NMacLeod

Ambulances lined up outside hospital Emergency Departments (EDs) are a vivid, and politically embarrassing, indication of inadequate capacity in the NHS. Media reports of diktats demanding that hospital CEOs meet performance targets suggest a desire for action, but are the local solutions being implemented to ease the pressure in the best interest of patient safety? The use of ‘safety cases’ in healthcare has received some interest in recent years but the conclusion drawn by, for example, Leberati and her colleagues,[1] was that while they have some potential value they are "fraught with challenge, highlighting the limitations of efforts to transfer safety management practices to healthcare from other sectors". A survey of the literature suggests that there is a danger of conflating ‘safety cases’ with ‘safety management’ or ‘quality’ systems. Part of the problem might be that safety cases are more a concept rather than a methodology: there is no script to follow. In this blog, Norman MacLeod discusses whether the the current crisis in hospital capacity can be explored through the safety case lens. What is a safety case? Safety cases are used to manage complex socio-technical systems. The goal is to provide evidence that the system described by the 'case' is safe. A safety case has three elements. First, we have some top-level, over-arching statements about the system. For example, you might say that a hospital is ‘fit for purpose.’ Another top-level statement might be that the hospital ‘meets the needs of its hinterland.’ While these examples may seem very broad, they aim to capture the essence of why the hospital exists and what its function is. Next, we need corroborating data. The top-level statement is, in effect, a logical proposition and the safety case owner must provide data to prove the proposition to be true. If a statement cannot be proven to be true then the safety case fails and the system must be considered to be unsafe. Finally, we need to declare any inference rules used to provide the data necessary to support the top-level statement. For example, direct performance measures might not be available and we might choose to use surrogates or data derived from extrapolations instead. Both direct evidence and that derived from inference rules must be valid and reliable – that is, they must be shown to measure what they claim to measure and must function consistently across time. A hospital safety case would require, as a minimum, evidence to show that the estate (design and maintenance), resources (equipment and consumables) and staff (numbers, grades, skills mix, recruitment, retention, training, etc.) were appropriate to satisfy the requirements of the top-level statement; in this case that the hospital was fit for purpose. However, the safety case is not static. It must be applicable to the lifecycle of the entity it covers. Which means that it must cope with change. And now we come to the ways hospitals are currently trying to cope with excessive demand. Hospital responses to increased demand The solutions being implemented by hospitals to cope with demand seem to fall into two groups: buffers and lubricants. Buffers are ad hoc capacity where patients can be held prior to moving to the next stage in their care. For example, EDs are creating additional spaces where patients can be held between arriving in an ambulance and entering the ED, or after treatment and being accepted on a ward. Some Trusts have made provision for discharge-ready patients to be moved to local hotels pending community care becoming available. Corridor nursing is an example of buffering. Lubricants include those measures aimed at expediting flow. The Positive Flow philosophy, where patents are force-fed from ED onto wards at fixed intervals, is one example. Discharging surgical patients from recovery rather than a discharge suite is another. A safety case would require changes to the existing system to be tested against the top-level arguments. So, we would need to understand the steady-state condition and then be able to compare the impact of any changes made. We need to assure that the new provisions are equally fit for purpose. Unfortunately, the experience to date suggests not. The creation of buffers is adding to the burden of supervision and increasing the requirement to move patients between stages of treatment. In some cases, inadequate logistical provision means that patients are in spaces with no oxygen supply or call bells. Care is being delivered in spaces where the minimum levels of dignity and privacy cannot be met. Rooms are being used that are difficult to observe and, in one case, had access to an exit allowing a patient to abscond undetected. Meeting the demands of positive flow can require additional beds in rooms or corridors. In one case, a Trust is replicating measures it had already removed because they were deemed unsafe in a previous Care Quality Commission report. Patients are being discharged without appropriate follow-up because the staff involved are untrained in the necessary procedures. It seems, then, that measures taken to solve one problem – capacity – have introduced new risks. Conclusion Applying the safety case concept requires an organisation to answer a simple question: are you configured to function in a safe way? The answer to that question must apply equally to the steady state and to any changes, no matter whether permanent or temporary. In the example of coping with excessive demand, local fixes are being implemented but it is not at all clear that solutions are safe. Perhaps it is time to look again at the safety case concept? Reference Liberati EG, Martin GP, Lamé G, et al. What can Safety Cases offer for patient safety? A multisite case study. BMJ Quality & Safety 2024 Feb 19;33(3):156-165. doi: 10.1136/bmjqs-2023-016042. Further reading on the hub: A silent safety scandal: A nurse’s first-hand account of a corridor nursing shift What is a ‘safety management system’? A blog by Norman MacLeod Can you measure safety? Part 1 - Improving patient safety Errors as clues in the search for safety measures: Measuring safety part 2

The relationship between management and the workforce, in very simplistic terms, can be considered one of reward in return for effort. The contracted effort is communicated through a roster. In organisations that have a continuous operation, blocks of effort are distributed to maintain the flow of output. The organisation of effort, then, is a legitimate function of management.  Norman's previous blog looked at performance variability under normal conditions. In this blog, Norman looks at the impact of physiological states and how management’s organisation of effort degrades decision-making. Fatigue The chart below shows pilot fatigue measured using the Samn-Perelli Scale (S-PS).[1] The S-PS has 7 intervals and a score of 4 indicates the onset of fatigue. The data shows how fatigue increases across the first and second sectors of the day, but, also, that fatigue is significantly higher during night-time operations. A study[2] of urology surgeons using the S-PS, reported that fatigue, as measured pre- and post-operation, increased by 67.95% across the four procedures undertaken in the day. Another study[3] looking at 29 ICU doctors found that the median S-PS score at the start of a day shift was 3 and 4 at the end; however, at the start of a night shift the median was 3 and at the end it was 5. Pilots with less than 6 hours of sleep before a duty started the day with an S-PS score of 4. In a risk assessment of night flights to Queenstown Airport, New Zealand, it was suggested that pilots with an S-PS of 4 or greater should be prohibited from flying.[4] Fatigue affects error rates. The Line Operations Safety Audit (LOSA)[5] shows that crew that slept for 6 hours or less before a duty committed more errors. In a study[6] of crew flying night cargo operations, crew acclimatised to the local day but flying during their local night had an error rate of 13.18/sector. However, crews who were flying at night in a different time zone but operating on their home daytime body clock had an error rate of 5.4 errors/sector. It is well-understood that performance is degraded during the 'window of circadian low' – that phase of the circadian cycle when humans are supposed to be sleeping – but in my previous blog, I made the point that raw error rates are not necessarily the issue, rather it was how errors shape the operation. Fatigue and decision-making The table below shows error outcomes across consecutive flights. An ‘additional risk’ is where, in dealing with the initial error, the crew either committed a subsequent error or the consequence was a ‘Undesired Aircraft State’ (UAS). It is common to see improved performance on the second sector as crew build familiarity but there is a sharp fall-off in performance on the third sector, including a significant increase in the number of mistakes made by crew. Mistakes in this context are errors of decision-making. In short, fatigue affects judgement. We see the same in other domains: in finance, traders make riskier trades when fatigued.[7] This data on fatigue and error points to job design and staff deployment as risk factors. Organisational responses to self-management of fatigue Workers absent themselves from the workplace for a variety of reasons. It could be for genuine ill-health, no-notice personal needs and disaffection (morale). Or it could be personal fatigue management. Again, the control of unplanned absence is a legitimate management activity. Workforce absenteeism places an increased burden on the attending workforce and adds to fatigue. The graph below shows the absence rate for a group of pilots and the percentage of pilots who did not take a single day of unplanned absence in a year. The absence management rules were changed to address the problem. The next graph shows how the duration of absences changed in response to the new policy: Pilot absence episode duration (days) The data suggests that management and workforce exist in a dynamic relationship and management’s attempt to exert control results in a corresponding response. The deployment of the workforce is a legitimate management function, but the way contracted effort is utilised shapes safety. Shift duration and timing induce fatigue and, importantly, fatigue can result in riskier decisions. In the previous blog, decision-making in normal operations was also seen to affect risk. Conclusion In this series of blogs, I have suggested that to understand safety we need to look at the factors that increase risk. Risk is a function of the tension between organisational controls and the need for flexibility that flows from variability in the workplace. Three areas of interest have been suggested: the preparation of staff for work, their control and, finally, their deployment. To understand ‘what goes on here’ we need to better understand the dynamics of these three domains. References Samn SW, Perelli LP. Estimating aircrew fatigue: A technique with application to airlift operations. Brooks Air Force Base. San Antonio, TX. Report No: SAM-TR-82-221, 1982. Petrut B, et al. Mental fatigue evaluation of surgical teams during a regular workday in a high-volume tertiary healthcare center. Urol Int 2020; 104(3-4): 301–308. Bihari S, et al. ICU shift related effects on sleep, fatigue and alertness levels. Occup Med (Lond) 2020; 70(2):107-112. Navigatus Consulting (2017). Queenstown Airport Night Operations Foundation Safety Case. Klinect JR. Line Operations Safety Audit: A Cockpit Observation Methodology for Monitoring Commercial Airline Safety Performance. Unpublished PhD thesis, 2005. University of Texas. Unpublished PhD thesis. University of Texas. MacLeod N. Crew Resource Management Training: A Competence-based Approach for Airline Pilots. CRC Press, 2021. Dickinson DL, Chaudhuri A, Greenaway-McGrevy R. Trading while sleepy? Circadian mismatch and mispricing in a global experimental asset market. Exp Econ 2019; 23:526–553. Further reading from Norman Can you measure safety? Part 1 Errors as clues in the search for safety measures: Measuring safety part 2

In a three-part series of blogs for the hub, Norman Macleod explores how systems behave and how the actions of humans and organisations increase risk.  In part 1 of this blog series, Norman suggested that measuring safety is problematic because the inherent variability in any system is largely invisible. Unfortunately, what we call safety is largely a function of the risks arising from that variability. In this blog, Norman explores how error might offer a pointer to where we might look.  Safety as risk propagation It is common in safety management to talk in terms of hazards. We can identify three classes of hazards: substances or objects that could cause loss or harm; engineered situations where humans engage in activity involving known hazards but under controlled conditions; acts by individuals that inadvertently expose the operation to a hazard (we might call these ‘errors’). Controls are put in place to contain hazards but controls are designed by humans and are fallible. Healthcare is an example of a hazardous condition: things are done to patients that would be illegal if inflicted upon a healthy person. Procedures act as controls in these situations but there is always a tension between work-as-imagined (WAI) and work-as-done (WAD). WAI describes the least-risky solution to a problem that will work in most circumstances (or, at least, those envisaged by the procedure designers), whereas WAD reflects the inherent flexibility needed in the real world. In a study of maritime accidents,[1] it was found that collisions have occurred between ships actively trying to follow the ‘rules of the road.’ Procedures contain affordance spaces, or lacunae, that must be filled by actors applying expertise. Procedures, or rules, form a hierarchy. At the top there are rules about goals: ‘first, do no harm.’ Then there are IF-THEN rules that aid decision-making: IF <symptom> THEN <condition>. The lowest order of rules are task prescriptions: step 1, step 2, step n. As we ascend the hierarchy, actors need more extensive training to cope with the lacunae that invariably exist. Many airlines use a process called the Line Operations Safety Audit (LOSA).[2] Trained observers monitor flight crew under normal flight conditions and log departures from procedures, crew responses and subsequent outcomes. In most cases, 95% of errors are inconsequential: error is very much noise in the system. LOSA can let us see what happens when crew attempt to fill in the gaps in procedures. The observer can tag an error as 'intentional’ (an INC) if certain criteria are met and figures of between 8.8% and 26.4% of INC errors have been seen. However, ‘Intentional’ errors are usually attempts to adapt to local circumstances or to solve problems. These departures from prescribed activity reflect system buffering. The outcome of an error can be categorised in LOSA as ‘inconsequential’, can trigger an additional error or results in an ‘Undesired Aircraft State’ (UAS) if the observer feels that safety has been jeopardised. In one study I looked at UASs arising from INCs versus non-intentional errors. INCs were twice as likely to result in a UAS. I then looked at who committed the error. For INCs, captains accounted for 91.66% of UASs compared with 40.6% when the error was non-intentional. The data suggests that agents actively choose courses of action that contravene procedures to maintain the flow of work but those decisions increase risk. Captains are over-represented in the data because they are the primary decision-makers in the team. Ironically, compliance with procedures is often the starting point for any safety investigation. However, rather than police ‘compliance’, organisations should probably find ways to capture variability and render it as knowledge. What error does To view error simply as failure, however, is to miss the fact that they change the work process in a way that needs to be addressed if safety is to be maintained. This can happen in one of three ways. First, they reduce performance margins. Even slight departures from the optimum aircraft configuration mean that, should a subsequent event occur, the crew have less flexibility to respond. In the flight data shown in the previous blog, an aircraft operating in the outer bands of the distribution is migrating towards the margins of the safe space. Something as commonplace as a change in windspeed or direction could result in a critical outcome. Second, error transfers risk when my action affects others. For example, passengers have been killed when aircraft have flown into turbulence. If a pilot delays or fails to turn on the seat belt sign in time the cabin crew and passengers are exposed to risk because they will not have taken steps to protect themselves (such as sitting down or fastening seat belts). Sometimes, and in contravention of procedures, pilots start the ‘after landing’ checklist early to save time. This usually results in pausing the checklist while air traffic control issues directions to the terminal building. LOSA shows that crew then often forget to finish the checklist and aircraft park with the weather radar still turned on, exposing the ground handlers to a radiation hazard. Finally, separation reduction describes the condition where aircraft are placed in closer proximity to hazardous objects (other aircraft, the ground) than was intended. Again, should something happen, the crew will have less time to react. Error, then, can reveal how the risk profile is shaped by the deliberate actions of crew. What goes on here? This examination of normal work suggests two candidate domains for measures of safety. First, what is the organisation’s understanding of the utility of its control structures (policies and procedures, codes of conduct)? How well-written and comprehensive are the structures? Where are the contradictions and ambiguities that flow from multiple stakeholders in the process of oversight? Second, what is the skills mix of those required to work within the system, recognising the need to cope with the variability inherent in the real world. Does the organisation have a competence model for the different functions in the system? What are the risks associated with substituting staff (bank staff, staff on loan)? Conclusion In this post I have looked how workplace variability shapes risk. I have suggested two key aspects of the structure of an organisation – control and competence – that could be candidates for measuring ‘safety’. In my final blog I want to explore how organisations actively design unsafety into their operations. References Belcher P. ‘A Sociological Interpretation of the COLREGS”. Journal of Navigation, 2002; 55(02): 213-224. Klinect JR, 1st Klinect JR. Line Operations Safety Audit: A Cockpit Observation Methodology for Monitoring Commercial Airline Safety Performance. Unpublished PhD thesis, 2005. University of Texas. Unpublished PhD thesis. University of Texas. Read part one and part three of Norman's blog series.

In a three-part series of blogs for the hub, Norman Macleod explores how systems behave and how the actions of humans and organisations increase risk.  He argues that, to measure safety, we need to understand the creation of risk. In this first blog, Norman looks at the problems of measuring safety, using an example from aviation to illustrate his points. In the final paragraph of his seminal 2005 paper, 'Evaluating the Quality of Medical Care',[1] Donabedian suggests that instead of asking "What is wrong: and how can we make it better?" we should, more often, ask "What goes on here?" The author identifies three areas of enquiry: process, outcomes and structure. He also recognises that care episodes are not discrete: instead, they form chains of events involving multiple actors. The issues raised in the paper apply equally to the problem of measuring safety. Vincent, Burnett and Carthey[2] offer a definition of patient safety as: "The avoidance, prevention and amelioration of adverse outcomes or injuries stemming from the process of healthcare." The authors also suggest that quality deals with the intended results of the healthcare system whereas safety looks at the ways the system can fail to function. Leveson, though, observes that, in engineering, reliability is not the same as safety: and we could substitute quality for reliability.[3] Safety has been described as a "dynamic non-event" (Weick) in that it is "an ongoing condition in which problems are momentarily under control […]".[4] Implicit in this position is that the absence of failure does not mean that an entity is safe. Another view is that safety is the "freedom from [a level of] risk which is not tolerable".[5] These approaches shift the focus from outcomes to the domain of structure and how it shapes processes. This suggests that measures of safety should address the issue of ‘control’ in the workplace. We particularly want to understand the distribution of risk and how it becomes ‘intolerable.’ Understanding ‘What goes on here?’ A patient entering the healthcare system experiences episodes of care, each of which is intended to remediate the patient’s condition in some way. Despite being highly proceduralised, the inherent variability in each patient requires treatment to be adaptive because, in short, no two patients are the same. Equally, the condition of the healthcare worker introduces variability. As a result, there are multiple pathways that can lead to the same safe outcome. The range of different ways an episode can unfold can be described as ‘buffering’: the system has the capacity to cope with variability and still function as intended. Unfortunately, each variation in the delivery of a specific episode carries with it a degree of risk, which is often not apparent unless something goes wrong. Occasionally activity will exceed the system’s buffering capacity. We can hypothesis a point where a process transitions from safe to unsafe: the resources available to restore the process to a safe state have been exhausted. We are particularly interested in how systems behave in these boundary states. Finally, we want to know how a system fails. Is the outcome inconsequential, recoverable but with additional intervention, or catastrophic? A system’s response to failure can be described as its tolerance. These concepts are illustrated using output from an aircraft’s digital flight data recorder (DFDR): Figure 1: Li L. CityU, Hong Kong. Personal communication. The graph depicts an aircraft during the final approach.[6] Approaching the runway, the pilot lifts the nose to stop the rate of descent. Power is reduced, the aircraft settles on the runway and the nose is lowered again. This change in attitude is recorded in flight data as the pitch angle. The graph shows the pitch angle of 300 aircraft during the final mile of the approach to touchdown and then shows the aircraft on the runway and slowing down. The dark blue band shows the central 50% of data points, those closest to the planned approach path, with the outer, lighter bands showing 20% either side (some data is lost in the processing). All these approaches were successful and the data shows the range of solutions to the problem of attitude control on final approach: the buffering. Airline safety management systems are required to track parameters out of tolerance and the chart shows the angle that would trigger a Flight Data Monitoring (FDM) alert. We can see the gap between ‘normal’ and what would trigger a safety alert. Put another way, it shows how close the system is operating to a safety trigger but without knowing it. The graph reveals the ‘what goes on here’ that would normally be invisible. The red line on the graph is the data for a specific flight that did result in an investigation. The outcome was a ‘hard landing’. Hard landings can trigger a mandatory maintenance inspection (lost productivity while the aircraft is being checked), damage to the aircraft structure and even a collapsed undercarriage. These are the outcomes that could arise from the same initial problem. The result, in this case benign, illustrates the tolerance in the system. Conclusion To measure safety we, first, need to understand performance variability (buffering), behaviour at the boundaries (opportunities to recover) and tolerance (how failure propagates). Having said that measures of outcome are not useful indicators of safety, the first problem we face is that safety reflects performance in a space that is not easily open to inspection. If that is the case, then we need to look for surrogates that can reliably stand in for direct measures of safety. In part 2 of this blog, I will look at how error may offer insight into system’s behaviour. I would love to hear your feedback on this blog and how you 'measure safety'. Please add your comments below (you will need to be a hub member and signed into the hub to comment). References Donabedian A. Evaluating the Quality of Medical Care. The Milbank Quarterly 2005; 83 (4):691-729. Vincent C, Burnett S, Carthey J. The Measure and Monitoring of Safety. The Health Foundation Spotlight, 2013. Leveson N. Engineering a Safer World. MIT Press. 2011. DOI: https://doi.org/10.7551/mitpress/8179.001.0001 Weick KE. Organizational culture as a source of high reliability. California Management Review 1987: 29 (2): 112-128. Li L. CityU, Hong Kong. Personal communication. Read part two and part three of Norman's blogs. Further blogs from Norman: What is a ‘safety management system’? Error isn’t a problem – the problem is the word ‘error’

It was recently reported that NHS Finance Directors were ‘incensed’ that the Health Services Safety Investigations Body (HSSIB) should think that they could be working more closely with patient safety chiefs. Whereas medical staff and clinicians represent the sharp end of healthcare delivery, the administrative functions, including finance, are the blunt end. Removed in space and time from the action, it can be hard to see how their behaviour can directly influence workplace outcomes. To understand the issue, Norman MacLeod reflects on how systems behave and the decision-making hierarchy within healthcare organisations. Most discussion of ‘systems’ revolves around assemblages of artefacts: tools, processes, people and spaces. However, the late Jens Rasmussen described a system as a set of nested decision-making processes.[1] Leveson, at MIT, adds that systems are hierarchical, with control being exercised by higher tiers over the lower levels. She adds that control is exercised through communication and feedback.[2] From this perspective, a ‘system’ comprises actors engaged in different types of decision making. The hierarchy of decision making At the lowest level, we have the individual in the workplace. At any moment, our behaviour is directed at a specific goal and our probability of success is shaped by such factors as stress and fatigue, competence, expertise and motivation. Control is represented by direct action and feedback is in the form of observed outcomes. Because of the complexity of work, individuals form teams to get work done and this is the next level in the system. Teams make decisions about allocation of work, priorities, coordinating effort, problem solving. When an individual joins a team they surrender a degree of autonomy: you are no longer a free agent. Control is exercised through briefings, instructions and procedures, and feedback is manifested in behaviour meeting expectations, through raising queries, declaring problems, etc. Teams can be both real and virtual. Real teams are typically those assigned to a task, working in close proximity. Virtual teams comprise agents that collaborate for a specific purpose and are usually remotely located. Virtual teams often work asynchronously: a request is submitted and the response follows after a lag. Virtual teams require additional skills as they typically involve working across organisational boundaries. Individuals and teams are where direct action occurs. The next level in the system is the organisation. At this level, decisions are made in relation to the specific goals the organisation has been set up to achieve and cover configuring assets, allocating resources, command and control. The organisation exercises control over teams and individuals through contracts of employment, codes of conduct, policies, etc. Feedback is typically through audit and compliance, event reporting, tracking of resource utilisation. Of course, the ‘organisation’ is also made up of individuals and teams: the model is recursive. What differentiates each level is the nature of the decisions it makes. The next, and possibly, highest level in the hierarchy are those entities that facilitate the functioning of the system but do not, in themselves, get directly involved. Here we see government departments, regulatory bodies, accrediting bodies. Actors at this level set strategic goals, allocate resources at the macro level and grant permissions. The components outlined here all exist in a broader environment. By convention, the environment describes attributes that exert influence on the actors in the system but is not influenced, in turn, by those actors. For example, the public health profile in a geographic area will shape the strategic goals set for the organisation and will influence the healthcare capabilities that need to be provided in that area. However, the action of an individual healthcare organisation will not necessarily shape the public health profile of its hinterland. Emergence and cross-scale effect So, where do finance directors fit into all of this? Obviously, as actors at the level of the organisation their decisions relate to the allocation of financial resource. As such, they shape decision making by others in the system responsible for spending on specific functions. But we now need to look at some other properties of systems: emergence and cross-scale effect. Emergence describes behaviours that cannot be explained simply based on the functioning of the parts of the system. Cross-scale effects captures how actions at one level in the system can have unintended consequences at another level. If we start with emergence, ‘safety’ is an emergent property at the level of the individual. Only individuals can act in a manner that bolsters safety or, conversely, it is the actions of individuals that create unsafe states. ‘Culture’ is an emergent property at the level of the team, while at the level of the organisation we see morale as a key emergent. Patient safety activities compete for resources in a landscape where other demands can be seen to have a more direct influence on outcomes. In financial terms, patient safety can be seen as a discretionary spend. This attitude to a legitimate demand can shape morale. Cross-scale effects are akin to Reason’s Latent Factors.[3] Their presence is often only revealed when something goes wrong. We can see cross-scale effects at work in the case of staff recruitment. For example, to save money posts are often ‘gapped’: a post is not advertised until after the incumbent has left. While the post remains unfilled, the burden of work is borne by others or simply not done. Where workload is increased, outcomes can include increased fatigue, staff turnover, sickness/absence or risk of error. So, a simple, rational decision at one level can have multiple consequences elsewhere. The example given here – gapping posts – is typically a response to financial constraints. My intention here is not to portray finance directors as villains: they simply have their hands on some powerful levers of control. But their protestations do possibly support the need for a more sophisticated attempt to understand how systems work. References Rasmussen J, Svedung I. Proactive Risk Management in a Dynamic Society. Swedish Rescue Services Agency, Karlstad, Sweden; 2000. Leveson N. Engineering a Safer World. MIT Press; 2012. Reason J. Human Error. Cambridge University Press; 1991. Other blogs from Norman MacLeod: What is a ‘safety management system’? Error isn’t a problem – the problem is the word ‘error’

Healthcare often uses the experience of aviation to set its patient safety agenda, and the benefits of a ‘safety management system’ (SMS) are currently being espoused, possibly because the former chief investigator for HSIB, Keith Conradi, had an aviation background. So, what does an SMS look like and would it be beneficial in healthcare? In this blog, Norman MacLeod discusses aviation's SMS, its many component parts, the four pillars of an SMS, just culture and its role in healthcare. To begin, you need to understand how regulatory change happens in aviation. The International Civil Aviation Organisation (ICAO) sets standards and recommended practices (SARPS), which are designed to ensure the highest practicable degree of uniformity across aviation in several areas, safety being one of them. All signatory UN states are required to incorporate the SARPS into their national regulations or declare a divergence. Typically, States do not like to diverge from ICAO SARPS. The International Air Transport Association (IATA) is the club most airlines belong to. It has it’s own audit process that requires airlines to conduct a comprehensive review every 2 years. The audit is based on the ICAO SARPS. If you don’t do the audit you cannot be in the club, and if you are not in the club you cannot operate into some airports. Possession of a SMS, then, is an ICAO requirement, but is further backed up by the need to satisfy the IATA audit. This need for compliance is a key driver of the SMS concept. The implementation of a SMS ran in parallel with the rollout of quality management in aviation, but also supported the move to ‘performance-based regulation’. Historically, aviation has been very prescriptive in term of oversight. The State Aviation Authorities laid down what was required of an airline and teams of inspectors would periodically visit and check that things were being done according to the rules. But Regulators were themselves becoming increasingly resource-constrained, so the philosophy changed. Airlines would be told the intent of the regulation and how to achieve it and the Regulator would now look at outputs from processes. SMS is an example of performance-based regulation. The transition to a SMS was not trouble-free. Quite often the argument for SMS was framed around cost savings on the part of Authorities. Canada is a case in point, where the savings were made ahead of implementation, and a report by the Auditor General of Canada found that safety was degraded during the transition as staff were cut and no one was tracking progress. The SMS concept is now well-established in aviation, but what is it exactly? In simple terms, it is an organising framework. It is often described as having four pillars: Safety policy. Safety risk management. Safety assurance. Safety promotion. These pillars pulled together existing concepts while adding some new requirements. The safety policy pillar lays out the management’s commitment to safety, sets objectives and defines the methods and processes that will be applied in the organisation. You might expect ‘just culture’ to be included in this pillar. The ‘just culture’ concept originated in the USA as a response to the prevailing punishment culture that characterised how aviation dealt with failure. It was product offered for sale. You could become qualified as a ‘just culture practitioner’ and the original just culture decision tree was trade-marked. However, the benefits of the approach were recognised and adopted by ICAO. The subsequent SARP required airlines to develop just culture policies and it is not uncommon to find that airlines have separate just culture and SMS manuals. Just culture illustrates how SMS has developed piece-meal over time. The safety risk management pillar includes hazard identification and risk management. It could be considered the heart of SMS. It includes safety reporting systems as a means of identifying new hazards and evaluating risk. Again, safety reporting has developed over time. With the advent of complex jet aircraft after the 1939–1945 war, reporting systems were used to track the reliability of technology. Lists of types of failure were published and airlines were required to report any encounters. Over time, aircraft became more reliable and more sophisticated. The former prompted a recognition that the industry needed to track failures in other areas (humans) and, in the case of the latter, the list of technological failures to be reported just got longer and longer. Safety reporting (or, rather, why people do not report) is a complex topic, but what has happened over time is that ‘anonymous, confidential’ reporting has emerged as a possible solution. The safety assurance pillar includes activities that provide analysis and oversight of safety, including periodic safety committee meetings, audits and data analysis. The safety promotions pillar incudes the provision of findings and feedback to bolster safety, reinforce a positive safety culture and generally increase understanding of safety. Airlines struggle with this. Such is the fear of safety information leaking into the public domain, many airlines limit information sharing internally. But there are other problems. ICAO mandates that States must have an accident investigation capability. Equally, the range of events that falls under the remit of the State investigators is laid down. The complexity of a major investigation is such that the time taken for the report to be published is so long that the circumstances relating to that event have probably changed. And, in any case, few people in that airline would feel motivated enough to read the report. Events that fall outside of the scope of the ICAO mandate fall to the airline to investigate, but they often lack the resources or the skills to undertake meaningful investigations, let alone disseminate useful learning points. To conclude, SMS is a concept with many component parts. It will stand or fall based on the quality of those parts. It is not a single solution: it is implemented differently in every airline. Would it add value to patient safety? Probably, in some areas. Is it a coherent solution to the problem of patient safety? Probably not. Further reading on the hub: Why healthcare needs to operate as a safety management system: In conversation with Keith Conradi The involvement of patients and families in a healthcare safety management system: In conversation with Jono Broad Patient Safety Learning – The elephant in the room: Patient safety and Integrated Care Systems Error isn’t a problem – the problem is the word ‘error’: a blog by Norman MacLeod

It has become fashionable to purge the term ‘error’ from the safety narrative. Instead, we would rather talk about the ‘stuff that goes right’. Unfortunately, this view overlooks the fact that we depend on errors to get things right in the first place. We need to distinguish between an error as an outcome and error as feedback, writes Norman MacLeod in this blog for the hub. In an increasingly litigious world, intolerant of failure, error has become inextricable linked with fault and blame. Here, error is considered in hindsight by agents in positions of power or with specific agendas. Something happened and someone must pay. Clichés such as ‘error is natural’ or ‘no one intends to make a mistake’ carry little weight. Unfortunately, this interpretation of ‘error’ feeds into debates in the safety domain but simply rejecting the term misses the point. To understand the importance of error we need to reflect on the nature of the world. Imagine a small pile of sand on a table. As you add more grains of sand, the cone will build, maintaining its shape until, eventually, the next single grain will trigger a cascade. Sand will slip down the side of the cone until a new shape is stabilised. And, so, the process goes on. The cone is stable under most circumstances but just a single grain of sand can trigger a transition to a new stable state. The world, then, exists in a state of self-organised criticality. This is important. If the world was too stable, it would not be able to respond to change. Instability, then, is an adaptive property. It also means that work must contend with this inherent instability. We need to be constantly adapting to events as we encounter them, which might not be how we anticipated them at the outset. It is this mismatch between ‘expected’ and ‘actual’ that is one source of error. But there is a more fundamental process that gives rise to error. All action flows from decisions made by a brain encased in bone. It has no direct access to the outside world. The brain acts like a Bayesian probability engine. The brain creates a set of expectations about the nature of the world, and these are compared with sensory inputs. Any discrepancies – errors – are resolved until our perceived reality meets a threshold. Our investment in establishing ‘reality’ is just enough to support whatever action is needed to achieve our goals. This last statement presupposes that all action is goal directed. Error, in this context, is feedback from the world about the correlation between our actions and our progress towards our goal. In fact, error is information that reduces uncertainty. In this sense, error allows us to fine-tune our actions. Studies of airline pilot performance reveal that about a third of errors committed by crew go unnoticed. They are seen by the trained observer, but not by the perpetrators, and barely 1% of these errors have any sort of impact on the operation of the aircraft. This suggests two things: first, in aviation at least, the operation is resilient and can cope with error; second, the consequence of error does not seem to impinge upon the crew’s understanding of what is happening to the extent that they need to take any action. However, when an error does come to the attention of the crew, a response is needed. Again, studies show that a significant proportion of detected errors are simply ignored by crew. Fewer than half require a positive intervention. It is fashionable to talk about error ‘management’. In fact, crew do not ‘manage’ errors: instead, they respond to the new set of circumstances created by the error. Error is the trace you leave behind, like the wake of a ship. You play what is in front of you and don’t look back. But what about the ‘things that go right’? Here is a game you can play. Imagine you are watching someone in the workplace. How do you know things are going right? Probably, it’s because you haven’t seen anything going wrong. We are designed to detect ‘wrong’ because that is what will save our lives. It’s an evolutionary thing. We are blind to ‘right’ because that is simply our expectations – the brain’s prediction – being met. That said, have you ever been impressed by something you have seen at work? Again, this is our prediction not being met, but in a surprising way rather than a negative way. Surprises, like failures, are learning opportunities. Both allow us to refine our internal representations of tasks, leading to better goal specification and richer action sequences directed at attaining that goal. Error, then, is not only good but also essential. The original meaning of ‘error’ was to wander. It is not the wandering that really matters but the path people were trying to follow in the first place. Key take away points: 1. After a process failure, the goal is to explain the gap between planned and actual. Culpability comes a distant second. 2. Most responses to adverse events merely shift the point of failure. The work will be no less variable and the role of error will not change. 3. If you really need a 'Just Culture' policy it suggests that the people with power do not understand error.