Safety-I Versus Safety-II: A Mixed-Methods Study Revealing the Imbalance of Approaches in Primary Care Medication Safety

Abstract

Objectives:

Our objective was to develop an in-depth understanding of the barriers and facilitators for medication safety in primary care by synthesizing findings from a multiyear, multisite study of care teams, pharmacists, and patients, using Safety-I and Safety-II lenses.

Methods:

We used mixed methods, including a systematic literature review and interviews on medication use in ambulatory primary care. We synthesized the findings using Safety-I and Safety-II lenses to identify safety challenges and strategies.

Results:

Published challenges and strategies were mostly framed through a Safety-I lens: establishing ever-expanding best practice algorithms and using them to decrease variability. In contrast, our analysis of patient and professional perspectives revealed that medication safety in ambulatory settings is undermined by the complexities of distributed work systems including poorly implemented safety checks; limited support for self-management; weak safety infrastructure; conflicting interests; and external forces beyond the control of patients and primary care professionals. We also identified actions by clinicians and pharmacists to improve medication safety that fall outside traditional compliance-focused Safety-I strategies. These actions were often initiated to overcome barriers in distributed work systems, highlighting the importance of Safety-II strategies in primary care.

Conclusions:

This study revealed a fundamental limitation in applying Safety-I principles to primary care medication safety, particularly the assumption that all system defects can be feasibly fixed. Given the complex realities of primary care, a complementary Safety-II perspective is essential, as it recognizes the agency of professionals and patients in managing risks within distributed work systems affected by uncontrollable external forces.

After 2 decades since the release of the “To Err is Human” report, observers have concluded that improvements in patient safety have been limited to a few examples in niche areas.¹ The original optimism of the patient safety movement has given way to hard bitten realism that there has been little measurable improvement in the overall rates of preventable harm.¹ The objective of this paper was to synthesize our findings from our multiyear, multisite project—the Partnership in Resilience for Medication Safety (PROMIS) Learning Lab funded by the Agency for Healthcare Research and Quality (AHRQ)—on primary care medication safety as perceived by patients, primary care teams, and pharmacists, where contrasts between Safety-I and Safety-II principles emerged describing challenges and highlight strategies to improve safety in complex adaptive systems for medication use.^2–7 Our goal was not to abandon Safety-I principles, but to use Safety-II principles to shed light on how complex systems such as those responsible for safe medication use may be improved. In particular, we highlighted the importance of recognizing inherent tradeoffs and conflicts in complex sociotechnical systems, and devising system improvements without assuming that it is always feasible or practical to resolve structural and constantly changing tradeoffs/conflicts.

SAFETY-I AND SAFETY-II

In the Safety-I paradigm, a set of dominating approaches pursued in health care have focused on achieving absence of adverse events. These approaches model causations of adverse events in linear, mechanistic manners, and frame safety improvement as redesigning to remove systems defects to ensure failure free operations.⁸ Safety-I principles promulgate improvement strategies to identify best practices and algorithms, standardize and decrease variability of work procedures, control work practices to follow ideal practices (work-as-imagined), and search out procedural variations when adverse outcomes occur.⁹ There is an implicit assumption that with time, all failure modes will be addressed and any aspects in a system can be redesigned (systems-as-idealized), and as long as workers follow best practices, adverse events will be eliminated.

Criticisms of the Safety-I paradigm point to limitations in recognizing that variations in human performance are needed for success in complex systems, including reducing preventable harms.¹⁰ Additional challenges to the Safety-I paradigm include limits in available resources to weed out system defects, and to counteract outside influences and disturbances that are uncontrollable and unpredictable.

Over the last 10+ years, Safety-II emerged as a paradigm to understand limitations of failure-focused approaches to safety in complex systems.⁸ The Safety-II paradigm recognizes that complex systems cannot be decomposed in such a way that safety may be assured by proceduralization of individual components. In contrast, everyday work in complex systems, such as primary care work systems, is—and must be—variable and flexible to address conditions that are often unexpected and not under the control of frontline workers such as primary care clinicians and pharmacists. The Safety-II paradigm provides ideas and concepts for understanding how things go right often not because people follow procedures, but because people can and do adjust their efforts to match the conditions of work (work-as-done). As systems continue to develop and introduce more complexity, these adjustments become increasingly important. In Safety-II paradigm, human contributions in complex systems are not a problem to be solved or standardized; they are the adaptive solution. By predicating that all systems can be optimized and redesigned, we may unintentionally degrade the importance of human agency in working in systems that often contain conflicts in interests and historical defects (system-as-found).¹¹

The main goal of this synthesis was to understand barriers and facilitators for medication safety in primary care, with our research efforts focused on high-risk adults who live in the community, commonly defined as older adults taking 5 or more prescribed medications.

METHODS

This study was designed to synthesize findings from a systematic literature review² and analyses of quantitative and qualitative data^3–7 collected by the Partnership in Resilience for Medication Safety (PROMIS) Learning Lab team under the Patient Safety Learning Lab (PSLL) project funded by the Agency for Healthcare Research and Quality from 2019 to 2024. Our project team also visited several family medicine clinics and community pharmacies in England and Netherlands to gain additional insights on how medication systems work in other countries. This synthesis of our findings occurred over multiple conversations and meetings with our multidisciplinary investigators and advisory board members with backgrounds in safety science, human factors and systems engineering, community pharmacy, primary care clinicians, and patient/family representatives. Multiple drafts of key findings and insights gained were shared and commented on by our expert team and discussed during meetings and refined iteratively. More details of our methods are included in the Appendix (Supplemental Digital Content 1, http://links.lww.com/JPS/A741).

RESULTS

Summary of Medication Safety Reviews

The systematic review of medication safety in primary care showed that primarily the Safety-I paradigm was used to conceptualize medication safety.² Two disconnects were identified in the reviews. First, most of the measures for medication safety have been procedural variations, which were aligned with Safety-I principles. More than three-quarters of the studies included in the review (44/56) used “potentially inappropriate prescribing” as a measure, not patient harm such as medication side effects. A large number of prescribing guidelines were used, such as those for prescribing for older adults.¹² Review of observational and interventional studies found that actual harmful events were not changed by successfully reducing potentially inappropriate prescribing,^13,14 raising questions about the safety benefits of such guidelines versus enforcing prescribing behaviors. Adverse drug events (ADEs) that cause patient harm serious enough to result in a visit to an emergency department or hospitalization occurred less often than commonly believed, and safety was not associated with compliance to prescribing guidelines.²

The second disconnect was a lack of consideration of multiple interacting work systems. In the previous literature, patient shared decision-making was rarely included, as was patients’ contributions in weighing risks and benefits. Attempts to overstandardize and oversimplify the work by primary care professionals and patients, common in applications of Safety-I principles,¹⁵ have actually been found to distort the nature of medication safety in ambulatory settings.²

Poorly Implemented Safety Checking Systems: Pharmacy Work Systems Perceived as a Barrier to Medication Safety

Patients identified community pharmacists and pharmacies as playing a role in ensuring medication safety, such as dispensing medication safely, although patient study participants did not fully utilize the safety benefits of their pharmacists.⁵ Clinicians in primary care have to work with pharmacy work systems (system-as-found), with little abilities to influence how these outside systems may be redesigned to optimize medication safety. They may even perceive pharmacy work systems as barriers to safety and thus devise solutions to overcome such barriers.

Pharmacists would sometimes refuse to dispense medications even though the prescriptions were appropriate to the physician and patient. Pharmacists can ensure medication safety by reviewing prescriptions and collaborating with physicians to address potential concerns, although in current distributed work systems, support for collaboration among the prescriber, pharmacist, and patient is suboptimal (system-as-found).⁷ Examples of incongruence between the primary care work system and the pharmacy work system are shown in Table 1. In addition, pharmacies are not required to label prescriptions in a patient’s native language, nor are they required to advise patients in their preferred language at the time prescriptions are picked up. This is in contrast with clinics and hospitals that are required to provide translation services to patients. This is an example of how standardization of practices across settings based on a common set of work practices, a Safety I-based approach, would have been actually helpful. Similarly, we also noted other safety-implicating inconsistencies among different systems, such as no requirement to provide medications for free by pharmacies, though going without a prescription medication can be life-threatening within a short timeframe. And in the United States, hospitals and clinicians are required to provide care in emergency departments to patients who perceive they have an emergency, regardless of their ability to pay.

TABLE 1.

Examples of Incongruence Between Primary Care and Pharmacy Work Systems

Examples	Implications
Example 1: A patient who had been on a stimulant for attention deficit disorder for several years encountered a situation where the pharmacist insisted on discussing the medication with the doctor before dispensing the medication. There was no regulatory mandate for the pharmacist to do this but the pharmacist acted as if this was necessary to prevent risks, which delayed dispensing. The patient reported decreased work performance for the time she was off the medication	This example illustrates a fundamental flaw in simplistic safety checking systems to catch theoretical risks while ignoring the negotiation between the prescriber and the patient for best patient outcome, and not supporting the agency of the pharmacist with effective communication channels. The agency of the prescriber, the pharmacist, and the patient is better captured by Safety-II paradigm
Example 2: A patient had been taking a benzodiazepine for anxiety experienced attacks that affected her ability to function. The physician and patient negotiated to increase the dose, but since the patient still had some pills left at home, they decided to finish these pills at the increased dose first before getting a new prescription. When the physician later wrote a new prescription, reflecting the increased dosage, the pharmacist refused to fill it, citing that the patient had run out of her previous prescription too soon	Although the pharmacist worked as part of distributed work systems for medication use in ambulatory settings, there was not a safety system that was designed to capture all aspects of the shared decision-making between the physician and patient
Example 3: A patient spent time in a rehabilitation facility that had her medications (buprenorphine and clonazepam) taken at admission and refused to return them at discharge as a safety precaution. The outpatient physician responded by represcribing the medication upon discharge from the facility, but the patient was unable to fill the prescription due to a safety check by the pharmacist who misunderstood state Pharmacy Board regulations. As a result, the patient self-medicated with street drugs in an attempt to calm their anxiety	This example highlights the limitations of safety checking systems based on simplistic protocols and naïve assumption of complete, up-to-date information (systems-as-idealized) available for workers in distributed work systems despite the reality of frontline workers, including pharmacists, in confronting information gaps routinely. Safety checks implemented in such a manner hampered safety efforts, resulting in refusing to refill medications. In this case, the role of the pharmacist could be to investigate the situation and to deviate from procedures. The Safety-II paradigm better captures the reality of frontline workers (including patients) in resolving conflicts and barriers routinely (working in systems-as-found) and elucidates the need for flexibility and adaptability in safety practices

Inadequate Support for Patient Self-management: Pharmacy System-created Information Perceived as a Barrier to Medication Safety

A patient was admitted to the hospital who had a history of alcoholic cirrhosis of the liver and ascites. Over the previous year, he had quit drinking and started taking his diuretic medications regularly, successfully managing his chronic liver diseases with ambulatory clinics without emergency department visits. However, after experiencing a death in the family, the patient became very depressed and started drinking alcohol again. The labels on the pill bottles instructed him to not take the pills with alcohol, and he stopped taking his medications. Two weeks later, he presented to the emergency department with delirium and abdominal swelling due to the exacerbation of his underlying liver disease. While we could not find studies showing improved patient outcomes as a result of using these labels, this case highlights the nuances of how safety is created in complex systems, where agency of frontline workers (pharmacists) could play a larger role, such as providing comprehensive guidance beyond the labels and acting as easy-to-access information resources to patients. The Safety-II paradigm would have provided more nuanced guidance on the correlation between alcohol usage and likely outcomes. We observed a similar case where a patient with heart failure stopped taking those medications because the indication on the label said, “for decreased pumping of the heart.” He assumed the medication would worsen his heart condition.

Many patients struggled to understand the label on prescription bottles, especially how refills work on most labels in the United States that list the quantity of pills in that bottle and how many refills are left. Patients are often expected to calculate how long the prescription is valid by considering the quantity of pills in the bottle; number of pills needed per day; and number of refills. An easier to understand solution, such as providing a starting date and an ending date for the prescription label, as is the case in the Netherlands, could improve patient adherence. This seemingly trivial example illustrated the limitations of Safety-I paradigm when systems defects may be difficult to design out (system-as-found), therefore, patients, family members, and frontline clinicians have to creatively address system defects to ensure medication use and safety.

In ambulatory settings, addressing medication nonadherence through the Safety-I paradigm inadequately considers the agency and active roles of patients and family members in medication self-management. Patients in our study reported trying to wean themselves off of medications without notifying either the primary care or pharmacy work systems.⁶ They attributed their “nonadherence” to barriers to conveniently obtain information from either of the work systems to make weaning decisions.

Defective Safety Infrastructure: Prescription Fill Process as a Barrier to Medication Safety

One issue with the prescription fill process captured in our study was when the original prescription was sent to the wrong pharmacy by an electronic prescribing function in an electronic medical record (EMR). This could happen for various reason, including patients changing their minds or the pharmacies not having a process to forward the information to the patients’ preferred pharmacy, especially across different corporate pharmacies. This highlights the brittleness of our health care system across the care continuum, and the limitations of applying only Safety-I principles and importance of supporting adaptability and agility, especially when unanticipated and important actions/ changes occur out of a self-contained work system.

Similar issues were also noted when long-term prescriptions were sent to a mail order pharmacy for cost and convenience while short-term prescriptions were sent to local brick-and-mortar pharmacies. Using multiple pharmacies created extra work for the primary care teams, which also increased the chance of an error. One clinician reported that a prescription sent to a mail order pharmacy was canceled, but there was no mechanism in the EMR to report that change to the mail order pharmacy. We collected several cases of mail order pharmacies continuing to send 3-month packets of discontinued medications to patients. Primary care clinicians also felt that mail order pharmacies were inappropriately rewarded by insurance companies by mailing medications, versus actually assessing patients’ adherence to their medications and using their expertise to provide tailored consultation/ guidance to patients.

Some of these barriers were beyond the control of the local pharmacy. National drug shortages often caused patients to go without their chronic medications for a period of time. If the shortages were severe, this caused the patient and their primary care physician to schedule more office visits to try other medications that were not in short supply. Our study subjects also expressed dismay that pharmaceutical manufacturers do not collaborate with each other to ensure that the same drug and dosage pill looks the same across companies.

Given these complexities and highly dynamic nature of work and multiple work systems, strategies by front-line workers who work in distributed, organically emerged work systems that have defects (systems-as-found)—and who must anticipate and develop resilience to address external threats to the primary care or patient work systems—are crucial for ensuring medication safety, which is entirely in alignment with Safety-II.

Conflicts of Interests: Assumption of Aligned Interests as a Barrier to Medication Safety

Cases illustrating conflicts of interests were described even though patient safety was universally assumed as a shared goal. The pharmaceutical companies and the pharmacy benefit manager management (PBM) companies were observed to erect barriers to appropriate medication prescribing and usage. Examples included patients being denied generic versions of their medication with the mandatory switching to a branded product. The cost of medications was a common barrier. During the project period, it was not unusual for insulin to list for $300 per vial, with much of that price going to commercial discount programs managed by PBM companies.¹⁶ Most large health insurance companies are co-owned with a PBM under a larger corporate umbrella.¹⁷ The Safety-II paradigm allows us to explore safety improvement in health care system as a complex adaptive system (systems-as-found). Hence, conflicts of interest are to be expected. In contrast, the Safety-I paradigm provides little insights on and impetus for empowering pharmacists and primary care clinicians to address such conflicts at the local level. It assumes best practices and protocols are universally agreed upon, and conflicts are to be designed out.

Uncontrollable External Forces: Safety Improvement without Considering External Forces as a Barrier to Medication Safety

Our study subjects reported barriers to patients receiving appropriate medications through prior authorization hassles created by insurance companies. They also reported examples of pharmacies and EMRs printing out long difficult-to-read patient handouts that included every possible rare event that could occur. The length and style of these documents were felt to be outside the control of pharmacies or other professionals, as they were likely approved by medico-legal departments of pharmacy systems and other entities such as EMR vendors, rather than by human factors and cognitive engineers and frontline clinicians.

Similarly, health care delivery organizations have little control over EMR prescribing alerts, even though preventable ADEs that appeared in pop-up boxes seen by physicians in EMRs were often very rare. For example, the interaction between preexisting liver disease and a nonsteroidal anti-inflammatory medication is an idiosyncratic reaction that occurs in <1 in 100,000 cases. It is completely understandable that a patient would choose to take that risk to achieve some relief from a chronic painful condition. Table 2 provides more details of rare events and the supporting evidence that may pop up on commercial EMRs.

TABLE 2.

Evidence of Adverse Drug Effects Seen in Pop-up Boxes

Interaction	Theoretical harm	Rate of actual harm
Liver injury from NSAID	Case-control studies primarily show increased association of NSAIDs with elevated liver enzymes18	0.7/100,000 prescriptions with some level of liver injury; less for common NSAIDs such as ibuprofen and naproxen.19 Most liver injuries resolve when the medication is discontinued with no permanent effects
Amlodipine and some statins (atorvastatin and simvastatin primarily)	Both drugs metabolized by the same liver enzyme, which could lead to elevated blood levels of the drug20	Cohort evidence for slightly increased risk of acute kidney injury, heart attacks and strokes versus other statins in Taiwan.21 No rate of harm estimated. No comparison to the relative rates of harms if one of the medications was not taken. In a simvastatin sub-analysis, amlodipine was not recognized as a risk factor for adverse events21
Alcohol and blood pressure medications	Concomitant effects on long-term cardiovascular health, drug metabolism rates	No longitudinal evidence of harm from a drug-alcohol interaction22

Examples of other medication safety barrier codes using Safety-I principles versus Safety-II principles with supporting quotes are in Table 3. Of note, the code of communication was reported in several examples, which is essential to support effective adaptations across agents and work systems to “create” safety under the Safety-II paradigm, such as working together to anticipate problems and recover from disruptions.

TABLE 3.

Contrasting Perspectives of Safety-I Versus Safety-II on Primary Care Medication Safety Barriers

Safety barrier	Safety-I versus II issue perspectives	Quote
Communication and health literacy	Relative weighting of risks/benefits needs to be considered	Prescriber: I may not mention all of the secondary effects, and they go to the pharmacy. They see the prescription, and they start reading the long list of side effects, the secondary effects, and then, you know, they just compare it. [Patients] feel something, something similar to whatever is in the list. Then they feel like they don’t want to take it, or they don’t take it, but they don’t call us and let us know.
Medical-legal influences and health literacy	Relative weighting of risks/benefits needs to be considered	Nurse: Even if it’s one patient who has a side effect, they have to list it on the side effects, and they don’t put how many patients had it. So I don’t think the pharmacy is really doing a bad job, it’s just that the patients don’t understand that not all of the side effects are going to happen
Receiving the medication from the pharmacy	Flexibility when system components do not work as imagined	Prescriber: If there is a [medication] option that is cheaper, [the pharmacist] should let the patient know. Interviewer: And in your perspective, do they do that very much? Respondent: They should. I don’t think they’re doing it. I mean, sometimes they write the medication by brand name, … the patient calls me and tells me it’s so expensive. Those mail-order pharmacies get to claim that the patient took that medication all of the time, that everything is great. They make a lot of money from it. It’s a money maker
Collaboration between system elements	Conflicts between systems	Nurse: Because with insurance changes not only come formulary changes but pharmacy changes. So, you know, like Humana likes CVS and Aetna likes Walgreens. And all the Walgreens talk together. And all the narcotics stuff is easy to lump together. Now, once you, once they change insurances, they might not be in the same system. And if they go to the county hospital, all bets are completely off
Automatic refills	Rigid protocols	Prescriber: So say they come in, and we’re doing this in … automatic refills. We stop it. The pharmacy is still dispensing it. And the patient says, “Well, they sent it to me, I’m going to take it.” And I’m like, “No, we told you not to.” That’s another big problem, the automated, the automatic refill system. It’s great for people who understand, but it is kind of not good.
Inappropriate communication and oversight	Rigid protocols	Prescriber: The insurance companies also monitor the patients’ medication list. And they’ll respond by sending us letters recommending that we get patients off the medication that they’re on or so forth. But oftentimes, it’s not possible to remove the patient from a certain medication even though it’s not recommended for that age
Pharmacist-patient interactions	Multiple	Community health worker: I think the biggest barrier that I had was the pharmacy at [a health care system]. They gave our patients such a difficult time, and they would choose things and confuse the patient and it was just so difficult for them. I argued with them continuously. So I was an employee, so I can’t imagine the patients. There was a situation where I went all the way up to the supervisor of the pharmacy, because the patient needed a certain medication, a certain amount, and they weren’t willing to get that amount. It was probably one of the biggest barriers that I think the patients go through at [the health care system]. The pharmacy and their lack of understanding and explaining things to patients correctly
Pharmacist-patient interactions	Competing demands/system resilience	Nurse: I mean, a lot of times, those pharmacists are really busy. They don’t really take the time. They’re like, do you have any questions? Okay, bye. So, I mean, that has been my experience
Prescriber-pharmacist communication	Anticipation of potential issues	Prescriber: I mean, it would be nice if it was easier to get in touch with the pharmacy. Sometimes you have to go through this little like, you know, automated message. Messages in Epic are actually pretty easy. They get back to you pretty quickly. But a fax, or you want to call and talk to a person, it usually takes a while. And a lot of times the pharmacists don’t want you to call them back unless it’s something that you’re prescribing right now
Third-party payer challenges, including Medicare products.	Poor communication between distributed work systems	Nurse: For instance, insulin, that’s probably our number one thing. Levemir versus Lantus versus Humulin, all those three, it’s just a pick and choose from what they (insurance companies) are going to pay. So Blue Cross Blue Shield will pay for this one. Medicare will pay for that one. Every year I go through the same thing with them. But [the pharmacies] don’t actually help us do anything, because they too don’t know what is being covered until we send a new prescription. They process it. Then guess what. Nope, that one wasn’t covered either, so let’s try this one. Nope, that one wasn’t covered either

DISCUSSION

In this paper, we identified the inadequacies of solely applying the Safety-I paradigm in primary care medication safety. The Safety-I paradigm attempts to influence prescribing through integrating standardization and best practice algorithms into clinical workflow (e.g., pop-up boxes targeted to prescribers); the Safety-II paradigm encourages a broader and realistic examination of interacting complex systems. Instead of assuming a set of idealized, well-designed collaborating systems prioritized in a Safety-I approach, our empirical, multisite study of “medication management in the wild” showed that in reality, frontline agents work within an environment with poorly implemented safety checking systems, inadequate support for patient self-management, defective safety infrastructure, expected conflicts of interest, and uncontrollable external forces. This environment was distributed over at least 3 different work systems—the clinic, pharmacy, and the patient’s residence—and over a variable length of time.

Our results are similar to previous work that found that safety was conceptualized more in terms of work functions involving grouping of tasks or responsibilities, rather than domains such as medications; diagnoses; care transitions; referrals; and testing.²³ Therefore, a more traditional view of quality improvement that almost exclusively measures performance deficiencies, and ignoring the strategies developed by frontline experts (i.e., primary care; patient/family; pharmacy), may have limited added value in primary care medication safety. Examples of ADEs leading to avoidable patient harms were rare in our studies, which is consistent with a Safety-II²⁴ approach focusing on clinicians’ proactive actions in routine patient care to improve medication safety in primary care.²

In complex systems, Safety-I approaches are often not sufficient to reduce harms from ADEs, and one must be mindful that they may impair abilities of clinicians in enacting safety actions to address contingencies, frustrating the agency of frontline workers and increasing risks of burnout.²⁵ In one study, EMR alerts on potential ADEs resulted in underutilization of a life-saving medication.²⁶ In fact, the Safety-I versus Safety-II tension has been noted to exist within just community pharmacies.²⁷

This contrast of what defines risk is a classic distinction between the information prioritized by basic scientists versus primary care clinicians. In the basic science of pharmacology, a measure of the rate of drug metabolism, area under the concentration-time curve, is called disease-oriented evidence in family medicine.²⁸ A measure of an outcome that is important to a patient, for example, muscle pain in a patient taking a statin, is called patient-oriented evidence that matters (POEM) in family medicine.²⁸ This cultural difference between pharmacist priorities and primary care-patient priorities helps explain why the EMR pop-up warnings are mostly ignored in primary care.²⁹

How Do We Maximize Medication Safety in Primary Care?

Our findings suggest that if primary care teams are to help maximize medication safety, a long list of protocols and rules is not the answer. We are not suggesting that protocols and rules are not necessary, on the contrary they have value if carefully developed and implemented based on human factors and cognitive engineering principles.³⁰ Unfortunately, in today’s health care environment, protocols and rules are used mainly as part of “defensive medicine” rather than actually supporting cognitive work of frontline experts and patients. Similarly, some Safety-I–based approaches and solutions are valid, but they must be balanced against the realities of primary care and the harms caused by violations of Safety-II principles.

First, it should be recognized that there are times when Safety-I and Safety-II principles are in direct conflict. If a frontline worker is expected by management to complete a task a specific way, but the worker believes that in a certain situation applying a standardized protocol makes no sense, what should the worker do? The Safety-I paradigm means that the worker has no agency, variation in the application of the protocol equals an error, and so the worker should stick to the “best practice,” rather than actually doing the best for a particular patient. The Safety-II paradigm gives the worker agency, who understands the goals of the specific task and the greater organization and is encouraged to create variability to achieve the best outcome. A similar phenomenon was observed in “diagnostic errors” in emergency departments.³¹ A proposed solution was to provide user-friendly guidelines and standard operating procedures that included their rationale to improve the adaptive capacity of frontline workers when needed.³²

Second, it should be recognized that many procedures or best practices in the Safety-I paradigm are not based on evidence but are driven by the dogma of standardization that can devalue frontline clinicians in addressing variations in patient situations and goals. The Safety-I paradigm does not recognize that more guidelines may be harmful, or that more standardization may not be desirable. It is the difference between controlling and supporting a complex adaptive sociotechnical system.⁹ We felt that some of the protocols and guidelines we witnessed reflecting safety I principles such as standardization moved away from the original intent of reducing human errors, and moved towards controlling and constraining clinicians in complex primary care settings. In fact, one of our study subjects who was the head of a medication safety program in a large health care system said that his job in controlling the actions of front-line clinicians was like, “playing god.” The role of Safety-I principles in medication safety should address the basics, to truly benefit from standardization. To realize such benefits, investment of resources is needed to develop a relatively small set of guidelines that are developed using human-centered design principles and realities of work, based on nuanced studies and continuous systematic reviews. A recent discussion on guidelines in primary care pointed out similar concerns on proliferation of preventive care guidelines to the detriment of the main goal of primary care professions.³³

Third, it should be recognized that patient care often involves unavoidable risk. Every medication has risks, but so do untreated diseases, as illustrated in a recent analysis on antidepressants for children.²⁶ It was notable in our review of the existing medication safety literature was largely absent of principles vital to primary care: obtaining patients’ perspectives; sharing decision-making; and respecting patients’ acceptance of very low medication risks to achieve an outcome important to the patients. It is a much simpler task to criticize only one aspect of patient care, medications, without considering all the priorities of patients.

Fourth, medication safety in primary care must be viewed at the system level where multiple distributed work systems are involved, including patient work systems. Primary care teams demonstrated that they implemented principles of high-reliability organizing without any top-down federal or corporate mandate to do so.³ It organically emerged from the practicalities of their fiduciary responsibilities to their patients. The Safety-II paradigm recognizes that the bigger threats to safety processes are often not a violation of common protocols, but external threats to a work system. This reaction to myriad external forces reflects mindfulness in the primary care teams and is consistent with research in other high hazard/high risk settings, but it also reflects a strong culture of adaptability.³⁴

The primary care teams dealt with conflicts and confusions among distributed systems with little ability to control the nature, frequency, or magnitude of inputs from other systems. They naturally demonstrated strategies of successful mindful HRO: sensitive to and constantly adjusting to small cues or mishaps; constantly adapting, tweaking, and solving small problems; making timely human adjustments; and anticipating vulnerabilities, contingencies and discrepancies.³⁵ In contrast to more self-contained systems, successful improvement efforts in primary care often result by not following rigidly imposed protocols, but rather from bottom-up innovations, flexibility, and a deep understanding of patient work systems and other connected systems.³⁶ An example of a rigid system Safety-I barrier was that many of our study subjects felt that the after-visit instructions generated by the health care system EMR was unreadable, mostly because of its length (“I’m not going to read that”). The physician work-around was to handwrite the most important message(s) on this multipage document or a different sheet of paper.

Finally, most primary care-oriented patient safety problems are not amenable to simple solutions and do not match the profound complexity of modern health care settings. Care is delivered in intricate, fragmented, sometimes chaotic settings, in complex political, sociocultural environments with a virtually infinite range of moving parts and interconnections. Health care is characterized by informalities; work-arounds; feedback loops; emergent behaviors; politics; nested networks; fractal properties; systems dynamics; and bottom-up adaptiveness.³⁷ These kinds of settings stubbornly resist the introduction of top-down; standardized policy; regulations; or linear-style interventions.^1,38 Safety-I assumes that errors can eventually be reduced to an undetectable level. Safety-II assumes that perfect outcomes in a flawless system is an impossible goal. Both approaches are necessary, but neither is entirely “correct”—just like no clinical or diagnostic test is perfect and clinical expertise requires learning which tool/test or combinations of them to use in a complementary manner for a specific patient. Hence, it us up to us, as safety experts and frontline clinicians, to balance the use of these 2 approaches for ensuring patient safety, rather than trying to achieve safety by over standardizing processes in the complex work system of primary care.

CONCLUSIONS

What are the key takeaway messages from our findings for health care system leaders? We boil it down to 2 recommendations:

• Parts of health care systems are made safer by prioritizing Safety-I principles; others by prioritizing Safety-II principles. The best system strikes a balance between the two. Avoid the temptation to rely solely on a Safety I approach even though some of its tenets may sound comforting: protocols; standardization; best practices; undetectable variation; quality and safety dashboards; and so on. These priorities mask the realities of complex patient care and ignore some unsafe events, especially in primary care work systems, where multiple forces outside of its control affect patient care outcomes.

• System defects cannot all be redesigned out in health care as care occurs in distributed work systems that are not possible to entirely control, and it is not realistic to assume that we can start from a clean slate and redesign the entire health care system from scratch. Risks are part of the trade-offs clinicians and patients have to make, and many of the risks are not practically addressable by Safety-I principles in medication safety in ambulatory primary care settings. The independent agency of frontline clinicians and patients is always necessary for safety in complex systems where dynamic conflicts and defects are expected. Safety-II principles should be exploited to enhance safety actions and support the agency of clinicians and patients in systems as found. In some situations, other actions should be celebrated: ignoring standardized protocols; recognizing the value of variations in care; and working within constraints caused by external distributed work systems.