vaayaa Inclusive Education
Healthcare risk assessment

Neurology and Neurodiagnostic Technology Risk Assessment: Patient Safety, Equipment, Privacy and Handover Controls

A worked example of how a neurodiagnostic testing service finds, scores and controls risks in EEG, nerve conduction and other neurophysiology work, from patient deterioration and infection to recording quality, privacy and staffing.

Updated November 2026 8 hazards assessed Review every 3 months Highest risk: Critical to Medium
See the Neurology and Neurodiagnostic Technology course

Executive summary

This assessment shows how a neurodiagnostic testing service can find, rate and control the risks that matter most to patients and to the reliability of results. Eight risks were chosen because they are plausible during everyday recording, activation and reporting work. Failure to recognize deterioration and a privacy breach are rated highest before controls, because they can cause serious harm. Equipment faults, infection transmission, activation injury and identity errors follow closely. Each risk is scored before controls and again after existing and added controls. Most fall to Medium or Low once controls are in place, but activation injury and deterioration recognition remain High because harm can occur quickly. The first actions are a written deterioration pathway, a standard electrode and cleaning routine, two identifier checks at every stage and encrypted storage with access logs. This is a teaching example, and specialist clinical and information governance review is needed for any real service.

Focus area
Neurology and neurodiagnostic technology
Setting
Neurodiagnostic testing service within a hospital neurology department, serving inpatients and outpatients
Method
Five by five likelihood and impact clinical risk register

Scope

This assessment covers the neurodiagnostic testing service of a hospital neurology department, including EEG, nerve conduction studies, electromyography and evoked potential recordings, from referral and preparation through testing, reporting and storage. It covers patient safety, infection control, equipment, records, privacy and staffing. Jurisdiction, local protocols and the specific equipment models are assumptions made for teaching.

Context

The service has neurophysiology technologists, a consultant neurologist who reviews each study, a clinical nurse for patients needing monitoring, a biomedical engineer who maintains equipment, and an administrative team that books studies and sends reports. Recordings are made on digital systems that connect to a shared patient record. Some tests involve activation such as flashing light or breathing steps, and some patients have seizures, heart or lung conditions or are unwell. Each risk is scored before controls to show its natural level, then again after existing controls and the controls that should be added.

Objectives, assets and stakeholders

The objective is to produce accurate, safe and timely neurodiagnostic results, protect patients from avoidable harm and infection, keep recordings private and secure, and maintain the trust of patients, referrers and regulators. Assets in scope include patients and their wellbeing, recording equipment and electrodes, the digital test records and images, the reporting pathway, and the reputation of the service. Stakeholders include patients and families, referring neurologists and general practitioners, technologists, nurses, the consultant neurologist, the biomedical engineering team, information governance staff and the service manager. Every risk has one owner role, and the clinical governance lead reviews the register each quarter with the service manager.

Risk matrix: before and after controls

Each cell shows hazard numbers placed by likelihood and impact. Compare the two grids to see how controls move each hazard.

Before controls

Inherent risk

Risk before controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain
4 Likely Likelihood 4, impact 3, score 12, high: H02 Likelihood 4, impact 4, score 16, high: H01 Likelihood 4, impact 5, score 20, critical: H06
3 Possible Likelihood 3, impact 3, score 9, medium: H07 Likelihood 3, impact 4, score 12, high: H03 H05
2 Unlikely Likelihood 2, impact 4, score 8, medium: H08 Likelihood 2, impact 5, score 10, high: H04
1 Rare

After controls

Residual risk

Risk after controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain
4 Likely
3 Possible
2 Unlikely Likelihood 2, impact 2, score 4, low: H02 H07 Likelihood 2, impact 3, score 6, medium: H03 H05 H08 Likelihood 2, impact 4, score 8, medium: H01 H04 H06
1 Rare
  • Low 1 to 4
  • Medium 5 to 9
  • High 10 to 16
  • Critical 17 to 25

Hazard register

A summary first, then the detail for each hazard.

Summary of hazards with scores before and after controls
No.HazardBeforeAfterOwner
H01 Failure to recognize patient deterioration during testing 16 High 8 Medium Consultant neurologist
H02 Equipment fault or poor signal corrupting recordings 12 High 4 Low Biomedical engineer
H03 Infection transmission through shared electrodes and equipment 12 High 6 Medium Infection control lead
H04 Harm during activation procedures such as flashing light or breathing steps 10 High 8 Medium Senior technologist
H05 Wrong patient identity or misfiled results 12 High 6 Medium Service manager
H06 Privacy breach and unlawful access to recordings 20 Critical 8 Medium Information governance lead
H07 Gaps in competence, staffing and shift handover 9 Medium 4 Low Clinical governance lead
H08 Vendor software or interface failure 8 Medium 6 Medium Digital services manager
H01

Failure to recognize patient deterioration during testing

Safety Before 16 After 8

A patient has a seizure, a fall in heart rate or breathing, or becomes distressed during a study, and the change is missed or reported too slowly, so harm is not prevented.

Who or what is affected: Patients, technologists and clinical staff

Causes

Long sessions, sedation, unfamiliar patients and monitoring that depends on one person.

Consequences

Injury, delayed treatment, serious harm and a complaint or formal review.

Existing controls

  • Technologists watch the patient and screen throughout each recording.
  • A clinical nurse is on call for patients needing extra monitoring.

Control gaps

There is no written pathway for changes in breathing, and alarms are not checked at the start of each study.

Additional controls

  • Prevent: Use a written pathway that names the staff to call and the first steps for each type of change.
  • Detect: Set alarm limits on monitoring equipment and check them at the start of every study.
Likelihood 4 x impact 4 before; 2 x 4 after Owner: Consultant neurologist Target: Within 30 days Early warning: Monitor readings outside agreed limits or an unplanned pause in a study.
H02

Equipment fault or poor signal corrupting recordings

Operational Before 12 After 4

Amplifiers, cables or electrodes fail, or signals are noisy, so a recording is incomplete or misread and the test must be repeated or the diagnosis is delayed.

Who or what is affected: Patients, technologists and referring clinicians

Causes

Wear on leads, cables damaged by handling, and electrical interference in the room.

Consequences

Repeated studies, delayed diagnosis, extra burden on patients and misleading readings.

Existing controls

  • Equipment is serviced by the supplier each year.
  • Technologists check impedance and signal quality before recording starts.

Control gaps

Pre-test checks are not recorded, and there is no loan equipment available during repairs.

Additional controls

  • Prevent: Replace worn cables and leads on a fixed schedule and log each change.
  • Recover: Keep a loan device and a rebooking route so a failed study is repeated promptly.
Likelihood 4 x impact 3 before; 2 x 2 after Owner: Biomedical engineer Target: Within 60 days Early warning: Repeated poor signal or artefact warnings from the same device within one week.
H03

Infection transmission through shared electrodes and equipment

Safety Before 12 After 6

Electrodes, needles, headsets or touch points carry blood, skin organisms or other infection between patients when cleaning, preparation or single use rules are not followed.

Who or what is affected: Patients, staff and visitors

Causes

Time pressure between patients, shortages of single use supplies and unclear cleaning steps.

Consequences

Patient infection, staff exposure, temporary service closure and loss of trust.

Existing controls

  • Single use needles and electrodes are used for each patient.
  • Work surfaces and touch points are wiped between patients.

Control gaps

Audits are carried out rarely, and staff are unsure which items are single use.

Additional controls

  • Prevent: Stock single use electrodes at each station and remove reusable items that cannot be cleaned properly.
  • Detect: Audit cleaning and hand hygiene each month and record results on a visible board.
Likelihood 3 x impact 4 before; 2 x 3 after Owner: Infection control lead Target: Within 30 days Early warning: Cleaning audit items not met, or stock of single use electrodes falling below the set minimum.
H04

Harm during activation procedures such as flashing light or breathing steps

Safety Before 10 After 8

Flashing light, breathing or sleep related steps can trigger a seizure, fainting or a fall, particularly in patients with epilepsy or heart and lung disease.

Who or what is affected: Patients with epilepsy, older patients and technologists

Causes

Light sensitivity, poor sleep, missed medicines and an incomplete history.

Consequences

Injury, a fall in the clinic, a seizure during testing and a need for emergency care.

Existing controls

  • Patients with known epilepsy are screened before any activation starts.
  • Technologists stay with the patient and have the stop procedure to hand.

Control gaps

Screening relies on verbal answers, and the stop routine is not practised.

Additional controls

  • Prevent: Require a written screening form that records seizure history and medicines before any activation.
  • Respond: Practise a stop and recovery routine for a seizure, with a clear signal for help.
Likelihood 2 x impact 5 before; 2 x 4 after Owner: Senior technologist Target: Within 30 days Early warning: A patient reports a new symptom, a missed dose or a change in history during screening.
H05

Wrong patient identity or misfiled results

Operational Before 12 After 6

A study is linked to the wrong patient, a result is attached to the wrong record or a report is sent to the wrong referrer, so a diagnosis or treatment is based on incorrect information.

Who or what is affected: Patients, referring clinicians and reporting staff

Causes

Busy lists, similar names and reports typed from handwritten notes.

Consequences

Wrong treatment, delayed diagnosis, distress to the patient and a formal complaint.

Existing controls

  • Patient name and date of birth are checked on the request form.
  • Reports are signed off by the consultant before release.

Control gaps

Identity is checked at booking but not at the bedside or before the report is released.

Additional controls

  • Prevent: Use two identifiers and a wristband check at every step from arrival to reporting.
  • Detect: Run a weekly check that reports match the recording log and the referring request.
Likelihood 3 x impact 4 before; 2 x 3 after Owner: Service manager Target: Within 30 days Early warning: Studies with missing identity checks or a mismatch between the request and the recording log.
H06

Privacy breach and unlawful access to recordings

Technology and data Before 20 After 8

Recordings, reports or images are copied to unsecured devices, sent to the wrong person, viewed by staff without a clinical need, or lost, exposing confidential health information.

Who or what is affected: Patients, families and staff

Causes

Shared logins, reports sent by ordinary email, use of USB drives and curiosity about well known patients.

Consequences

Loss of patient trust, harm to the patient, and regulatory or legal action.

Existing controls

  • Staff sign confidentiality agreements on joining.
  • Recordings are stored on the hospital system with individual logins.

Control gaps

Access logs are not reviewed, and some staff still use personal email to send reports.

Additional controls

  • Prevent: Encrypt stored recordings and block copying to personal devices and removable media.
  • Detect: Review access logs monthly and flag any record opened without a clinical reason.
  • Respond: Hold a written breach response plan covering containment, notification and lessons learned.
Likelihood 4 x impact 5 before; 2 x 4 after Owner: Information governance lead Target: Within 45 days Early warning: Access to a record by a user with no link to the patient's care.
H07

Gaps in competence, staffing and shift handover

People Before 9 After 4

Testing is performed by staff who are not signed off for a procedure, or the team is short, and information about a patient's condition or earlier events is not passed on at shift change.

Who or what is affected: Patients, technologists and nurses

Causes

Sickness, staff turnover and reliance on memory at handover.

Consequences

Errors in testing, delayed care and an unsafe test being run.

Existing controls

  • Each technologist has a competence record for each test type.
  • A verbal handover takes place at the start and end of each shift.

Control gaps

Competence records are not checked against the rota, and handover is not written down.

Additional controls

  • Prevent: Require sign off for each test type before a person works unsupervised and keep a rota that covers absence.
  • Respond: Use a structured handover tool with a written checklist for any patient under monitoring.
Likelihood 3 x impact 3 before; 2 x 2 after Owner: Clinical governance lead Target: Within 60 days Early warning: A shift running with fewer than the minimum number of signed off staff.
H08

Vendor software or interface failure

Supplier Before 8 After 6

The supplier's software update, connection to the patient record or cloud storage fails or changes without warning, so studies cannot be recorded, read or sent on time.

Who or what is affected: Technologists, referring clinicians and patients waiting for results

Causes

Unannounced updates, network failure and dependence on one vendor.

Consequences

Delays, lost recordings, repeated testing and frustrated clinicians.

Existing controls

  • The supplier provides technical support under a service contract.
  • Updates are installed only after the technical team has tested them.

Control gaps

The contract does not set response times, and downtime drills are not run.

Additional controls

  • Detect: Log every software update and interface error and review the log each month.
  • Recover: Keep a paper downtime form and a written procedure with contact numbers for the vendor.
Likelihood 2 x impact 4 before; 2 x 3 after Owner: Digital services manager Target: Within 90 days Early warning: Interface errors or failed uploads recorded more than once in a single week.

Rating method and evaluation

Each risk is rated on two five-point scales. Likelihood runs from Rare to Almost certain, and impact runs from Negligible to Catastrophic. Multiplying the two gives a score from 1 to 25, which falls into one of four bands: Low from 1 to 4, Medium from 5 to 9, High from 10 to 16 and Critical from 17 to 25. The score guides the order of work and is not a measurement of harm. Inherent risk is the score before any controls. Residual risk is the score after existing and added controls. Impact is judged on physical harm to the patient, effect on diagnosis, spread of infection, loss of privacy and cost to correct. A risk is never rated down only because it has not happened yet. Critical and High risks need senior clinical attention and a dated plan, Medium risks need routine controls with a named owner, and Low risks are accepted and watched. Staff who perform the tests should challenge the ratings at each review, and any risk is rescored when its indicator reaches its threshold or after an incident.

Likelihood, impact and rating bands

Likelihood

  • 5 Almost certain: Expected to happen in most circumstances.
  • 4 Likely: Will probably happen in many circumstances.
  • 3 Possible: Could happen at some time.
  • 2 Unlikely: Not expected, but it could happen.
  • 1 Rare: Only in exceptional circumstances.

Impact

  • 1 Insignificant: No lasting effect. Handled within routine work.
  • 2 Minor: Small effect that is quickly corrected.
  • 3 Moderate: Noticeable effect that needs managed effort to correct.
  • 4 Major: Serious effect on people, delivery or reputation.
  • 5 Catastrophic: Severe or lasting effect that threatens the whole activity.

Bands (likelihood x impact)

  • Low (1 to 4): Accept and monitor.
  • Medium (5 to 9): Manage with routine controls.
  • High (10 to 16): Senior attention and a treatment plan.
  • Critical (17 to 25): Act first. Do not proceed until reduced.

Monitoring, escalation and review

Review this assessment every 3 months, and sooner when an indicator below reaches its threshold.

Early-warning indicators and escalation thresholds
Indicator to watchEscalate when
Patients whose heart rate or oxygen level falls outside the agreed limits during a study.Escalate to the supervising clinician at once when a limit is breached, and to the consultant neurologist if the study must stop.
Studies with missing identity checks or incomplete recording logs.Escalate to the service manager whenever one is found, and review it with the team within a week.
Recording equipment failing a scheduled test or repeatedly reporting artefact.Escalate to the biomedical engineer immediately and remove the device from use until it is repaired and retested.
Unauthorized or unexplained access to stored recordings in the access log.Escalate to the information governance lead within 24 hours, and to the privacy officer if a breach is confirmed.
Infection control audit items not met, such as uncleaned equipment or reusable items in use.Escalate to the infection control lead when an item is not met, and to the clinical governance lead if it repeats within a month.

Contingency arrangements

If a patient deteriorates during testing, the technologist stops the activation, keeps the patient safe and calls the clinical team using the agreed emergency pathway. If a serious incident or privacy breach occurs, the service manager secures the equipment and records, informs the consultant and the information governance lead, and follows the local reporting procedure. The biomedical engineer removes faulty equipment from use and arranges loan equipment or rebooks studies. Patients are told what they need to know early and plainly.

Prioritized action plan

  1. Introduce a written deterioration escalation pathway with a named clinical lead, owner consultant neurologist, within 30 days.
  2. Enforce two identifier checks and a recording log at every stage, owner service manager, within 30 days.
  3. Encrypt stored recordings and review access logs each month, owner information governance lead, within 45 days.
  4. Standardize electrode preparation, cleaning and single use supply, owner infection control lead, within 45 days.
  5. Set a maintenance and test schedule for all recording equipment, owner biomedical engineer, within 60 days.

Conclusion

Safe neurodiagnostic testing depends on a few steady habits: recognizing deterioration early, preparing and cleaning consistently, checking identity at every step, keeping equipment tested and records private. The highest scores sit with deterioration and privacy, and each has actions that bring the residual score down. Review the register on the stated cycle and after every incident, and seek qualified clinical, information governance and legal advice for any real decision.

Assumptions and limitations

Assumptions

  • The service follows local clinical protocols for infection control, equipment checks and resuscitation readiness.
  • Staff are qualified technologists and clinicians working under local supervision with competence sign off.
  • Jurisdiction and health system are not specified, so legal and regulatory duties are described in general terms only.

Limitations

  • The scores are examples for learning and do not describe any real service or patient group.
  • Clinical practice and regulation vary by location and change over time, so specialist review is needed.
  • This is educational content and does not replace a formal site-specific assessment or licensed clinical advice.

Related frameworks to study

  • Clinical risk management cycle
  • Hierarchy of controls
  • Structured clinical handover
  • Root cause analysis of incidents
  • Confidentiality, integrity and availability model

Healthcare Risk Assessment

China, India, United States, Indonesia, Pakistan, Nigeria, Brazil, Bangladesh, Russia, Japan, Mexico, Philippines, Vietnam, Egypt, Turkey, Germany, United Kingdom, France, Italy, Canada, South Korea, Australia, Spain.

For Learning Reference Only: This assessment demonstrates how risk assessment principles are applied in a practical setting, providing a useful reference for learning and understanding. Actual assessments may be adapted to suit specific site conditions and circumstances.

Keep learning

Study the subject behind this assessment.

Neurology and Neurodiagnostic Technology course Read the best practices for this course

More Healthcare risk assessments

Hourly Active: 35,661 Learners