How can the HRT and NAT frames contribute to a fresh look at five popular and promising patient safety practices? We will examine each of these practices in turn, as summarized in .
Conducting double checks, in which one provider reviews and signs off on another's task, is a form of social redundancy that is pervasive in nursing (e.g., Cohen, Kilo 1999
; Griffin 2003
) and pharmacy (e.g., Cohen et al. 1996
) and is required in particular situations by the Joint Commission on Accreditation of Healthcare Organizations (JCAHO). Despite the widespread practice of nurses double-checking medications, it has not been widely studied in hospitals (ISMP 2004
). Double-checking requires that one fallible person monitor the work of another imperfect person. Because people tend to hear what they expect to hear and see what they expect to see, effectiveness is reduced (e.g., Reason 1990
; ISMP 2003
). Applying the HRT and NAT frames calls attention to the social and organizational implications of double-checking.
From a HRT perspective, when two professionals double-check a hazardous medication, they embody three key attributes of a HRO: (1) redundancy, (2) adherence to patient safety norms embedded in a culture of reliability, and (3) use of formal procedures that reinforce culturally expected behavior. Despite the Institute for Safe Medication Practices (ISMP) norms for double-checking high-hazard medications, one survey reports that such norms were routinely followed in only 45 percent of the hospitals (Smetzer et al. 2003
). Furthermore, HRO proponents are aware of the limits of relying solely on prevention as a means of averting harm (Weick and Sutcliffe 2001
). Over-reliance on double-checking can actually reduce mindfulness of safety risks. For example, if a hospital is not selective in its medication double-checking requirements (ISMP 2004
), providers may consider the pervasive requirement to be a “superficial routine task” and not check independently (ISMP 2003
The NAT frame also underscores the limits of redundancy, as embodied in double-checking medications. Even if nurses double-check medications independently, as instructed by ISMP alerts, they both can make the same mistake; both providers may be stymied by equipment or other environmental design flaws, such as a confusing drug label (ISMP 2004
). Furthermore, double-checking, like other backup procedures, can compensate for underlying problems, and thus, delay their discovery and correction (Reason 1997
). For example, if a mistake is detected and corrected during a routine double-check procedure in the hospital pharmacy, it is not classified as an error, and thus, the underlying cause may go unnoticed by pharmacy management (Tamuz, Thomas, and Franchois 2004
NAT researchers argue that social redundancy, such as double-checking, may inadvertently undermine safety protections because of the inherent difficulties of expecting people to act as backups. When people are aware that others are duplicating their efforts, redundancy can diffuse responsibility and lead individuals to overlook safety checks (Snook 2000
; Sagan 2004b
). Instead of conducting an independent double-check, pharmacy “staff learn to rely upon the checker to catch problems” (ISMP 2004
). Alternatively, a pharmacist who trusts the quality of a colleague's work may fail to conduct a thorough, independent double-check because of overconfidence (Smetzer 2005
). Effective duplication can also be subverted by differences in status and responsibility, such as when the nurse who double-checks defers to the nurse with the primary drug administration responsibility.
Crew Resource Management (CRM)
CRM is a form of interpersonal communication training developed for and by commercial airline pilots (e.g., Weiner, Kanki, and Helmreich 1993
; Hamman 2004
), based on group dynamics research (Hackman 1990
), and adapted as teamwork training in simulated operating room settings (Gaba, Maxwell, and DeAnda 1987
; Gaba 1989
; Helmreich and Schaefer 1994
). CRM practices include briefings—in which the person in charge reviews the tasks facing the team and highlights potential threats—and interpersonal communication methods. CRM instructs subordinates on how to raise safety concerns and question the actions of authority figures without challenging their authority. CRM is one of the “proven methods” of teamwork training for health care providers (Kohn, Corrigan, and Donaldson 2000
, p. 149). Hospitals have implemented both briefings and instruction in interpersonal communication (Leonard, Graham, and Bonacum 2004
; McFerran et al. 2005
), however, these vary in thoroughness and depth.
Although teamwork is not considered a key element of HRT, CRM training fits well with the HRO model (e.g., Weick and Sutcliffe 2001
). CRM techniques support “migrating decision making,” in which decision makers defer to the person with the relevant expertise, rather than the one with the highest-ranking authority. Furthermore, CRM can make it easier to identify anomalies and, thus, respond flexibly to an unexpected situation. For instance, a team member is expected to speak up when confronted with a potential threat to patient safety (Sutcliffe, Lewton, and Rosenthal 2004
HRT highlights how reward systems and organizational culture influence the effectiveness of CRM implementation (Musson and Helmreich 2004
). Successful CRM implementation depends on removing disincentives for speaking up. If CRM training consists of “one-shot, day-long classroom lectures” (Musson and Helmreich 2004
, p. 29), it is unlikely to be sufficient to produce cultural change and overcome prevailing norms against speaking up to authority. Effective CRM would have to grow out of or be customized to fit a hospital's cultures.
, the originator of NAT, underscores the broad, societal implications of supporting CRM and other methods designed to improve safety through modifying work group culture. He raises concerns that methods for improving teamwork “ask how we can make risky systems with catastrophic potential more safe” (Perrow 1999a
, p. 379), but fail to raise more fundamental questions about the implications of pursuing efficiency goals in industries with catastrophic potential. Perrow's concerns may be less relevant to hospitals than to other high-hazard organizations because loose coupling among hospital equipment, procedures, and units reduces the potential for catastrophic system accidents.
NAT's emphasis on coupling and interactive complexity draws attention to important structural conditions that may affect CRM effectiveness in hospitals. CRM techniques are likely to prove more effective when systems and procedures are loosely coupled, because team members have time to identify hazards and to intervene before negative consequences occur. In contrast, tightly coupled, time-dependent technologies (e.g., chemical plants, heart-lung machines) provide fewer opportunities for intervention (Perrow 1984
). Therefore, we hypothesize that CRM methods will vary in their effectiveness depending on the degree of coupling that characterizes specific medical, surgical, and emergency response procedures.
Furthermore, under conditions of interactive complexity even if CRM enhanced communication among authority figures and their subordinates, they might still fail to recognize an unsafe situation or identify emerging threats. When practitioners cannot predict all the conditions under which potentially hazardous interactions might occur, they lack access to information that could be critical to collective decision making. Practitioner assessments of a situation may also be obscured by multiple layers of redundant safety measures. For example, in one hospital, the pharmacy computer system frequently generated a flurry of redundant but irrelevant warnings, making it difficult for the pharmacists to notice critical warning messages (Tamuz and Thomas 2006
). Thus, in loosely coupled systems, NAT would view efforts to improve interpersonal communication through CRM as a necessary, but not sufficient condition for improving patient safety.
Computerized Physician Order Entry (CPOE)
Researchers and health policy analysts recommend CPOE implementation as a means of reducing medication errors that lead to adverse drug events (e.g., Aspden et al. 2004
). CPOE eliminates handoffs between physicians, nurses, clerks, and pharmacists and reduces errors because of illegible handwriting, similar sounding drugs, and predictable drug interactions. CPOE can also accurately and efficiently collect data on particular error frequencies and disseminate such drug-related information. (See Kaushal, Shojania, and Bates 2003
for a review.)
HRT and NAT do not directly address CPOE. However, both frames suggest constructive insights. The HRT perspective would highlight CPOE's impact on information flow among decision makers. CPOE can contribute to HRO development by providing clinicians and higher-level managers with accurate data on error frequencies and adverse drug events. A disadvantage of CPOE is that current software and commercial products may not solve and can even complicate data entry, retrieval, and exchange as well as communication among providers (Ash, Berg, and Coiera 2004
; Miller and Sim 2004
; Health Data Management and Schuerenberg 2005
). Thus, implementing CPOE may enhance data access for top managers while hindering communication among clinicians with expertise and first-hand experience.
NAT draws attention to the implications of CPOE for system design. CPOE has the potential to produce fundamental design changes in the medication process; these changes would reduce interactive complexity and tighten coupling between medication ordering and dispensing. CPOE would reduce the potential for unexpected interactions in the medication process by eliminating involvement of some personnel (e.g., clerks who copy and fax the doctors' orders) and equipment (e.g., fax machines). Coupling would tighten because an order change would more directly and rapidly affect drug dispensing; proceeding from the physician's keyboard to the pharmacy computer, with fewer possibilities for people to alter or stop the order.
In practice, however, CPOE systems do not yet conform to designers' expectations. The difficulties that have emerged can be readily understood within the context of NAT. First, according to NAT, system breakdowns can result from an array of different conditions, ranging from simple, recognized component failures to a multiplicity of unanticipated and unpredictable interactions. Second, redundancy in technologies like CPOE not only can enhance safety precautions, but also may undermine them.
To illustrate these two issues, we draw examples from research on an early CPOE system (Koppel et al. 2005
). The researchers found that CPOE eliminated some medication error risks but gave rise to an array of other unanticipated risks. In NAT, some of these errors would be classified as simple component failures, such as the failure of the computer program to cancel a test-related drug order after the physician cancelled the order for the test. Other risks documented in this CPOE system illustrate how instances of interactive complexity can occur even in a relatively linear CPOE system (Perrow 1984
). For example, residents diligently followed the dosing guidelines on the computer screen, but the minimal doses appearing on the screen reflected purchasing procedures for the pharmacy (e.g., purchase as 10 mg tablets) rather than clinical standards (e.g., for effective minimum dosage). Thus, a process designed for use by one component (i.e., pharmacy) interacted in an unexpected way with another (i.e., house staff). From a NAT viewpoint, simple component failures are less troublesome; once identified, they can be corrected. But unanticipated interactions among system components cannot be completely predicted, averted, or designed away.
This CPOE study also illustrates the difficulties of adding redundancy onto an existing organizational system, a recurrent theme in NAT research (e.g., Sagan 2004b
). Some of the problems reported by Koppel and colleagues emerged from the design of the new CPOE technology and its unanticipated interactions with components (e.g., equipment, operators) in the existing medication ordering process (see also Han et al. 2005
). CPOE was added to an existing system in which nurses continued to use handwritten reminders (e.g., to renew antibiotic orders) and attached them to patients' charts. However, because the physicians were entering orders in electronic patient records, they did not notice the nurses' written reminders. This illustrates how adding CPOE to an existing system resulted in unexpected interactions among system components.
One of the advantages of CPOE is that it replaces social redundancy (e.g., nurses checking doctors' orders) with technical redundancy (e.g., computerized error detection). However, for allergy monitoring, “House staff claimed post hoc [allergy] alerts unintentionally encourage house staff to rely on pharmacists for drug-allergy checks, implicitly shifting responsibility to pharmacists” (Koppel et al. 2005
, p.1200). This illustrates how technical redundancy can generate social redundancy and thereby increase the potential for error.
NAT points to a third potential problem with CPOE that has not been widely discussed: the safety trade-offs associated with making technologies more tightly coupled. To reduce routine errors, CPOE tightens the coupling of the medication ordering process. An unanticipated consequence of tighter coupling may be greater risk of infrequent, but potentially widespread and harmful errors. For example, a mistake in a decision rule programmed into the computer has the potential to harm many patients simultaneously.
We support implementation of CPOE but emphasize that NAT sounds an important cautionary note about the trade-offs in implementing tightly coupled systems. We need to better understand the conditions under which hospitals should tighten the coupling between departments and procedures, for example, as a means of reducing multiple, error-prone hand-offs. We also need to specify conditions under which hospitals can allow loose coupling and thereby provide more time to diagnose, respond to, and reverse potentially hazardous situations. Slowing down and decoupling operations can provide time for safe recovery, but at the cost of efficiency.
In hospitals, tight coupling is likely to occur in four types of procedures, which are shown in . Emergency procedures tend to be tightly coupled because they are time-dependent. In technology-driven procedures, such as anesthesiology (Gaba 1989
), tasks are time-dependent and the sequence of tasks cannot be easily changed. Chemical processes are tightly coupled because they are time-dependent, invariant in their sequences, and follow a standard path. Furthermore, tight coupling of these procedures reduces the feasibility of using slack—buffers or redundancies that may mitigate negative outcomes. Finally, automation often further tightens the coupling in technology-based and chemical processes, reducing the availability of alternative paths to implementation and the slack resources necessary for recovery. The risk in automation is that a low-probability error, such as introduction of an incorrect component in a chemical process, can rapidly spread a wave of high consequence errors.
Tight Coupling in Hospital Procedures
Both HRT and NAT stress the importance of learning from errors and near misses. However, the proponents of the two perspectives differ in their assessment of the feasibility of gathering information about these safety-related events and learning from them.
Although HRT does not explicitly promote incident reporting systems as a safety measure, incident reporting systems are consistent with elements of HRT. Incident reporting provides a method for clinicians to relay first-hand data about potential patient safety threats to key decision makers, provided that the clinicians can engage in valid “sensemaking” (i.e., accurately interpret what they observed). In addition, top-level HRO managers could gather and analyze incident data to assess emerging patient safety problems and evaluate existing ones; they could use the incident data to maintain a “big picture” of potential threats to patient safety. HRT advocates (e.g., LaPorte and Consolini 1991
) are optimistic that organizations can create reward systems that support meaningful incident reporting and promote the capacity to learn from errors.
HRT researchers also recognize that when organizations do not fully enact these HRO precepts, they can hinder the gathering and use of incident reporting data. Making sense of errors can be problematic in HROs (Weick and Sutcliffe 2001
); this might be reflected in health care providers' expressions of confusion over what constitutes a medical error (e.g., Wakefield, Wakefield, and Uden-Holman 2000
; Taylor et al. 2004
). Moreover, there are also concerns about the reliability of incident report data, because of the tendency toward underreporting (e.g., Aspden et al. 2004
). Furthermore, hospitals undermine the incentives for incident reporting when they “blame and shame” those who make mistakes (Roberts, Yu, and van Stralen 2004
NAT researchers recognize that incident reporting systems can provide the feedback organizations need to learn from their experience, but they tend to be pessimistic that organizations will succeed in modifying their internal reward systems to promote blame-free incident reporting and learning (Sagan 1994
; Perrow 1999b
). “The social costs of accidents make learning very important; the politics of blame, however, make learning very difficult” (Sagan 1994
, p. 238). High-hazard organizations usually do not create incentives for individuals to report their errors or for departments to share incident data with one another. Despite these difficulties, airlines have developed innovative methods of reducing disincentives for incident reporting. Pilots who self-report incidents are sheltered from company disciplinary measures and full regulatory prosecution (Tamuz 2000
Whereas HRT focuses on the “culture of blame” and NAT on “the politics of blame,” both sets of researchers concur that misguided reward systems discourage incident reporting. Surveys of health care providers suggest that fear, particularly of implicating others (e.g., Taylor et al. 2004
) or of litigation (e.g., Vincent, Stanhope, and Crowley-Murphy 1999
), contributes to underreporting. Similarly, nurses are less likely to disclose their errors if they perceive their unit leader is not open to discussing mistakes (Edmondson 1996
Given the formidable barriers to gathering data within the organization, NAT directs attention beyond the organization's boundaries. The organizational environment provides alternative methods for incident reporting, as well as a source of pressure for internal change. Perrow (1999b
, p. 152) recommends “constant feedback about errors and a system-wide sharing of near misses.” He focuses on gathering data and disseminating information among organizations, not within them. Such industry-level, nonregulatory, interorganizational reporting systems are exemplified by the Aviation Safety Reporting System (ASRS) (Tamuz 2001
) and an ASRS-based transfusion medicine reporting system (Battles et al. 1998
NAT researchers also suggest that agencies in the external environment can exert influence on intractable internal organizational interests. These agencies can create pressures and incentives to adopt safety practices (Perrow 1999b
). For example, JCAHO has created incentives for hospitals to promote incident reporting and adopt patient safety practices (Devers, Pham, and Liu 2004
). Unfortunately, external forces, such as the tort system and professional licensing boards, can also block organizational learning in high-hazard industries when external agents assume that incompetent individuals cause most errors and adverse events (Tasca 1990
). Therefore, NAT highlights the roles of agencies in the external environment in shaping internal incident reporting and patient safety practices.
Root Cause Analysis (RCA)
A RCA is a formal investigation of an adverse event or a potential adverse event (i.e., one in which the patient was not injured but could have suffered harm). RCA programs rely on rational decision-making processes to provide impartial, analytical tools for adverse event analysis. The nuclear power industry developed methods for investigating the root causes of hazardous events (e.g., Perin 2004
). Similar RCA techniques have been adapted to the Veterans Administration hospitals (Bagian et al. 2002
) and disseminated as a model for U.S. hospitals. Specific RCA methods have been devised for U.K. health care settings (Donaldson 2000
) and tailored to analyzing transfusion medicine mishaps (Kaplan et al. 1998
The HRT perspective highlights the potential contributions of RCAs. RCAs can be seen as a forum for “migrating decision making” by providing an opportunity for people with first-hand knowledge of an event to share their expertise with upper-level managers. Developing a culture of reliability and mindfulness would be a necessary condition for holding effective RCAs and also would be consistent with expanding the RCA focus to include potential adverse events, not just patient injuries.
HRT also focuses on communication with top management and within management teams. HRT would lead us to ask what top managers know about the RCA events and about any plans to avert their recurrence. Ideally, in a HRO, information resulting from a RCA would contribute to development of management's “big picture” of the hospital's operations.
NAT highlights how applications of rational problem solving techniques, such as RCA, are affected by decision making under conditions of ambiguity and politics. Political considerations can affect critical choices about: (1) the events to be considered in a RCA, (2) investigation and interpretation of what went wrong, and (3) corrective actions. When decision makers choose events for RCAs, they often do so under conditions of ambiguity (Marcus and Nichols 1999
). In hospitals, it is often unclear whether an adverse event could have been prevented, whether it is a rare aberration or likely to recur, or in the case of a near miss, whether it could have resulted in harm (March, Sproull, and Tamuz 1991
Ambiguity gives managers room for interpretation. They may choose to investigate events that advance their personal or professional interests, whether to engineer a certain success or distract attention from a failure. Alternatively, they may decide not to analyze a threatening event. Furthermore, decision makers may choose to analyze an event because they can devise a solution for it (Carroll 1998
) or because it matches a solution they want to implement (Kingdon 1995
Interpreting the causes of and solutions for an accident can be a highly political process (Tasca 1990
). When alternative solutions conflict, NAT would predict that the choice will migrate to the most influential participants, not necessarily to those with the most expertise. In addition, when a patient is harmed the stakes are high, and clinicians seek to protect “their own.” In one hospital (Franchois 2003
), provider groups protected their own professional interests by choosing solutions in response to a patient injury, and in some cases, implementing their preferred solutions, before
the first RCA meeting was held. RCA participants may also join in producing a “success” that identifies a proximate, simple, and visible cause and thereby avoids in-depth treatment of the issues, like other forms of limited learning in hospitals (Tucker and Edmundson 2003
). Despite its name, an RCA can allow the participants to choose simple fixes, rather than searching for more complicated underlying causes. Thus, the HRT frame highlights potential contributions of an RCA, while the NAT frame illuminates the limitations of implementing an RCA in practice.