How we began
My small team at University College set out to develop methods of accident analysis for healthcare, beginning in obstetrics. Professor Richard Beard at St Marys hospital in London (now part of Imperial College Hospitals) bravely allowed a small team of psychologists to come into his unit and talk to staff about what had gone wrong. While familiar now, this was unprecedented at the time and a tribute to his forward thinking and the priority that the staff gave to safety. Sally Taylor Adams and Nicola Stanhope spent many hours and days on the maternity unit getting to know staff, gaining trust and listening. We thought we would have to wait a long time to find suitable stories to analyse but, to our surprise, there were stories almost every day. Sally and Nicola took copious notes and soon we had a corpus of stories of times when there had been problems or when care had led to poorer outcomes than expected.
We pored over these notes trying to understand what had happened, drawing out the narrative and trying to find a set of concepts which would map across the different stories. We found that incidents were often preceded by a long chain of smaller problems which combined to cause harm to a patient. We began to see, as James Reason had suggested, that errors and problems took place in a broader context and were influenced by multiple factors, the latent conditions as he called them [3].
From this account, it will be clear that our work on incident analysis was built from the beginning on the experiences and stories of front-line staff. We tried, as best we could, to reflect the clinical realities in our early analyses, discussing our reflections and conclusions with the staff who had originally provided the stories. We continued this collaborative in the next step of developed the ALARM protocol, a structured approach to the analysis of clinical incidents. We worked closely with a small group of newly appointed risk managers from a number of hospitals, experienced people with backgrounds in nursing and medicine. They all belonged to the Association of Litigation and Risk Managers (ALARM) which gave the name to the protocol. We developed prototype approaches, which they would test in their own work, then the group would refine, test again until we were satisfied it was a workable approach. We published some case studies (Refs) and finally, in a British Medical Journal special issue on patient safety, we were able to publish a paper describing the ALARM approach [4]. Later we extended the approach to examine incidents in mental health and primary care, which gave rise to a revision and extension which we published as the “London Protocol” which has been translated into several languages and can be applied to all areas of healthcare including the acute sector, mental health, and primary care [5].
The lessons of James Reason: the organisational accident model
Human beings have the opportunity to contribute to accidents and clinical incidents at many different points in the process of production and operation. Problems and failures may occur in the design, testing, implementation of a new system, its maintenance and operation. The most obvious errors and failures are usually those that are the immediate causes of an accident, such as a train driver going through a red light or a doctor picking up the wrong syringe and injecting a fatal drug.
The immediate causes described above are the result of actions, or omissions, by people at the scene. However, other factors further back in the causal chain can also play a part in the genesis of an accident or a serious clinical incident. These “latent conditions” lay the foundations for accidents in the sense that they create the conditions in which errors and failures can occur. This places the operators at the sharp end in an invidious position as James Reason eloquently explains: « Rather than being the instigators of an accident, operators tend to be the inheritors of system defects… their part is usually that of adding the final garnish to a lethal brew whose ingredients have already been long in the cooking » [6].
Reasons’s organisational accident model applies this perspective to the study and analysis of accidents in many safety critical industries, distinguishing the errors made by people from the conditions in which people worked, which in turn are the consequences of organisational processes, such as planning, scheduling, forecasting, design, maintenance, strategy and policy. The latent conditions so created are transmitted along various organisational and departmental pathways to the workplace (the operating theatre, the ward, etc.), where they create the local conditions that promote the commission of errors and violations (for example, high workload or poor human - equipment interfaces) [6]. The model presents the people at the sharp end as the inheritors rather than as the instigators of an accident sequence. Reason points out that this may simply seem as if the “blame” for accidents has been shifted from the sharp end to the system managers. However, managers too are operating in a complex environment and the effects of their actions are not always apparent; they are no more, and no less, to blame than those at the sharp end of the clinical environment. The broader point is that everyone’s thought and actions, both errors and successful actions, need to be understood in the broader context of their working environment.
Systems analysis of clinical incidents
We aimed to develop a method which was simple and yet sophisticated, a method which was easy to follow and yet which guided the person and group reviewing an incident to a full exploration of the issues involved. We found that the term error did not easily capture the wider problems, such as failure to monitor over a period of time, that we were identifying in our observations and interviews. We therefore adopted the term “care management problem” to specify the problems observed in the process of care. We also extended and adapted classifying the error producing conditions as the original formulation seemed more suited to very standardised industries with high levels of automation. We developed a framework of contributory factors affecting clinical practice specifically adapted for the healthcare context (Table 1) which was again based on our analyses and observations of frontline work in healthcare [7].
The basic approach of both ALARM and the London Protocol is as follows. During an investigation information is gleaned from a variety of sources. Case records, statements and any other relevant documentation are reviewed. Structured interviews with key members of staff are then undertaken to establish the chronology of events, the main care delivery problems and their respective contributory factors, as perceived by each member of staff. Ideally the patient, or a member of their family, should also be interviewed though as yet this is not yet common practice in these analyses. The key questions are “What happened? (the outcome and chronology); How did it happen? (the errors and care delivery problems) and Why did it happen? (the contributory factors)”.
While a considerable amount of information can be gleaned from written records interviews with those involved are the most important method of identifying the contributory factors. This is especially so if the interview systematically explores these factors and so allows the member of staff to collaborate in the investigation. In the interview the story and “the facts” are just the first stage. The staff member is also encouraged to identify both the successful aspects of the care provided and the errors and care delivery problems. Both staff members and interviewer can reflect together on the contributory factors, which greatly enriches both the interview and investigation.
The protocol may be used in a variety of formats, by individual clinicians, researchers, risk managers and by clinical teams. A clinical team may use the method to guide and structure reflection on an incident, to ensure that the analysis is full and comprehensive. For serious incidents a team of individuals with different skills and backgrounds would be assembled, though often only a risk manager or an individual clinician will be needed. The contributory factors that reflect more general problems in a unit are the targets for change and systems improvement.
A window on the system: systems analysis rather than root cause analysis
For reasons that are now lost in history, most other approaches to analysing incidents in healthcare are termed “root cause analysis”; in contrast we have described our own approach to the analysis of incidents as a systems analysis as we believe that it is a more accurate and more fruitful description. The term root cause analysis, while widespread, is misleading in a number of respects. To begin with, it implies that there is a single root cause, or at least a small number. Typically, however, the picture that emerges is much more fluid and the notion of a root cause is a gross oversimplification [8].
However, a more important and fundamental objection to the term root cause analysis relates to the very purpose of the investigation. Surely the purpose is obvious? To find out what happened and what caused it. It is certainly necessary to find out what happened and why, in order to explain to the patient, their family and others involved. However, if the purpose is to achieve a safer healthcare system, then it is necessary to go further and reflect on what the incident reveals about the gaps and inadequacies in the healthcare system in which it occurred. The incident acts as a “window” on the system – hence systems analysis. Incident analysis, properly understood, is not a retrospective search for root causes but an attempt to look to the future [8]. In a sense the particular causes of the incident in question do not matter, as they are now in the past. However, the system weaknesses revealed are still present and could lead to future problems; both ALARM and the London Protocol aim to guide reflection on incidents in order to reveal these weaknesses.
The need for reassessment
The systematic analysis of incidents has greatly expanded our understanding of both the causes and prevention of harm. These analyses have been conducted in multiple clinical settings and have revealed both the range of vulnerabilities in health systems but also the many factors that may contribute to error. These approaches have been widely employed in healthcare over the last twenty years but are now subject to critique and reassessment [9-11].
The primary reason for a revised vision of incident analysis is that healthcare itself is changing dramatically. People are living longer, often with multiple co-morbidities which are managed over very long timescales. Care is increasingly being delivered in the home and in community settings; patients and families are increasingly and necessarily in charge of their own care. The focus of care is moving from the hospital to the home and community which means that we need to pay much more attention to safety issues that arise outside at home, in the community and in primary care settings [11].
In reflecting on the current requirements of incident analysis, Carl Macrae, Jane Carthey, Rene Amalberti and I set out seven major changes that we believe are needed [12]. These were to widen time frame of investigation; work with patients and families’ carry out fewer and deeper investigations; examine successes and recovery, as well as failure; examine contributory factors at different time points and in different settings; reflect on the workability of care processes and broaden the repertoire of responses and recommendations. We cannot review all of these in this paper, but I will summarise three that are particularly critical.
Widen the time frame of analysis: work with patients to review their healthcare journey
Many patients suffer significant harm because of multiple small failures that accumulate throughout their care, rather than a single dramatic failure at one point in time. For instance, many hospital admissions for older people are due to adverse drug events, particularly those due to the interaction of multiple medications over a long period of time. In the case of an admission to hospital with a complex drug reaction, a full understanding of the event might only be achieved by tracking the history of the patient’s care over several months leading up to the admission.
The suggestion that we might extend our analysis to longer time periods raises a number of questions about the definition and identification of events that would be suitable and productive for analysis. The word “incident” does not seem entirely appropriate when considering a series of events that might gradually unfold over several months and some new terminology might be required. We might instead speak of a “safety analysis of the patient journey” over a particular time period [11].
This will require looking back through the medical and personal history of the patient in search for all events that have defined the person’s healthcare journey and contributed to the final outcome, whether or not these events have been perceived as serious at the time they occurred or whether the problem was detected and resolved. This broader approach will require a new type of forum, supported by technical tools such as video conferencing, covering longer periods in the patient’s medical history and involving the participation the patient and family with both hospital and community practitioners.
Conduct fewer, deeper and more proportionate analyses
Healthcare organisations have finite resources for safety investigation and analysis, and these resources are frequently consumed by the demands of outside agencies. Staff can become understandably frustrated and burdened by requirements incident investigation carried out without adequate time or sufficient training. We need to conduct deeper and longer-term analyses, which might seem to simply increase the burden on the system. However, this can be mitigated by careful selection of events to analyse and the use of aggregate analyses in which sets of incidents are reviewed. There is also, in my view, limited and diminishing value in repeatedly analysing similar incidents and finding the same set of contributory factors, a common problem in the British NHS.
An extensive analysis of 10 incidents a year can provide a rich understanding of the safety landscape and the main vulnerabilities in a clinical setting A deep investigation of 10 incidents in a given clinical area over a year would reveal enough insight for several years’ worth of further exploration and improvement. Findings from such analyses must then be considered in the context of other safety relevant information [13,14] and the longer-term organisational strategy for improving the quality and safety of care. Rapid analyses by clinical teams can also be very valuable for reflection, training and surfacing of local safety issues but will probably not be sufficient as a basis for decisions about major improvement programmes.
Broaden our repertoire of responses and recommendations
Reviews of recommendations generated by incident analysis have found that most recommendations are weak and few address fundamental system issues [15,16]. There is little understanding that admonitory people-focused solutions like re-writing the safety procedure, or sending out an email reminder to staff are weak and will not in themselves lead to sustained improvements. Studies of successful improvement and behaviour change suggest that even when basic procedures are very well understood considerable work is needed both to understand reasons for non-compliance and to bring about change. Such changes, in the case of hand-hygiene for instance, often require long term multi-faceted interventions which embrace cognitive, social and emotional determinants of behaviour all set within a wider organisational strategy with highly visible leadership commitment [17]. Sometimes an investigation of a single incident will point to immediate changes that need to be made, such as replacement of faulty equipment or updating of misleading or inconsistent guidelines. Generally, however we should not generate plans for major interventions on the basis of a single incident but draw on a wider range of information and check that the findings of the incident are really indicative of more widespread problems. Aggregate analyses of safety investigations over a year, integrated with other related safety and quality data, will allow examination of major system issues and the production of more meaningful actions plans [18]. For instance, poorly organised handover may be a factor in multiple safety incidents but be regarded as too difficult to tackle in a single incident action plan. A hospital reviewing a year’s worth of events however can see a pattern emerging and prepare a serious plan for improving handover across the whole organisation.
Conclusions and next steps
Healthcare is changing rapidly with more care being provided in the home and community to an ageing population suffering chronic diseases over long time periods. Our previous concepts of quality and safety have to evolve to reflect these changes [11]. Rather than thinking primarily in terms of specific incidents we need to consider the balance of benefit and harm over long time periods and encompass the social and psychological impact of healthcare as well as physical effects. The longer-term perspective has important implications for the subsequent safety strategies that we implement. These changes are profound and will require major adjustments in both practical and cultural terms and research to explore and evaluate the most effective approaches.
ALARM and the London Protocol have served us well and been widely used across the world. The essential approach of following the patient journey and examining contributory factors has proved both efficient and effective as a means of understanding how safety is achieved and how it can be lost. This approach however needs to evolve to encompass longer time scales, the home and community context and critically the active involvement of patients and families, particularly when they often play the primary role both in the delivery and coordination of healthcare.
There is also need for significant research and investment in the development of both current and new approaches. While the methods of incident analysis proposed twenty years ago have spread widely, there has been distressingly little research into the concepts, methods, reliability and outcomes of such analyses. We need, for instance, to develop and evaluate means of involving patients and families, to develop methods of assessing and monitoring the quality of investigations and the value and impact of findings and recommendations from investigations might be meaningfully assessed. This period of revision offers an opportunity for a more critical and scientific vision to emerge which is truly linked to organisation and system wide learning and improvement.