Search the hub

While traditional methods such as Failure Mode and Effects Analysis (FMEA) are well-established, they often reach their limits in clinical practice. This is due in particular to the subjectivity of fault identification. I would like to propose the Hazard and Operability Study (HAZOP) as a complementary risk analysis method. HAZOP offers a structured, systematic approach to risk identification and assessment, particularly suited to analysing process risks and human factors. Unlike FMEA, HAZOP uses guide words (e.g. NO, MORE, LATE, LESS, OTHER THAN) to explicitly identify and analyse potential deviations from tasks and procedures.  A systematic approach to identifying and assessing clinical risks Despite the implementation of risk management systems, practice often falls short of expectations. This is due, among other factors, to the complexity of clinical processes, the dynamics of the work environment, and interprofessional interfaces, which make a holistic risk assessment difficult. Although traditional methods are widely used, they reach their limits in clinical practice: Subjectivity: When using traditional methods such as FMEA, which rely on the team’s spontaneous fault detection and experience, critical risks are easily overlooked as they are not recognised as ‘failure modes’. Monocausality: Traditional failure-mode-based approaches lead to a monocausal derivation of causes and effects. Human factors as ‘operator error’: Human errors are easily classified as ‘user problems’ without questioning the systemic causes (e.g. time pressure, unclear responsibilities, inadequate communication). Against this background, I propose the Hazard and Operability Study (HAZOP) as a complementary risk analysis method. The HAZOP method was originally developed in the aviation industry and has established itself there as the gold standard for analysing risks in highly complex, safety-critical environments. HAZOP enables the approach required by ISO 31000 as a structured, step-by-step approach: Risk identification Risk analysis Risk evaluation Risk identification using guide words The method uses guide words as a heuristic to systematically identify potential process deviations as a starting point for the risk analysis. These guide words are adapted to clinical reality and enable a comprehensive risk analysis: Guide Word: Possible deviation. No: Failure to perform a task. More: Excessive performance of a task. Less: Inconsistent performance of a task. Late: Delayed performance of a task. Other than: Incorrect execution of a task. Using guide words as a starting point for risk identification also helps to involve those with little experience in risk management in the process. A list of guide words can and should be adapted to the specific requirements of the specialist department. Practical application: Example 'documentation of vital signs' Task: Recording and documenting vital signs in the intensive care unit. Guide word: Possible deviation No: Blood pressure is forgotten. Late: Documentation is delayed, delaying further diagnosis. Less: Not all vital signs are measured. Other than: A mix-up of patients in the documentation. Risk analysis The identified risks can be assessed using a two-dimensional risk matrix, like in other risk tools: Probability of occurrence (scale: ‘almost impossible’ to ‘almost certain’). Impact (scale: ‘no health consequences’ to ‘life-threatening consequences’). This commonly used and well-known assessment method enables measures to be prioritised and helps hospitals to proceed in a resource-efficient way. Risk evaluation and identification of measures Preventive and corrective measures are developed during interprofessional workshops, in which representatives from all relevant professional groups (doctors, nursing staff, administration, IT) work together to evaluate risks and propose solutions. Typical measures include: Process optimisations (e.g. standardisation of documentation procedures). Training to raise awareness of human factors. Technical adjustments (e.g. introduction of digital checklists). Clarification of responsibilities (e.g. through clear SOPs). Discussion The HAZOP method offers several key advantages that are particularly relevant to clinical patient safety: The use of guide words enables risks that are often overlooked to be systematically identified. This reduces subjectivity in error detection and enables more objective prioritisation of measures. The method allows for the analysis of human and organisational factors. This enables a holistic view of incident causes and supports hospitals in developing systemic solutions. HAZOP can be seamlessly integrated into the SEIPS 2.0 approach, which enables a coherent risk assessment that accounts for all relevant factors. The approach promotes collaboration among professionals from different disciplines. This strengthens the learning culture and helps to close governance gaps. Thanks to the structured approach and the use of guide words, risk analysis can be carried out more quickly and efficiently. Conclusion The HAZOP method, with its guide words, is a proven, systematic and evidence-based tool for improving clinical patient safety. It enables a comprehensive risk analysis that takes into account technical, procedural and human factors. Do you use the HAZOP method? We would love to hear from you if you're using HAZOP in a clinical setting so we can share real-life examples of its use. Email us at [email protected] or comment below (you need to be signed into the hub; sign up here, it is free and easy to do).

In a three-part series of blogs for the hub, Norman Macleod explores how systems behave and how the actions of humans and organisations increase risk.  In part 1 of this blog series, Norman suggested that measuring safety is problematic because the inherent variability in any system is largely invisible. Unfortunately, what we call safety is largely a function of the risks arising from that variability. In this blog, Norman explores how error might offer a pointer to where we might look.  Safety as risk propagation It is common in safety management to talk in terms of hazards. We can identify three classes of hazards: substances or objects that could cause loss or harm; engineered situations where humans engage in activity involving known hazards but under controlled conditions; acts by individuals that inadvertently expose the operation to a hazard (we might call these ‘errors’). Controls are put in place to contain hazards but controls are designed by humans and are fallible. Healthcare is an example of a hazardous condition: things are done to patients that would be illegal if inflicted upon a healthy person. Procedures act as controls in these situations but there is always a tension between work-as-imagined (WAI) and work-as-done (WAD). WAI describes the least-risky solution to a problem that will work in most circumstances (or, at least, those envisaged by the procedure designers), whereas WAD reflects the inherent flexibility needed in the real world. In a study of maritime accidents,[1] it was found that collisions have occurred between ships actively trying to follow the ‘rules of the road.’ Procedures contain affordance spaces, or lacunae, that must be filled by actors applying expertise. Procedures, or rules, form a hierarchy. At the top there are rules about goals: ‘first, do no harm.’ Then there are IF-THEN rules that aid decision-making: IF <symptom> THEN <condition>. The lowest order of rules are task prescriptions: step 1, step 2, step n. As we ascend the hierarchy, actors need more extensive training to cope with the lacunae that invariably exist. Many airlines use a process called the Line Operations Safety Audit (LOSA).[2] Trained observers monitor flight crew under normal flight conditions and log departures from procedures, crew responses and subsequent outcomes. In most cases, 95% of errors are inconsequential: error is very much noise in the system. LOSA can let us see what happens when crew attempt to fill in the gaps in procedures. The observer can tag an error as 'intentional’ (an INC) if certain criteria are met and figures of between 8.8% and 26.4% of INC errors have been seen. However, ‘Intentional’ errors are usually attempts to adapt to local circumstances or to solve problems. These departures from prescribed activity reflect system buffering. The outcome of an error can be categorised in LOSA as ‘inconsequential’, can trigger an additional error or results in an ‘Undesired Aircraft State’ (UAS) if the observer feels that safety has been jeopardised. In one study I looked at UASs arising from INCs versus non-intentional errors. INCs were twice as likely to result in a UAS. I then looked at who committed the error. For INCs, captains accounted for 91.66% of UASs compared with 40.6% when the error was non-intentional. The data suggests that agents actively choose courses of action that contravene procedures to maintain the flow of work but those decisions increase risk. Captains are over-represented in the data because they are the primary decision-makers in the team. Ironically, compliance with procedures is often the starting point for any safety investigation. However, rather than police ‘compliance’, organisations should probably find ways to capture variability and render it as knowledge. What error does To view error simply as failure, however, is to miss the fact that they change the work process in a way that needs to be addressed if safety is to be maintained. This can happen in one of three ways. First, they reduce performance margins. Even slight departures from the optimum aircraft configuration mean that, should a subsequent event occur, the crew have less flexibility to respond. In the flight data shown in the previous blog, an aircraft operating in the outer bands of the distribution is migrating towards the margins of the safe space. Something as commonplace as a change in windspeed or direction could result in a critical outcome. Second, error transfers risk when my action affects others. For example, passengers have been killed when aircraft have flown into turbulence. If a pilot delays or fails to turn on the seat belt sign in time the cabin crew and passengers are exposed to risk because they will not have taken steps to protect themselves (such as sitting down or fastening seat belts). Sometimes, and in contravention of procedures, pilots start the ‘after landing’ checklist early to save time. This usually results in pausing the checklist while air traffic control issues directions to the terminal building. LOSA shows that crew then often forget to finish the checklist and aircraft park with the weather radar still turned on, exposing the ground handlers to a radiation hazard. Finally, separation reduction describes the condition where aircraft are placed in closer proximity to hazardous objects (other aircraft, the ground) than was intended. Again, should something happen, the crew will have less time to react. Error, then, can reveal how the risk profile is shaped by the deliberate actions of crew. What goes on here? This examination of normal work suggests two candidate domains for measures of safety. First, what is the organisation’s understanding of the utility of its control structures (policies and procedures, codes of conduct)? How well-written and comprehensive are the structures? Where are the contradictions and ambiguities that flow from multiple stakeholders in the process of oversight? Second, what is the skills mix of those required to work within the system, recognising the need to cope with the variability inherent in the real world. Does the organisation have a competence model for the different functions in the system? What are the risks associated with substituting staff (bank staff, staff on loan)? Conclusion In this post I have looked how workplace variability shapes risk. I have suggested two key aspects of the structure of an organisation – control and competence – that could be candidates for measuring ‘safety’. In my final blog I want to explore how organisations actively design unsafety into their operations. References Belcher P. ‘A Sociological Interpretation of the COLREGS”. Journal of Navigation, 2002; 55(02): 213-224. Klinect JR, 1st Klinect JR. Line Operations Safety Audit: A Cockpit Observation Methodology for Monitoring Commercial Airline Safety Performance. Unpublished PhD thesis, 2005. University of Texas. Unpublished PhD thesis. University of Texas. Read part one and part three of Norman's blog series.