Patient Safety and Wrong-Site Surgery Prevention

Wrong-site surgery means operating on the wrong patient, the wrong side, the wrong anatomical site, the wrong procedure, or — in spinal surgery — the wrong vertebral level. Some classifications also include the wrong implant. It is not a single mistake but a family of errors that share one feature: a defect in identity, side, site or level that should have been caught before the skin was cut.

It is classified by the United States National Quality Forum (NQF) as a serious reportable event and by the Joint Commission as a sentinel event. The term used on the ward and in the exam is never event: a serious, largely preventable patient-safety incident that should not occur if the available preventive measures have been put in place. The point of the label is not that clinicians are negligent, but that the system has failed to supply the defences that make the event impossible.

Why it matters is self-evident but worth stating aloud in a viva. For the patient it is a catastrophe — a healthy limb entered, a correct one neglected, sometimes irreversible harm. For the surgeon it is professionally, emotionally and legally devastating; it is almost impossible to defend in negligence or battery because consent to that operation on that part was never given. It is reportable to the regulator, it triggers a root-cause analysis, and it erodes public trust in the institution. Prevention is therefore not optional politeness around surgery but a core professional duty.

The categories below cover the events an examiner expects you to name. Notice that wrong level in spine is a distinct and very common category, because a correctly lateralised, correctly identified operation can still be performed at the wrong disc or vertebra.

Why orthopaedics and spinal surgery are disproportionately affected. Orthopaedic surgery is one of the highest-risk specialties for wrong-site events, and the reasons are structural rather than behavioural. Most orthopaedic operations act on paired, lateralised structures where the only difference between correct and catastrophic is left versus right. Spine surgery adds multiple, anatomically similar levels stacked along one column, so a perfectly lateralised operation can still be performed at the wrong vertebra. Lists often run several procedures on one patient (for example bilateral foot surgery) or identical operations on consecutive patients, which seeds human error. Finally, orthopaedics depends on a long chain of artefacts — consent forms, booking entries, imaging, implants, instruments, positioning and draping — and each is a place where identity can silently drift. The American Academy of Orthopaedic Surgeons built its Sign Your Site campaign precisely because this specialty recognised itself in the data.

The framework is not one document but two complementary ones that every orthopaedic trainee is expected to know by name: the Universal Protocol and the WHO Surgical Safety Checklist. State both, say where each comes from, and explain how they overlap. That single sentence structure wins the mark.

The Universal Protocol for Preventing Wrong Site, Wrong Procedure, and Wrong Person Surgery was introduced by the Joint Commission (United States) following the sentinel-event data of the early 2000s and became mandatory for accredited organisations. It rests on three principal requirements:

• Pre-procedure verification — confirm, in advance, that the correct documents, imaging, implants and consent are present, consistent with each other, and match the patient. Every discrepancy is resolved before the patient enters the theatre, not during the time-out.
• Mark the site — the intended operative site is marked at or near the incision, by a licensed independent practitioner who will be present for the procedure.
• Time-out — a final, immediate pause, performed in the location where the procedure will occur, immediately before the incision, during which the team verbally confirms patient, site, side, procedure and agreement.

The WHO Surgical Safety Checklist is the World Health Organization's global instrument, developed under the Safe Surgery Saves Lives challenge and validated by Haynes and colleagues in 2009. It is organised into three phases that map onto the natural breaks of an operation: Sign In before induction of anaesthesia, Time Out before skin incision, and Sign Out before the patient leaves the operating room. Each phase carries a short, fixed set of items covering identity, site, procedure, consent, anaesthetic safety, antibiotic prophylaxis, imaging, airway/aspiration risk, blood loss, and — at Sign Out — instrument and swab counts, specimen labelling, and equipment problems.

The two systems are not rivals. The Universal Protocol is a rule (the three non-negotiable requirements that prevent wrong-site surgery); the WHO checklist is a tool (a structured conversation that enforces the rule and adds the broader theatre-safety items). In practice a unit embeds the Universal Protocol's mark and time-out inside the WHO checklist's Time Out phase.

The proof that this works is the 2009 WHO pilot. Across eight hospitals on several continents, introducing the checklist cut the rate of surgical complications from 11% to 7% and inpatient mortality from 1.5% to 0.8% — a result that held across rich and poor settings alike and shifted the checklist from a suggestion to a near-universal standard.

Examiners move quickly from naming the protocol to asking exactly how it is performed. The detail is where marks are won or lost.

Site marking is the physical, visible defence. The intended operative site is marked with a permanent marker, at or near the intended incision, so that the mark survives skin preparation and draping and is visible to the scrubbed team at the moment of incision. Several rules recur in every guideline and are worth memorising:

• The mark is made by a licensed independent practitioner who will be present for the procedure — not by a nurse, not by a junior who then leaves, and ideally by the operating surgeon. Marking should be done with the patient awake and involved whenever possible.
• Use an unambiguous mark, conventionally the surgeon's initials, and where policy directs, an explicit marker such as the word YES. Never mark the non-operative side with an X or NO — a wrong-side mark must not exist to be misread under drapes.
• Mark the side and the specific site (e.g., the index finger, not just the hand; the L4/5 level, not just the lumbar spine).
• Midline and unpaired structures (perianal, midline spine exposure, single-midline-organ surgery) are not marked in the same way, but still require the rest of the protocol.
• The mark is checked against the consent form, the imaging and the wristband — three independent sources that must agree.

The time-out is the verbal defence. It is performed in the operating room, immediately before the incision, with the patient in their final position. The whole team stops every other activity; no one is setting up trays or filling forms. A nominated member leads a structured confirmation of patient identity (using at least two identifiers, never the bed number), the planned procedure, the operative site, side and — for spine — level, the position, that consent is present and consistent, that the relevant imaging is displayed in the room, that the correct implants and instruments are available, and that antibiotic and thromboprophylaxis have been given. Anyone in the room — from the consultant to the newest nurse — is empowered and expected to stop the list if anything does not match. The time-out is then documented in the record.

Spine and bilateral surgery need extra steps. In spinal surgery the side is usually obvious but the level is not, and wrong-level is the commonest wrong-site error in spine. Prevention means intra-operative localisation — counting vertebrae from a stable landmark such as the sacrum or the last rib-bearing vertebra under image intensifier — with the level confirmed on imaging both before the skin incision and before the dura or disc is entered. In bilateral surgery (for example simultaneous bilateral knee arthroplasty, or multiple trigger-finger releases), each site is treated as a separate procedure with its own confirmation, because the presence of two correct sites halves the protection that laterality normally provides.

Emergencies and the unable-to-confirm patient. The protocol is never suspended, only adapted. In the unconscious or unaccompanied trauma patient, identity is verified by wristband, by the paramedic handover, and by imaging; the time-out is still held and documented. Urgency is the classic condition under which wrong-site surgery happens, so it is precisely then that the discipline must hold.

Naming the protocol answers the prevention question; explaining why it still fails answers the deeper one. The framework examiners want is James Reason's model of error, which reframes safety away from blaming individuals and towards designing systems.

Reason's Swiss cheese model pictures the defences of an organisation — consent, booking, site marking, the time-out, team vigilance — as a series of slices. Each slice has holes: an active slip by a person, or a latent weakness built into the system. Most of the time a hole in one slice is blocked by the next. A disaster occurs only when the holes in several slices momentarily line up, allowing a trajectory of accident opportunity to pass right through. Wrong-site surgery is the textbook trajectory: a booking error (latent), uncorrected at verification, reinforced by an ambiguous consent, mirrored by a site mark made by the wrong person, and finally unchallenged by a time-out no one really stopped for. No single person was reckless; the holes aligned.

Reason separates two kinds of failure. Active failures are the unsafe acts of people at the sharp end — the slip, lapse or mistake committed in the moment. Latent conditions are the resident pathogens of the system — scheduling pressure, identical patient names, missing imaging, fatigued staff, a hierarchy that silences the junior nurse who can see the mark is wrong. The mature analysis of a never event concentrates on the latent conditions, because those are what you can redesign; the active failure is merely the trigger that a better system would have absorbed.

To describe the active failure precisely, Reason distinguishes the error types. A slip is the right plan carried out wrongly (you intend to mark the left knee and your hand moves to the right). A lapse is a failure of memory (you forget that this list order was changed). A mistake is a wrong plan — rule-based, when a good rule is misapplied, or knowledge-based, when the plan is built on incomplete understanding. Violations, distinct from errors, are deliberate deviations from a safe rule, and may be routine (everyone skips a step), situational (the rule is impossible under the conditions), or exceptional. The countermeasure differs by type: slips and lapses are reduced by forcing functions and standardisation, mistakes by training and decision support, violations by fixing the conditions that make the rule impossible to follow.

The contrast Reason draws between the person approach (blame, name, shame, retrain the individual) and the system approach (engineer the holes out of the slices) is the heart of modern patient safety. The person approach feels just but does not work, because the same latent conditions will produce the same error in the next person. The system approach — standardisation, forcing functions, independent checks, and a culture in which anyone can speak up — is what actually reduces never events.

When a never event occurs, three legal and ethical threads run together: the standard of care the surgeon is judged against, the consent the patient gave, and the duty of candour that follows. The three English cases an examiner expects you to know set out the law of professional standard and of consent; the ethical framework underneath them is the four principles of Beauchamp and Childress.

Bolam v Friern Hospital Management Committee (1957) established the classic test: a doctor is not negligent if they act in accordance with a practice accepted as proper by a responsible body of medical opinion skilled in that art. For a generation this Bolam test governed not only treatment decisions but, via Sidaway, the disclosure of risk in consent. Its weakness is obvious — it lets medicine judge itself by its own customary standard, even when that standard is lax.

Bolitho v City and Hackney Health Authority (1997) qualified Bolam. The House of Lords held that a court is not bound to accept a body of opinion merely because it exists; the opinion must be capable of withstanding logical analysis and must represent a responsible, reasonable and defensible practice. In effect, Bolitho placed the court, not the profession, as the final arbiter of whether a practice is defensible — closing the most circular use of the Bolam test.

Montgomery v Lanarkshire Health Board (2015) transformed the law of consent. The Supreme Court held that a doctor must take reasonable care to ensure the patient is aware of any material risks of treatment and of reasonable alternatives, and that a risk is material when a reasonable person in the patient's position would attach significance to it — judged from the patient's perspective, not the doctor's. This replaced the professional-standard (Sidaway/Bolam) approach to disclosure with a patient-centred, shared-decision-making model. Therapeutic privilege (withholding information because the doctor judges it not in the patient's interest) survives only in the rarest cases.

For wrong-site surgery these threads converge with brutal simplicity. Operating on the wrong site is, in law, both a battery (the patient never consented to that contact with that part) and negligence (a breach of the duty of care that caused harm). The consent process — correct patient, correct procedure, correct side, correct level, documented — is itself a defence layer in the Swiss cheese model; when consent, booking and mark disagree, it is the consent that anchors the truth.

The duty of candour is the obligation to be open and honest with a patient when something has gone wrong: to explain what happened, to apologise, to describe the consequences and the steps taken, and to report it through the appropriate channel. In the United Kingdom it is both a statutory requirement on registered providers and a professional duty under the General Medical Council's Good Medical Practice; equivalent duties run through the AAOS Standards of Professionalism and professional codes worldwide. The candour duty has a non-negotiable practical edge in a never event: explain to the patient as soon as they are able to understand, apologise without attempting to deflect, and never alter or fabricate the record. The time-out and the correction of a near-miss are documented contemporaneously and truthfully — that record is both the patient's right and the surgeon's protection.

Underneath the law sits the four-principles framework of Beauchamp and Childress (Principles of Biomedical Ethics). Wrong-site surgery touches all four with unusual clarity: autonomy is violated because the patient never chose this operation on this part; beneficence is not served because the intended benefit was never delivered; non-maleficence is the principle the event most directly breaches, since harm was done that the whole protocol existed to prevent; and justice is engaged through fair allocation of the resources of remedial care, honest disclosure, and accountability. The four principles give the examiner a clean structure for any ethics question that flows from a safety event.

The evidence base for wrong-site surgery prevention is unusual: it is drawn less from trials than from landmark reports, the legal record, and the organisational-science literature on error. The cards below cover the central surgical study, the governing legal cases, the human-factors science, and the foundational ethical text.

The material below condenses the topic for revision and viva practice — the high-yield points, the memory hooks, three worked vivas, and a one-screen cheat sheet.