Systems-based models for investigating patient safety incidents

Learning objectives.

By reading this article you should be able to:

• •Discuss the properties of complex systems and a systems approach to incident investigation.
• •Describe the differences between reactive and proactive safety approaches.
• •Describe some of the system-focused models applied to patient safety incident investigations.

Key points.

• •Healthcare has properties of a complex system.
• •A systems approach to investigation considers how a system's structure influences behaviour.
• •A system's resilience is contributed to by people's ability to adjust to varying conditions.

Patient safety incidents are events where a patient experienced or could have experienced harm during an encounter with healthcare. The aim of investigating an incident is to learn from it by identifying contributory factors. An investigation also seeks to understand the interactions between these factors and how they give rise to either safe or unsafe care. Patient safety investigations have historically focused on solutions at the end of a perceived linear ‘chain of events’ with little attention applied to the background of the incident.

Healthcare has, in its recent history, been encouraged to learn from safety-critical industries such as transport. This has led to modified tools and procedures from these sectors being transposed into different areas of healthcare with variable effects on improving safety.¹ One approach, imported from the aviation industry, stemmed from a report released by the US Institute of Medicine, called To Err is Human: Building a Safer Health System.² This report recommended a nationwide mandatory public reporting system for incidents. A range of such incident reporting tools now exist internationally. However, recently it has been argued that there has been too much focus on reporting rather than high-quality analysis of the incident itself.¹

Studies of accidents in safety-critical industries have led to the development of incident investigation tools focusing on a broader understanding of accident causation with less focus on individual error and more on organisational and wider system factors. One such tool, now widely used in healthcare, is root cause analysis (RCA), which originated in the engineering industry. However, there have been criticisms of the technique and how it is implemented at a local level despite its intentions to look at the wider system and not just individual actions.³ Critics suggest that system components are studied in isolation and the importance of their interactions and dependencies with other components is not appreciated.⁴ Kellogg and colleagues⁵ reviewed 302 RCAs and found that despite repeated RCAs into several event types the same events recurred multiple times. Another concern is that most RCAs propose behaviour-focused solutions such as training and policy reinforcement. System-focused solutions involving interactions between people and technology and underlying design-related factors are rarely considered.^5,6

Incorporating a system focus in national healthcare services

On 1 April 2017, the Healthcare Safety Investigation Branch (HSIB) became operational. Its remit is to conduct independent investigations of patient safety concerns in NHS-funded care across England. It is the first organisation of its type in the world. The investigations are learning- and system-focused and do not look to apportion blame or liability. In its National Investigation Programme, investigations are selected based on their potential to interrogate different levels of the healthcare system and their impact on patients and services.

In March 2020, NHS England/Improvement in the UK, as part of its new patient safety strategy, published a new patient safety incident response framework (PSIRF).⁷ It describes a broader systems approach to local incident management moving away from ‘root cause analysis’ focused on person-based factors.⁷

In January 2020, the UK Academy of Medical Royal Colleges published the first iteration of a national patient safety syllabus to guide the training of all NHS staff.⁸ Its learning outcomes include ‘understanding the systems-based approach to investigating patient safety incidents’.

The ‘systems approach’ to safety management

Safety management encompasses the practices that direct, monitor and intervene in operations for the purpose of minimising the risks to patient safety. Incident analysis is just one aspect of a wider safety management system.

Safety-critical sectors such as aviation have very low accident rates and advocate a systems approach to safety management.⁹ A systems approach argues that it is unexpected system interactions rather than individuals that are responsible for accidents and safety improvement cannot be achieved simply through more individual training.¹⁰ Following on from that, a systems-approach advocates that interventions for improvement should be focused on better design and system interactions. These should occur alongside person-based interventions such as re-training and local policies which are believed to be less effective for longstanding change and improvement¹¹ (Fig. 1).

Fig 1.

The hierarchy of effectiveness. This diagram depicts the effectiveness of various strategies for modifying behaviour. The framework deems person-based approaches less effective than ones targeted at the system level. Although culture change may have the most long-lasting effect, it is the most difficult to implement. A forcing function is an aspect of a design that prevents an unintended or undesirable action from being performed or allows its performance only if another specific action is performed first (e.g. special Luer-lock syringes that only connect to specific spinal needles). Adapted with permission from ISMP Canada: https://www.ismp-canada.org/download/ocil/ISMPCONCIL2013-4_EffectiveRecommendations.pdf.

Healthcare is a complex system

Healthcare has been described as having the characteristics of a complex system (Table 1). A complex system is a collection of individual agents (patients, staff, departments) that undertake work that cannot be fully specified or prescribed in advance. These agents' actions are interconnected so that one agent's actions change the context for other agents in the system. Within these complex systems are interactions between people, technologies, environments and external factors. Different systems interact with other systems with different properties, characteristics and healthcare delivery goals, for example an operating theatre and ICU working together during a patient's perioperative care.

Table 1.

Properties of complex systems relevant to healthcare

Property	Description
Poorly defined boundaries with other systems	Other hospitals, ambulance trusts, community services influence the functioning of an individual hospital. Healthcare is an open system in which external agents (regulators, media, social care policy, weather, pandemics) can influence its functioning.
Membership can change and members can have membership of more than one system	Within anaesthesia and intensive care this is apparent with rotational and temporary staff, unfamiliar anaesthetists working across different external teams and potentially at very short notice (interventional radiology, endoscopy).
Dispersed and decentralised control	Decisions are made constantly by individual agents. An ICU may have different protocols and policies to the rest of a hospital for certain circumstances or conditions (e.g. cardiac arrest, medication practices). Clinicians have autonomy to deviate from policy to accommodate patient complexity and uncertainty.

These interactions can unpredictably affect the system's capacity, resources and demand, requiring it to adapt to maintain performance. This may be achieved through unplanned workarounds or trade-offs. A workaround or trade-off is a deviation from an intended work process or policy, which is used to overcome an obstacle in order to meet demands, for example not double-checking a medication before it is given. This particular example trades efficiency over thoroughness when throughput and output are the dominant concerns. A workaround may also be necessary to overcome poor design or availability of equipment.

A systems approach during an investigation allows an opportunity to understand the role of the system in influencing frontline healthcare workers behaviours. Dekker and Leveson¹² highlight however that a systems approach should not be misunderstood as blaming the system rather than holding people accountable; neither is it removing their autonomy and creating more policies, rules and checklists within the system. Despite the assertions of the benefits of system-based interventions, it has been difficult to evaluate their impact by the traditional measures that assume a linear relationship between processes and outcomes.¹¹

Human factors and systems engineering

Work system design for patient safety: human factors and systems engineering

Models have emerged to incorporate the science of human factors and ergonomics (HFE) to understand how humans interact with the complex systems in which they work, referred to as work systems. A work system is a system in which humans or machines perform processes or activities using information and technology. Ergonomics and human factors is the scientific discipline concerned with the understanding of interactions among humans and other elements of a system, and the profession that applies theory, principles, data and methods to design in order to understand human well-being and overall system performance.¹³

The systems engineering initiative for patient safety (SEIPS) model illustrates that patient safety risks may develop from several work system factors and the interactions between them.¹⁴ These interactions affect the processes (admission to the ICU, flow in and out of the postoperative care unit) required to deliver safe care. This influence on the processes can produce different outcomes, which can be patient-, staff-, organisation-related (medication safety, staff well-being, organisational reputation).

Fig. 2 shows an example of work system elements, processes and outcomes applied to analysing an incident involving insertion of a central venous catheter. Insertion of a central venous catheter is a task that is affected by numerous work system factors and necessary during the process of admitting a patient to the ICU for the management of septic shock. Application of the SEIPS model to the work system in which the incident occurred allows investigators to visualise the numerous interactions that occur which impact the process and outcomes. This allows for an analysis of the work system factors that may have contributed to the incident occurring, thus allowing for a structured approach to developing the terms of reference and scope of an investigation.

Fig 2.

SEIPS 2.0 applied to the ICU work system after an incident involving a retained central venous catheter guidewire. SEIPS 2.0 can be applied to determine work system factors that may have influenced an incident occurring.¹⁵ Each work system elements contains factors that are thought to be relevant to the incident occurring. The diagram depicts that all factors interact with each other. Specific elements have a direct interaction and may be ones to focus on during an investigation, example interactions are depicted by dashed green lines. The feedback loops indicate that changes in the work system can occur as healthcare organisations collect, analyse, and use process and outcome data. CVC, central venous catheter.

In the graphical representation of SEIPS, the person is deliberately placed at the centre of the work system, emphasising that design should support people (healthcare worker or patient) and that their performance is affected by interactions between the other work system factors. In terms of incident investigation, SEIPS provides a framework for analysing a particular work system and understanding the emergence of patient safety issues within it. The model has been applied to a number of relevant areas of healthcare including the implementation of electronic health records in ICU.¹⁵

Defining safety

Reactive safety (Safety-I)

Patient safety approaches have in the past assumed that linear cause-effect chains can explain incidents.³ They have also assumed that incidents will always have a cause that can be found and that these causes are noticeably different from those actions that allow the achievement of successful incident-free care. This is the basis of the Safety-I approach to safety management which tends to be reactive to incidents.¹⁶ Accidents and near misses are believed to be the result of deviations from prescribed work, and therefore remedies traditionally focus on increasing compliance and training. However, as already described healthcare is complex and unpredictable and the problems that occur within it cannot be deconstructed into a linear causal chain. There will, however, be instances where the incident complexity and context may allow for linear ‘cause and effect’ thinking.

Non-linear approaches to safety question several assumptions made by the Safety-I approach. These assumptions include:

• •Systems can be easily divided into meaningful elements or activities.
• •Events occur in a predictable and predetermined sequence.
• •Incidents occur in a logical and understandable way.

Resilience engineering and proactive safety (Safety-II)

The performance and the work within complex systems both vary. Although variability can be thought of as a weakness, contemporary safety models see it as a strength and as the primary reason why complex systems function well despite external pressure. Resilience engineering (RE) is a perspective on safety in complex systems that emphasises how outcomes emerge from the complexity of the clinical environment. Complexity creates the need for flexible adaptation by humans to achieve outcomes in the face of expected and unexpected conditions.¹⁷ RE focuses on understanding the nature of adaptations, learning from success and increasing adaptive capacity.¹⁸ Indeed, a study using RE principles to examine emergency department escalation policies intended to deal with increased demand, found the policies to be inadequate.¹⁹ It was discovered that escalation processes were adapted to manage pressures informally. This adaptive capacity (work as done) was found to be incompletely specified in policies (work as prescribed/imagined).

RE has, particularly in healthcare, come to be known as Safety-II. The Safety-II approach to safety management is proactive and bases its definition of safety on what normally goes right to prevent incidents from occurring. The approach argues that safety exists in the absence of incidents, so the system should be examined at these times to see how it prevents these from occurring. A Safety-II approach sees human performance variability as the reason things go right most of the time and focuses on work-as-done in its study of safety. Humans are seen as an essential resource required for flexibility and resilience.

Work-as-imagined and work-as-done

Approaches to analysing the work of humans attempt to discriminate between the assumptions that people have about how work should be done and the observations and descriptions of how work is actually done.²⁰ Work is imagined by a variety of stakeholders in healthcare including policy makers, regulators, patients and frontline clinicians. It affects the way we expect things to be done and how particularly as anaesthetists and intensivists we integrate into teams who regularly work together without us.

Work-as-imagined (WAI) describes what should happen under normal or ideal working conditions but it does not consider how performance must be adjusted to compensate for the changes in working conditions. This inconsistency is not always considered when developing guidelines, policies or work processes (work-as-prescribed) and can lead to inefficiency, misunderstanding and conflict.²¹

Work-as-done (WAD) describes what actually happens and how it is influenced by the complex system within which it occurs. It describes how clinicians make continuous small and large changes to their daily work to satisfy the needs of patient care and efficiency. To maintain efficiency, workarounds may be used. These may include avoiding basic tasks perceived to have low value, skipping middle steps in guidelines or escalating care through non-standard processes.

Moppett and Shorrock discuss how thinking about the different types of work can be used when approaching the problem of wrong-sided regional anaesthetic blocks.²¹ They highlight that WAI and work-as-prescribed (the formalisation of work-as-imagined in procedures) does not account for variations in human behaviour when designing the stop-before-you-block initiative. These stop moments rely on an independent second check. The WAI includes a fully engaged assistant who has the confidence, authority and engagement to stop the process and does not consider distractions.

The discrepancy between WAI and WAD highlights the necessity to observe how work is performed on ‘the shop floor’ to ensure that recommendations are relevant and appropriately designed.

Functional resonance analysis method

The functional resonance analysis method (FRAM) is a method to explore complex systems and has been used to analyse incidents in many domains.²² FRAM has been applied to healthcare including understanding the variations in the process of sepsis management in different settings.^23,24

FRAM depicts a system as a number of functions – a function being something the system does in everyday work to achieve an outcome, for example refer to neurosurgical centre leads to decision to operate. The method looks at each function and examines its potential variability in everyday work and unexpected circumstances and helps to describe work-as-done. Variability here might include neurosurgeon occupied in the operating theatre or decision requires more senior input. FRAM provides an opportunity to highlight where control or dampening of variability can be implemented so the system remains predictable and within the boundaries of safe performance.

FRAM allows the examination of how one function may affect the other without the need to describe a strict direct-cause relationship. The relationships and interactions of the functions are studied in terms of six aspects (see Supplementary Table 1). The characterisation of these aspects helps define the potential variability of functions and how the functions relate to each other.

Using FRAM to analyse an incident

A FRAM analysis does not attempt to find a cause for an incident but attempts to describe what should happen for the work to succeed.²⁵ Once this is described, the investigator can start to look at how the variability of different functions can combine to explain the incident. By doing this, the system's potential interdependencies is described as opposed to depicting a sequence of individual steps as would be done in a linear model. FRAM can also be used for a proactive analysis of a system to see how potential variability creates risks and judge if a system is fit for purpose.

The FRAM method is used to compile a model of the interactions and dependencies between system functions being studied. Supplementary Fig. 1 shows an example of a FRAM model.

A key part of FRAM is describing the type of variability relevant to a function. Functions can be divided into three broad categories: human, technological or organisational (Table 2).

Table 2.

Describing variability of functions in FRAM. Each type of function can be affected by Endogenous (internal) and Exogenous (external) variability²⁶

Type of function	Description	Endogenous variability	Exogenous variability
Human	Carried out by individuals or small groups. Variability is often of high frequency and amplitude. High amplitude can lead to positive and negative outcomes.	Physiological and psychological factors such as fatigue and stress. These may be induced by workload or different working practices.	Social factors such as peer pressure, social norms and expectations. Other factors such as public expectation, and standards. Commercial and political considerations can affect human function.
Technological	Equipment and devices. Technological functions are assumed to be stable and reliable most of the time but it is appreciated they can be variable.	Inner workings are complicated and there is inevitable component degradation.	Inappropriate maintenance and inappropriate working conditions.
Organisational	Organisational functions are performed by groups with defined work activities. Organisational variability is thought to be of low frequency but high amplitude when it does happen. This is thought to be that that organisational functions are mostly systemic.	Organisational functions are affected by reasons such as communication, authority gradient and culture.	Environmental factors: regulation, public requirements, financial pressure, weather, politics.

Healthcare Safety Investigation Branch

Both SEIPS and FRAM are models that have been used by HSIB to investigate patient safety incidents. An initial scoping investigation into the local circumstances of the incident is carried out before broadening the investigation nationally to ascertain the scale of the issue and how the healthcare system interacts at different levels in relation to the type of incident investigated. A system-based investigation analyses the numerous levels of influence in healthcare such as government policy, regulation, commissioning, local-level management and infrastructure, frontline care providers and the patient perspective. HSIB also undertakes a maternity investigation programme, which has specific criteria on which it bases its decision to investigate.

Observational work across the country is a core part of the national investigation process of the HSIB. This is a way of understanding the trade-offs people apply in order to resolve goal conflicts and to cope with the complexity of the system and the uncertainty of the environment. Investigators work closely with expert subject matter advisors who help with understanding work system behaviour and work-as-done from people who are part of the system but removed from the incident itself. At the end of an investigation, system-level recommendations are made to regulators, government departments and professional bodies.

Both Norway and South Korea have also established national independent bodies for healthcare safety investigation. These are the Norwegian Healthcare Investigation Board (UKOM) and the Patient Safety Headquarters, Korea Institute for Healthcare Accreditation respectively.^26,27

What can be done at a local level?

An individual hospital or department does not have the resources or powers to make national system-level recommendations. However, within its new PSIRF, NHS England and NHS Improvement, in March 2020, published its national standards for patient safety incident investigation (PSII) in which it advocates ‘strong/effective systems-based improvements to prevent or significantly reduce the risk of a repeat incident’.²⁸ The document also recommends a selective approach to PSIIs. This selection will be based on risk and learning potential and not on a particular incident severity outcome. No particular patient safety investigation method has been advocated; however, it promotes ‘analysis techniques that facilitate a systems approach’ and a methodology that ‘identifies system strengths as well as problems’. The approaches and methods described above are all grounded in these core principles and potentially may form the basis of local patient safety incident responses.

Acknowledgements

The authors thank Dr Laura Pickup for her input into the FRAM section of this article.

Biographies

Paul Sampson FRCA is a specialty registrar in anaesthesia at University Hospitals Plymouth and spent a year as a clinical fellow with the Healthcare Safety Investigation Branch.

Jonathan Back PhD is an intelligence analyst with the Healthcare Safety Investigation Branch. He has a background in safety science and systems thinking in healthcare.

Stephen Drage FRCA FFICM DipICM (UK) MSc is a consultant in anaesthesia and intensive care medicine at Brighton and Sussex University Hospitals NHS Trust. He is also director of investigations at the Healthcare Safety Investigation Branch.

Matrix codes: 1I01, 2C07, 3J00

Declarations of interest

At the time of writing, all three authors were employed by the Healthcare Safety Investigation Branch.

MCQs

The associated MCQs (to support CME/CPD activity) will be accessible at www.bjaed.org/cme/home by subscribers to BJA Education.

Supplementary material

The following are the Supplementary data to this article:

figS1.