Most people think of handoffs as moments. A discharge happens. A referral gets sent. A letter arrives. Done.
That's how the systems model it. That's how we talk about it. And it's not how it actually works.
In the first piece, I argued that healthcare causes harm most often in the spaces between decisions - when responsibility dissolves without anyone noticing. This one's about why that space isn't a moment. It's a surface. And why treating it as a moment makes our safety models systematically blind.
The relay race that isn't
We carry this mental image of handoffs as relay races. One runner, one baton, clean pass, next runner takes over. Satisfying. Clear.
Except none of the assumptions hold.
The runners aren't in the same place at the same time. The GP writes a referral; the consultant reads it days later. The hospital discharges a patient; the community team picks it up whenever they next check their list.
The handoff zone isn't marked. In athletics there's a box painted on the track. In healthcare the boundaries are ambiguous, contested, often invisible to the patient.
The baton isn't a single object. Clinical responsibility is a bundle of obligations, authorities, and liabilities. It can transfer partially, conditionally, or not at all.
And once the pass is made, it stays made in athletics. In healthcare, the baton can hit the ground and nobody notices for weeks.
The relay model works for describing success. It's useless for understanding how things go wrong.
What a surface actually looks like
In engineering, a risk surface is any boundary across which harm can propagate. In plain terms, it's a period where things can go wrong, consequences are real, and ownership is unclear.
Walk through a real handoff.
A consultant decides a patient's ready for discharge. A letter gets dictated, maybe days before the patient actually leaves. It gets transcribed, checked, sent. The GP receives it days later. It sits in a workflow queue. Someone reads it, decides whether anything needs doing, acts or files.
When did responsibility transfer?
When the consultant decided? When the letter was sent? When the GP received it? When someone read it? When they decided it was now their problem?
Nobody knows. During that whole window - days, sometimes weeks - the patient exists in distributed responsibility. Multiple parties have partial obligations. None has complete ownership. The patient has no idea who's in charge.
That's not a moment. It's a surface. Surfaces have area. More area, more exposure.
The transfers that don't look like transfers
When I talk to Clinical Safety Officers about where harm accumulates, primary-care-to-primary-care keeps coming up.
Hospital-to-GP handoffs are dangerous, but visible. There's an institutional boundary. Paperwork exists. Someone knows a handoff is supposed to happen.
Primary-care-to-primary-care is different. A patient moves house. A practice closes and disperses its list. A locum sees someone and won't be there next week. A long-term condition review lands on whoever's available that day.
These cross responsibility boundaries without triggering any of the machinery that's supposed to catch them. No discharge letter. No referral form. Just a patient whose relationship with the system has quietly changed, and obligations that may or may not have followed.
The record transfers eventually. But the record is history. It says what happened. It doesn't say: here's what was being monitored, here's what was expected next, here are the active obligations.
Silent state migration
In other sectors we'd call this silent state migration. The data moves but the operational context doesn't. The new system inherits the information without the intent. That gap between information and intent is where risk lives.
Risk doesn't need activity
This is the hard one for organisations to accept. Risk can sit there while nothing's happening.
A patient waiting for referral outcome. A test result that was probably fine. A symptom that doesn't quite hit escalation criteria yet. Clinically quiet. Structurally dangerous.
In aviation, handover between control zones doesn't end when the first controller says goodbye. It ends when the receiving controller has positively confirmed responsibility and the aircraft is under stable supervision. The transition completes when someone else has verifiably started - not when someone stopped.
Healthcare treats many handoffs as if absence of activity equals safety. Discharge summary sent, handoff done. Referral made, obligation moved. But absence of activity isn't presence of ownership. The surface stays open until someone has explicitly accepted responsibility. Not received information - accepted responsibility.
Integration multiplies surfaces
The policy direction is toward more integration. ICSs, neighbourhood teams, virtual wards, provider collaboratives. More organisations working together, more boundaries crossed.
Broadly right. Fragmentation causes harm. Joining things up should help.
But there's a structural problem nobody talks about enough: every integration is also a new risk surface.
A neighbourhood team spanning general practice, community services, mental health, social care - that's enormous potential for coordination. It's also a mesh of organisational boundaries, each one a potential site where responsibility dissolves.
The ambition is that boundaries become seamless. The reality, without proper design, is that they become invisible. Invisible isn't the same as absent. Invisible means breakdowns don't trigger alarms.
I've seen this in finance. When banks merged in the 2000s, integration was supposed to eliminate duplication. What happened in several cases was risk management fell into gaps between legacy systems. Each side assumed the other was handling it.
Healthcare integration has the same vulnerability. More connections, more surfaces. Unless you explicitly model responsibility at those surfaces, you're building something that's better at sharing data and worse at maintaining accountability.
Monitoring windows
There's a specific problem that doesn't have good language yet.
Patient gets seen. Concern noted but not immediately actionable. Clinician says monitor your symptoms, come back if it worsens. Follow-up maybe scheduled, maybe left to patient initiative.
The patient's now in a monitoring window. Not under active care, not fully discharged. Conditional responsibility - the clinician has obligations contingent on certain things happening.
Problem is, monitoring windows aren't modelled anywhere. The EPR records the consultation. Maybe records that advice was given. Doesn't record: this patient is in a 14-day monitoring window for these symptoms, if no contact these obligations reactivate.
System thinks the episode's complete. From a safety perspective it's dormant but live. The clinician remembers for a few days, then the patient fades into background noise. The patient might intend to call back but symptoms are ambiguous and they don't want to be a bother.
Two weeks later, something serious. Everyone agrees the patient should have returned sooner. Nobody notices that the system had no mechanism for tracking the obligation. No way of flagging that a monitoring window was expiring unresolved.
A risk surface with no owner. Because we treat time as someone else's problem.
Taking surfaces seriously
If handoffs are surfaces not moments, clinical safety needs to think differently.
Surface area: how many transitions, across how many organisations, with how many different responsibility models? Complex care pathways cross dozens of boundaries. Each one is exposure.
Exposure time: how long does the patient exist in ambiguous responsibility? A handoff that completes in hours is different from one that drifts over weeks.
Boundary conditions: what has to be true for transfer to actually happen? Information sent, or acknowledgment required? Explicit acceptance, or responsibility by default?
Right now these questions only get answered retrospectively, by people reconstructing what went wrong. The systems don't model responsibility surfaces. They model events. Events don't capture what matters.
Design, not behaviour
Same point as before: this is structural, not moral. Clinicians aren't getting handoffs wrong because they don't care. They're in systems that weren't designed to track what they're asked to track.
Better training won't fix it. More checklists won't fix it. Infrastructure that treats responsibility as a first-class concept might.
Explicit states: offered, accepted, active, dormant, transferred, ended - states that today exist only in people's heads. Time-aware obligations that know when monitoring windows expire. Boundary conditions defining what makes transfer complete. Alerts when surfaces stay open too long.
These patterns exist elsewhere. Financial services tracks settlement with this rigour. Aviation tracks control zone handoffs with positive confirmation. Healthcare has the same need and hasn't built for it.
Every new integration, pathway, collaboration creates surface area. The question is whether we're building infrastructure to make those surfaces safe.
The Complete Mind the Gap Series
- Mind the Gap #1 — Care Doesn't Fail Where You Think It Does
- Mind the Gap #2 — Handoffs Aren't Moments. They're Risk Surfaces. (current)
- Mind the Gap #3 — Responsibility Is the Thing Nobody Can Point To
- Mind the Gap #4 — Evidence Decays Faster Than We Admit
This is part of the Mind the Gap series — exploring where clinical safety actually fails and what infrastructure would make it safer. View the full series
