PSIRF Explained: What the Patient Safety Incident Response Framework Requires

Most guidance about the Patient Safety Incident Response Framework describes it as a new way to investigate. That is the wrong frame, and it leads organisations to over-investigate. PSIRF's defining feature is that it stopped telling providers what to investigate. It is, in NHS England's own words, "not an investigation framework that prescribes what to investigate" — it sets up a system for choosing a proportionate response, and leaves most of that choice to the provider's own published plan.

This guide sets out what PSIRF actually mandates, what it leaves to local discretion, and the three places where people most often get it wrong.

What PSIRF replaced, and when

NHS England published PSIRF in August 2022. It replaced the Revised Serious Incident Framework of March 2015, and it removed that framework's central distinction: PSIRF "makes no distinction between 'patient safety incidents' and 'Serious Incidents'". The category of "Serious Incident" no longer governs the response.

Organisations were expected to transition within twelve months from September 2022, with transition completed by autumn 2023. NHS England now reports PSIRF as implemented in every NHS secondary care provider. Primary care is a different picture: PSIRF is being piloted in 50 or more GP practices, so transition is complete in secondary care and still in progress in primary care. Anyone describing the transition as finished across the NHS is overstating it.

Who it applies to

The test is contractual, not organisational. PSIRF "can be used by any healthcare service but is mandatory for services provided under the NHS Standard Contract, including acute, ambulance, mental health, and community healthcare providers" — and that includes maternity and all specialised services.

For primary care the position is layered. Primary care services contracted under the NHS Standard Contract are required to comply. Other primary care providers may choose to adopt it, working with their integrated care board. NHS England's primary care patient safety strategy states there is "no intention to lift and shift PSIRF directly from secondary care into primary care", names general practice as the first area to begin implementation from 2024, and says community pharmacy, optometry and dental providers "should also start to implement PSIRF" where they feel confident to do so. That strategy is explicitly not a contractual requirement on primary care providers or ICBs.

Independent providers delivering NHS-funded care under the NHS Standard Contract are in scope. Some air ambulance services and some social care providers are not required to implement PSIRF contractually, but may align with it voluntarily and can access PSIRF training.

A note on geography

PSIRF is an NHS England framework. Its mandate runs through the NHS Standard Contract, and its oversight architecture is integrated care boards and NHS England regional teams, all of which are English. It does not apply in Scotland, Wales or Northern Ireland, which have their own arrangements — Northern Ireland has consulted on a separate framework of its own. Worth stating plainly, because PSIRF is frequently described as though it were UK-wide. If you work across the four nations, as providers regulated by RQIA in Northern Ireland often do, PSIRF is not your framework.

The four principles

The framework says it "integrates four key principles". NHS England's overview page calls the same four "aims", so you will see both terms:

• Compassionate engagement and involvement of those affected by patient safety incidents
• Application of a range of system-based approaches to learning from patient safety incidents
• Considered and proportionate responses to patient safety incidents
• Supportive oversight focused on strengthening response system functioning and improvement

The policy and the plan

Every provider in scope must have both a patient safety incident response policy and a patient safety incident response plan, and both must be published on the organisation's website. The plan must be agreed by the integrated care board, by other commissioning leads where required, and by the board. ICBs are required to approve and sign off the policies and plans of providers in their system.

The plan specifies the methods the organisation intends to use to maximise learning, and how those methods apply to different incident types. It is built from the organisation's own incident profile, improvement priorities, resources and stakeholder priorities — which is why two neighbouring trusts can legitimately respond differently to the same type of incident.

On review frequency, there is a widespread misconception worth correcting. PSIRF requires the plan to be an active document, updated as required, and reviewed fully alongside the policy a minimum of every four years. It does not mandate annual review. Many organisations work to a one or two year cycle, and that is a local choice, not a national requirement.

The response methods

NHS England's collective term is "learning responses". A patient safety incident investigation is one of them, not the default:

• Patient safety incident investigation (PSII) — an in-depth review of a single incident or cluster, undertaken where an incident or near-miss indicates significant patient safety risks
• Multidisciplinary team review — for past incidents or where staff recall is difficult; the team agrees contributory factors and system gaps through open discussion
• Swarm huddle — convened as soon as possible after an event, to gather information quickly and decide how to reduce the risk of recurrence
• After action review — a structured discussion covering what was expected, what happened, the difference and the learning; it can examine good outcomes as well as harm
• Thematic review — identifies common themes across a cluster of incidents or datasets, including the barriers and facilitators to safety

Method selection is set in the organisation's own plan, except where a national requirement applies. Where a PSII is carried out, the report must use the standardised national template.

Three things people get wrong

1. Never Events no longer mandate a PSII

This is the single most common error. NHS England's guide to responding proportionately lists incidents meeting the Never Events criteria as requiring a "proportionate learning response" — and states explicitly that organisations must continue to respond to Never Events to support learning, but that "it is no longer mandatory that this learning response is a Patient Safety Incident Investigation". A trust automatically opening a PSII for every Never Event is applying the old framework's logic to the new one.

The Never Events framework is itself under review. A twelve-week consultation ran from February to May 2024, after which NHS England said providers must continue recording events meeting the Never Events criteria, with learning responses undertaken in line with PSIRF. No replacement policy has been published, so the position remains unresolved.

2. Most national requirements are referral duties, not investigation triggers

Only two categories nationally require a locally-led PSII: deaths thought more likely than not to be due to problems in care, meaning those meeting the Learning from Deaths criteria; and deaths of patients detained under the Mental Health Act 1983, or where the Mental Capacity Act 2005 applies, where care problems may be involved.

Everything else on the national list is a duty to refer, which may or may not be accompanied by a local response:

• Mental health-related homicides — referral to the NHS England regional independent investigation team, which decides whether an independent PSII is needed
• Maternity and neonatal incidents meeting the national criteria — referral for an independent investigation, not a locally-led one. The criteria cover intrapartum stillbirth, early neonatal death within the first six days, potentially severe brain injury diagnosed in the first seven days, and maternal deaths related to or aggravated by pregnancy or its management
• Child deaths — referral to the child death overview panel
• Deaths of people with a learning disability — referral to the LeDeR programme. This is a referral requirement, not a PSII trigger, and the two are often conflated. The adjacent statutory training duty, the Oliver McGowan mandatory training, is separate again
• Safeguarding incidents — referral to the local safeguarding lead or designated professionals, covering children on protection or looked-after plans, victims of wilful neglect or domestic abuse, adults receiving local authority care, and female genital mutilation, Prevent, modern slavery and trafficking cases
• Incidents in NHS screening programmes — referral to the local screening quality assurance service
• Deaths in custody involving NHS-provided health care — referral to the Prisons and Probation Ombudsman or the Independent Office for Police Conduct
• Domestic homicide — handled by the community safety partnership, which may establish a review

One practical caution: the national guidance still refers to bodies under former names in places, and maternity investigation functions have moved since the framework was written. Confirm the current receiving body before relying on a referral route rather than taking the table at face value.

3. Duty of Candour has not changed

PSIRF alters the response method, not the statutory duty. The standards require organisations to uphold their Duty of Candour obligations, and the trigger remains harm grading: moderate or greater harm engages the duty, regardless of which learning response is chosen. For maternity, the requirements are expressly unchanged for all incidents. Duty of Candour does not dictate which response method to use, and choosing an after action review over a PSII does not reduce the duty.

Training and competence

The operative document is the patient safety incident response standards, whose current version is 1.3, January 2026 — and the summary of changes for that version is "amended training requirements for those in oversight roles", making it the most recent substantive PSIRF change.

Three roles carry named training requirements:

• Learning response leads — the course "Systems approach to learning from patient safety incidents"
• Engagement leads — "Patient and staff engagement and involvement in learning from patient safety incidents"
• Oversight leads — "PSIRF oversight"

All three must also complete levels 1 and 2 of the patient safety syllabus. Note that level 1 exists in two variants: "essentials of patient safety for all staff", and "essentials of patient safety for boards and senior leadership teams". Oversight leads take the board version. Level 2 is "access to practice" for all three roles. Getting these the wrong way round is a common documentation error at audit.

Beyond the courses, learning response leads and engagement leads must each contribute to a minimum of two learning responses per year, and all three roles must undertake continuous professional development and network with other leads at least annually. Learning response leads must not have been involved in the incident or manage the staff involved; Band 8a or above is recommended, though that is a recommendation rather than a requirement. Leads must work in a team, have dedicated paid time, and have access to subject matter experts.

For anyone commissioning this training: at least 50% of delivery must be live teaching, with assessment against learning objectives, and facilitators must demonstrate the training qualifications and the skills and experience specified in the standards. Engagement facilitators need specialist training in areas such as trauma-informed practice. Delivery can be in-house, purchased from suppliers on the NHS training framework, or provided by HSSIB.

How PSIRF relates to LFPSE

The cleanest way to hold these apart: LFPSE is the recording system, PSIRF is the response system. Recording an event to Learn from Patient Safety Events is a separate duty from choosing a learning response, and recording happens whether or not any investigation follows. Reporting to LFPSE is the equivalent of reporting to the old NRLS and StEIS; NRLS was decommissioned on 30 June 2024, and StEIS remains in use until the next LFPSE version is rolled out, which adds fields to support PSIRF.

Timeframes, and what oversight is for

The standards set response timeframes by agreement with those affected, typically one to three months and no longer than six. That is a significant departure from the old framework's fixed 60 working day clock, and it is the change that most often unsettles teams used to the previous regime.

The standards also insulate learning responses from other processes: responses are for learning only, and should be kept separate from blame, liability and fitness-to-practise considerations, with individual performance review or disciplinary action reserved for wilful harm or wilful neglect. Oversight is meant to focus on improvement "rather than compliance with prescriptive, centrally mandated measures".

For scale, the Department of Health and Social Care's July 2025 review of patient safety across the health and care landscape cited unpublished estimates of up to 3,000 patient safety incident investigations conducted by trusts annually, alongside around 15,000 other learning responses captured following patient safety events. The review did not recommend replacing PSIRF, and concluded that most investigations should continue to be managed within provider organisations.

A working checklist

• Confirm your policy and plan are both published on your website, and both signed off by the ICB and the board.
• Check when the plan is next due a full review — the national minimum is four years, not one.
• Audit your Never Event responses. If every one triggers a PSII automatically, your process predates the current guidance.
• Separate the two mandated locally-led PSII categories from the referral duties in your policy, so staff are not opening investigations where a referral is what is required.
• Check your named leads against the standards: the right course, the correct level 1 variant, two learning responses a year, and annual networking evidenced.
• Confirm Duty of Candour is triggered by harm grading in your process, independently of the response method chosen.
• If you commission training externally, check the 50% live teaching requirement and the facilitator criteria before signing.

The framework rewards organisations that can justify a proportionate choice and evidence the learning that followed. It penalises those still sorting incidents into categories and reaching for an investigation template. Where staff training touches capacity and consent decisions, the same principle of proportionate, evidenced judgement runs through adjacent regimes such as the Liberty Protection Safeguards, and the documentation habits transfer.