Insulin Error Death: How Do All Hospitals Learn?

A man named Donald Gough died in a Cardiff hospital in November 2022, four weeks after an insulin error during surgery. He was 77, a retired NHS radiographer who had spent more than 50 years working in the same health system that was now caring for him. He had bowel cancer that had spread to his liver, and he agreed to surgery to remove the secondary tumors. He was told the operation carried a risk of death of about 5 percent at most. He did not wake up as expected afterward.

The cause was encephalopathy, brain injury from very low blood sugar. The reason his blood sugar crashed is that he had high levels of insulin in his body. He was not diabetic. There was no clinical reason for him to receive insulin at all.

At the inquest, which concluded this June, every surgeon, nurse, and theater staff member involved in his care denied giving him insulin, and none of them saw anyone else do it. The coroner found no malice. His words were that

“Systems based on human checks may unaccountably break down.”

So we have a confirmed, fatal exposure to a high-alert drug, and no one can say whose hand was on the syringe.

I want to be careful here. I don't have the full coroner's report, only the reporting from the inquest. I'm not a clinician, and I wasn't in that operating room. I'm not going to pretend I know exactly what happened, because nobody seems to (not even the people who were there).

The Question That Isn't “Who”

When investigators can't identify who administered a drug, the instinct is to call it a dead end. Case unsolved. Nothing more to learn.

I'd argue the opposite. The inability to attribute the error is itself the finding. It means the system allowed a dangerous drug to reach a patient with no record of who gave it, when, or why. You don't need to name the individual to see that. And you don't need to name the individual to fix it.

That's the shift I keep coming back to in how organizations respond to harm.

The reflex is to ask “Who did this?” The more useful questions start with “What?” and “Why?” and “How?”

What made insulin available in that room? Why was a high-alert drug stored where a patient who didn't need it could be exposed to it? How does a handover happen without a record of what was passed along?

To their credit, the hospital seems to have asked some of those questions. The inquest heard that insulin is no longer stored in the fridge in the anesthetists' room. Handovers from the anesthetist to recovery staff now have to be logged. The consultant anesthetist admitted he should not have left the patient before he had woken up. Those are real changes, and notice what they have in common. None of them is “tell people to be more careful.” They change the conditions. They make the error harder to commit and easier to catch.

That's the right altitude to work at. The weakest response to any error is the one that depends on humans trying harder next time. Education, reminders, a new policy, a stern word. They feel like action and they change very little, because they don't touch the conditions that made the mistake available in the first place. Removing insulin from a fridge where it doesn't belong is worth more than a hundred reminders to be vigilant. When the same kind of mistake keeps repeating across an industry, that's a signal about the design, not about the people.

How a Factory Would Handle This

Let me step outside healthcare for a second, because I think the parallel sharpens the point.

Imagine a global manufacturing company with 50 plants around the world. In one of them, a worker is electrocuted and dies. Maybe a machine wasn't properly grounded, or a lockout step got skipped, or a guard was missing.

What does a serious company do?

It does not say “that was an isolated incident at one plant” and move on. It does not quietly fire a supervisor and consider the matter closed. A company that takes safety seriously treats that death as information that belongs to the entire enterprise. Within days, every other plant gets a stop-and-check. Every similar machine across all 50 sites gets inspected. The investigation digs into what conditions allowed it, and whatever they find gets turned into a standard that travels everywhere. If grounding was the issue, all 50 plants verify grounding. If a lockout procedure failed, the procedure gets redesigned and rolled out globally, sometimes with a physical change that makes the unsafe state impossible rather than merely against the rules.

The death is treated as a horrible gift, paid for at the highest possible price, and the company refuses to waste it. One plant's tragedy becomes every plant's lesson. That's not corporate sentiment. It's how you keep the same death from happening in plant number two.

This is the question that the Gough case raises for me. Does healthcare work that way? The short answer is no, until proven otherwise.

When One Hospital Learns From an Insulin Error, Should the Rest?

I genuinely don't know how widely this kind of event gets shared and learned from across hospitals. It seems like it doesn't happen that same way, even within hospitals that are part of the same system.

There are mechanisms. Patient safety alerts, never-event reporting, regulators that can require changes. Some of that machinery exists, and some of it works. But I'm not convinced that a fatal insulin exposure at one hospital reliably becomes a prompt for every other hospital to ask

“Could this happen here? Where is our insulin stored? How solid are our handovers?”

Insulin errors in general are common. Insulin reaching a patient who should never have received it is much rarer. Cases where no one can ever say who gave it are rarer still. So I'm not suggesting this exact scenario is playing out in operating rooms everywhere. But it could? The goal of “never events” means we should aim for NEVER.

It isn't the only time a non-diabetic patient has been harmed by insulin that was never meant for them. Insulin is used in both diabetic and non-diabetic patients, and it has been tied to more medication errors than any other class of drug. In one stretch of less than 18 months, Pennsylvania facilities alone reported more than 2,600 insulin-related error events, and the second most common type was a wrong-drug error, one medication given in place of another. Most of those get caught. The frightening ones are the mix-ups, because a mix-up is a design problem you can actually do something about (which makes it LESS frightening)

But the conditions underneath it aren't rare at all. Accessible high-alert drugs, syringes that aren't labeled at the point they're drawn up, handovers that rely on memory and a verbal “he's all set” rather than a record. Those conditions exist in a lot of places. The catastrophic version is uncommon. The near misses that share its roots happen all the time. The factory doesn't wait for a second electrocution to check the grounding at the other 49 plants. It shouldn't take a second death for hospital number two to look at its own fridge.

What Would It Take

I don't have a tidy program to offer here, but the manufacturing comparison does suggest a couple of things.

The first is that learning across a system has to be designed, not hoped for. The factory doesn't rely on plant managers happening to read about each other's accidents. There's a process that moves the lesson, on purpose, with someone accountable for making sure it lands at every site. I'm not sure healthcare has built that same muscle for sharing, at least not consistently across organizations that don't report to the same boss.

We do have proof that the lessons exist. After a different patient, Juliet Marlow, died in an English hospital in 2018 when her blood sugar wasn't monitored and she was given insulin but no sugar for hours, the inquest heard that the hospital had improved its procedures as a result. Good. One hospital learned. The question that nags at me is what happened next. Did the hospital down the road change anything, or did they have to wait for their own death first?

I keep coming back to a case I wrote about years ago, because it answers that question in the worst way. In 2006, three infants died in an Indianapolis hospital after being given an adult-strength dose of the blood thinner heparin instead of the infant dose. The vials looked nearly identical, same size, similar shade of blue, easy to grab the wrong one in a dim room at 2 a.m. The story made national news. Two years later, in 2008, Dennis Quaid's newborn twins were given the same massive heparin overdose at Cedars-Sinai in Los Angeles, twice, through the same look-alike vial problem. The twins survived. But the lesson from Indianapolis had been sitting in plain sight for two years, and it didn't make the trip from one hospital to another. The look-alike packaging risk had even been documented publicly back in 2006. The information existed. The system to carry it across the industry, and make every hospital act on it, did not.

That's the gap I can't stop thinking about with Cardiff. A factory doesn't let a known fatal hazard sit unaddressed at 49 other sites for two years. Why does healthcare?

There's an even older lesson sitting right there in the insulin story. For years, handwritten orders abbreviated “units” as a “U,” and a sloppy “U” reads as a zero, which turns 5 units into 50. Consider what that means with insulin. One hospital reported a case where a man was ordered 5 units of a fast-acting insulin and received 50 units, twice, because the order was written “5U” instead of “5 units.” The institution's own review named the use of “U” for units as a contributing factor. Ten times the intended dose, from a single letter.

The fix has been known for decades. The Institute for Safe Medication Practices put “U” on its list of error-prone abbreviations and tells everyone to spell out “units,” precisely because a U can be mistaken for a zero and cause a tenfold overdose. Cheap. Obvious. And yet the abbreviation keeps showing up, because a guideline that lives in a binder depends on every tired person remembering it at 3 a.m. That's the weakest kind of control, the one that asks humans to try harder. Old habits die hard.

The more reliable answer is to take the choice away. Rather than train doctors to stop writing “U,” the better-designed electronic systems simply won't let the abbreviation stand, flagging or expanding it to “units” so the unsafe version never reaches the patient. The principle is the same one as pulling the insulin out of the anaesthetists' fridge. Don't ask people to avoid the hazard through willpower. Engineer the situation so the hazard isn't available to begin with.

The second is that none of this travels without psychological safety. Look at how the useful facts in this case surfaced. They came out at an inquest, under oath, years later. The storage problem, the weak handover, the anaesthetist leaving early. The leadership question is whether your organization surfaces those conditions before a death drags them into a courtroom. That depends entirely on whether your people can say “the way we store insulin in here worries me” without fear of being blamed or ignored, and whether saying so actually leads to a change they can see. An organization that punishes the messenger is training itself to stay ignorant.

Darril Wilburn, who spent years at Toyota, said “it's a leader's responsibility to create a system where people can be successful.” Donald Gough spent 50 years inside a system, caring for other people. He deserved one that was designed to catch the error that killed him, and to make sure the next hospital caught it too.

I keep coming back to a question that a Toyota leader used to ask his team at the end of a hard day on the line. Not “whose fault was it,” but “what did we learn today?”

When a patient dies from something like this, the harder question is the one after that. What did everyone else learn? And if the answer is “nothing, because no one told them,” whose job was that?