Learning for safety in health care and air traffic control

Introduction Risk management in enterprises, organisations and companies has had a long and complicated history. During the eighties, and at least during the beginning of the nineties, the notion concerning risk management was that if an accident happened in an otherwise perfect system it was due to the human operator in some way being the cause of the error. The cause for the accidents was described in terms of “negligence”, “lack of competence” and such similar statements. Gradually, during the late nineties, the risk management paradigm shifted. James Reason, a psychologist, made a tremendous impact with his book Human error, published in 1990. He introduced the term latent failures (or latent conditions). These, he said, are “resident pathogens”, built into the system. They are latent since the system can live with these pathogens for months and even years, and perform adequately, until something happens, which hampers the “immune system of the system”. Reason states that the human operator goes to work everyday with the intention of doing a good job. The human operator has no wish “to screw up things”. When accidents happen, and operators make mistakes, it is therefore not a deliberate action. The causes should be sought in design flaws in the system. In this thesis we are dealing with high-risk systems, though not high-risk technologies. We are studying acute somatic health care, air traffic control, pharmacy and cancer treatment. We will explore different ways for an organisation to receive feedback from safety related occurrences, in order to improve safety. The aim with this thesis will be to explore methods for obtaining safety feedback in the above mentioned domains. Four different approaches will be attempted: • Retrospective learning from accidents (paper I) • Proactive learning using an external agent (paper II) • Operator centred learning (paper III) • User centred proactive learning (paper IV) Methods and material Methods In paper I we used MTO (Man-Technique-Organisation) analysis as described by the nuclear power operators in Sweden, with a certain adaptation for health care. Paper II was inspired on the work with paper I. During the numerous interviews with doctors and nurses a quite common reaction was: “Why did we not think of these risks before? It is so obvious!” Another concern was the limited value of retrospective investigations when it comes to improving safety. This started us on designing a method for proactive risk analysis. Several methods were already described for this, but they were mainly tuned to technical systems with more or less tight coupling, assuming a high degree of linearity (as for instance the Failure Mode and Effect Analysis, FMEA). We felt these methods did not fit the way in which our studied organisations functioned. The result was the DEB (Disturbance- Effect-Barrier) analysis used in paper II. The identified system weaknesses by using this method was compared to system weaknesses extracted from the analysis (done by headquarter analysts) of 15 loss of separation incidents at the unit. When working with this it became obvious that one category of incidents, i.e. the loss of separation incidents (AIRPROX) , was only the tip of the iceberg. Each day there were a number of near misses that did not result in loss of separation, and therefore not used for safety feedback. Talking to the controllers also revealed a hidden knowledge on questionable procedures that might constitute risks. Thus the idea was fairly simple: Why not let the controllers do the job of analysing safety occurrences? This led to the design of a method for operator-centred learning, i.e. paper III. The method included a brief to the controllers for 1½ days on system thinking. The starting point for paper IV was particularly tragic. I investigated a case where an eight-year-old girl with cancer was killed by mistake. She was administered the total dose of cytotoxic agents each day for three days, i.e. a 300% overdose. We used the DEB analysis again, for a proactive risk analysis of the process of treating patients with cytotoxic drugs, but this time using a formalised user group. Material The material for paper I was a consecutive series of eight reports to the National Board of Health and Welfare, from acute somatic health care. The material for paper II was a DEB analysis performed for the processes at the Malmoe air traffic control unit in Sweden. In paper III a trial was performed for half a year with extended reporting of learning occurrences. In this way an additional 45 occurrences were reported which otherwise would not have been documented and analysed. In paper IV the DEB analysis were performed at one ward unit at the department of oncology at the Lund University hospital, taking into consideration interface problems between the ward unit and the hospital pharmacy (which prepared the cytotoxic infusions). Results In paper I we could demonstrate that the notion of latent conditions was fruitful for analysing and learning from medical accidents. We identified a number of system weaknesses in seven out of eight cases, providing a good potential for improving safety. In paper II we identified a number of risks (latent conditions) in the air traffic control system. We compared the identified system weaknesses with 15 loss of separation cases, investigated by the regulator. We identified all system weaknesses from 14 out of 15 as loss of separation analyses. In paper III we could demonstrate that the operators indeed were able to analyse “learning occurrences”, and to identify preventive actions, one of these being training on the aircraft flight management system for controllers. Also, they could show that quite a few number of “unexpected flight behaviours” actually were actually partly caused by air traffic control actions. In paper IV we refined the DEB analysis by using a formalised reference group of staff from the very beginning.. The analysis disclosed a number of system weaknesses, which were presented for the staff. The disclosed risks were accepted as valid, and quite a few of our recommendations were implemented during the next couple of years Discussion We discuss our methods in relation to current research, particularly we discuss MTO analysis in relation to root cause analysis, and DEB analysis in relation to FMEA. We are critical to both. We find that both methods could benefit from using the notion of latent conditions, and even applying the concept and vocabulary from the ISO 9000 quality management standard when describing risks. We discuss the learning potential of retrospective vs. proactive analysis and are in favour of proactive methods. We introduce complexity theory and relate this to our results. Our conclusion is that the operator-centred approach (paper III) seems to be the most effective way of influencing a complex system in a desirable manner, concerning self-organising and emergent properties