Incident Studio / INC-013
Ask Qyro or search⌘K New
INC-013 · Hillside Surgery · reported 2 Oct 2026, 09:05

Duplicate patient record created

2Minor harm possiblePriorityP2OwnerZYStep 6 of 9
H-15 Identity mismatchCAPA-009Hillside portal

1. Capture

Done
Reported by
[Practice manager], Hillside Surgery, through the Trust Portal
Occurred
1 Oct 2026, 16:40
Product
AI Triage Platform 2.3
What happened
A returning patient with a hyphenated surname was given a new record instead of being matched
Patients affected
1
Harm
None known
Immediate action
Practice linked the records manually
Attachments
Screenshot.png

2. Triage

Done
Severity
Minor harm possible · likelihood possible
Priority
P2 · triage deadline met
MHRA
Not reportable: no harm, assessed 2 Oct
ICO
Not a personal data breach: nothing disclosed
LFPSE
Practice’s decision · not reported
Triaged by
Zak Yahiya, 2 Oct 11:20 · Qyro draft accepted

3. Engagement

Done
StakeholderRoleLast contactNext update
[Practice manager]Reporter9 Oct · portal16 Oct
[Clinical lead], HillsideDeploying CSO9 Oct · call16 Oct
Zak YahiyaSupplier CSO––
[DPO]Data protection2 Oct · emailClosed
Duty of candour
Not required: no harm
Communications
4 logged · Open log

4. Risk assessment

Done
Hazard
H-15 Patient identity mismatch known hazard
Risk now
Major × low, 8
Proposed
Major × medium, 12 · Suggested by Qyro
Containment
Practices asked to check matches for hyphenated surnames · sent 3 Oct

5. Replication

Done
Reproduced
Yes, 4 of 5 attempts
Environment
Staging, release 2.3
Steps
Register “Smith-Jones”, return as “Smith Jones”
Evidence
Screen recording Matching logs
By
[Engineer], 7 Oct

6. Root cause and CAPA

In progress
Root cause drafted by Qyro · confirm before it counts
Method
5 whys
Contributing
Technical: matching ignores punctuationProcess: no test case for name variants
Root cause
Patient matching compares surnames exactly, so spelling variants of the same name create a new record
CAPA-009Corrective: match surname variantsOwner [Engineer] · due 30 OctDraft CAPA-009Preventive: name-variant tests in every releaseOwner [Quality lead] · due 6 NovDraft

7. Risk management

To do
Hazard log
H-15 updated with this cause and the new control
Residual risk
Re-estimated after the fix
Safety case
Update needed? CSO decides
Sign-off
Supplier CSO

8. Delivery

To do
Fix
Release and version
Change control
Runs through the Change control workflow
Verified
Test evidence attached
Customers told
Release note through each Trust Portal

9. Closure

To do
Closure checks
All CAPAs done · hazard log updated · reporter told
Effectiveness
Check scheduled by the Planner
Learning
Summary shared with staff and the practice
Closed by
Owner, with CSO approval