Mistake proofing: changing designs to reduce error

Abstract

Mistake proofing uses changes in the physical design of processes to reduce human error. It can be used to change designs in ways that prevent errors from occurring, to detect errors after they occur but before harm occurs, to allow processes to fail safely, or to alter the work environment to reduce the chance of errors. Effective mistake proofing design changes should initially be effective in reducing harm, be inexpensive, and easily implemented. Over time these design changes should make life easier and speed up the process. Ideally, the design changes should increase patients' and visitors' understanding of the process. These designs should themselves be mistake proofed and follow the good design practices of other disciplines.

Patrice Spath wrote: “If healthcare is to improve patient safety, systems and processes must be designed to be more resistant to error occurrence and more accommodating of error consequence”.¹

Senders and Senders wrote: “Errors will continue to be made. Accidents, on the other hand, can largely be prevented by intelligent and imaginative use of additional cues that announce that an error has occurred and that make it possible for the error to be corrected before damage has been done. Where possible, physical design should be used to prevent error from being translated into injury.”²

Processes occur in a physical environment populated with equipment, supplies, devices, and technologies. This paper is intended to help generate ideas about how this physical environment can facilitate processes—how design changes can make processes, executed by humans within a physical environment, more reliable and effective. It is about how changing the design of processes can prevent the performance of a prohibited action, ensure required actions are performed, or ensure that information required for correct action is available at the correct time and place, and that it stands out against a noisy background. Creating such designs is called “mistake proofing”. It is also known by its Japanese slang buzzword “poka‐yoke”. The ideas and impetus for design changes will not come solely from a single area of expertise; rather, all medical personnel, doctors, nurses, technicians, engineers, designers, managers, and executives need to think about how the design of healthcare processes could be improved.

Examples of mistake proofing include “self‐blunting” sharps and the revolving door style lid of a sharps container that insulates its users from its hazardous contents. The pin indexing systems common in medical gas connections in many hospitals is another example. Mistake proofing would also include high tech solutions like bar coding, automated medication dispensing systems, and electronic infant abduction detection systems. However, as a case study will show, many designs are far easier to change than these.

What is meant by design?

The word “design” has many meanings. It can be used broadly to mean any planning activity—for instance “design a response” or “design a new strategy”. Elsewhere it is used to mean “the act of working out the form of something”.³ In the context of industrial engineering, design means “creating and developing concepts and specifications that optimize the function, value and appearance of products and systems for the mutual benefit of both user and manufacturer”.⁴ In statistical quality control, the economic “design” of control charts means choosing a sample size, a sample interval, and a percentage of the distribution to be contained within control limits.

When Spath¹ uses the word “design” in the quote above, even readers interested exclusively in patient safety may be thinking of very different types of improvement activities. Some may design a work environment conducive to patient safety by creating a safety culture. Others will design a medication prescription process that prohibits dangerous abbreviations. Activities such as creating new labels for medications that make distinguishing information more distinct would also be included in design. Infusion pumps can be designed with free flow protection and occlusion alarms. All of these design activities will probably be needed for patient safety improvement efforts to be successful.

In the second quote, Senders and Senders² limit their concept of design to “physical design”—the altering of a tangible or visible aspect of a process. While no exclusive definition of design is advocated here, in this paper the term “design” will be used in this relatively narrow physical sense. Changing the appearance of a label or adding a tube clamping system to an infusion pump is a design change. Changing the culture shared by hospital employees or prohibiting the use of abbreviations are not considered design changes in this paper.

Like design, the concept of mistake proofing varies in the literature. Again, what constitutes mistake proofing will be relatively narrow. Mistake proofing must involve physical, tangible or visual changes. The following heuristic can be used to determine if a change is mistake proofing or not: if you cannot take a picture of the design change, it probably is not mistake proofing.

Broader views of mistake proofing are available.⁵,⁶ Stewart and Melnyk⁵ describe an 11‐step “poka‐yoke” improvement process that is very similar to other step by step quality improvement processes. The mistake proofing changes that result from the process are reducing the total linear distance materials travel during the process, and reducing congestion at a process bottleneck. Both changes are worthwhile; neither would be considered mistake proofing unless they were accomplished by physical design changes to the process. Rearranging the equipment to reduce travel distance alone would not constitute mistake proofing. Reducing inventory (and thus congestion) around critical equipment also is not the kind of design change under consideration. In a paper by Godfrey et al,⁶ mistake proofing includes most error prevention strategies. Physical design changes are only a subset of what is included. All the items in table 1 are examples of what Godfrey et al include in mistake proofing. Items shown in the lower half of table 1 are worthwhile changes and will probably improve patient safety; however, they are not physical design changes and are not defined as mistake proofing in this paper.

Table 1 Examples of what constitutes mistake proofing using the definition in this paper.

Mistake proofing

• Make the colors of the tube and the point where the tube should be connected the same

• Change the shapes of the tube and the point where the tube should be connected so that the wrong tube cannot be connected

• Use infusion pumps that regulate the flow intravenous fluids

• Change colors of the tubes by medication

• Standardize the valves in the whole hospital

• Put in an automatic timer

• Use a partitioned cart which can contain only a certain number of medications

• Differentiate labels among concentrations

Not mistake proofing

• Set up a brief meeting between the physician and clinical and clerical support staff (known as a “huddle”) to review the schedule and identify ways to make the day flow better and do contingency planning for unexpected demand

• Note on the encounter sheet that the patient needs to return in 4 weeks for a 30 minute appointment

• Require two nurses to independently check the label on a unit of blood against the patient's identification band

• Emphasize to callers that calls will be returned “at the end of office hours”

• Forward patient calls to an automated direction line that the hospital operates as soon as they have finished booking the examination

• Make sure that examination rooms are stocked and the supplies and equipment are arranged in a standard way

• Require a chart review, normally done the day before or the morning of the visit, to determine whether all appropriate documentation is in the chart and ready for the physician

• Pharmacy intervention for non‐standard concentrations

Examples come from the error proofing database in the paper by Godfrey et al.⁶

Often mistake proofing is not what is done but how it is done. Item number 6 under “not mistake proofing” is “make sure that examination rooms are stocked and the supplies and equipment are arranged in a standard way”. Standardization can play a pivotal role in mistake proofing; however, if it is accomplished by inspecting shelves to insure they are fully stocked during patient safety rounds, it is not mistake proofing. If it is accomplished by implementing a visual reorder point (or kanban system⁷) to ensure that standardized quantities of supplies are available, that would be mistake proofing. Error prevention strategies that start with “make sure that …” beg the questions of how and who. Mistake proofing responses to these questions use physical design changes.

This narrow physical definition of the terms “design” and “mistake proofing” is informed by authors in psychology, quality management, and manufacturing. Noted psychologist Donald Norman⁸ discusses putting “knowledge in the world”. He refers to knowledge in the world as “external knowledge”. Though not stated explicitly, Norman's examples are all physical artifacts that communicate procedural knowledge about the process. Of the first 352 published examples of mistake proofing from Japanese manufacturers,⁹,¹⁰ the only examples that lack a photograph or line drawing are in fact physical changes and could have been photographed.

Ways in which design can reduce error

Mistake proofing provides four different approaches to designing processes that tend to reduce human error.¹¹ These approaches are introduced briefly below and are discussed in more detail in Grout:¹²

1. Design mistake prevention into the process.

2. Design mistake detection into the process.

3. Design the process to fail safely.

4. Design a work environment that prevents errors.

Mistake prevention

Mistake prevention includes those design changes that essentially force the user not to err. Donald Norman⁸ called these “forcing functions”. Other authors have referred to them as “barriers”.¹³ These design changes can take the form of automated control—for example, an electronic infusion pump—or can take the form of a benign failure that shuts down the process—for example, the tube clamp that keeps the intravenous fluid from flowing freely when the tube is pulled from the infusion pump. More information about how to design benign failures is available elsewhere.¹⁴

Mistake detection

Mistake detection allows the process user to determine immediately when a mistake has been made. As Senders and Senders² imply, if the mistake can be detected rapidly, corrective action can often be effected before harm actual occurs. For example, the use of radio‐opaque sponges designed with embedded fibers to facilitate their detection allow the error of leaving a sponge in the patient to be detected at a stage in the process where it can be retrieved with relative ease. Harm to the patient is reduced compared with detection later.

Fail‐safing

Tsuda¹¹ refers to this approach as preventing the influence of mistakes. Consider automotive airbag passenger restraint systems. They prevent the influence of a mistake. The crash still occurs, but the influence of the accident is less catastrophic because of design features. Examples in medicine include the lead aprons used in radiology to prevent vital organs from being exposed to radiation that would be harmed if not protected, and the use of gloves and face shields to protect against splashing blood.

Work environment

Some error reduction in the work environment can be accomplished simply by reducing ambiguity, streamlining processes, and reducing complexity. Any simplification efforts will reduce the opportunities for error. No one can err on process steps that have been eliminated. Simplicity, cleanliness, and a lack of ambiguity provides an environment that is more conducive to holding “knowledge in the world”.

Some of the hospitals¹⁵,¹⁶ that have been appropriating and adapting the Toyota production system for their use have focused on visual systems called “5S”.¹⁷,¹⁸,¹⁹ The 5S are Japanese words whose Romanization all begin with the letter “S”: Seiri (Organization), Seiton (Orderliness), Seisou (Cleanliness), Seiketsu (Standardize), and Shitsuke (Discipline).

The 5S process starts with a thorough cleaning of the space in which the process occurs. Typically this step reveals a substantial amount of unneeded items that can be removed and, after a waiting period (to insure they are truly not needed), can be discarded (Seiri). In medical environments this process also can lead to the discovery of very valuable unused equipment and supplies. The investment of effort is often paid back instantaneously. Swedish Hospital in Seattle reports recovering $28127.00 worth of inventory items in one clean‐up project.²⁰ Those items that remain after cleaning are placed carefully in locations where they are used (Seiton). The focus is on reducing motion and increasing ease of work. If an item is used in more than one location, then a duplicate item may be added into the workspace so that one is always available when and where it is needed. Once the items used in a process are in place, efforts must be made to ensure they stay where they belong (Seisou). This involves creating “automatic recoil”, a system of location and item labeling that makes returning items to their designated place obvious and easy. These efforts must be maintained and institutionalized (Seiketsu) and must become habitual cultural parts of the organization (Shitsuke).

While mistake prevention tends to be a “stronger” technique than mistake proofing in the work environment, a broad and non‐exclusive approach to mistake proofing is recommended. Improving the work environment, detecting mistakes, preventing mistakes, and preventing the influence of mistakes will all need to be included in the effort to reduce human errors in healthcare processes.

Attributes of good mistake proofing designs

Mistake proofing design changes are not all created equal. Some are better than others. Ideally, good mistake proofing designs would be very effective in preventing errors or harm. They would be inexpensive, easy to implement, make life easier for workers, and speed up the process. They should elicit involvement of patients' families or loved ones. They should be mistake proofed themselves, and should be informed by other good design practices. This section describes these attributes in detail.

Effectiveness

The effectiveness of a design change is determined by its ability to reduce the relative priority of an error. This can be measured using failure mode and effect analysis (FMEA)'s concept of risk priority numbers (RPN).²¹ Effective design changes should decrease the frequency with which errors occur, render the error much more detectable, or reduce its severity dramatically. Godfrey et al²² rate effectiveness on a 3 point scale. A very effective solution (3) makes the occurrence of an error very unlikely or impossible or improves detectability using control measures that are very unlikely to let an error go undetected. Effective solutions (2) reduce the likelihood of occurrence; however, the likelihood and severity taken together still indicate the existence of a significant hazard, or control measures that are inadequate to detect errors consistently. Ineffective solutions (1) do not reduce the likelihood of occurrence and cannot readily detect when errors have occurred.

Inexpensive

Ideally, mistake proofing design changes would be very inexpensive. The example at the end of this section will show that some solutions can be very inexpensive. Godfrey et al²² define costs as low, moderate, or high depending on the organizational level of approval required to fund the changes. Low cost changes (3) can be paid for out of the daily operating budget; moderate costs (2) need to be paid for out of unit level budget; high costs (1) require payment from hospital level budgets.

Easily implemented

The ideal design change would require minimal training and not generate any employee resistance. Easy implementations (3) require little or no training and generate little or no worker resistance to the change. Moderate difficulty implementations (2) require a training course and some resistance is expected. Difficult implementations require major culture shifts and overcoming strong resistance.

Solution priority number (SPN)

Godfrey et al²² aggregate these first three dimensions of good mistake proofing design changes into an index number called the solution priority number (SPN), where SPN equals the numerical rating of effectiveness × the cost rating of the design change × the rating of the ease of implementation.

Make life easier, speed up the process

In addition to the first three attributes which focus on preliminary aspects of implementing changes, mistake proofing should make workers' lives easier over the long term. The best designs will not be cumbersome or slow the process down. Rather, design changes that reduce errors and speed up processes go together. Hinckley²³ provides data which indicate that, for comparable technologies, those that take less time to use also tend to exhibit fewer errors. The following are recommendations from the design for manufacturability and assembly literature. These recommendations are intended to reduce the labor time required to manufacture products;²⁴ however, they are also likely to have the effect of mistake proofing processes to which they are applied:

• reduce part count and part types;

• strive to eliminate adjustments;

• design parts to be self‐aligning and self‐locating;

• ensure adequate access and unrestricted vision;

• ensure the ease of handling parts from bulk;

• minimize the need for reorientations during assembly;

• design parts that cannot be installed incorrectly;

• maximize part symmetry where possible or make parts obviously asymmetrical.

The implication is that actions that reduce the length of time something takes to do will also reduce how often those doing it will err. Design changes that speed up the process tend to simultaneously reduce error rates. A caveat is needed: the recommendation is to streamline processes, not to rush people or encourage haphazard work.

The Toyota Production System also focuses on speeding up the process and reducing waste.²⁵ It defines waste very broadly as anything that does not add value for the patient. Waste can be exhibited in the following forms:

• overproduction;

• waiting

• transporting;

• inappropriate processing;

• unnecessary inventory;

• unnecessary/excess motion;

• defects.

Preliminary evidence suggests that healthcare processes have a substantial amount of non‐value added activities. The Toyota Production System proponents view all of these activities as waste that should be reduced or eliminated. Rogers and McAuliffe²⁰ found that 91% of the time spent providing the first unit dose of a medication is non‐value added time. This process involved 25 process steps and took 70 minutes to perform. After vigorous reduction of non‐value added activities, the process required only nine process steps and took less than 20 minutes. Non‐value added activities still took up 67.5% of the time. Particularly where staff shortages exist, these mistake proofing and waste reduction strategies are very attractive.

In addition, workers' lives can be made easier by making recovery from likely process failures quicker and easier. Typically, decreasing the wastes listed above—especially unnecessary inventory and waiting—will allow problems to be detected more quickly. Quick detection usually makes it easier to recover.

Increase understanding of the process

Patients and their visitors are very interested in the processes of care. They are also a resource that can be used to ensure that good quality care is occurring. They are highly motivated and anxious to make a difference. Good design will help them perform that function well. Good mistake proof design should help patients and their visitors to make sense of the process. The mistake proofing should be understandable and free of medical jargon. The design should make the patient's status or condition obvious, and make the steps of process clear. Mistake proofing should also keep loved ones from inadvertently harming the patient.

Dr Robert S Mecklenburg of Virginia Mason Medical Center is designing a wristband checklist based on the Institute of Healthcare Improvement best practices for acute myocardial infarction.¹⁶ It provides patients and family members with the ability to know where they are in the treatment process and allows them to be meaningfully involved in ensuring that proper steps are taken in a timely manner. Another example which increases visitors' understanding of the process and helps prevent them from inadvertently harming the patient will be described in the case study which follows.

Be mistake proofed

Good mistake proofing designs will be easy to install correctly, require very little adjustment, and verifying functionality (or calibration) should be straightforward and simple. If the mistake proofing stops the process as part of its proper function, it should be easy to troubleshoot the problem and get the process going again. If the mistake proofing fails, it should do so in “detect mode”. It should indicate that something is wrong with the process. It should not signal that everything is proceeding in a correct and error‐free manner when the mistake proofing is, in fact, not functioning at all and providing no protection from errors. When failures occur, it is best if they are easy to fix.

Be informed by other good design practices

Edward Tufte²⁶ has proposed design principles for effectively displaying quantitative information. His approach is rooted in a ruthlessly austere “less is more” philosophy: “Above all else show the data. Maximize the data‐ink ratio. Erase non‐data‐ink. Erase redundant data‐ink. Revise and edit.”

This approach yields minimalist displays designed to provide the maximum amount of data possible without letting the graphics obscure the interpretation. The box plots in fig 1 show how information may be communicated more clearly with less ink. It would also allow more information to be shown in less space without diminishing comprehension or understanding. Tufte refers to the visually “loud”, graphics‐rich, data‐poor objects typical in Microsoft PowerPoint and the graphs on the front page of USA Today as “chart junk”.²⁶,²⁷ Chart junk is counterproductive to comprehension and understanding.

Figure 1 Typical series of box plots and Tufte's “box” plot.

Tufte's concepts seem very applicable to increasing the information content in work processes as well. When designing labels to indicate where things go in 5S, typically every machine and cart location is outlined with broad colored tape. Taken to extremes, the result is equivalent to “chart junk” (fig 2A). In fig 2B design changes provide workers with the same information, but in a far less visually noisy way, using 4 inch diameter circles for each cart wheel.

Figure 2 Tufte's minimalist approach applied to marking a cart's location on the floor: (A) before, (B) after.

Case study

The Institute for Healthcare Improvement's “100 000 Lives Campaign”²⁸ includes four recommended practices to reduce the incidence of ventilator associated pneumonia, also known as “the ventilator bundle”. One of these practices is to ensure that the head of the bed is elevated to between 30° and 45°. Participants in the Patient Safety Improvement Corps (PSIC) from Mississippi²⁹ implemented a simple mistake proofing design change to help ensure that this practice was being followed. Their design change was an instance of mistake prevention in the work environment, one of the weaker forms of mistake proofing. However, it had a few of the attributes of good mistake proofing and, while not eliminating errors, it has helped to reduce them substantially. A few alterations which may add additional attributes to the design will be proposed.

The PSIC team felt that it was important to be able to determine whether the bed was at the correct angle from outside the room in the ICU. Their solution was to apply a label to the bed to indicate the correct angle (fig 3). The label is easily made and installed, but requires a judgment call on what 30° looks like. The staff quickly became adept at judging the angle, and the design change helped hospital personnel to determine more easily if something was wrong. The design change was a significant success.

Figure 3 “HOB 30” label affixed to bed to indicate the appropriate inclination of the bed and allow for a visual assessment of compliance from a distance.

The design change can be evaluated using the solution priority number (SPN). The effectiveness of affixing a “HOB 30” label to the bed may reduce the likelihood of occurrence and also provides some amount of increased detectability. However, the design is not so effective that a significant hazard no longer exists, so the effectiveness rating of this design is 2. The design change can be paid for out of daily operating budget so the cost rating is 3. Since this label is a relatively straightforward job aid,³⁰ the training involved can be a very short briefing about the label and its purpose, and it is unlikely to generate any real resistance, the design change is therefore easy to implement and would be rated as 3. The SPN is 2×3×3 = 18; this is the second highest possible score.

In contrast, a stronger type of mistake proofing would be one that would set off an alarm on the ventilator if the bed was lowered below 30°. The ventilator would have to be retrofitted with the ability to interact with a programmable logic controller that would use inputs from a limit switch mounted to each bed in the unit (or facility). This change would be very effective (3) but would also be high cost (1 or 2) and would require training the staff on the new procedures for setting up the ventilator (2). The SPN would be 3×1×2 = 6 or 3×2×2 = 12. Despite the fact that this design change is more high tech and a “stronger” mistake proofing design change, it may be less attractive because it is so much more difficult to fund and implement.

To further enhance the effectiveness of the label, a few additional design changes might be considered to obtain more good attributes. Judging the 30° angle is an acquired skill. Judging whether something is level is easier and most people can do it effectively without much thought. It might be better if the label was mounted at 30° so that it is level when the bed is at the correct angle (fig 4). Also notice that the code “HOB 30” is replaced by text that describes what is desired in language that most would understand. The small text on the white background of the label shown in fig 4 explains to visitors what the label is for and what actions they can take to ensure the best care for the patient. It also provides an indication that making the patient “more comfortable” may not be in his or her best interest (fig 5).

Figure 4 The “HOB 30” label might be improved by providing a jargon free label affixed to the bed so that the proper angle will make the label level.

Figure 5 Close up view of the label.

The label could be enhanced further by placing relatively subtle lines on the label at a 30 degree angle so that, when the head of the bed is lowered until it is flat, the lines are level. This would make accurately affixing the labels easier, requiring a carpenter's level or just measuring from horizontal surfaces on the bed itself. These lines should be very close in color to the background color and narrow so as not to be distracting to the label when viewed from a distance. The lines would also allow the accuracy of the placement of the label to be assessed by looking to see that the lines are level when the head of the bed is down.

Conclusions

An earlier variation of “the devil is in the details” appears to have been “God is in the details”. Attribution of who said it first varies. In the context of this paper, whether it is the devil or God who is in the details, its meaning is unchanged: small design changes can have a profound impact on human errors. Thoughtfully changing the physical details of healthcare process design can be very effective in preventing errors or harm. These details can be designed to speed up the process and make life easier for workers. They should be inexpensive, easy to implement, and mistake proofed themselves. They should enable and encourage the family or loved ones to be involved in—or at least understand—the process. All of these design changes should be informed by good design practices from outside health care.