Exploring the sociotechnical intersection of patient safety and electronic health record implementation

Abstract

Objective

The intersection of electronic health records (EHR) and patient safety is complex. To examine the applicability of two previously developed conceptual models comprehensively to understand safety implications of EHR implementation in the English National Health Service (NHS).

Methods

We conducted a secondary analysis of interview data from a 30-month longitudinal, prospective, case study-based evaluation of EHR implementation in 12 NHS hospitals. We used a framework analysis approach to apply conceptual models developed by Sittig and Singh to understand better EHR implementation and use: an eight-dimension sociotechnical model and a three-phase patient safety model (safe technology, safe use of technology, and use of technology to improve safety).

Results

The intersection of patient safety and EHR implementation and use was characterized by risks involving technology (hardware and software, clinical content, and human–computer interfaces), the interaction of technology with non-technological factors, and improper or unsafe use of technology. Our data support that patient safety improvement activities as well as patient safety hazards change as an organization evolves from concerns about safe EHR functionality, ensuring safe and appropriate EHR use, to using the EHR itself to provide ongoing surveillance and monitoring of patient safety.

Discussion

We demonstrate the face validity of two models for understanding the sociotechnical aspects of safe EHR implementation and the complex interactions of technology within a healthcare system evolving from paper to integrated EHR.

Conclusions

Using sociotechnical models, including those presented in this paper, may be beneficial to help stakeholders understand, synthesize, and anticipate risks at the intersection of patient safety and health information technology.

Background

The USA federal government, through stimulus spending and the Affordable Care Act, is encouraging widespread implementation of health information technology (HIT) to improve healthcare quality and patient safety.¹ These efforts are founded on expectations of increased coordination of care, improved follow-up, and increased efficiency throughout the continuum of care.² However, research suggests that technology may lead to new uncertainties and risks for patient safety through disrupting established work patterns, creating new risks in practice, and encouraging workarounds.^3–10 In particular, the increasing adoption of electronic health records (EHR) has revealed potential safety implications related to EHR design, implementation, and use.^11–15 These risks are not related solely to the technological features of the EHR but may involve EHR users and their workflows, aspects of the organizations in which they function, and the rules and regulations that govern or oversee their activities. Furthermore, patient safety risks associated with EHR may vary along the EHR adoption and implementation timeline. Given the complexity and multifaceted nature of EHR-related safety risks, a comprehensive model is needed to understand and anticipate these risks in a sociotechnical context.

Sittig and Singh^{16 17} developed an eight-dimensional sociotechnical model to study the safety and effectiveness of HIT at all levels of design, development, implementation, use, and evaluation. Four earlier sociotechnical models informed the development of the eight-dimensional model: the model of Henriksen et al,¹,⁸ the framework for analyzing risk and safety of Vincent et al,¹,⁹ the systems engineering initiative of patient safety of Carayon et al,²⁰ and the interactive sociotechnical analysis of Harrison et al.²,¹ The model's dimensions represent interdependent domains of an EHR-enabled healthcare system: hardware and software; clinical content; human–computer interface; people; workflow and communication; internal organization policies, procedures, and culture; external rules, regulations, and pressures; system measurement and monitoring (figure 1).^{16 17} For example, failure to follow up a critical laboratory result could be attributable to a software error that prevented transmission of the laboratory result to the correct provider (hardware and software), faulty display of information in the provider's EHR window (human–computer interface), or inadequate coordination of roles within the clinical care team (workflow and communication).²² Efforts to improve EHR-related patient safety rely on identification of underlying risks as well as an appreciation of contributing areas of vulnerability (eg, people, organization policies and procedures, or system measurement).²³

Figure 1.

Diagram illustrating the interaction between the eight-dimension sociotechnical and three-phase electronic health record (EHR) safety models. The goal is for organizations to move from a paper-based medical record system ‘up the escalator’ to become an EHR-enabled healthcare system. Within each phase of the three-phase model, all eight dimensions of the sociotechnical model come into play. HIT, health information technology.

The sociotechnical intersection of patient safety and EHR is complex. First, this intersection conceptualizes the healthcare system as an evolving, complex adaptive system in which safety risks often emerge from users’ interactions with the EHR that lead to new clinical workflow processes. These new workflow processes involve different environmental (eg, human interaction with physical devices and their workspace),²⁴ cultural (eg, role changes of clinicians in the EHR-enabled workflow),²⁵ or even sociopolitical (eg, clinical power structure) factors.²⁶ Second, these safety risks are multifactorial and rarely involve a single contributing factor. Third, improving patient safety within an EHR-enabled healthcare system requires a journey in which the sociotechnical infrastructure and functionalities evolve over time. The sociotechnical model does not itself convey how it fits into the continuum of HIT safety that includes safe transition from paper to fully integrated EHR. Therefore, to understand the intersection of EHR and patient safety, Sittig and Singh²⁷ further proposed a three-phase model to account for the variation in the stages of implementation, levels of complexity, and related patient safety concerns within an EHR-enabled healthcare system. The first phase is concerned with safety events that are unique and specific to technology (ie, unsafe technology), which often emerge early in the process of implementation. The second phase addresses unsafe or inappropriate use of technology as well as unsafe changes in the overall workflow that emerge due to technology use. The third phase addresses use of technology proactively to identify and monitor potential safety concerns before harm occurs to the patient. While the boundaries between the phases may not always be distinct, the three-phase model could be useful for goal setting and identification of threats to patient safety.²⁷

In light of emerging and often novel risks associated with EHR, comprehensive models such as those described above are needed to assess the variety of safety threats and near misses. Such efforts will advance the understanding of EHR-related safety events to allow for the planning of safer systems and processes. Previously, we conducted a longitudinal, sociotechnical evaluation of the implementation and adoption of EHR in English National Health Service (NHS) hospitals.^{28 29} As part of that study, we conducted interviews that yielded a large volume of open-ended comments, some of which reflected concerns about patient safety. That study demonstrated the importance of considering the sociotechnical context of EHR implementation, although the UK investigators did not apply a formal framework to assess patient safety until now.³⁰ Our aim was to explore and illustrate the application of the eight-dimensional sociotechnical and three-phase EHR safety models to organize and interpret EHR-related patient safety concerns elicited during evaluation. Rather than conduct hypothesis testing, our goal was to highlight the ‘real-world’ usefulness of practical sociotechnical approaches to ensuring safe and effective EHR implementation and future use.

Materials and methods

Setting and design

In 2002, the UK Department of Health decided to implement three centrally procured national EHR applications, both made to order and commercially available, in the English NHS hospitals. Implementation was to be supported by a small number of centrally contracted local service providers, each responsible for delivering standard software systems to local hospitals, ensuring system integration, interoperability, and national connectivity within a geographical region. This was part of an overall US$19.6 (£12.7) billion strategic initiative to transform the NHS's HIT infrastructure into an integrated set of electronic systems connected to national databases and a messaging service (the ‘NHS spine’).³⁰ The data presented here were extracted from a 30-month (September 2008 to March 2011) prospective, longitudinal, and real-time case study-based evaluation during EHR implementation and adoption in 12 hospitals (nine acute and three mental health).³¹ The original research proposal was approved as a service evaluation by a NHS ethics committee.

Data collection

The methods of data collection have been described elsewhere.^28–30 Interviews were conducted at all stages of EHR implementation and adoption from initial awareness and planning to sustained use. In order to explore the implementation processes across hospitals, interviewers sought to determine the organizational activities undertaken and their consequences for professional roles, workflows, and clinical practices. Participating hospitals were purposefully selected according to their projected implementation timelines and included a range of hospital types (ie, teaching, non-teaching, acute care, and mental health) to allow comparisons.

The original investigators conducted semistructured interviews with a broad range of stakeholders: managers, implementation team members, information technology (IT) staff, junior and senior physicians, nurses, allied health professionals, administrative staff, external implementation-related stakeholders, and software developers. The six interviewers did not explicitly ask interviewees questions regarding patient safety. Interviews were audio-recorded and transcribed verbatim. Data were anonymized by redacting information that identified the individual participant or site.

Data analysis

One author (AT) asked the original UK investigators to review transcripts for content related to patient safety. Out of 480 interviews conducted in the evaluation, AT confirmed 49 interviews in which patient safety content was present. The data were then analyzed using a framework analysis approach, a qualitative research method that has pre-set aims but accommodates new themes from the data.³² Framework analysis has five stages: familiarization; thematic analysis; indexing (coding); charting; and mapping and interpretation. We began by reviewing and summarizing relevant quotes regarding EHR-related patient safety concerns. Using the eight dimensions of the sociotechnical model as the framework, three reviewers (DWM, DFS, and HS) indexed the data. While acknowledging the interrelatedness of the models, for clarity we coded the dimension and phase most directly implicated in the safety concern. The data were then arranged according to the three-phase model (charting). This analysis was performed iteratively until consensus was obtained among the reviewers. Interrater reliability was not assessed as the aim of the study was to explore themes of patient safety and EHR implementation (mapping and interpretation), not rigorous classification with the two models. ATLAS.ti 6 by ATLAS.ti Scientific Software Development (http://www.atlasti.com) was used for data management.

Results

The interviewees’ roles in EHR implementation and the number of hospital represented are shown in table 1. The sociotechnical domains were not mutually exclusive, but were seen to interact in the data; however, they are presented within the domain judged to be most involved with the safety concern. Some dimensions of the sociotechnical model are better represented than others in the dataset, as demonstrated by the mappings of phases and dimensions in table 2. Similarly, most data were mapped to phases one and two of the three-phase model. Table 3 provides a high-level summary of the safety concerns present in the data. This table reveals that certain dimensions have heterogeneity while others have more homogeneous concerns expressed. For instance, in hardware and software concerns regarding EHR availability were prominent in phase one; data sharing and system–system interface issues were also seen. Conversely, in clinical content, most concerns were regarding phase two, in which users experienced difficulties (perceived or actual) with order entry through the EHR. We present the data according to the three-phase model to illustrate safety risks that emerged as most relevant to each phase of implementation.

Table 1.

Interviewee role and hospital representation

Interviewee role	No of interviewees	No of hospitals represented
Senior manager	7	6
EHR implementation/IT team	9	6
Healthcare practitioners	16	6
Clinical managers	6	5
Administrators	3	5
Strategic health authorities	3	N/A
Local IT service providers	2	N/A
EHR software developers	3	N/A
Total	49	N/A

EHR, electronic health record; IT, information technology.

Table 2.

Types of safety concerns categorized by sociotechnical dimensions and phases of EHR implementation and use

	Phase 1	Phase 2	Phase 3
Hardware and software	11	2	0
Clinical content	3	7	0
Human–computer interface	4	4	0
People	1	4	0
Workflow and communication	1	6	0
Internal organization policies, procedures, and culture	3	0	0
External rules, regulations, and pressures	2	0	0
System measurement and monitoring	0	0	1

EHR, electronic health record.

Table 3.

Summaries of interview data demonstrating safety concerns by phase and dimension

Sociotechnical dimension	Phase of use	Summary of safety concern
Hardware and software	Phase one	▸ Problems with EHR availability (login or network access) (n=4) ▸ Lack of basic EHR functionality (n=4) ▸ Problems related to data maintenance, sharing, or security (n=3)
	Phase two	▸ Problems with accessing appropriate clinical information ▸ Problem with system–system interfaces
Clinical content	Phase one	▸ Undeveloped or non-standardized clinical content in the EHR (n=3)
	Phase two	▸ Parallel use of paper and EHR ▸ Problems or difficulties with use of order entry (n=6)
Human–computer interface	Phase one	▸ User interface too burdensome or error prone for data entry (n=4)
	Phase two	▸ User interface does not support clinical workflow (n=3) ▸ Risk of copy and paste functionality
People	Phase one	▸ Data security concerns
	Phase two	▸ Users sharing EHR access (n=3) ▸ Poor training leads to improper use
Workflow and communication	Phase one	▸ Errors related to appointment scheduling applications
	Phase two	▸ EHR not integrated into clinical workflow ▸ EHR causes delays in work (n=3) ▸ Laboratory result routing unreliable (n=2)
Internal organizational policies, procedures, and culture	Phase one	▸ Multiple medical record numbers per patient increase risk of wrong selection ▸ Data confidentiality risks ▸ Local IT budget must support ongoing IT infrastructure requirements
External rules, regulations, and pressures	Phase one	▸ National IT budgeting important for safe EHR use after implementation ▸ Complexity of software and business models of vendors may affect future use
System measurement and monitoring	Phase three	▸ Challenges and benefits of EHR-based quality reporting

EHR, electronic health record; IT, information technology.

Phase one

In accordance with the model, phase one EHR safety concerns were unique and specific to technology. Within the framework of the sociotechnical model, specific comments were frequently mapped to the domains of hardware and software, clinical content, and human–computer interface. An example of a phase one safety concern regarding hardware and software was the acknowledgment of an insufficient data center and back-up procedures.

‘The danger with [hospitals] doing their own thing is that instead of having a proper data centre meeting certain standards you get it sort of in a shed out the back sort of thing and it's not 24/7, it's not resilient, it doesn't have a fail over site that it can go to, it doesn't have a fail over within, guaranteed two hours service level and it's up to what they can negotiate with the supplier, so cost effectively it's not as cost effective and from a resilience and safety point of view it's not as good. I think the safety is probably one of the key things that doing it centrally and nationally is a lot more secure.’

IT Manager, Site H

Sociotechnical model: hardware and software

A recurring safety concern, also related to hardware and software, was implementation of an EHR without necessary software features to support a clinical workflow that demanded those features.

‘If you think someone's at risk of suicide and you kind of tick the box there and put some text in, you expect that will bounce through to the care plan module so they could then put a response to it and it stops things getting lost and what have you. It doesn't do anything like that. When you identify needs it doesn't bounce it through to the care planning functionality so that it's already there so that you know what you've got to address, and if you forget to transfer the fact that this person is at risk of stabbing someone, then the system doesn't offer any safeguards to drag it through.’

Healthcare provider, Site G

Sociotechnical model: hardware and software

In contrast to the absence of a feature, some users identified a design or implementation they perceived to be error prone. For instance, users described EHR hardware and software issues or human–computer interface problems that contributed to patient safety concerns.

‘We've had a couple of instances in Radiology where we've not been able to cancel requests and patients have been scanned twice, so they've had a double exposure of radiation.’

Director, Site E

Sociotechnical model: hardware and software

‘…[It's] terribly easy to make a mistake, because you can bring up several Maria Smiths and if you are not careful and you don't look at the date of birth, because they are just a list and they are right on top of each other, you could pick the wrong one.’

Receptionist, Site E

Sociotechnical model: human–computer interface

Phase two

In this phase patient safety is compromised through unsafe use of technology or unsafe changes in workflow. The most common dimensions in this phase were workflow and communication, people, human–computer interface, and clinical content. The prevailing theme from the data was the risk introduced when EHR was placed within a clinical context that did not facilitate safe use. For instance, a phase two concern was the improper integration of computers into clinical encounters in which EHR use cannot occur simultaneously with delivery of care (ie, in procedural or sterile areas). Another example was the barrier associated with the requirement to sign into the EHR, which resulted in password sharing and generic password use.

‘…you go to your colleague and you say, log me in and then you use other people's cards. They had to have this generic access in A&E (emergency department) because actually this was a crazy situation. It broke all the rules for information and governance and data protection.’

Manager, Site E

Sociotechnical model: people

Certain EHR features, such as copy and paste, were recognized as safety risks due to inappropriate use. In the example below, pathology specimens were mislabeled and the EHR was understood, in this instance, to increase risk of patient harm.

‘The ability to copy and paste in fields is dangerous. Incorrect details are being pasted into incorrect patient fields (i.e., prostate as specimen details in female patient request or missed miscarriage in clinical details for male patient).’

Healthcare provider, Site D

Sociotechnical model: human–computer interface

Some workflow and communication problems were specific to certain practice areas for which use of the EHR, as implemented, was thought to be particularly ill suited. For instance, EHR users in the mental health hospitals felt the effort needed to document in the EHR was not only potentially unsafe, but impeded the ability to see patients in a timely manner.

‘The psychiatric assessments are quite lengthy and there are quite a lot of notes that go with it. Doctors are not going to be able to do it while they are with the patient, because of issues like risk. … So it's going to increase the time spent and you are then delayed seeing the next patient which is I think the big anxiety.’

Doctor, Site M

Sociotechnical model: workflow and communication

Finally, as clinical workflow and communication was noted to become error prone when the medical record was in transition from paper to electronic form, clinical content also arose as an area of potential risk.

‘We have to print out now anyway and put into the paper notes because not everyone is on [software X]… But I can also see the fact that when everyone is on it you won't have to do it.’

Healthcare provider, Site H

Sociotechnical model: clinical content

Phase three

This phase addresses EHR use to monitor and identify safety concerns before patients are harmed. This ultimate use of technology was reflected in only one interview. The participant noted the difficulty in reporting quality measures before EHR implementation and the potential advantages of an EHR-enabled healthcare system.

‘If everybody is using the same system, they have the same functionality available to them. There is only a limited amount of ways that you can record information from reporting and performance indicator and assessment sort of point of view. We often have difficulty meeting certain targets, because we don't have a way of reporting it. It's a real struggle. But, at least if everybody has the same struggle then you are comparable to everybody else and there aren't these gaps. You are more easily able to make a comparison across organizations. I think that's an advantage.’

Manager, Site M

Sociotechnical model: system measurement and monitoring

Discussion

IT and EHR could potentially have large quality and safety benefits. However, there is increasing acknowledgement that the use of EHR could introduce unintended risks, and simultaneous efforts are needed to establish safe EHR design and implementation.¹⁴ As with other patient safety issues, a piecemeal, reactive approach to identifying and correcting EHR-related safety issues is unlikely to be efficient or effective. Systematic analysis of EHR-related safety concerns must be performed within a context that accounts for the evolving sociotechnical infrastructure and functionality that defines the journey to a safe EHR-enabled healthcare system. In this analysis from the evaluation of the NHS's implementation of EHR, we attempted to demonstrate the ‘real-world’ usefulness of analyzing spontaneously reported safety concerns through two operational models related to HIT: an eight-dimension sociotechnical model and a three-phase EHR safety model. A sociotechnical approach may allow developers, IT managers, administrators, clinicians, and others to understand risks in the development, implementation, and use of EHR and HIT while accounting for complex interactions of technology within the healthcare system. Further application of these models may be helpful as government bodies make HIT safety a greater priority within clinical environments.³³

The three-phase model was useful to understand the context of safety risks given that our sites were still early in their EHR implementation journey, and therefore both phases one and two were sufficiently represented. Unfortunately, we were unable to identify many activities within phase three of the model. Furthermore, the eight-dimension model was found to have face validity to understand and classify EHR-related safety concerns within the technical, social, or clinical context in which they occur. Applications of such models could be useful to inform or prioritize implementation efforts. For example, we found, as anticipated, that phase one safety concerns arose most commonly in the hardware and software domains of the sociotechnical model. Therefore, organizations should ensure that proper hardware requirements are in place before EHR implementation (eg, adequate number of workstations, appropriate data center). Phase two concerns were frequently mapped to clinical content and workflow and communication. Phase two priorities could therefore involve understanding and changing the clinical workflow or the EHR configuration to facilitate safe care. Organizational and leadership factors are commonly recognized as important for success,³⁴ but we suggest that understanding the local culture, workflow, and potential impact on productivity is equally necessary.^{31 35} Our combined model also suggests that as an organization evolves, both patient safety improvement activities and patient safety hazards also evolve from concerns about safe functionality and ensuring safe and appropriate use, to using the EHR itself to provide ongoing surveillance and monitoring of patient safety. Further exploration of this evolution could inform sociotechnical approaches to improving safety in future large-scale EHR implementations.

The strengths of this qualitative analysis include the large scale of the EHR implementation and evaluation involving simultaneous interviews. Other qualitative investigations have analyzed EHR implementations, but primarily focused on barriers to implementation, system-wide challenges, or overall benefits and concerns rather than patient safety.^35–39 Our high-level approach differs from that of other classification systems, notably that of Magrabi and colleagues,^{40 41} which includes both technical and human elements.⁴² For instance, the human elements it encompasses are generally related to the direct use of the computer, and to actions closely linked in time to the error at hand. By contrast, the model used in this paper encompasses a broader range of sociotechnical factors (eg, workflow and organizational factors) that are more temporally dissociated. Each approach might have its own advantages and limitations depending on what type of data is available for analysis, the depth and breadth of available data, and the rationale of why the analysis was undertaken.

We also build on previous work demonstrating the use of sociotechnical models. For instance, in our previous work, we found this sociotechnical model applicable in specific clinical contexts (eg, test results and referral communication),^43–48 but until this analysis, a formal model to study patient safety issues with EHR implementation was lacking (including within the previous body of work done by the UK investigators). Our sociotechnical model was adapted by the Institute of Medicine in their report on HIT safety albeit without the detailed technology dimensions that we believe are essential to appreciate the nuances involved with EHR use.¹⁴

To our knowledge, there are few if any practical models that are specific to HIT that provide guidance in this area. The combination of the sociotechnical model with the three-phase model allows us to view EHR safety from a systems engineering perspective. Through this lens, interaction of the two models is considered from four fundamental perspectives of complex systems: scale (quantitative size); function (the reason for existence); structure (the interconnection of system elements); and temporality (scales of time).⁴⁹ In our combined model (figure 1), the phases differ in their ‘sociotechnical’ scale, function, structure, and temporality. Within each phase, the eight-dimensional sociotechnical model can be used to understand unique safety issues. For instance, a phase one software problem may encompass a single function such as inappropriate matching of blood products due to a software coding or content error. While in phase three, errors in blood typing would be identified in real time through an organization-wide monitoring program that alerts clinicians whenever the blood type of a patient has ‘changed’. In other words, in phase one, we view the sociotechnical scale of the problem to be much more isolated and contained, while in the latter phases, the scale increases significantly: including users and the physical environment in phase two and, potentially, the entire organization in phase three.

Another example is the different skills and roles of people involved in phase one who are responsible for configuring the hardware (eg, moving database servers to a physically secure location) and software (eg, setting up encryption keys on the periodic back-up systems) to ensure patient confidentiality. While in phase three, people ensuring patient safety would probably include informaticians developing surveillance and monitoring capabilities to identify potential breaches of patient confidentiality or health information management and human resource professionals to investigate these potential breaches and enforce policies to protect health information.^{50 51}

The limitations of this study include the interview protocol's lack of specificity to patient safety issues and the inability to assess impact on patient safety. The interviewers broadly focused on EHR implementation and did not intentionally seek detailed responses about patient safety. While safety concerns arose in several interviews, the interviews did not necessarily elicit the full range of potential EHR-related safety concerns. Although the concerns of those involved during implementation appeared appropriate, no additional effort was made to validate these concerns. As this was a secondary analysis of previously collected data, interview data regarding safety potentially could have been overlooked during the initial review by the original UK investigators because the data collection did not anticipate this use. The case study design may have reduced the generalizability of the findings, but despite different EHR software, cultures, and methods of healthcare delivery, we believe the usefulness of our analysis is the potential ability of the two models to identify EHR-related safety concerns and priorities to address them.

Conclusion

Examining the intersection of HIT and patient safety with practical conceptual models can advance the EHR-enabled healthcare system towards the goal of improving patient safety. ‘Safe technology’ and ‘safe use of technology’ are necessary for efforts to improve and monitor patient safety; for example, phase three of the EHR-enabled healthcare system. We demonstrated how the combined use of two models has face validity to facilitate understanding of the sociotechnical aspects of safe EHR implementation and the complex interactions of technology within the evolving healthcare system. Our sociotechnical approach, along with other existing frameworks, may be beneficial to help stakeholders understand, synthesize, and anticipate risks within the continuum of HIT safety that includes safe transition from paper to integrated EHR.