Safe Surveillance is a Systems Issue

In 2026, NHS England estimated that more than 1.3 million outpatients on follow-up pathways were waiting for an appointment, over 990,000 with no date booked. Failing to track patients through surveillance pathways is a structural problem, not a one-off backlog. The Getting It Right First Time (GIRFT) outpatient transformation programme covers 17 specialties, its high-volume, low-complexity workstream spanning ophthalmology, general surgery, trauma and orthopaedics, gynaecology, otolaryngology and urology. Personalised, stratified follow-up has been recommended after breast, prostate and colorectal cancer surgery, and blanket review cannot work at this scale. Set against the World Patient Safety Day 2026 theme of ‘safe care for noncommunicable diseases’, this adds up to a large, unmeasured reservoir of clinical risk across every surgical discipline.

Urology illustrates both the problem and its consequences. Several urological pathways depend on reliable tracking over months or years. These include repeat cystoscopy for bladder cancer, active surveillance for prostate cancer, interval imaging for small renal masses and Bosniak 2F cysts, planned removal of ureteric stents, and risk-stratified follow-up after cancer treatment. Around 12% of ureteric stents are retained beyond their intended removal date, sometimes with disastrous consequences. The problem isn’t flawed clinical guidance; for each pathway the evidence base is well established.

A systems approach explains why guidance on its own hasn’t fixed this. SEIPS, the Systems Engineering Initiative for Patient Safety, models care as a work system (person, tasks, tools and technology, organisation, and environment ) these interact to shape the processes and outcomes patients experience. Applied here, the Task element looks solid because guidelines specify what should happen and when. The recurring failure sits elsewhere. In Tools and Technology, spreadsheets, paper diaries or memory stand in for digital registries that could raise an automatic alert. In Organisation, administrative tracking capacity hasn’t grown to match caseload. In Environment, a patient’s surveillance passes across general practice, radiology, oncology and surgical teams, often with no shared systems between them. For the Person element, workload matters more than individual competence. Where the other elements fail, clinicians absorb the gap themselves by chasing results, keeping spreadsheets, flagging overdue patients. This is an unmeasured administrative burden layered onto clinical duties that job planning doesn’t account for. That clinicians are absorbing it shows how much individual effort is propping the system up, effort that is neither sustainable nor a substitute for ownership.

There’s a second layer to this, drawn from Safety-II thinking. Safety-I asks why things go wrong and works to remove the causes; Safety-II asks why things go right most days, and treats that as something to study rather than assume. Seen this way, the informal spreadsheets, the chased results, the clinician remembering who is overdue are not just gaps being patched. They are Work-As-Done, the everyday adaptation that closes the distance between the surveillance pathway as written and as it has to run given the staffing, technology and caseload described above. That adaptation is a large part of why so few patients are lost to follow-up despite those gaps. It is also fragile: it lives in individual heads, does not transfer when a clinician moves post or takes leave, and fails without warning. Redesign should not discard this adaptive capacity; it should convert it into defined triggers and automated alerts that the system owns so existing resilience keeps working without relying on one person.

Urology’s response, set out in GIRFT’s national follow-up guidance, is best understood as a redesign of these same system elements, not another layer of clinical guidance. Patient-initiated follow-up (PIFU) gives patients a defined trigger and a route back into care. Remote monitoring, such as a prostate-specific antigen (PSA) tracker with a defined alert threshold, replaces routine review with automated, technology-driven flagging and cancer surveillance held by a named clinical nurse specialist fixes the Organisation-level ownership a rotating outpatient roster can’t provide. Each is a redesign of the work system itself, not a request for clinicians to work harder or remember more reliably, offering a model other surgical specialties could reasonably adopt.

For those with governance responsibility, the assurance question isn’t whether a protocol exists, but whether the surrounding work system (its technology, staffing and team ownership) can deliver it reliably. At one GIRFT pilot site, only 2.5% of patients on urology PIFU pathways required an appointment. That’s only a genuine efficiency gain if it was the system itself, rather than memory or good intention, that kept the remaining 97.5% safe.

Every surveillance pathway, in any surgical specialty, needs a reliable way to define what is being monitored, assign responsibility for the next action, and escalate when no response is received. Where these functions are not built into the pathway, the weakness lies in the design of the work system, however strong the underlying clinical protocol may be.