Article Text
PDF
Abstract
Complex, well defended, high technology systems are subject to rare but usually catastrophic organisational accidents in which a variety of contributing factors combine to breach the many barriers and safeguards. To the extent that healthcare institutions share these properties, they too are subject to organisational accidents. A detailed case study of such an accident is described. However, it is important to recognise that health care possesses a number of characteristics that set it apart from other hazardous domains. These include the diversity of activity and equipment, a high degree of uncertainty, the vulnerability of patients, and a one to one or few to one mode of delivery. Those in direct contact with patients, particularly nurses and junior doctors, often have little opportunity to reform the system’s defences. It is argued that some organisational accident sequences could be thwarted at the last minute if those on the frontline had acquired some degree of error wisdom. Some mental skills are outlined that could alert junior doctors and nurses to situations likely to promote damaging errors.
- SHO, senior house officer
- SpR, specialist registrar
- organisational accidents
- defences
- barriers
- mental skills
- SHO, senior house officer
- SpR, specialist registrar
- organisational accidents
- defences
- barriers
- mental skills
Statistics from Altmetric.com
- SHO, senior house officer
- SpR, specialist registrar
- organisational accidents
- defences
- barriers
- mental skills
- SHO, senior house officer
- SpR, specialist registrar
- organisational accidents
- defences
- barriers
- mental skills
Do healthcare institutions have organisational accidents that occur as the result of a variety of contributing factors arising at many levels of the system?1 The short answer is a qualified yes. The hedging arises for two reasons. Firstly, unlike other hazardous endeavours (for example transport systems, nuclear power generation, oil and gas production, and chemical process plants), there is a scarcity of indepth accident reports in health care—most incidents are investigated at the local level and rarely reach the public domain. It is thus difficult for an external researcher to trace the organisational origins of an adverse event. Secondly, health care has a number of properties that make it significantly different from other areas. These include the enormous diversity of its operations and equipment, the frequency of emergencies, the degree of uncertainty, and the vulnerability of patients. But perhaps the most important distinction lies in the way its products are delivered. In most hazardous industries, a few individuals serve a large number of end users. But health care is provided in a one to one or, at most, a few to one fashion.
Health care is a very personal business. How the individual health carer exercises his or her skills can have a profound effect upon the safety of the process. This contrasts with those domains in which the performance of the human operator is extensively moderated by automated safety features. It would, for example, require some ingenuity on the part of an individual pilot to engineer the crash of a modern airliner. But in many healthcare activities serious harm is but a few unguarded moments away.
A prerequisite for an organisational accident is the presence within the system of multiple controls, safeguards, and barriers that are designed to prevent known dangers from coming into damaging contact with people, assets, or the environment. To the extent that hospitals possess a wide range of defences against patient harm, health care fulfils the basic requirements for the occurrence of organisational accidents.
In hazardous domains where the operations are relatively stable and predictable (for example nuclear power generation, chemical process plants, and the most recent commercial aircraft), a great deal of reliance is placed upon engineered safety devices and procedural controls. In health care, however, the nature and variety of defences varies widely from one activity to the next. Where anaesthetists, intensivists, and radiologists employ automated controls comparable to high technology industries, surgeons, physicians, and nurses have to rely heavily on their own skills in order to protect patients from harm. In many areas of health care people constitute the primary defences, although the past decade or so has seen an increasing use of procedures and protocols.
What can be done to improve the effectiveness of those junior doctors and nurses who so often act as the last line of defence? It is argued that the mental skills necessary to detect and avoid a potentially dangerous situation involve making guided ordinal ratings relating to the state of the proximal health carers, the context, and the task. Collectively, they offer some measure of error wisdom in any given situation (that is, the likelihood that something will go wrong). Although such skills should be relatively easy to acquire, they would need to be exercised frequently if their effectiveness is to be maintained.
A case study is described that possesses all the hallmarks of an organisational accident. Could a greater degree of error wisdom on the part of the junior doctors, who were the last line of defence in this succession of failed barriers, have served to thwart the tragedy?
THE NATURE OF ORGANISATIONAL ACCIDENTS
Organisational accidents arise from the concatenation of several contributing factors originating at many levels of the system. These, in combination with local triggers, open a window of opportunity in which the hazards are allowed to pass unchecked through successive weaknesses in what the military and the nuclear industry have termed defences in depth (that is, a defensive system that involves successive barriers, each designed to support the others). Because of the many layers of protection, such accidents are rare events. They require the simultaneous alignment of gaps or absences within what are usually diverse and redundant defences. These aspects are encapsulated in the Swiss cheese model of organisational accidents2 shown in fig 1.
The Swiss cheese model of accident causation. The slices of cheese represent successive layers of defences, barriers, and safeguards.
In an ideal world, the defensive layers would be intact. In reality, they are more like Swiss cheese: full of holes. These gaps, weaknesses, and failures (or the complete absence of necessary safeguards) occur for two reasons:
-
Active failures—these are unsafe acts (errors or procedural violations) on the part of those in direct contact with the system that create weaknesses or absences in or among the protective layers.
-
Latent conditions—these are defensive gaps, weaknesses, or absences that are unwittingly created as the result of earlier decisions made by the designers, builders, regulators, and managers of the system. Such holes exist in all complex hazardous systems because the decision makers cannot foresee all the possible accident scenarios. However, latent conditions (also termed resident pathogens) possess two important properties: firstly, their effects are usually longer lasting than those created by active failures; and secondly, they are present within the system prior to an adverse event and can be detected and repaired before they cause harm. As such, they represent the primary targets of any safety management system.
Following an organisational accident, the model requires the asking of two related questions. Firstly, how did each defence or barrier fail? Secondly, why did it fail? Answers to the second question frequently, but not always, begin with unsafe human actions; that is, errors or procedural violations committed by those at the sharp end, people in direct contact with the patient or the system. But such active failures rarely arise solely from wayward psychological processes or negligence. They are more often the direct consequence of error provoking circumstances within the local workplace. And these, in turn, are the product of higher level latent conditions: prior decisions by equipment designers, senior managers, the writers of protocols, and the like. They can also occur through the gradual erosion of safeguards by subtle and often well intentioned workarounds or changes in operating practices, as revealed in the case study presented.
CASE STUDY: A WELL DOCUMENTED VINCRISTINE TRAGEDY
A close examination of this adverse event is possible because its organisational precursors were investigated by an external expert in accident causation, and the very detailed findings made available to the public domain.3 A summary is shown in box 1.
Box 1 Outline of the vincristine tragedy
An 18 year old male patient, largely recovered from acute lymphoblastic leukaemia, mistakenly received an intrathecal injection of the cytotoxic drug vincristine. The treatment was given by a senior house officer (SHO) who was supervised by a specialist registrar (SpR). The former (with only two month’s postgraduate experience in haematology) was unfamiliar with the usually irreversible neurological damage caused by the intrathecal administration of vincristine, and while the latter had 18 month’s experience as an SHO in haematology (although with fairly limited involvement in chemotherapy), he had only been in post for three days. It was a requirement that the spinal administration of drugs by SHO’s should be supervised by a SpR. This supervisory task fell outside the scope of the SpR’s duties at that time (see box 5), but no one else seemed to be available and he wanted to be helpful. The error was discovered very soon after the treatment and remedial efforts were begun almost immediately, but the patient died just over three weeks later.
Box 5 Communication failures and workarounds
-
The locum consultant was concerned about the patient’s history of poor time keeping and treatment compliance and had made a verbal request that he should be informed as soon as the patient arrived for his scheduled maintenance treatment on the day of his appointment. This request was not written down and not acted upon.
-
On the day after the SpR’s arrival on the ward, the consultant haemotologist told him that he would have restricted clinical duties for the next two weeks and that he should shadow a staff grade doctor in order to observe the workings of the ward. However, it soon became apparent that the precise or intended meaning of the term shadowing was not understood by the SpR, the SHO, or the nursing staff.
-
The two drugs arrived on the ward in the same package. This occurred despite the fact that the pharmacist had made a note in the Sterile Production Unit log stating that the vincristine would be required on “Thurs AM” and added the instruction “send separately”.
-
It had become common practice for ward staff to request the pharmacy to send both intrathecal and intravenous drugs together. The pharmacists complied because they did not want to be accused of compromising patient care.
-
The day case coordinator on the ward left for home at 4 pm, not having informed the SpR that the patient and his grandmother had arrived. They were late. The treatment had been scheduled for the morning. Similarly, the ward sister went off duty at 4.30 pm without telling the SpR of the patient’s arrival some 15–30 min earlier.
The hazards of injecting vincristine intrathecally (rather than intravenously) were well known within the prestigious teaching hospital where this tragedy happened. This particular adverse event has occurred several times before. An influential report commissioned by the UK’s Chief Medical Officer featured such an accident as a full page case study.4 It was noted that there had been 14 similar events in the UK since 1985. Other surveys indicate that a large number of such occurrences have occurred worldwide (ISP Barker, personal communication, January 2003).
The precise numbers are not important here. What matters is that the same procedure has been directly associated with iatrogenic fatalities in a large number of healthcare institutions in a variety of countries. The fact that these adverse events have involved different healthcare professionals performing the same procedure clearly indicates that the administration of vincristine is a powerful error trap. When a similar set of conditions repeatedly provokes the same kind of error in different people it is clear that we are dealing with an error prone situation rather than with error prone, careless, or incompetent individuals.1
The hospital in question had a wide variety of controls, barriers, and safeguards in place to prevent the intrathecal injection of vincristine. But these multiple defences failed in many ways and at many levels. The upstream defensive breakdowns and absences are summarised in boxes 2–6.
Box 2 Administrative and procedural measures that failed
-
The hospital medical staff had modified the protocol on which the patient’s treatment was based so that vincristine (intravenous route) and cytosine (intrathecal route) were to be administered on different days. (The original protocol allowed them to be given on the same day.) In an effort to reduce the inconvenience to patients, the nursing staff had adopted the practice of bringing both drugs to the ward on the same day.
-
The amended protocol required the intrathecal injection of chemotherapy to be given on the first day and the intravenous vincristine on the second. On the patient’s prescription, however, vincristine was entered as the first item, although it was to be administered on the second day.
-
Within the pharmacy, it was required that there should be separate labelling, packaging, and supply of intrathecal and intravenous cytotoxic chemotherapy to ensure that the drugs to be administered by different routes should not arrive at the day case unit at the same time and in the same package. On this occasion, however, the pharmacy allowed the drugs to be released together in the same clear bag, presumably for the convenience of the ward and the patient.
-
The hospital’s Drug custody and administrative code of practice contained important information on good practice with regard to the prescription of drugs and the responsibilities of the medical staff in relation to the safe preparation, checking, administration, and recording of drugs. But the supervising consultants were unaware of its existence and its safety critical contents had not been brought to the attention of the SpR and the SHO.
-
The Haematology conditions and protocols issued on the ward stated that intravenous and intrathecal chemotherapy drugs should not be together on the same trolley; that methotrexate, cytosine, and hydrocortisone were the only drugs to be administered intrathecally, and that these drugs should never be given on the same day as intravenous vincristine. But two versions were on the ward at the same time, and this last instruction was missing from the one given to the SpR. In addition, these guidelines made no mention of the usually fatal consequences of giving vincristine intrathecally. There is no formal record of whether the SpR received a copy of the protocols and guidelines.
Box 3 Indicators and barriers that failed
-
The same prescription form was used for both intrathecal and intravenous cytotoxic chemotherapy. The only indication of their distinctive routes was given by handwritten initials rather than by separate forms that are clearly distinguished in colour.
-
The intravenous route for the vincristine on the regular prescription section of the chart was written in a barely legible fashion, at least in comparison to the other route instructions given on the same chart.
-
The name of the drug and the dosage was printed in 9 point bold type on the syringe labels. The warnings with regard to route of administration were given in 7 point normal type, thus de-emphasising this critical information.
-
The warning printed on the side of the vincristine syringe “Vincristine Sulphate Injection 2 mg/2 ml NOT FOR INTRATHECAL USE” was partially obscured by the attachment of the label, again de-emphasising its significance.
-
Although there were physical differences between the two syringes (grey coloured protective cap for vincristine and red for cytosine), there were also a number of similarities: the syringes were of similar size; the respective volume of the two drugs (2 ml for vincristine and 2.5 ml for cytosine) offered little in the way of discriminatory cues; the contents of both syringes were colourless fluids; and most significantly, both syringes could be connected to the spinal needle delivering the intrathecal drugs.
Box 4 Failures of supervision and instruction
-
Given the largely apprenticeship style of postgraduate medical training, there is a heavy responsibility upon senior medical staff to ensure that junior doctors and those newly appointed are clearly informed as to the nature and scope of their duties, as well as ensuring that they are aware of all the relevant protocols, guidelines, and codes of practice. It is also essential that these supervisors and mentors should establish at the outset the extent of their charges’ knowledge and experience with regard to potentially hazardous procedures. It is apparent that the induction and training of the new SpR and the SHO were far from ideal, and, most significantly, they were virtually non-existent with regard to the well documented patient safety issues on the ward in question.
-
The locum consultant asserted that he and the consultant haematologist had informed the SHO and other junior doctors present on a ward round two days earlier as to the dangers of the intrathecal administration of vincristine. This is contested by a number of the doctors present. Thus, there are grounds for doubting that this warning was ever given.
THE SITUATION JUST PRIOR TO THE INJECTIONS
At 5 pm, 20 min before the drugs were administered, the large majority of the ingredients for the subsequent tragedy were in place. The many gaps and absences in the system’s multiple upstream defences had been unwittingly created and were lining up to permit the disaster in waiting to occur. Two inadequately prepared junior doctors, each with inflated assumptions about the other’s knowledge and experience, were preparing to give the patient his chemotherapy.
It was a Thursday afternoon, normally a quiet time on the ward. Their clinical supervisor, a locum consultant haematologist (in post for only four months prior to this event), was working in his office; the staff grade doctor whom the specialist registrar (SpR) was supposed to shadow was a part timer and not at the hospital that day. The ward sister had gone home. There were no other SpRs available that afternoon. There was no senior medical presence in the vicinity to halt a sequence of events that was now very close to disaster. To compound the situation further, the patient and his grandmother had arrived unannounced and unscheduled for that particular time. The last holes were about to move into alignment.
THE LAST LINE OF DEFENCE: THE JUNIOR DOCTORS ON THE SPOT
The senior house officer (SHO) had wanted to administer the drugs in order to gain experience in giving spinal injections. The SpR handed him the syringes. In doing this, he read out the patient’s name, the drug, and the dose from the syringe label. He did not read out the route of administration. There were also other omissions and errors:
-
He failed to check the treatment regimen and the prescription chart with sufficient attention to detect that vincristine was one of the drugs in the packet, and that it should be delivered intravenously on the following day.
-
He failed to detect the warning on the syringe.
-
He failed to apprehend the significance of the SHO’s query “vincristine intrathecally?” on being handed the second syringe.
Box 6 Collective knowledge failures and false assumptions
-
The staff nurse on the day case unit took a blood sample from the patient and then informed the SHO of his arrival. She also told the SHO that because an intrathecal injection was to be given he would need to be supervised by an SpR. Not appreciating the limited scope of the SpR’s duties, the SHO approached the SpR and informed him that the patient was due to have an intrathecal injection of chemotherapy.
-
The SpR did not know that the SHO was unfamiliar with the patient’s treatment and condition, and ignorant of the dangers associated with the wrong route administration of vincristine. He agreed to carry out the supervision, believing it to involve the simple provision of oversight for a junior colleague who knew the patient and understood the procedures.
-
The two junior doctors asked the staff nurse where the patient’s chemotherapy was located. Anxious to help, she eventually found it in the day case unit refrigerator. The transparent plastic package containing both syringes was the only item of chemotherapy in the refrigerator. She checked that the patient’s name was printed on each of the syringe labels, and then took the package to the treatment room where the SpR was alone. She handed the package to him with the words “Here’s X’s [the patient’s first name] chemo”. Although a trained chemotherapy nurse, she did not herself check the nature of the drugs or their routes of administration. She assumed that the SpR and the SHO would do the necessary checking. She also assumed that both doctors were experienced in the administration of the chemotherapy drugs.
These errors had grievous consequences. But the SpR’s actions were entirely consistent with his interpretation of a situation that had been thrust upon him, which he had unwisely accepted and for which he was professionally unprepared. His perception that he was required to supervise the intrathecal administration of chemotherapy was shaped by the many shortcomings in the system’s defences. He might also have reasonably assumed that all of these many and varied safeguards could not have all failed in such a way that he would be handed a package containing both intravenous and intrathecal drugs. Given these false assumptions, it would have seemed superfluous to supply information about the route of administration. It would be like handing someone a full plate of soup and saying “use a spoon”.
IS THIS ORGANISATIONAL EXPLANATION SUFFICIENT?
The system model of human fallibility5–7 is strongly endorsed by a number of high level reports relating to patient safety.8,9,10 But is that really the end of the story? The answer depends on what remedial actions are likely to be set in train as the result of adopting a wholly organisational accident interpretation.
Clearly, blaming and punishing the junior doctors involved would do little or nothing to prevent the recurrence of such a tragedy. Indeed, it is likely to be counterproductive.11 The message for healthcare institutions from this organisational analysis is clear: they should review their defences regularly in order to remedy whatever gaps may exist or could be anticipated. This would certainly be a very positive outcome. But no matter how assiduously this process is carried out, not all of the latent pathogens would be eliminated. Organisational safeguards can never be entirely effective. The last line of defence would continue to be the junior doctors and nurses in direct contact with the patient, and they are unlikely to be markedly different in either quality or experience from those involved in the case outlined above.
If we cannot make systems immune to organisational accidents, what can we do to improve the reliability and error wisdom of those at the sharp end? A pointer is provided by the results of a large scale observational study of 21 surgical teams performing arterial switch operations on neonates in 11 UK centres.12 The observations revealed that errors and problems were relatively frequent occurrences—an average of seven events for each procedure, one of which was major or life threatening. It was also found that the surgical teams with the best outcomes were not those who were error free, but those who successfully compensated for the errors that had occurred. Even though the prior defences might have been breached (for example the cardiologist’s briefing, the equipment safeguards, and the skills and experience of the team members), it was still possible to avoid the adverse event sequence so that the baseline expectations of success were not affected (around 96%).
The consultant surgeons taking part in the study were highly skilled and mostly very experienced in performing this complex procedure. It is obviously not possible to transplant these attributes directly into the heads of junior healthcare professionals. But skills can be of two kinds: technical skills and mental skills, and the latter are much more easily transferable. Indeed, the process can begin quite early in healthcare training—although it rarely does, even at any stage.
SOME MENTAL SKILLS UNDERPINNING ERROR WISDOM
What would it take to make alarm bells ring in the heads of those confronted with a situation like that described in the case study? Nurses and junior doctors have little opportunity to make radical changes to the system. But could we not provide them with some basic mental skills that would help them to recognise and, if possible, avoid situations with a high error potential? The three bucket model shown in fig 2 leads to a possible strategy.
Three bucket model of error likelihood.
In any given situation, the probability of unsafe acts being committed is a function of the amount of bad stuff in all three buckets. The first relates to the current state of the individual(s) involved, the second reflects the nature of the context, and the third depends upon the error potential of the task. While most professionals will have an understanding of what comprises bad stuff in regard to the self (lack of knowledge, fatigue, negative life events, inexperience, feeling under the weather) and the context (distractions, interruptions, shift handovers, harassment, lack of time, unavailability of necessary materials, unserviceable equipment), they are less likely to know that individual task steps vary widely in their potential to elicit error. For example, omission errors are more likely in steps close to the end of a task, or where there is lack of cueing from the preceding step, or when the primary goal of the task is achieved before all necessary steps have been completed, and so on. These factors have been discussed at length elsewhere.13
Full buckets (with respect to bad stuff) do not guarantee the occurrence of an unsafe act, nor do nearly empty ones ensure safety (they are never wholly empty). We are dealing with probabilities rather than certainties.
People are very good at making rapid intuitive ordinal ratings of situational aspects.14 Together with some relatively inexpensive instruction on error provoking conditions, frontline professionals could acquire the mental skills necessary for making a rough and ready assessment of the error risk in any given situation. Subjective ratings totalling between six and nine (each bucket has a three point scale, rising to a total of nine for the situation as a whole) should set the alarm bells ringing. However, as stated earlier, these skills need to be exercised regularly.
There is considerable evidence to show that mental preparedness—over and above the necessary technical skills—plays a major part in the achievement of excellence in both athletics and surgery.15 The three bucket model and its associated toolkit emphasise the following aspects of preparedness:
-
accept that errors can and will occur
-
assess the local bad stuff before embarking upon a task
-
have contingencies ready to deal with anticipated problems
-
be prepared to seek more qualified assistance
-
do not let professional courtesy get in the way of checking your colleagues’ knowledge and experience, particularly when they are strangers
-
appreciate that the path to adverse incidents is paved with false assumptions.
CONCLUSIONS
It is evident from the case study discussed above that organisational accidents do occur in healthcare institutions. The identification of organisational accidents enjoins us to ask how and why the safeguards failed. It also requires not only the remediation of the defective barriers, but also regular audits of all the system’s defences. The same event never happens twice in exactly the same way. It is therefore necessary to consider many possible scenarios leading to patient harm. This would truly be proactive safety management because the latent ingredients of future adverse events are already present within the organisation.
So far this conclusion echoes the recommendations of the high level reports cited earlier. But because of the often unplanned, isolated, and very personal transactions characteristic of health care, these systemic measures still leave frontline professionals largely unprotected, at least in the short term. The paper has outlined some mental skills by which nurses and junior doctors could acquire a greater degree of error wisdom. Global systemic reforms take considerable time and resources. Instilling informed vigilance and intelligent wariness in those at the sharp end need not consume much of either. Concurrently, healthcare organisations will need to demonstrate receptiveness and responsiveness to the messages received from frontline professionals about unsafe conditions if this error wisdom is to be cultivated.
Key messages
-
Like other complex, well defended systems, healthcare institutions are subject to organisational accidents.
-
A detailed case study involving the intrathecal injection of vincristine is presented to support this claim.
-
Health care possesses a number of singular features indicating that purely systemic reforms, while essential, are not enough to protect those at the sharp end.
-
Nurses and junior doctors require mental skills that will improve their recognition of error provoking situations, but to be effective, they must be practised regularly.