Since the Institute of Medicine (IOM)¹ report To err is human was published, the problem of preventable adverse patient outcomes has received enormous attention. To help direct efforts to improve patient safety, a variety of paradigms has been proposed, each offering a new—or at least a different—way to tackle the problem. These paradigms fall into three broad categories:

• focus on reducing healthcare professional (HCP) errors;

• focus on reducing patient injuries; and

• focus on improving the use of evidence based medicine.

The first paradigm proposes that, to achieve patient safety, errors committed by HCPs must be prevented, eliminated, or reduced. The idea is that, since HCP errors in delivering care can lead to patient harm, patient safety efforts must focus on preventing errors from occurring in the first place. This paradigm is exemplified by the IOM report¹ which proposed that, to achieve safety, one must focus on error reduction through the design of safer systems. A follow up report by the IOM² continued supporting the error prevention paradigm by explaining: “A new delivery system must be built to achieve substantial improvements in patient safety—a system that is capable of preventing errors from occurring in the first place, while at the same time incorporating lessons learned from any errors that do occur”. The paradigm promotes eliminating errors by designing better healthcare systems.

In a paper presenting the second paradigm, Layde et al³ argued that because error and harm are not always linked, patient safety efforts should focus on the reduction of patient injuries. Errors that do not lead to harm—often called near misses or near hits—may occur when (a) luck is involved, such as when an erroneous medication is administered, but the patient suffers no adverse effects; (b) the error is not clinically significant enough to cause harm, such as when a minor overdose of a low risk medication is administered; or (c) the error is caught before harm can be done, such as when a pharmacist catches a physician prescription error. The authors argue that, since a proportion of errors does not result in patient harm, not all errors are worth trying to eliminate. Instead, they propose that individuals in healthcare delivery systems should analyze patient harm, determine what factors (including errors) contribute to harm, and then redesign the system of care to eliminate all factors that contribute to harm, including factors that cause errors.

Brennan et al⁴ recently proposed a third patient safety paradigm that focused on implementing evidence based practices for quality patient care. The assumption is that, if clinicians follow evidence based practices, then patients will receive more appropriate and therefore higher quality. Higher quality care, they argue, will be safer care. The rationale used by the authors and others⁵ for targeting patient safety with evidence based medicine is that the goal of discovering the causes of patient injuries is complicated by the subjective nature of identifying errors and injuries, and by the acuity and fragility of patients. They do, however, point out that safety science can contribute to a better understanding of how to design for both safe and effective care.

In each of the above paradigms there are two common themes. Each of these themes has limitations that can be addressed through a complementary human factors engineering paradigm, which is presented below. Firstly, underlying all three paradigms is the belief that, to achieve safety, changes are needed in the design of the system where patients receive care. The idea is that, with better designed healthcare delivery systems, errors or patient injuries can be eliminated or evidence based practices can be better implemented. However, although each paradigm focuses on improving system design, there is little explanation as to the mechanisms by which system design affects outcomes such as errors, injuries, and quality. Not specifying a mechanism leaves unanswered the question “what type of system design will lead to error/injury reduction or quality improvement in those paradigms?” Secondly, each paradigm focuses on patient related outcomes including safe and/or effective care, but little attention seems to be paid to the central role of the HCP and the activities they perform within the healthcare delivery system (although see IOM⁶ chapter on nurse work environment). This paper presents a human factors engineering paradigm that is complementary to the paradigms listed above and addresses both limitations. This paradigm should be useful to anyone involved in healthcare delivery decision making, including healthcare delivery system managers, directors, change agents, and HCPs themselves.

DESIGNING TO SUPPORT PERFORMANCE AND ELIMINATE HAZARDS: A HUMAN FACTORS ENGINEERING PARADIGM

System redesign does not necessarily lead directly to safe or high quality care. Rather, system redesign affects such outcomes by improving the process of care, which is achieved primarily through two mechanisms: performance and hazard reduction. Performance consists of the mental, physical, social, and behavioral activities carried out by HCPs toward some (usually patient related) goal. Hazards are system elements that increase the likelihood of error or injury. In many ways these two mechanisms are two sides of the same coin, as both are achieved through appropriate system design. Although error, injury, and evidence based medicine paradigms also call for designing “safer” or “more effective” systems, they do not specify the mechanisms by which design produces safe and high quality care. What, then, are the guidelines for design? The human factors engineering paradigm proposes that the mechanism by which system design may improve patient safety outcomes is through HCP performance and the elimination of hazards; thus, design mustsupport HCP performance and eliminate hazards.

The following sections provide a conceptual overview of what is meant by designing for HCP performance and hazard reduction. Specific details on methods for technically redesigning systems,^7–9 or for methods about redesigning a system to support performance^10–14 or reduce hazards,^11,15–19 are given in the cited literature. With this in mind, the paper next addresses what is meant by the terms “performance” and “hazard reduction”.

HUMAN PERFORMANCE

Human performance can be defined as “the pattern of actions carried out to satisfy an objective according to some standard”.²⁰ This and other definitions^10,12 treat performance in terms of actions, activities, or generally any transformation processes that humans engage in to produce some output. The transformations themselves are a subsequent stage of what we will refer to as inputs—the system pre-conditions that influence performance.²¹ Thus, interactions among inputs contribute to the achievement and quality of transformations, and transformations lead to outputs (fig 1).^7,22

Figure 1 is derived from open systems theory^23,24 and earlier work that defined a work system,²⁵ and from more recent adaptations of the work system model to health care^26,27 (and from Carayon et al elsewhere in this supplement). It provides a framework for understanding how the elements or inputs (left side) of a system can interact to influence the performance of HCPs (middle) and, ultimately, patient safety (right side).

Inputs

The left side of fig 1 represents the work system^25,26 (and from Carayon et al elsewhere in this supplement) in which HCPs perform their jobs. The elements in this work system are the system inputs into performance. These include:

• Patient and HCP factors. These are characteristics of individuals such as health, age, weight, needs, mood, personality, experience, intelligence, language and knowledge. Some characteristics are less dependent on the situation, such as personality and intelligence, while others such as mood may vary depending on the situation. These can be referred to as traits and states, respectively.

• Task factors. These are characteristics of the tasks or jobs HCPs must execute, including what the tasks themselves are, as well as characteristics such as work flow, time pressure, job control, and workload.

• Technology and tool factors. Technology factors refer to quantities and qualities of technologies in the organization. Such factors include the number and types of technologies and their availability and location. The design of tools and technologies, including their integration with other technologies, propensity to breakdown or crash, responsiveness, and other design characteristics would also be included.

• Environmental factors. These are the features of the environment in which HCPs work. These features include lighting, noise, and physical space and layout.

• Organizational factors. These are the structural, cultural, and policy related characteristics of the organization. Examples include leadership characteristics, culture, regulations and policies, levels of hierarchy, and supervisor span of control.

• External environment factors. The external environment of any given system is anything outside of that system. The external environment of a patient room is the unit in which it resides, but also includes the hospital, local, state and federal laws, and the economic conditions and demographic makeup of the community.

The examples used above for the various system inputs are by no means an exhaustive set of factors to consider. Also, none of these factors may be important to patient safety in and of itself; rather, it is typically the interaction between inputs that can influence patient safety. For example, lighting is not good or bad by itself, but lighting can be problematic for certain tasks or create glare on certain displays. Similarly, a technology such as computerized physician order entry may or may not influence patient safety; rather, it will have a positive or negative impact on safety depending on many factors such as (a) how well it is integrated into the physical environment and the workflow, (b) how much training is provided to end users, and (c) how end users perceive its ease of use and usefulness.

The input (left) side of fig 1 also shows that any given system (for example, a patient room, unit or hospital) exists within hierarchies of other systems. In other words, any given system is part of a larger system and also contains subsystems. For example, an inpatient nursing unit—which is itself a system—exists within a larger system such as a hospital. Also, that nursing unit contains subsystems such as patient rooms, medication administration systems, and within unit communication systems. These hierarchies (or nestings) of systems are important to understand for patient safety because they influence HCP performance, and thus patient safety.²⁸ This implies that (re)design of healthcare delivery systems must involve careful consideration of (a) the context in which the system resides (higher level systems), (b) the influence of and impact on lower level subsystems, and (c) the impact on the inputs and outputs of other systems.^7,28 Unintended negative consequences may otherwise occur.

Transformations (performance)

The middle section of fig 1 shows transformations. Transformations—also sometimes referred to as processes or performances—are the actual acts of transforming inputs into outputs. Physical transformations result in new configurations of the system, such as when a transferred patient now resides in a new location or when a surgery is completed and a patient is physically transformed. Cognitive and social/behavioral transformations also result in new system states—for example, after a difficult diagnosis a physician is more mentally fatigued and the patient more informed than he/she was initially (cognitive); or when the presence of a manager leads a pharmacist to recheck a medication cart before it is transported to the unit by a pharmacy technician (social/behavioral).

Outputs

The right side of fig 1 shows outputs. An output of performance can be as general as “surgery completed” or as specific as “tablet placed in mouth of patient” or “nursing knowledge of a policy improved”. Output can be thought of as a new state of the pre-transformation system and is evaluated by referring to a relevant set of objectives and standards—for example, must give right patient the right medication at the right time, and so on. Relevant outputs for patient safety might include achievement of the five rights of medication administration, the correct information handed off between HCPs, or adequate knowledge and skill to correctly use a new computerized provider order entry system.

Feedback

The idea of feedback is central to fig 1 because feedback from outputs affects subsequent inputs and thus affects performance and patient safety. This feedback operates in two main ways: (1) it acts as an input into other processes and (2) it influences the same process when it recurs in the future. Consider medication dispensing, which is influenced by a variety of inputs. The output of medication dispensing is either the right or wrong drug dispensed. If data on dispensing errors are tracked and problems are identified in the inputs-transformation-outputs sequence, knowledge about how the output (wrong medication) comes about could be used as corrective feedback to change some of the inputs into the dispensing process (for example, policies, personnel or technology) in order to provide better HCP performance and, subsequently, better patient safety. At the same time, the output of the dispensing activity (which is a dispensed medication) is one of the main inputs into the medication administration process, which follows dispensing in the medication use process.

Role of the patient

In fig 1 the patient comes into play in all three stages. At the input stage, patient characteristics partly determine how the system must be designed to support HCP performance. This is evident, for instance, in design differences between infant and adult beds and equipment. The transformations themselves are patient care related activities—for example, treatment decisions or medical procedures. The output, which is the resulting change in system state, includes changes to the patient—for example, the patient is treated—which then acts as feedback to subsequent transformation—for example, as a patient recovers, that information should influence subsequent treatment plans.

We discuss three types of performance that should be taken into account in system design: physical, cognitive, and social/behavioral. Although inputs, transformations, and outputs for each type are addressed separately, we stress that many of the same inputs affect all three types of performance and that the distinctions between these types of performance are artificial—that is, the boundaries between them are fuzzy at best because, regardless of the amount of thought versus movement, all human activities are essentially “cognitive” to the extent that the brain is involved in everything we do.²⁹

Physical performance

Physical performance refers to physical actions requiring the musculoskeletal system. Walking, carrying charts, operating, palpating, and transferring patients are examples of physical performance. As with all types of performance, successful execution of physical performance depends on both the individual who is performing and on the design of the system in which the performance takes place. Examples of relevant inputs for physical performance include:

• HCP individual characteristics: strength, visual acuity, dexterity, flexibility, age, experience, knowledge, fatigue, health, fitness.

• Patient characteristics: mobility, weight, cooperation, communication ability, coordination.

• Task characteristics: number of patient rooms to be visited, number of medications to be administered, workflow.

• Technology and tool characteristics: availability of necessary equipment, ease of use of necessary equipment, size and design of scalpel, quality of video monitor for endoscopy.

• Environmental characteristics: physical space layout, lighting, temperature.

• Organizational characteristics: how much speed, quality, and safety are emphasized, policies for completing the performance, and social norms such as when it is acceptable, if ever, to break from policy.

• External environment characteristics: regulations regarding, for example, work hour restrictions, industry-wide conventions for the design of physical layouts.

To accurately understand the influence of inputs on transformations, it is important to understand how system factors interact to affect performance. For instance, nurse strength and fatigue (HCP characteristics), patient weight and mobility (patient characteristics), nurse busyness (task characteristic), availability of patient transport technology (tool/technology characteristic), the physical layout of the unit (environmental characteristic), and social pressure (organizational characteristic) jointly and interactively determine whether that nurse asks for help in lifting and moving a patient.

As the outputs of physical transformations result in some change in the system, outputs can be evaluated as final products or as inputs into future performance cycles. For example, a pharmacist views a medication that has been prepared by a pharmacy technician as the output of the medication preparation process while a nurse views that same medication as a necessary input into the medication administration process. Good human factors design can produce system inputs that better accommodate HCP physical performance to achieve outputs that are beneficial to patients (fewer adverse events/injuries), administrators (efficient use of time), and HCPs (minimal fatigue). Design principles for supporting physical performance are widely available.^10–14

Cognitive performance

Cognitive performance^10,12 is associated with transformations in the human brain, comprising such implied mental activities as perceiving, thinking, reasoning, and remembering. Again, fig 1 can be used to guide thinking on how to design a system to support cognitive performance. To understand how the different elements of the work system can affect cognitive performance, we will look at either characteristics of, or the inputs from, each of the different elements of the work system:

• HCP individual characteristics: knowledge, memory and attention capacity.

• Patient characteristics: language, education and economic background, mental health.

• Task characteristics: complexity of the task, time pressure, how the individual must keep track of information, interruptions.

• Technology and tool characteristics: ease of use, readability, standardization of information display, clarity of information.

• Environmental characteristics: lighting, noise, distractions.

• Organizational characteristics: training, management expectations and rewards for fast versus precise work.

• External environment: policies and regulations, informatics industry standards for information display, academic traditions for training HCPs.

As previously mentioned, human elements and inputs from the entire work system interact to influence performance. For example, lighting (environmental characteristic), time pressure (organizational characteristic), task complexity (task characteristic), and visual acuity (individual characteristic) all interact to influence whether or not a HCP realizes that the medication name on a syringe is incorrect.

There are a number of categories of cognitive transformations that are important to healthcare work, some of which can be exemplified using the case of an individual’s reaction to an auditory alarm. Firstly, sensation and signal detection occur as the individual becomes aware of the alarm; perception of the alarm and localization follow as the individual interprets the sound waves as an “alarm” and attempts to determine where the sound is coming from. The individual then accesses his or her long term memory to determine the meaning of the alarm. The individual next engages in decision making and response selection to decide how to respond to the alarm, uses his or her working memory to temporarily retain the response goal in memory until task completion, and uses response execution to either turn off or respond to the alarm. Finally, the individual engages in post-response monitoring to gauge the impact of his or her behavior on the system. For HCPs to effectively react to alarms, the design of the system must facilitate each of those cognitive processes.

Many additional cognitive processes exist, such as learning, language and communication; self-regulation, coordination and integration; problem detection, problem formulation and plan generation, mental imagery and manipulation; situation awareness and assessment; visual search and pattern matching; attention—which includes vigilance and monitoring; and cognitive/executive control.^30,31

Cognitive transformations can produce various outputs. Some such as speech and motor function are observable, whereas others such as learning, mental overload, reaching an unspoken decision, or forming a new memory are more internalized. Again, designing inputs to support cognitive performance—for example, reducing distractions and dependence on memory, increasing HCP skills, and improving the signal-to-noise ratio—will produce favorable outputs (better memory, correct decisions, improved communication, and accurate responses) associated with patient safety, quality, effectiveness, error reduction and injury reduction goals.

Social/behavioral performance

Social/behavioral performance here refers to transformations that, while occurring in the brain just as the many types of cognitive performance, have traditionally not been addressed by the cognitive sciences but rather by the social sciences. These include mental processes for attributing causality; cognitive and emotional self-regulation and social learning; motivational processes, processes involved in planning deliberative behavior, and cost-benefit analyses; and other normative decision making processes. Even though the distinction between cognitive and social/behavioral performance is artificial, for the sake of clarity we discuss social/behavioral performance separately.

As with the other types of performance, a variety of system inputs may be relevant for social/behavioral performance:

• HCP individual characteristics: experience, age, physical abilities and limitation, knowledge, personality.

• Patient characteristics: mental and physical functioning status, age, financial situation, family considerations.

• Task characteristics: time pressure, complexity, number of tasks, workflow, amount of socialization.

• Technology and tool characteristics: degree of automation, communication options within technology, need for sharing and teamwork in using tools/technology.

• Environmental characteristics: physical layout and arrangement of space.

• Organizational characteristics: reward system, management style, training, culture.

• External environment: local, state, federal policies and laws, relevant aspects of local/national culture.

Individual inputs and inputs from the work system interact to influence behavioral transformations and, subsequently, outputs. These transformations can produce important outputs like moods, motivations, behaviors, plans, and decisions. Additionally, many theories of social/behavioral performance can be used to understand important social situations and behaviors in health care,³² including how blame is assigned following an accident; end user beliefs, attitudes, and decisions regarding technology (use, overrides, workarounds); and volitional behaviors (following protocol, hand washing).

Considering the performance types together

As should be evident, elements of a system and the different types of performance are all interconnected. This implies that no inputs should be considered relevant to only one particular transformation process, especially because slight perturbations in a single transformation can become accentuated through feedback over multiple performance cycles. This should be clear from the extensive overlap of examples of inputs in the previous sections. For instance, alarms in wards or operating rooms can be a source of mental distraction to HCPs, but they may have effects on all types of performance. In this case, unwanted sound can cause auditory discomfort (physical performance), drown out interpersonal communication (social/behavioral performance), and disrupt attention (cognitive performance). System inputs can therefore affect multiple types of performance directly and indirectly, even when the effects do not seem obvious. The implication is that, when thinking about how to design or redesign healthcare systems, care must be taken to make sure that the design is appropriate for each of the different types of performance that different people in the system must achieve.

HAZARDS

In the previous sections we explained how system inputs could influence HCP performance. In the same way that inputs can facilitate HCP performance, poorly designed inputs can act as hazards in that they can lead to poor performance and thus increase the likelihood of adverse outputs such as errors, injuries, and poor quality.^33,34 A hazard is anything that increases the probability of errors or of patient/employee injury. “Hazard” is a safety term that means the same thing as “risk factor” in health care or epidemiology and, like risk factors, hazards can vary by frequency, duration, location, predictability, and magnitude. As such, hazards can be located anywhere in the structure of the work system (left side of fig 1).

Importantly, because all of these hazards occur in the real work environment, they typically interact with each other and can therefore lead to other hazards.³⁵ For example, when a nurse is using a hand held wireless scanner for scanning patient identification bands and medications at the point of care, the medication and patient information displayed in the scanning device may be difficult to read because of poor contrast between the text and background in the display. The readability of the display could be even worse in situations where room lighting creates glare, possibly requiring the nurse to hold the scanning device at uncomfortable wrist angles. These interactions among inputs can be hazards in that they are potentially detrimental to different types of performance—in this case visual perception, decision making, and grasping may be affected which, in turn, may impact patient safety, employee safety, and quality output goals.

COMPARING THE PARADIGMS

The human factors engineering paradigm of designing systems to support the performance needs of HCPs and to reduce hazards was presented as complementary to the paradigms of reducing errors, reducing injuries, and focusing on evidence based medicine. Each of the other three paradigms offers important insights and directions for improving safety. The paradigm focusing on errors requires that an error occurs in order to initiate patient safety interventions, but it is more proactive than the second paradigm which focuses on injuries. However, both paradigms can be viewed as proactive to the extent that the underlying causes of the outcomes of interest—whether errors or injuries—are identified and redesigned to prevent future occurrences. The third paradigm offers a very different approach but, again, one that complements the others. Focusing on evidence based medicine is likely to reduce patient harm but, because errors and injuries will still occur, other paradigms may still be needed to guide safety efforts.

In the human factors engineering paradigm the inputs and transformations represent the types of causal factors that the error and injury paradigms are concerned with redesigning to improve safety. Transformations in fig 1—such as decision making for treatment or diagnosis—need to be supported by inputs such as evidence based medicine (as discussed in the third paradigm) for HCPs to make appropriate decisions for their patients.

One aspect of the human factors engineering paradigm that does differentiate it from the others is the focus on designing for the needs of the patient and HCP simultaneously. From a traditional healthcare point of view, focusing primarily on patient outcomes is intuitive and necessary. The patient is part of the system and is a source of inputs into HCP performance. The patient can also be a source of hazard—for example, when patients forget to self-administer a medication. Given the impact of the patient on HCP performance (as in fig 1) and on the existence of hazards, the patient indirectly affects outcomes such as safety and quality of care. This calls for consideration of the patient in the design of the system and in the performance of tasks.

From a human factors engineering perspective, it is also critical to focus on other system factors that influence patient outcomes through the mechanisms of HCP performance and hazards. Such a system oriented paradigm urges thinking of HCPs in the context of their work, their organization, and the tools that they use.^28,30,36,37 This perspective is implicit in the University of Wisconsin-Madison Systems Engineering Initiative in Patient Safety (SEIPS) model (Carayon et al, elsewhere in this supplement) which combines a traditional human factors engineering model of a work system²⁵ with the structure-process-outcome model of Donabedian³⁸ and is the foundation for the model in fig 1.

Designing to support performance and eliminate hazards is different from designing to reduce injuries or reduce errors in at least three important ways. Firstly, because this paradigm sheds light on the performance and hazard pathways to patient safety and quality outcomes, these outcomes can be achieved proactively by using human factors engineering science.^10,12,13 Secondly, the human factors engineering paradigm provides a shift towards positive thinking (support performance in an environment with fewer hazards) and away from negative thinking (reduce error or injury). This may go a long way towards alleviating problems that HCPs feel when trying to address errors, which is tantamount to feeling that they are the problem (no matter how many times we insist “it’s the system”). Even the idea of eliminating hazards is positive because hazards are things in the work system that increase the risk of adverse outcomes; the HCP-hazard interaction, not the HCPs themselves, is by definition the cause of errors or injuries. Thus, this approach—like the evidence based medicine approach—does not focus on the “bad things” HCPs might do. Thirdly, designing to support performance and reduce hazards entails identifying the needs of the HCP to support care activities. This can help ensure that systems are designed to provide HCPs with the right information (such as evidence based medicine guidelines), technologies, feedback, and support.

In contrast, designing to reduce errors or injuries can lead to systems that eliminate some poor designs but do not necessarily improve the factors that are needed for successful HCP performance in providing care. This is because, when errors or injuries are the outcome of interest, redesign will involve focusing on the subset of system elements thought to contribute to an adverse outcome (that is, the error or injury). However, many other elements of the system still contribute to overall HCP performance, so focusing on the narrow subset of the system thought to contribute to errors or injuries may leave the overall system vulnerable to different errors or injuries. Similarly, focusing on evidence based medicine will probably improve patient safety and quality, but only to the extent that the work systems in which HCPs practice are designed to support their performance needs to practice evidence based medicine.

For example, using the other paradigms as they relate to medication safety, one might identify the two main causes of adverse drug events to be a lack of correct medication information at the bedside and disregarding existing evidence based treatments. With this information, the error or injury reduction strategy is to provide accurate and timely information at the bedside, while the evidence based medicine strategy might be to ensure HCPs follow the evidence. In contrast, using the human factors engineering paradigm, one could realize that redesign should focus on providing accurate and timely information and on system design to support other aspects of performance and hazard reduction such as readability (font size, glare, screen quality), interpretability (information organization/display and meaningfulness), consistent access (in a standardized location and manner), problem identification, and problem solving. Clearly, the above approach is much truer to what human factors engineers mean by a “systems” focus as it considers the entirety of the system in designing to support the end user.

Admittedly, HCP performance is but one of many goals that a healthcare delivery system must be designed to achieve. As sociotechnical systems theory points out,^9,39 to be successful a healthcare delivery system must be designed to support employee performance, business needs such as profitability and positive image, and external environment needs such as compliance with JCAHO and Medicare regulations. Design must also support the needs of the patients, which include receiving safe and effective care. There is evidence from outside health care that designing to support employee performance can help to achieve safety and financial goals,^40–42 as well as quality goals.⁴³ The same should be true in health care.

CONCLUSIONS

The human factors engineering paradigm for patient safety was presented as an alternative but complementary paradigm to the error reduction, injury reduction, and evidence based medicine focused paradigms. In this paradigm the focus is on designing for HCP performance and hazard reduction so that outcomes such as error and injury reduction or quality improvement can be achieved. This paradigm may prove more fruitful than the other paradigms because the focus is on enabling HCPs to execute successfully the very care processes that lead to patient and organizational outcomes. This means that the human factors engineering paradigm may also enable successful implementation of the other three paradigms. This is not to suggest that, by using this paradigm, HCP errors, violations, or patient harm can be eliminated; to be certain, the goal of eliminating all errors or adverse outcomes will never be achieved, leading some to argue that systems should be designed to promote error detection and recovery.^44,45 However, much can still be done with good system design to reduce the likelihood of adverse outcomes. Error and injury surveillance, analysis, and control are important tasks within an overall safety program, but any of them alone is unlikely to be sufficient. The human factors engineering paradigm offers a complementary set of objectives to address safety and quality proactively.