The Silence Before the Harm: When Staff Don't Feel Safe to Report Near Misses

A near miss is the cheapest lesson a healthcare organisation will ever get, pretty much free feedback data. Nobody was harmed, nothing needs putting right, and the system has just shown you exactly where it's weak.

All it costs is someone being willing to say so.

When staff don't feel safe to report, that lesson is lost. And the organisation usually doesn't notice, because the most visible sign of a silent culture is a reassuringly short incident log.

What the numbers say

The 2025 NHS Staff Survey, published in March 2026, gives a clear picture of how staff feel about reporting:

•      59.3% said their organisation treats staff involved in an error, near miss or incident fairly. Put another way, around four in ten didn't.

•      71.1% said they would feel secure raising concerns about unsafe clinical practice.

•      55.5% were confident their organisation would address their concern.

•      33.7% had seen an error, near miss or incident in the last month that could have hurt staff or patients.

All three confidence measures fell slightly on the year before. The survey covers NHS staff, not the independent sector, but there's no reason to assume private providers are doing better. In some ways it's harder.

Why staff stay quiet

The reasons are rarely dramatic. They tend to be ordinary, and they add up.

Fear of blame. If the last person who reported something ended up in a disciplinary meeting, everyone noticed.

Nothing happens. If reports disappear into a system and nobody hears back, people stop bothering.

"It was fine in the end." A near miss feels like a non-event. Staff don't see why they should fill in a form about something that didn't happen.

It takes too long. A busy shift and a clunky reporting system is a reliable way to lose near-miss data.

Hierarchy. Raising a concern about a senior colleague's practice feels risky, especially for junior, bank or agency staff.

The independent sector twist

Private and independent providers face some extra pressures. Teams are often small, so a report can be hard to make anonymously. Many consultants work under practising privileges, and they may also bring commercial value to the hospital. A nurse questioning a consultant's practice may wonder, privately, whether the organisation will back her or the person who brings in the work. It may have seemed that in harmful events, the last person to touch the patient was blamed.

None of that is unique to private healthcare. But a board that hasn't asked the question directly can't know how its staff would answer it.

What silence costs

Unreported near misses don't disappear. They repeat, until one of them doesn't stay a near miss.

There's a governance cost too. A low incident rate is easy to read as good news. Often it's the opposite: a sign that people have stopped reporting. Under the Patient Safety Incident Response Framework (PSIRF), organisations are expected to learn from patient safety events rather than focus on blame. And CQC's "Learning culture" quality statement looks for openness and honesty, concerns that are listened to, and lessons that are learned and shared. An organisation that hears very little from its staff will struggle to show any of that.

What good looks like

Make it fair, make it visible. A just culture approach separates honest mistakes and system problems from reckless behaviour. Staff need to see that in practice, not just read it in a policy.

Close the loop. Tell people what happened to their report. A short "you told us, we changed this" note does more for reporting than any campaign.

Make it quick. If it takes more than a few minutes, near misses won't get reported. Offer more than one route, including anonymous and verbal.

Thank people for near misses. Treat a near-miss report as good practice, because it is. Some organisations share a "good catch" each month.

Protect the person, not just the process. Make sure staff know they won't be treated badly for raising a concern in good faith, including about a senior colleague or a consultant with practising privileges.

Questions for your board

•      Is our reporting rate rising, falling or flat, and do we know why?

•      Which teams report the fewest incidents, and have we asked them why?

•      What share of our reports are near misses or no harm? A healthy reporting culture usually has plenty.

•      When did someone last tell us something about a senior clinician, and what happened to them afterwards?

The Harbour Governance team believes the best measure of a safety culture isn't how few incidents you report. It's how much you hear before anyone gets hurt.

The Law of Conservation of Paperwork.

Every so often, someone in healthcare finds a corner the regulator hasn't reached yet. A service that technically isn't a regulated activity. A process nobody has thought to write a form for. A brief, glorious patch of open ground.

Enjoy it. It won't last.

This week DHSC asked CQC to regulate diagnostic-only ADHD and autism assessments. For years these services sat in a gap in the wording of the regulations: a clinic could diagnose to its heart's content, provided it didn't then treat anyone. That gap is now being filled, as all gaps eventually are, with a registration application, a statement of purpose and a registered manager who is about to find out what a Regulation 18 notification is.

We've come to think of this as a law of nature. Energy can't be created or destroyed…and neither can paperwork.

It simply flows from places that have plenty to places that have none, until the whole system reaches equilibrium. This usually happens the week of your inspection.

A few observations from a career spent on wards, in law and in information systems:

• Any process that "doesn't need a policy" will need one the morning after the incident.

• The form you abolish in a streamlining exercise will be back within 18 months as a template, a checklist and a dashboard.

• "We'll document it later" is the most expensive sentence in healthcare.

• There's no such thing as an unregulated activity. There are only regulated activities that haven't been noticed yet.

• Every framework is eventually replaced by a new framework. That brings guidance, the guidance brings FAQs, and the FAQs bring clarifications. CQC's new frameworks land at the end of the year, and I've cleared some shelf space.

Now the serious bit, because as a governance consultant I'm contractually obliged to include one!

Health and safety professionals have a saying: regulations are written in blood. Behind almost every rule there's someone who got hurt before it existed.

Healthcare is no different. Bureaucracy tends to win because somewhere underneath it there's a patient who was let down while nobody was looking. The ADHD gap was where people could receive a poor service with no one checking, and closing it is the right call.

So if your service is sitting in a gap right now, the cheapest time to build good governance is before anyone tells you to.

You'll have to do it eventually. Better to do it on your own timetable than on CQC's.

The paperwork is coming. You may as well make friends with it.

CQC's Rebuild: Where It Actually Stands, and What It Means for You

CQC has spent the best part of two years publicly acknowledging what providers already knew‚ that its own systems were failing under the weight of backlogs, delayed reports, and inconsistent assessments. What's less widely understood is how much progress has actually been made, and where the gaps still sit. Worth knowing, because the pace of that rebuild directly shapes how often you're likely to be inspected, and what CQC will be looking for when you are.

How bad it got…

The rebuild followed two external reviews‚ by Dr Penny Dash and Professor Sir Mike Richards‚ that were unflinching about CQC's operational state. At the start of 2025, roughly 500 assessment reports were sitting in a backlog, unpublished. Providers were operating for months, sometimes longer, without knowing where they stood.

What's actually changed

The numbers are genuinely better. That backlog of around 500 reports has been reduced to just four. CQC set a target in April 2025 to publish 9,000 assessments by September 2026, and as of January 2026 it was ahead of that schedule, having completed over 5,000 since the previous April‚ including 50% more inspections in November 2025 than the same month a year earlier.

Structurally, CQC has appointed four permanent Chief Inspectors, each leading assessment teams organised around specific sector expertise rather than generic inspection capacity. That's a meaningful shift if you've previously felt inspected by someone without a clear grasp of how an independent provider actually operates. Registration has also had attention‚ a pilot to simplify and speed up home care registrations, a simpler registration form being tested, with plans to extend both across other sectors.

On the framework itself, CQC ran a consultation‚ Better Regulation, Better Care‚ which drew more than 1,600 responses, feeding into ongoing refinements of the assessment approach and how ratings get applied. That work is still live rather than finished.

What's still unresolved

Two things are worth watching rather than assuming are settled. First, the final shape of the revised assessment framework hasn't landed yet‚ the consultation feedback is still being worked through, so exactly how assessments and ratings will operate once the changes are finalised isn't yet locked in. Second, the digital and case management systems underpinning all of this are being rebuilt gradually, with full functionality not expected until later in the programme. Progress on process doesn't necessarily mean progress on the tools providers actually interact with day to day.

What this means for you

The practical read for independent providers is straightforward: inspection activity is increasing, not easing off, and it's increasing with more sector-specific expertise behind it. If you've been operating on the assumption that CQC's own struggles bought you time, that assumption is getting less safe by the month.

Recent enforcement action against an independent provider‚ UCS Medical, an ambulance service rated inadequate in early August with three warning notices issued‚ is a reminder that increased inspection volume is translating into real outcomes, not just more paperwork.

There's also a timing point worth flagging alongside our recent piece on HSSIB. CQC is absorbing new investigative responsibilities from HSSIB at the same time it's still mid-rebuild on its core inspection function. Whether that expansion sits comfortably alongside a regulator that's still catching up on its existing workload is a fair question, and one worth watching rather than assuming will resolve itself smoothly.

None of this changes the fundamentals of good governance‚ but it does raise the stakes on having your evidence genuinely current rather than assembled hastily before a visit. A regulator moving faster, with sharper sector expertise, is less likely to be satisfied by a policy that technically exists but hasn't been reviewed in eighteen months.

The bottom line

CQC's rebuild is real, not just presentational‚ the backlog numbers back that up. But "improving" and "settled" aren't the same thing, and the framework you'll eventually be assessed against is still being finalised.

The safest position is the one that doesn't depend on knowing exactly when CQC's changes land: governance and evidence that would hold up under scrutiny whenever the visit comes.

HSSIB's Abolition: What It Actually Means for Independent Providers

Most sector commentary on the Health Bill has focused on the big, headline structural changes‚ NHS England disappearing, the Secretary of State's powers expanding, ICBs being reshaped.

One change getting less attention deserves more, particularly if you're an independent provider: the Health Services Safety Investigations Body is being abolished, and its functions are moving into the Care Quality Commission.

That's not a footnote. It changes who investigates patient safety incidents, on what terms, and‚ for independent providers specifically‚ with what relationship to the body that also inspects and rates you.

What HSSIB actually does today

HSSIB was set up as a fully independent, arm's-length body carrying out no-blame patient safety investigations. Its remit already extends beyond the NHS: it investigates concerns across the NHS and in independent healthcare settings where the safety learning could also help improve NHS care.

The mechanism that makes this work is "safe space"‚ legal privilege over investigation evidence, meaning what staff tell HSSIB investigators can't be disclosed without the chief investigator's consent or a High Court order. The entire premise is that people speak more honestly when they know their words won't be used against them in a disciplinary or regulatory process. It's the same principle that underpins investigation branches in aviation and rail.

The critical structural feature, for our purposes, is separation. HSSIB investigates. CQC regulates. Different organisations, different purposes, and a firewall between the two.

What changes under the Bill?

The Health Bill folds HSSIB's investigative functions directly into CQC. This implements a recommendation from Dr Penny Dash's review of the patient safety landscape, which argued the current system is fragmented and needs consolidating. Report Stage and Third Reading in the Commons are scheduled for 7 September 2026, so this is close to settled rather than a distant possibility.

The concern being raised in Parliament isn't abstract. Once the organisation running "safe space" investigations is the same organisation that inspects your service, rates it, and can issue warning notices or move toward prosecution, the separation that made safe space credible starts to look harder to maintain in practice‚ even with internal protocols and process barriers in place. Recent parliamentary scrutiny has centred on exactly this: whether HSSIB's independence, and by extension the confidence staff have to speak openly, can survive being absorbed into a regulator with enforcement powers.

This isn't a theoretical worry from outside government either. CQC's own evidence to the committee scrutinising the Bill acknowledges it needs "maximum clarity" on how the safe space provisions will operate within CQC, and flags that the existing approval mechanism‚ Secretary of State sign-off before certain thematic reviews‚ needs to continue functioning without creating a regulatory gap. In other words, even CQC is asking for clearer rules on how it's meant to run something that was designed, from the outset, to be independent of it.

Why this matters specifically for independent providers

Two things are true at once. HSSIB already investigates in independent settings where the learning has wider relevance, so this isn't a new relationship being created from scratch. But independent providers arguably have more at stake in the safe space firewall holding, not less‚ you're already navigating a regulator that inspects you commercially as well as clinically, and staff confidence to disclose openly during an investigation matters just as much in a private setting as an NHS one, arguably more given smaller teams and less institutional distance between staff and leadership.

If safe space becomes something CQC administers rather than something a genuinely separate body guarantees, the practical question for your organisation becomes: how do you reassure your own staff that speaking to an investigation isn't functionally the same as speaking to your regulator? That's a governance and culture question your organisation will need to answer locally, regardless of how Parliament resolves the structural one.

What to do now

Nothing changes today‚ the Bill hasn't passed, and even after Royal Assent, the detail of how CQC operationalises this will come through secondary legislation and statutory guidance rather than the Act itself. But there's value in getting ahead of it:

• Watch for CQC's protocols, not just the Bill's passage. The operational detail, how CQC ring-fences investigation evidence internally, what staff training changes, what governance sits between the investigatory and regulatory arms‚ is where this will actually be decided.

• Revisit how your incident policies reference HSSIB. Any internal document, induction material, or duty of candour guidance that names HSSIB specifically will need updating once the transfer takes effect, and it's worth flagging now rather than scrambling later.

• Think about staff confidence, not just process. If your team already has reservations about raising concerns, a structural change to the body meant to protect their disclosures is exactly the moment those reservations either get addressed or get worse. A conversation now, framed honestly, costs little and buys goodwill.

We'll track this through Report Stage and flag what changes once the detail lands‚ this is very much a "watch this space" rather than a "here's what you must do" moment, but it's the kind of change that rewards early attention rather than a scramble after Royal Assent.

Governance Bingo: The Words You'll Hear in Every MDT Meeting

You know the meeting. Ten minutes in, someone says "going forward" and you feel it — the low hum of a hundred meetings just like this one, stretching back through your entire career.

We thought it was time someone wrote the bingo card.

The card

Print it, screenshot it, tape it under the boardroom table. Five across, five down, one free square in the middle for whoever brought biscuits.

Commonly Used Words in Governance Meetings.

Full house gets you nothing except the quiet satisfaction of having survived the meeting with your sense of humour intact.

Why we all talk like this

Here's the less funny bit, and it's worth two minutes of your day.

Jargon in governance meetings isn't just habit. It does actual work — some of it useful, most of it not.

The useful part: shorthand saves time between people who already share the same reference points. "Triangulate the data" means something specific to a room full of quality leads who've done it a hundred times. Said to a new starter, or worse, to a patient or family member, it means nothing at all.

The less useful part is what "robust" is really doing in most sentences. It's rarely describing anything. It's filling the space where a specific claim should be — the actual staffing ratio, the actual audit frequency, the actual number of incidents reviewed last quarter. "We have a robust incident reporting process" tells an inspector nothing. "We reviewed 94% of incidents within five working days last quarter, against a target of 90%" tells them everything.

That's the real cost. Not that jargon is annoying — though it is — but that vague language lets vague thinking hide in plain sight. A policy document full of "comprehensive frameworks" and "ongoing assurance" can sail through several review cycles without anyone checking whether it actually says anything. Precise language forces precise thinking, because you can't write a specific number or a specific date without first knowing it.

CQC inspectors have heard "we take a holistic approach" more times than any of us have. What lands, every time, is the plain sentence: what happened, what you did about it, what changed as a result.

A small challenge for your next document

Before you next write "robust," stop and ask what number, date, or named person would actually prove the point. Nine times out of ten, that's the sentence you meant to write.

Full marks if you get through the next MDT without needing your bingo card at all.

We'll believe it when we see it.

A Lost to Follow Up Tragedy

We wanted to write about a case that has hit pretty hard this week.

Paul Harries was an NHS manager who died in October 2024 from a ruptured abdominal aortic aneurysm (AAA), but this wasn’t a clinically silent condition. His aneurysm had been known about, monitored, and then lost.

The Prevention of Future Deaths report should be read carefully by every governance professional in the sector, and can be found here: 

https://www.judiciary.uk/prevention-of-future-death-reports/paul-harries-prevention-of-future-deaths-report/

Mr Harries AAA was initially diagnosed through the National AAA Screening Programme in November 2020 and referred on to the Vascular team at the Royal Sussex County Hospital. Following an initial assessment which showed a more complex picture, Mr Harries was further referred to the Assessment Unit (VAU) for scanning and monitoring. Monitoring by this team in January 2022 identified the aneurysm had increased in size.

In July 2022, Mr Harries missed a scheduled appointment and scan, no further action was taken and he was lost to follow up.

In February 2023,  Mr Harries attended ED after coughing blood for a week. He was scanned and the incidental finding showed a further increase in the size of the aneurysm. However, this information was not present in the discharge summary and his GP was not informed for 14 months.

In April 2024, Mr Harries' GP reviewed him for hypertension; became aware of the history of aneurysm and the more recent results, referring Mr Harries to the Vascular Team as ‘Urgent’.

Unfortunately the Vascular team operated a modified triage system, recategorised Mr Harries as ‘Amber’, which meant he would be triaged within six weeks and reviewed within around 40 weeks. This should have meant he was given the appropriate diagnostic tests by mid-May, and be reviewed by the team by mid-November.

A diagnostic scan in May 2024 showed the aneurysm was difficult to measure. His outpatient appointment, booked on 15 September 2024 was set for 19 October 2024.

Mr Harries died at home on 9 October 2024, two weeks before that appointment.

Mr Harries' family contacted PALS at The University Hospitals Sussex NHS Foundation Trust in February 2025, an inquest being opened on 25 September 2025. 

The coroner noted that there were four main areas of concern:

• a failure of safety netting and follow-up systems.

• Incidental finding communication - incidental findings not routinely communicated if they do not relate to the presenting complaint: 

• Urgent referral recategorisation: There was a failure to request of the GP their rationale behind the urgency.

• Long waits with a condition known to be deteriorating.

The Coroner went on to note that the changes made by the hospital "do not appear to fully resolve the observed weaknesses", and that the hospital remains reliant on three separate referral systems - which rely on three different IT systems.

We at Harbour are not writing this to apportion blame. 

The trust has responded with evident commitment to change, and the individuals involved were operating within systems that failed them as much as they failed Mr Harries.

We are highlighting this writing this because every one of these failures has a governance name:

• Failure of safety netting systems.

• Failure of information governance and clinical communication.

• Failure of triage governance and clinical oversight.

• Failure of risk stratification and escalation

The trust has since announced significant investment in a new Electronic Patient Record — and we genuinely hope it helps. A well-implemented EPR, with cross-specialty visibility and automated flagging of incidental findings, should make cases like Mr Harries less likely.

But here is the question that kept us discussing this into the night as governance professionals:

What happens when we digitise a broken system?

An EPR doesn't fix a culture where urgent referrals get recategorised without sufficient clinical oversight. It doesn't automatically resolve the question of who is responsible when a finding crosses specialty boundaries. It doesn't eliminate the human judgment call that sits at the centre of triage.

Done well, digital transformation closes the gaps. Done poorly, it makes them faster, more scalable, and so much harder to see.

The governance question for every provider investing in new digital systems right now is not just: will this EPR connect our data? 

It's: have we mapped our existing failure points honestly enough to know whether we're building something better — or just digitising what we already have?

None of these questions are unique to large NHS trusts, and Independent providers face the same risks, often with smaller teams, less infrastructure, and digital systems that were never designed to talk to each other.

Effective oversight of patient safety transcends administrative compliance; it represents the critical boundary between a clinical oversight and a tragic outcome.

In the context of Paul’s experience, several governance challenges remain unresolved:

• Where does the accountability lie for monitoring patients who miss scheduled imaging?

• How do we guarantee that unexpected clinical findings are effectively relayed to primary care?

• What are the mechanisms for justifying the recategorisation of urgent clinical referrals?

• Which specialty assumes primary responsibility when a diagnosis spans multiple departments?

Any framework unable to address these fundamental queries is fundamentally compromised. 

Without clear answers, we risk accelerating the pace of institutional failure.

Rest in peace, Paul Harries. We owe a debt of gratitude to his family and the coroner for their commitment to ensuring the healthcare sector learns from this loss.

Source: HSJ, 2025; https://www.judiciary.uk/prevention-of-future-death-reports/paul-harries-prevention-of-future-deaths-report

#PatientSafety #HealthcareGovernance #PSIRF #DigitalSafety #EPR #ClinicalGovernance #HarbourGovernance #IndependentHealthcare