Patient Safety and Wrong-Site Surgery Prevention

The framework is two complementary documents that every orthopaedic trainee is expected to know by name: the Universal Protocol and the WHO Surgical Safety Checklist. State both, say where each comes from, and explain how they overlap.

The Universal Protocol. The Universal Protocol for Preventing Wrong Site, Wrong Procedure, and Wrong Person Surgery was introduced by the Joint Commission (United States) following the sentinel-event data of the early 2000s, and became mandatory for accredited organisations. It rests on three principal requirements:

• Pre-procedure verification. Confirm in advance that the correct documents, imaging, implants and consent are present, consistent with each other, and match the patient. Every discrepancy is resolved before the patient enters the theatre, not during the time-out.
• Mark the site. The intended operative site is marked at or near the incision.
• Time-out. A final, immediate pause in the location where the procedure will occur, immediately before the incision, during which the team verbally confirms patient, site, side, procedure and agreement.

The WHO Surgical Safety Checklist. This is the World Health Organization's global instrument, developed under the Safe Surgery Saves Lives challenge and validated by Haynes and colleagues in 2009. Its three phases map onto the natural breaks of an operation:

• Sign In, before induction of anaesthesia
• Time Out, before skin incision
• Sign Out, before the patient leaves the operating room

Each phase carries a short, fixed set of items covering identity, site, procedure, consent, anaesthetic safety, antibiotic prophylaxis, imaging, airway and aspiration risk, and blood loss. Sign Out adds instrument and swab counts, specimen labelling and equipment problems.

Rule and tool. The Universal Protocol is a rule: the three non-negotiable requirements that prevent wrong-site surgery. The WHO checklist is a tool: a structured conversation that enforces the rule and adds the broader theatre-safety items. In practice a unit embeds the Universal Protocol's mark and time-out inside the WHO checklist's Time Out phase.

The WHO pilot. Across eight hospitals on several continents, introducing the checklist was followed by a fall in surgical complications from 11% to 7% and in inpatient mortality from 1.5% to 0.8%. That result shifted the checklist from a suggestion to a near-universal standard.

The Ontario evaluation. The pilot was a before-and-after study with no control group, and examiners know what followed. When Ontario mandated checklists across 101 hospitals, the largest evaluation to date (some 215,000 procedures, roughly 28 times the WHO sample) found no significant change in mortality (0.71% to 0.65%, P=0.13) or complications (3.86% to 3.82%, P=0.29).

Reconciling the two. The difference is baseline risk: the WHO cohort started at 1.5% mortality and Ontario at 0.71%, so there was far less harm available to prevent. A checklist filed without a genuine spoken pause is paperwork rather than a defence. Neither study reported wrong-site events separately, so the case for the checklist in wrong-site prevention rests on the specific verification steps it forces, not on these mortality figures.

Site marking is the physical, visible defence. The intended site is marked with a permanent marker at or near the intended incision, so that the mark survives skin preparation and draping and is visible to the scrubbed team at the moment of incision. The rules recur in every guideline:

• The mark is made by a licensed independent practitioner who will be present for the procedure: not a nurse, not a junior who then leaves, and ideally the operating surgeon. It should be made with the patient awake and involved whenever possible.
• The mark is unambiguous, conventionally the surgeon's initials, with an explicit marker such as the word YES where policy directs. Never mark the non-operative side with an X or NO: a wrong-side mark must not exist to be misread under drapes.
• The mark names the side and the specific site: the index finger, not just the hand; the L4/5 level, not just the lumbar spine.
• Midline and unpaired structures (perianal, midline spine exposure, single-midline-organ surgery) are not marked in the same way, but still require the rest of the protocol.
• The mark is checked against the consent form, the imaging and the wristband, three independent sources that must agree.

The time-out is the verbal defence, performed in the operating room with the patient in their final position. A nominated member leads a structured confirmation of:

• patient identity, using at least two identifiers and never the bed number
• the planned procedure
• the operative site, side and, for spine, level
• the position
• consent, present and consistent
• the relevant imaging, displayed in the room
• the correct implants and instruments, available
• antibiotic and thromboprophylaxis, given

Anyone in the room, from the consultant to the newest nurse, is empowered and expected to stop the list if anything does not match. The time-out is then documented in the record.

Spine: the level. In spinal surgery the side is usually obvious but the level is not, and wrong level is the commonest wrong-site error in spine. Prevention means intra-operative localisation, counting vertebrae under image intensifier from a stable landmark such as the sacrum or the last rib-bearing vertebra. The level is confirmed on imaging both before the skin incision and before the dura or disc is entered.

Bilateral surgery. In bilateral surgery (for example simultaneous bilateral knee arthroplasty, or multiple trigger-finger releases), each site is treated as a separate procedure with its own confirmation. The presence of two correct sites halves the protection that laterality normally provides.

Emergencies and the unable-to-confirm patient. The protocol is never suspended, only adapted. In the unconscious or unaccompanied trauma patient, identity is verified by wristband, by the paramedic handover and by imaging, and the time-out is still held and documented. Urgency is the classic condition under which wrong-site surgery happens, so it is precisely then that the discipline must hold.

Naming the protocol answers the prevention question; explaining why it still fails answers the deeper one. The framework examiners want is James Reason's model of error, which moves safety away from blaming individuals and towards designing systems.

The Swiss cheese model. Reason pictures the defences of an organisation (consent, booking, site marking, the time-out, team vigilance) as a series of slices, each with holes: an active slip by a person, or a latent weakness built into the system. Most of the time a hole in one slice is blocked by the next. A disaster occurs only when the holes in several slices momentarily line up, allowing a trajectory of accident opportunity to pass right through.

The wrong-site trajectory. Wrong-site surgery is the textbook case. A booking error (latent) goes uncorrected at verification, is reinforced by an ambiguous consent, is mirrored by a site mark made by the wrong person, and is finally unchallenged by a time-out no one really stopped for. No single person was reckless; the holes aligned.

Active failures and latent conditions. Active failures are the unsafe acts of people at the sharp end: the slip, lapse or mistake committed in the moment. Latent conditions are the resident pathogens of the system: scheduling pressure, identical patient names, missing imaging, fatigued staff, a hierarchy that silences the junior nurse who can see the mark is wrong. The mature analysis of a never event concentrates on the latent conditions, because those are what you can redesign; the active failure is merely the trigger that a better system would have absorbed.

Error types. Reason divides the active failure into slips, lapses and mistakes, set out with orthopaedic examples in the table below. Violations are distinct from errors: deliberate deviations from a safe rule, which may be routine (everyone skips a step), situational (the rule is impossible under the conditions) or exceptional. The countermeasure differs by type: slips and lapses are reduced by forcing functions and standardisation, mistakes by training and decision support, violations by fixing the conditions that make the rule impossible to follow.

Person approach and system approach. Reason's contrast between the person approach (blame, name, shame, retrain the individual) and the system approach (engineer the holes out of the slices) is the heart of modern patient safety. The person approach feels just but does not work, because the same latent conditions will produce the same error in the next person. Standardisation, forcing functions, independent checks and a culture in which anyone can speak up are what actually reduce never events.

When a never event occurs, three legal and ethical threads run together: the standard of care the surgeon is judged against, the consent the patient gave, and the duty of candour that follows. Three UK cases an examiner expects you to know set out the law of professional standard and of consent. The ethical framework underneath them is the four principles of Beauchamp and Childress.

Bolam v Friern Hospital Management Committee (1957) established the classic test: a doctor is not negligent if they act in accordance with a practice accepted as proper by a responsible body of medical opinion skilled in that art. For a generation the Bolam test governed treatment decisions and, via Sidaway, the disclosure of risk in consent. Its weakness is that it lets medicine judge itself by its own customary standard, even when that standard is lax.

Bolitho v City and Hackney Health Authority (1997) qualified Bolam. The House of Lords held that a court is not bound to accept a body of opinion merely because it exists: the opinion must be capable of withstanding logical analysis and must represent a responsible, reasonable and defensible practice. In effect Bolitho made the court, not the profession, the final arbiter of whether a practice is defensible, closing the most circular use of the Bolam test.

Montgomery v Lanarkshire Health Board (2015) transformed the law of consent. The Supreme Court held that a doctor must take reasonable care to ensure the patient is aware of any material risks of treatment and of reasonable alternatives. A risk is material when a reasonable person in the patient's position would attach significance to it, judged from the patient's perspective, not the doctor's.

What Montgomery replaced. It swapped the professional-standard (Sidaway/Bolam) approach to disclosure for a patient-centred, shared-decision-making model. Therapeutic privilege, withholding information because the doctor judges it not in the patient's interest, survives only in the rarest cases.

Wrong-site surgery in law. Operating on the wrong site is both a battery, because the patient never consented to that contact with that part, and negligence, a breach of the duty of care that caused harm. The consent process (correct patient, procedure, side and level, documented) is itself a defence layer in the Swiss cheese model. When consent, booking and mark disagree, it is the consent that anchors the truth.

The duty of candour is the obligation to be open and honest with a patient when something has gone wrong. In the United Kingdom it is both a statutory requirement on registered providers and a professional duty under the General Medical Council's Good Medical Practice. Equivalent duties run through the AAOS Standards of Professionalism and professional codes worldwide.

Candour after a never event. The practical steps are non-negotiable:

• Explain to the patient what happened, promptly and honestly, as soon as they are able to understand, including the consequences and the steps taken
• Apologise without attempting to deflect
• Ensure their immediate clinical care
• Preserve the records, and never alter or fabricate them
• Report through the incident system and to the regulator
• Cooperate fully with the root-cause analysis

The time-out and the correction of a near-miss are documented contemporaneously and truthfully. That record is both the patient's right and the surgeon's protection.

The four principles. Beauchamp and Childress's Principles of Biomedical Ethics sits underneath the law, and wrong-site surgery touches all four principles with unusual clarity:

• Autonomy is violated, because the patient never chose this operation on this part
• Beneficence is not served, because the intended benefit was never delivered
• Non-maleficence is the principle the event most directly breaches, since harm was done that the whole protocol existed to prevent
• Justice is engaged through fair allocation of the resources of remedial care, honest disclosure and accountability

The four principles give the examiner a clean structure for any ethics question that flows from a safety event.

Definition. Wrong-site surgery means operating on the wrong patient, the wrong side, the wrong anatomical site, the wrong procedure or, in spinal surgery, the wrong vertebral level. Some classifications also include the wrong implant. The family of errors shares one feature: a defect in identity, side, site or level that should have been caught before the skin was cut.

Classification. The United States National Quality Forum (NQF) classifies it as a serious reportable event and the Joint Commission as a sentinel event. On the ward and in the exam it is a never event: a serious, largely preventable patient-safety incident that should not occur if the available preventive measures have been put in place. The label accuses the system, which has failed to supply the defences that make the event impossible; it does not say the clinicians were negligent.

Why it matters. For the patient it is a catastrophe: a healthy limb entered, a correct one neglected, sometimes irreversible harm. For the surgeon it is professionally, emotionally and legally devastating. The event is reportable to the regulator, triggers a root-cause analysis and erodes public trust in the institution, so prevention is a core professional duty rather than optional politeness around surgery.

The categories. Each has a recognisable orthopaedic form. Wrong level in spine is a distinct category because a correctly lateralised, correctly identified operation can still be performed at the wrong disc or vertebra.

Why orthopaedics and spine are disproportionately affected. Orthopaedic surgery is one of the highest-risk specialties for wrong-site events, and the reasons are structural rather than behavioural.

• Most orthopaedic operations act on paired, lateralised structures, where the only difference between correct and catastrophic is left versus right
• Spine surgery adds multiple, anatomically similar levels stacked along one column, so a perfectly lateralised operation can still be performed at the wrong vertebra
• Lists often run several procedures on one patient (for example bilateral foot surgery) or identical operations on consecutive patients, which seeds human error
• The specialty depends on a long chain of artefacts (consent forms, booking entries, imaging, implants, instruments, positioning and draping), and each is a place where identity can silently drift

The American Academy of Orthopaedic Surgeons built its Sign Your Site campaign because this specialty recognised itself in the data.

The material below condenses the topic for revision and viva practice — the high-yield points, the memory hooks, three worked vivas, and a one-screen cheat sheet.

The evidence base for wrong-site surgery prevention is unusual: it is drawn less from trials than from landmark reports, the legal record, and the organisational-science literature on error. The cards below cover the central surgical study, the governing legal cases, the human-factors science, and the foundational ethical text.