 days Early warning: Overridden duplicate alerts or merged records without a second reviewer.
H04

Electronic record system outage

Technology and data Before 12 After 6

The record system or network fails during a busy period, so staff cannot view histories, order tests or document care, and paper fallbacks are slow or incomplete.

Who or what is affected: Patients, ward staff and the information systems team

Causes

Power or network failure, software faults and planned maintenance that overruns.

Consequences

Delayed care, duplicate testing, lost entries and staff stress.

Existing controls

  • Nightly backups of the record database are kept.
  • A printed summary of key patient data is kept at each ward.

Control gaps

Downtime forms are out of date, and staff have not practiced the procedure.

Additional controls

  • Recover: Test a full restore each quarter and record the time taken.
  • Respond: Activate a downtime procedure with paper forms and a named coordinator within 30 minutes.
Likelihood 3 x impact 4 before; 2 x 3 after Owner: Information systems lead Target: Within 45 days Early warning: Repeated slow log in times or failed connections on any ward.
H05

Consent and disclosure errors

Legal and compliance Before 12 After 6

Records are released to an insurer, family member or other party without valid consent or a lawful reason, or a patient's wishes about sharing are not recorded and followed.

Who or what is affected: Patients, families and requesting parties

Causes

Unclear rules on who may receive information, and consent recorded on paper only.

Consequences

Complaints, regulator reports, loss of trust and possible legal action.

Existing controls

  • Release requests must be made in writing.
  • A consent form is kept on file for each patient.

Control gaps

Consent flags are not linked to the release process, and samples are rarely taken.

Additional controls

  • Prevent: Check consent flags on the record before any release is made.
  • Detect: Sample a set of releases each month against the request and consent record.
Likelihood 3 x impact 4 before; 2 x 3 after Owner: Information governance lead Target: Within 60 days Early warning: A release sent without a matching consent entry on the record.
H06

Handover gaps and staffing shortfalls

People Before 12 After 6

Shift changes or thin staffing leave records unfinished or key details unspoken, so the next team does not know what is pending, what was tried or what must happen next.

Who or what is affected: Patients, incoming staff and the ward manager

Causes

Short staffing, reliance on memory and busy periods without a senior nurse present.

Consequences

Missed tasks, repeat work, delayed treatment and patient harm.

Existing controls

  • A structured handover sheet is used at each shift change.
  • Agency staff receive a short induction before working alone.

Control gaps

Handover sheets are often incomplete, and no one audits their quality.

Additional controls

  • Prevent: Use a standard handover tool that lists pending results, risks and actions.
  • Respond: Escalate to the duty manager when a shift starts with unfinished tasks or no named lead.
Likelihood 4 x impact 3 before; 2 x 3 after Owner: Ward nurse manager Target: Within 30 days Early warning: Handover sheets with blank fields or pending tasks older than one shift.
H07

Coding and billing inaccuracies

Financial Before 9 After 4

Diagnoses or procedures are coded incorrectly from incomplete notes, so claims are wrong, payments are reversed and the data used for planning becomes unreliable.

Who or what is affected: Coders, finance staff, payers and planners

Causes

Vague notes, pressure to close accounts quickly and unclear coding guidance.

Consequences

Under or over payment, audit findings, repayment demands and poor planning data.

Existing controls

  • Coders check notes before final coding.
  • Claims are reviewed by a senior coder above a set value.

Control gaps

Queries to clinicians are not tracked, so patterns of weak documentation go unnoticed.

Additional controls

  • Prevent: Query the clinician when a note does not support the code assigned.
  • Detect: Compare a monthly sample of coded episodes with the source notes.
Likelihood 3 x impact 3 before; 2 x 2 after Owner: Coding manager Target: Within 60 days Early warning: A rise in coding queries or reversed claims for one clinical team.
H08

Hosted platform and supplier dependence

Supplier Before 8 After 3

The outside vendor that hosts the record platform fails, changes terms or ends support, so access to data, data export or service upgrades are delayed or lost.

Who or what is affected: Patients, clinical staff and the procurement team

Causes

Reliance on one supplier, weak exit terms and limited internal technical skills.

Consequences

Loss of access to records, forced migration, cost overruns and delayed care.

Existing controls

  • The contract includes a service level for uptime.
  • Data is exported to a second store each month.

Control gaps

The monthly export has never been tested for full readability.

Additional controls

  • Prevent: Require the vendor to state data return terms and exit steps in the contract.
  • Respond: Review the vendor's performance each quarter and trigger the exit plan after two missed service levels.
Likelihood 2 x impact 4 before; 1 x 3 after Owner: Procurement and contracts lead Target: Within 90 days Early warning: Vendor service level misses or late notice of changes to support.

Rating method and evaluation

Each risk is rated on two five-point scales. Likelihood runs from 1, rare, to 5, almost certain, and impact runs from 1, minor, to 5, severe, with patient harm weighted most heavily. Multiplying the two gives a score from 1 to 25, which falls into one of four bands: Low from 1 to 4, Medium from 5 to 9, High from 10 to 16 and Critical from 17 to 25. The score guides the order of work and is not a precise measurement. Inherent risk is the score before any controls. Residual risk is the score after the existing and added controls, and it must never be higher than the inherent score. Any risk still High needs senior attention and a dated plan, any Medium needs routine controls with a named owner, and any Low is accepted and watched. Staff who handle records should challenge the ratings, and each risk is reviewed whenever its warning indicator reaches its threshold or after a reportable incident.

Likelihood, impact and rating bands

Likelihood

  • 5 Almost certain: Expected to happen in most circumstances.
  • 4 Likely: Will probably happen in many circumstances.
  • 3 Possible: Could happen at some time.
  • 2 Unlikely: Not expected, but it could happen.
  • 1 Rare: Only in exceptional circumstances.

Impact

  • 1 Insignificant: No lasting effect. Handled within routine work.
  • 2 Minor: Small effect that is quickly corrected.
  • 3 Moderate: Noticeable effect that needs managed effort to correct.
  • 4 Major: Serious effect on people, delivery or reputation.
  • 5 Catastrophic: Severe or lasting effect that threatens the whole activity.

Bands (likelihood x impact)

  • Low (1 to 4): Accept and monitor.
  • Medium (5 to 9): Manage with routine controls.
  • High (10 to 16): Senior attention and a treatment plan.
  • Critical (17 to 25): Act first. Do not proceed until reduced.

Monitoring, escalation and review

Review this assessment every 6 months, and sooner when an indicator below reaches its threshold.

Early-warning indicators and escalation thresholds
Indicator to watchEscalate when
Unsigned clinical notes older than 48 hours on any ward.Escalate to the ward nurse manager when any note is older than 48 hours, and to the clinical records manager after one week.
Users who open a high number of records outside their assigned patient list.Escalate to the information governance lead at once, and suspend the account pending review if misuse is suspected.
Overridden duplicate patient alerts or merged records without a second reviewer.Escalate to the registration services manager on the same day, and to the clinical governance committee if harm is possible.
System downtime longer than 30 minutes or failed quarterly restore test.Escalate to the information systems lead at once, and to the chief operating officer if downtime continues beyond two hours.
Releases sent without a matching consent entry on the record.Escalate to the information governance lead within one working day, and to the caldicott or privacy lead for any disclosure outside the service.

Contingency arrangements

If a serious event occurs, such as a confirmed privacy breach, a prolonged system outage or a patient identity error, the records manager activates the downtime or incident procedure and stops related releases. The information systems lead isolates affected accounts and restores data from the latest tested backup. The information governance lead notifies the clinical governance committee and the relevant authorities as the applicable rules require. Clinicians check the affected patients directly, and families are told what they need to know early and plainly.

Prioritized action plan

  1. Enforce role-based access and review logs for unusual searches, owner information governance lead, within 30 days.
  2. Apply two identifier checks and duplicate alert review at registration, owner registration services manager, within 30 days.
  3. Test the downtime procedure with paper forms on each ward, owner information systems lead, within 45 days.
  4. Introduce a standard handover tool with mandatory fields, owner ward nurse manager, within 30 days.
  5. Link consent flags to the release process and sample releases monthly, owner information governance lead, within 60 days.

Conclusion

Reliable medical records depend on a few steady habits: complete notes, safe identity checks, role-based access, tested downtime plans, clear handovers and careful release of information. The highest scores sit with access control and patient identification, and each has actions that bring the residual score down. Treat the register as a living record, review it on the stated cycle, and seek qualified clinical, legal and privacy advice for any real decision about patient care or information release.

Assumptions and limitations

Assumptions

  • Jurisdiction is not specified, so privacy, consent and retention duties are described in general terms only.
  • The hospital uses one electronic record system with paper archives for older files.
  • Clinicians are licensed, and documentation standards are set by a clinical governance committee.

Limitations

  • The scores are teaching examples and do not describe any real service, system or incident.
  • Clinical safety and privacy rules vary by jurisdiction, so specialist review is needed.
  • This is educational content and does not replace a formal site-specific assessment or licensed advice.

Related frameworks to study

  • Clinical governance and risk management cycle
  • Hierarchy of controls
  • Three lines model of risk ownership
  • Plan, do, check, act improvement cycle

Healthcare Risk Assessment

China, India, United States, Indonesia, Pakistan, Nigeria, Brazil, Bangladesh, Russia, Japan, Mexico, Philippines, Vietnam, Egypt, Turkey, Germany, United Kingdom, France, Italy, Canada, South Korea, Australia, Spain.

For Learning Reference Only: This assessment demonstrates how risk assessment principles are applied in a practical setting, providing a useful reference for learning and understanding. Actual assessments may be adapted to suit specific site conditions and circumstances.

Keep learning

Study the subject behind this assessment.

Health Information Management and Medical Records course Read the best practices for this course

More Healthcare risk assessments

Hourly Active: 45,552 Learners