- To identify and assess potential hazards in robot-assisted urological surgery.
- To develop a comprehensive checklist to be used in operating theatres with robotic technology.
Healthcare Failure Mode and Effects Analysis
The operating theatre is a high-risk environment where patient safety takes priority. Adverse events, defined as inadvertent harm caused by medical error, are reported to be common, yet preventable in surgery. Data from developed countries suggest that up to 66% of adverse events are surgically related ; 13% of adverse events during surgery lead to disability and 4% lead to death . Approximately half of these complications are thought to be avoidable. A retrospective review of 1014 medical records from two London hospitals found that 16.2% of adverse events were detected in general surgery; 43% of which were deemed preventable . A review of an England and Wales error reporting database found that 446 184 patient safety incidents occurred in surgical settings over a period of 3 years .
Research has indicated that adverse events in surgery are primarily attributable to failures in non-technical skills such as communication, teamwork, leadership and decision-making [5-7]. Checklists have been used as an intervention to prevent these failures by promoting a team-working culture, standardising practice, allowing the detection of potential errors and improving patient safety as a whole. One example is the WHO surgical safety checklist. A large-scale study involving eight hospitals in eight diverse cities worldwide, showed that implementation of the WHO surgical safety checklist reduced mortality rates and postoperative complications by 0.7 and 4%, respectively . In addition, de Vries et al.  reported that the use of a ‘Surgical Patient Safety System’ checklist in six hospitals resulted in a reduction in the postoperative complication rate from 27.3 per 100 patients before implementation to 16.7 per 100 patients after implementation.
Robot-assisted surgery is an intricate procedure involving communication and support from a multidisciplinary team (MDT). The increasing complexity of this type of surgery may have detrimental effects on patient safety . This area of surgery is likely to benefit from a checklist or a safety barrier that allows standardisation and monitoring of this complex procedure. Various methods have been used to develop and validate safety barriers for the high-risk processes in healthcare environments. The Healthcare Failure Mode and Effects Analysis (HFMEA) protocol has been widely used across organisations. HFMEA is a powerful systems evaluation tool developed by the US Veterans Affairs National Centre for Patient Safety. It is a step-by-step process that involves the MDT in identifying potential causes of error within a system through the use of flow diagrams, hazards scoring and decision tree analysis. Potential errors are prioritised according to severity, frequency/probability, criticality, detectability and existing control measures. The final process includes taking steps to implement solutions, minimise errors and avoid adverse events . HFMEA has been successfully used to assess failures in communication and information transfer in the surgical care pathway [12, 13] and in other areas of healthcare such as radiology [14, 15], oncology (including chemotherapy and radiotherapy) [16-19], prescriptions for medication and medication safety [20-22]. To our knowledge, there are no current publications on the validation of a checklist for robotic surgery using this method.
The present study aimed to assess and evaluate the safety of robot-assisted urological procedures via a multidisciplinary approach, using the HFMEA protocol, and ultimately to develop a surgical safety checklist to be used in urology operating theatres with innovative robotic technologies.
We used HFMEA to construct a checklist for urological procedures carried out with innovative robotic technology developed by the da Vinci® Surgical System in a busy teaching hospital in London, UK from June to December 2011. HFMEA uses a five-step method that involves the MDT in actively identifying and eliminating potential errors in a system  (Fig. 1).
A high risk system, such as an operating theatre, was chosen for investigation.
An MDT was assembled consisting of two theatre nurses, one recovery nurse, three urology registrars, five consultants, one anaesthetist and three medical students. An advisor (K.A.) was responsible for overseeing the process; and a team leader (N.K.) was responsible for liaising with the team, leading discussion and keeping record.
The team leader (N.K.) created a preliminary flow diagram based on MDT discussions and 30 h of observation of robot-assisted urological surgery. The main processes and sub-processes were identified (Fig. 2). The main processes were the anaesthesia phase, operating phase and handover phase. Failure modes, which are defined as the way by which a process can fail to achieve its expected goal, were identified for all sub-processes (Table 1).
|No.||Process||Definition||Failure mode||Effects||Severity||Probability||Hazard score||Single point weakness?||Existing control measure?||Detectable?||Proceed?|
|1.||WHO Surgical Safety Checklist completed||Team completes the WHO checklist including staff introductions, checking patient identity, consent, marking, allergies, antibiotic prophylaxis and blood loss.||WHO checklist not completed||Unexpected adverse events and errors occur; harm to patient||2||2||4||N||Y||Y||N|
|2.||Relevant history checked||Team check all relevant history such as any pre-medications, fasting time, drug/alcohol history or any obstructive airway conditions||Relevant history not checked||Unexpected adverse event.||3||4||12||Y||N||N||Y|
|3.||Jewellery/piercings/nail polish removed||Team ensures that all jewellery/piercings and nail polish are removed||Jewellery/piercing/nail polish not removed||Interference with equipment/monitoring||1||1||1||N||Y||Y||N|
|4.||Patient's airway is assessed||Patient's airway is fully assessed and checked for dentures/crowns/bridges/loose tooth and any other obstructions.||Airway not assessed||Adverse events/respiratory related injury||3||3||9||Y||N||N||Y|
|5.||Patient vitals signs ready to be monitored||Patient vital signs such as blood pressure, ECG, oxygen level are monitored||Vital signs not monitored||Adverse events missed/not detected||3||4||12||Y||Y||Y||N|
|6.||Equipment checked||Anaesthetic machine/monitoring equipment is checked for faults. Team ensures all equipment is connected to the mains electrical supply and switched on.||Equipment not checked for faults, not connected properly||Patient not correctly ventilated/monitored.||4||2||8||Y||N||N||Y|
|Operating theatre – before the procedure|
|7.||Surgical team wash hands||All staff present in the operating theatre wash hands||Surgical team do not wash hands||Transmission of infections||2||4||8||N||Y||N||N|
|8.||Operating team put on surgical gown and gloves||The operating surgeon, assisting surgeon and scrub nurse wear sterile surgical gowns and gloves. They must avoid touching anything that is not sterile.||Operating team do not put on sterile gown and gloves||Transmission of infections||3||4||12||N||N||Y||N|
|9.||WHO Surgical Safety Checklist completed||Team completes the WHO checklist including staff introductions, checking patient identity, consent, marking, allergies, antibiotic prophylaxis and blood loss.||WHO checklist not completed||Unexpected adverse events and errors occur; harm to patient||2||2||4||N||Y||N||N|
|10.||Details recorded on white board||Details of the patient and the procedure are written on the white board.||Details not written on white board or details are incorrect.||Confusion/miscommunication amongst staff, possible injury to patient.||2||2||4||N||N||N||N|
|11.||Patient is secured on to the operating table||Patient's legs and torso are strapped and gel pads are placed under the arms, neck and shoulder blades.||Strapping too tight or patient not secure||Restricting blood flow, injury to patient||4||3||12||N||N||N||Y|
|12.||Operating table position is adjusted||The operating table position is adjusted using a remote control according to the correct level and inclination required for the procedure. The patient is positioned appropriately on to the operating table (for example Trendelenburg position for robotic surgeries).|| |
Patient is not positioned correctly;
Operating table not locked and is mobile.
Anaesthetist trying to move the table after the robot has been docked.
|Patient obtains injury, surgery impeded||4||3||12||N||N||N||Y|
|13.||Patient is draped appropriately||Patient is covered with sterile drapes and only the operating site is exposed. Anaesthetist working area (unsterile) is separated from the surgical site (sterile) by drapes.||Inadequate draping||Risk of infections||2||1||2||N||N||Y||N|
|14.||Hair removed from operating site||Hair is removed with an electric clipper from the operating site|| |
New, exchangeable clipper head not used
Excessive hair removal beyond the operating site
|Risk of infections||2||2||4||N||N||Y||N|
|15.||Antiseptic solution applied||Antiseptic solution is applied on the operating site and any excess solution is wiped off so that there is no pooling.||Antiseptic solution not applied or not applied liberally||Risk of infections||2||2||4||N||N||Y||N|
|16.||Adhesive drape applied||Plastic adhesive drape is applied to surgical site after antiseptic solution has been applied.||Adhesive drape not applied||Risk of infections||1||1||1||N||N||Y||N|
|17.||Equipment table positioned||Equipment table positioned appropriately to allow easy access to instruments and maintain sterile field.|| |
Equipment table inappropriately positioned.
Sterile field not maintained
|Surgery impeded, risk of infections||2||1||2||N||N||Y||N|
|18.||Surgical instruments counted||All instruments are counted before, during and after surgery and recorded in the patient's chart and white board. The count is audible and involves two members of staff, one of whom is part of the operating team||Instruments not counted or mistake in counting||Surgical instrument/foreign object retained||3||3||9||N||N||N||Y|
|19.||Faulty equipment checked||Any faults in the equipment used are checked before surgery, including surgical instruments, robot and monitoring equipment. Suitable trained staff conduct preliminary checks of robot.|| |
Equipment not checked for faults
Robot fails preliminary checks
Robot malfunctions prior to starting the case and after anaesthetic administration
|Surgery impeded, delays in operating list, injury to patient||4||3||12||N||N||N||Y|
|20.||Catheter inserted (if necessary)||Some urological procedures such as a prostatectomy will require a catheter to be inserted before surgery.|| |
Catheter site not sterilised
Instruments not sterilised
Problems with catheter insertion
|21.||Marking for port placement (robotic/laparoscopic)||Placement of ports (device that allows laparoscopic/robotic instruments to pass through the skin) are marked according to guidelines for the type of surgery to be performed.|| |
Markings not made
Injury/harm to patient
|22.||Port placement (robotic/laparoscopic)||Ports are inserted according to guidelines for the type of surgery to be performed.||Ports not inserted correctly|| |
Injury/harm to patient
|23.||Drape robot and arms||The robot, robot arms and all other instruments are draped with clear plastic covers. Draping should not be too tight and restrict robot arm movements|| |
Failure to drape
Draping too restricting
|Risk of infection||1||1||1||Y||N||Y||N|
|24.||Robot is docked and correctly positioned (robotic surgery)||The robot is positioned close to the patient (either at the side or between the legs) so that the robot arms can be inserted.|| |
Communication failure in guiding the docking process
|Injury to patient||4||3||12||Y||N||N||Y|
|25.||Robot Brakes Applied||Brakes applied after docking||Brakes not applied||Injury to patient||4||4||8||Y||Y||N||N|
|26.||Robotic/Laparoscopic instruments inserted||Robotic/laparoscopic instruments (such as scissors, electrocautery instruments and endoscopic camera) are inserted through ports.||Instruments not correctly inserted||Injury to patient||3||3||9||Y||Y||Y||N|
|27.||Avoid possible arm collision||The camera and instrument ports are placed to optimise range of movement and avoid possible arm collision.|| |
Ports are inadequately placed
Injury to patient, surgeon or anaesthetist
Disruption to surgery
|28.||Instruments ready for easy exchange||Ensure all instruments (clipping, cutting, suction, irrigation etc) are laid out and ready for easy exchange between scrub nurse and assisting surgeon||Instruments not ready/laid out||Delay in surgery||3||4||12||N||N||N||N|
|29.||Operating team position themselves||The operating surgeon, assisting surgeon, scrub nurse and anaesthetist position themselves appropriately. In robotic surgery, the operating surgeon disposes of his/her gown and gloves and takes up position at the console, ready to begin the procedure.|| |
Communication problems in team (especially in robotic surgery when the operating surgeon is placed far away at the console)
|Miscommunication leading to error and patient harm||1||1||1||N||N||Y||N|
|30.||Check lead and assisting surgeon communication, adjust intercom volume||Check that the lead surgeon (at the console) is able to communicate clearly and effectively with the assisting surgeon. The intercom volume may need to be adjusted to allow this.||Miscommunication between lead and assisting surgeon||Injury to patient, unexpected adverse events||3||4||12||Y||N||N||Y|
|31.||Lead surgeon adjust working space||Lead surgeon should adjust their working space to avoid collisions between the master controllers and against the walls as well as to prevent fatigue and uncomfortable positioning|| |
Master controller collision
Disruption to surgery
Possible injury to patient
|Operating theatre – after the procedure|
|32.||Robotic/Laparoscopic instruments removed (laparoscopic/robotic)||Robotic/laparoscopic instruments removed through ports.||Instruments not removed carefully||Injury to patient||2||3||6||N||N||Y||N|
|33.||Ports removed (laparoscopic/robotic)||Ports removed||Ports not removed carefully||Injury to patient||3||3||9||Y||Y||Y||N|
|34.||Robot de-docking (robotic)||Robot is steered away from the patient, back to resting position.||Communication failure in guiding the de-docking process||Injury to patient||3||4||12||N||N||N||Y|
|35.||Specimen retrieval bags removed (laparoscopic/robotic)||If specimen retrieval bags are used, they are removed after the procedure, before sutures are done.|| |
Specimen bag retained
Bag punctured, leakage of contents
|Harm to patient||3||3||9||Y||N||N||Y|
|36.||Any other instruments (such as needles, swabs, vascular clips etc) removed||Surgical team carefully check that any needles, vascular clips or swabs used are removed from the patient.||Instruments not removed and retained within patient||Serious injury to patient||3||3||9||N||N||N||Y|
|37.||Sutures done||Sutures are done and any wounds are closed||Sutures not done properly||Delayed healing, surgical site infections||2||4||8||N||N||N||Y|
|38.||Specimens collected from patient correctly labelled||Specimens are correctly labelled with patient's details.||Specimens not correctly labelled||Mix-up of lab results, patient management affected||3||3||9||Y||N||N||Y|
|39.||Surgical instruments counted||All instruments are counted before, during and after surgery and recorded in the patient's chart and white board. The count is audible and involves two members of staff, one of whom is part of the operating team.||Instruments not counted or mistake in counting||Surgical instrument/foreign object retained||3||3||9||N||N||N||Y|
|No.||Process||Definition||Failure mode||Effects||Severity||Probability||Hazard score||Single point weakness?||Existing control measure?||Detectable?||Proceed?|
|40.||Equipment sterilised|| |
All instruments used during the procedure must be sterilised, including robotic arms and robot (if used), which is protected by plastic coverings.
All instruments are cleaned prior to procedure in accordance with manufacturer's instructions.
|Equipment not fully sterilised and pre-procedure cleaning in accordance with manufacturer's instructions not done||Transmission of infections||2||4||8||N||Y||N||N|
|41.||Equipment problems reported||Any faulty equipment (e.g. with robot maintenance or laparoscopic equipment) identified is reported||Faulty equipment not reported||Faulty equipment not replaced||1||2||2||Y||N||N||Y|
|42.||Surgical team wash hands||All staff present in the operating theatre wash hands following||Surgical team do not wash hands||Transmission of infections||1||3||3||N||N||N||N|
|43.||Patient's chart updated||Patient chart filled in with details of the procedure, instructions for postoperative management and any particular problems/concerns.||Patient chart not fully updated||Missing information, poor postoperative management||3||3||9||N||N||N||Y|
|44.||Anaesthetist Present to Monitor Patient Recovery||Anaesthetist is present to monitor patient vital signs and recovery.||Recovery not monitored carefully||Patient not reassured/supported during recovery||3||3||9||N||N||N||Y|
|45.||Patient transferred from operating table to trolley||All members of the team help transfer the patient using a slide. They ensure patient is secure throughout the transfer and that the operating table and trolley wheels are locked.||Patient not secure during transfer, wheels are not locked||Patient obtains injury||2||2||4||N||N||Y||N|
|46.||Recovery Plans Discussed||Patient recovery discussed, any concerns regarding recovery explored.||Recovery plans not discussed||Important issues disregarded, recovery/post-operative management affected||3||3||9||N||N||N||Y|
|47.||Evaluation of procedure||Discussion of any issues/concerns and ideas for improvement.||Evaluation not conducted||Important issues disregarded, procedure not improved||1||3||3||N||N||N||N|
|Handover to recovery|
|48.||Patient presented to recovery team||Recovery team check details of the patient and the procedure||Whole team not present, wrong patient brought in||Ineffective care, miscommunication regarding care.||3||2||6||N||N||N||N|
|49.||Accurate handover of details of the procedure||All relevant information regarding the procedure is passed on to the recovery team.||Incomplete handover of information||Ineffective care, miscommunication regarding care.||3||3||9||N||N||N||Y|
|50.||Recovery plan discussed||The patient's recovery plan, any changes to the plan following surgery and any special circumstances are discussed.||Recovery plan not discussed||Ineffective care, miscommunication regarding care.||4||3||12||N||N||N||Y|
|51.||Any complications discussed||Any problems/complications during the procedure are discussed with the recovery team||Problems not discussed||Important issues overlooked, ineffective patient care||4||3||12||N||N||N||Y|
Next, a hazard analysis was conducted through MDT focus groups and discussions. A hazard score was deduced by rating each failure mode according to its severity and probability. Severity described the level of harm that could result from the failure mode and is classified as minor, moderate, major or catastrophic. Probability was defined as the likelihood that harm could occur as a direct result of the failure mode, classified as remote, uncommon, occasional or frequent. A hazard score was calculated by multiplying the severity and probability ratings (Fig. 3). Once a hazard score had been calculated for each event, all failure modes with a hazard score ≥8 were chosen for further evaluation.
Failure modes were further evaluated according to the decision tree analysis (Fig. 4). If the effect of a failure mode caused whole-system breakdown or an adverse event so severe that the procedure could not be continued, it was regarded as a ‘single point weakness’. Further screening included analysing whether there was an effective control measure in place and whether the failure mode was easily detectable.
All failure modes identified in step 4 were included in the robotic surgery operating theatre checklist as a means of eliminating/controlling the hazards identified using the HFMEA.
A surgical safety checklist was developed for robot-assisted urological surgery using HFMEA methodology. The HFMEA revealed the following:
We used HFMEA protocol to assess and evaluate the safety of robot-assisted urological procedures and this led to the development of a surgical safety checklist to be used in urology operating theatres with innovative robotic technologies. This 22-item checklist was produced as a result of the in-depth, systematic analysis of all failure modes identified through the HFMEA. The hazard scoring and decision tree analysis were the key determinants of which hazards were finally included in the checklist. As the HFMEA is very much MDT-centred, the content of the checklist was dependent on those hazards which the MDT considered to be important in their work environment. Many other details, such as briefing, checking patient identity, consent, marking, allergies, antibiotic prophylaxis and blood loss, were not covered by the checklist. Although these aspects are of great importance to patient safety, many of them are already covered by other checklists, e.g. the WHO surgical safety checklist , which was deemed to be an existing control measure for these hazards. In addition, the aim of the present investigation was not to replace these generalised checklists but to introduce additional checks specific to robotic procedures that are not fully covered by other, more generic checklists.
Using the HFMEA we identified specific hazards, e.g. patient positioning, port placement, robot docking/de-docking and robotic and laparoscopic equipment checks, which were considered to be important in robot-assisted urological procedures and which are not extensively covered by other checklists. For example, lack of correct and secure patient positioning scored very highly on the hazard analysis (hazard score 12) and was deemed to lack existing control measures and have low detectability. Patient positioning is an important consideration in robotic and laparoscopic surgery as optimum positioning is required to access pelvic and retroperitoneal organs and to increase ease of robot docking, but this issue is not addressed in generic checklists that are in widespread use. Also, poor positioning is often overlooked in surgery as a cause of iatrogenic harm such as peripheral nerve injury and compartment syndrome . Improper positioning of the upper limbs has been shown to cause ulnar nerve damage (compression of the cubital tunnel of an extended and pronated arm against table), brachial plexus injuries (hyperabduction of shoulder or excessive flexion of head to the contralateral side), and radial nerve injuries (pressure on the spiral groove by inadvertently allowing the arm to hang off the table) [23-25]. Moreover, prolonged Trendelenburg positioning during robot-assisted radical prostatectomy has been shown to cause venous pooling in the upper extremities leading to laryngeal oedema requiring reintubation, posterior ischaemic optic neuropathy, and brachial plexus neuroplexia caused by compression of the shoulder braces used to prevent cephalad sliding [26, 27].
Other considerations in robot-assisted urological surgery include port placement and robot docking. In open surgeries, access to the surgical field can be manipulated by retraction, patient repositioning or increasing the size of the incision; however, in robotic procedures, once the robot has been docked, the patient must remain stationary for the rest of the procedure. Visualisation and manipulation of the surgical field is achieved with a minimal incision through laparoscopic instruments inserted through carefully placed ports. Proper docking and port placement is crucial in allowing adequate intra-abdominal mobility and reach of instruments, avoiding external arm collision and safe and comfortable access for the assisting surgeon . Accordingly, robot docking/de-docking and correct/safe port placement scored highly on the HFMEA (hazard scores 12 and 9, respectively).
Equipment checking and reporting of equipment faults with the robot or any other instruments was also deemed important and included in the checklist. One study reported 11 cases of technical issues with robotic technologies, including malfunction of robotic arms, light or camera cords, power failure leading to re-boot and port placement issues . Dealing with these issues and reporting equipment fault is important in order to prevent disruptions to surgery.
The HFMEA results identified relevant and important hazards in robot-assisted urologic surgery for inclusion in the checklist, but the present investigation has a few limitations. One is that the narrow focus on robot-assisted urological surgery may mean that the results/checklist is not applicable to other areas of surgery or medicine; however, the nature of the HFMEA requires a focused approach for in-depth and detailed analysis which identifies all possible failure modes in a system. This may not be possible or practical if the scope of the investigation is too large. van Tilburg et al. , who used HFMEA to analyse medication errors in a paediatric oncology ward, suggested that a more specific focus may prevent an ‘overload of failure modes’ or a superficial analysis leading to generalisation of failure modes and recommendations.
Another consideration is whether the HFMEA method was appropriate for the development of a checklist. A checklist, by definition is an all-inclusive list of tasks carried out in a specific order. The focus of this definition is on the comprehensiveness of the checklist, the fact that it encompasses every single step in the process; however, HFMEA is a system of reduction where all but the highest scoring hazards, with an arbitrary cut-off point of 8 on the hazard analysis, or those hazards not considered to be a single point weakness are excluded from further analysis. This could result in some steps being missed from the checklist. The decision analysis ensures, however, that all hazards that are not further analysed have either pre-existing control measures or are highly detectable. HFMEA can therefore produce a more focused checklist tailored to the needs of the MDT in their immediate environment.
Another issue is that with an innovative field such as robotic surgery, methods and technologies are constantly updated. This could mean that the checklist has to be frequently revised to keep abreast of any changes. We hope that by describing the process of HFMEA in a surgical setting, operating theatre teams will be able to follow the method and assess hazards in new methods and technologies. This may allow the checklist to be updated within individual institutions according to the MDT's needs, but full participation from the MDT would be required as the process may be potentially costly or time-consuming.
A more general consideration is whether HFMEA is a suitable and reliable method for analysing risk in a healthcare setting. Habraken et al.  analysed user feedback on 13 HFMEA analyses carried out in Dutch healthcare settings and found that 20.8% of respondents reported HFMEA to be too time-consuming and 7.8% of respondents had difficulty carrying out the risk assessment, including hazard scoring and using the decision tree; however, 90.3% of healthcare professionals felt that the results of the HFMEA were meaningful and 87.1% expected an improvement in safety as a result. Shebl et al.  tested the reliability of HFMEA within UK hospitals by comparing the results of two separate HFMEAs conducted at two different hospital sites on the same topic. Their results showed only a 17% match in failure modes identified in the two groups with marked differences in the hazard analysis scores, indicating that HFMEA has poor reliability, but the perceptions and needs of the MDT in the two different settings may have differed significantly, leading to differences in hazard analysis. Thus, HMFEA appears to be a useful method for analysing risk within a healthcare setting, provided there is sufficient input and cooperation from the MDT. Disadvantages can include excessive use of time and resources and difficulty assessing reliability.
Future plans and developments include implementation and validation of the checklist within urology operating theatres and evaluating its effectiveness in robot-assisted procedures. It is anticipated that the use of the checklist will encourage a culture of safety and awareness within the operating theatre, but it is unlikely that a simple, technical solution such as a checklist can be the sole driver of significant culture change without support and cooperation from all members of the team. Mahajan  found that significant barriers to widespread adoption of a checklist, such as the WHO surgical safety checklist, included cultural factors, organisational hierarchy, logistics and timing, and misuse of the checklist. These issues should be anticipated and dealt with before implementation.
In conclusion, HFMEA has been successfully used to assess risk within the operating theatre and identify potential failure modes in robot-assisted urological surgery. The results of the hazard analysis led to the development of a 22-item surgical safety checklist tailored for use in operating theatres that use robotic technologies. Focus was placed on those hazards which are most important in robotic urological procedures such as patient positioning, docking and de-docking, port insertion and equipment failure reporting. Further research will involve validation and implementation of the checklist within operating theatres with robotic technologies to assess the effectiveness of the intervention. It is anticipated that findings will be transferable to other high-risk processes in healthcare.
The research was supported by the National Institute for Health Research (NIHR) Biomedical Research Centre based at Guy's and St Thomas' NHS Foundation Trust and King's College London. The views expressed are those of the author(s) and not necessarily those of the NHS, the NIHR or the Department of Health.