Abstract
Introduction
Medical errors constitute one of the most important challenges in healthcare, harming thousands of people around the world every year [1–4]. Recent studies showed the high rate of errors affecting patient safety worldwide [5–11]. For instance, Walker et al. [12] reviewed a number of studies from a range of countries, and concluded that the adverse event rate ranges from 3% to 17% . All the figures, from around the world, indicate that improvements need to be made to healthcare systems to enhance patient safety. To help accelerate improvement in patient safety, healthcare organisations are advised to monitor their care delivery processes, identify errors, and investigate their links to hazards and risks. In order to address the latter challenge, risk identification is used as the main approach to support the process of finding, recognising, and describing risks within the risk assessment process [13].
Risk identification is one of the key approaches in investigating possible linkages between hazards and errors, affording healthcare organizations an important means to substantially reduce errors [14]. Using a range of tools and methods, the aim of robust risk identification is to compile a comprehensive list of risks within the scope of risk management. Risk identification plays a vital role in the risk management process, since control mechanisms are far less likely to avoid or decrease the effects of unidentified risks [14–17].
While the literature indicates that retrospective approaches, such as incident investigation, have most often been used to identify risks in healthcare [18–20], there are only a few resources available that discuss current risk identification practices in healthcare further. The report on Prospective Hazard Analysis (PHA) produced by Ward et al. [20] analysed current PHA practices in the healthcare field, and another study by Card et al. [21], described a content analysis of the risk management strategies, policies, and procedures used, particularly focusing on the function of risk evaluation and risk control [37]. However, there is no evidence determining what trust-level guidance exists to support the risk identification process in NHS trusts.
To help understand this, a content analysis was conducted of risk management documents from the trusts in the East of England (EoE) region of the NHS. As Ward et al. [20] suggested, the analysis of such documents can be helpful for gaining a significant level of insight into current prescribed risk identification practices.
The primary aim of this analysis was to understand what support is provided by trust-level policies, procedures, and strategies, to help healthcare staff to identify patient safety risks. This study, therefore, attempts to provide a better understanding of the recommended risk identification practice in selected trusts. A brief comparison with the guidance of other safety-critical industries was also conducted to examine the possible differences between risk identification documents used in healthcare trusts and those of other industries, and learning points to healthcare field.
Methods
In order to obtain risk management-related documents, a Freedom of Information (FOI) request was sent to each acute, mental health, and ambulance trust in the EoE, on 26 February 2013. Similar to the requests sent by Card et al. [21] earlier, the trusts were asked to provide the following documents: Your organisation’s current Risk Management Policy (or nearest equivalent, e.g., Risk Assessment Policy) Your organisation’s current Risk Management Procedures (or nearest equivalent, e.g., Risk Assessment Procedures)
In addition to the documents above, the trusts were also asked to provide any other relevant documents (e.g., plans, checklists, strategies, procedures, policies, etc.) potentially containing details on hazard/risk identification with respect to patient safety.
The documents obtained from the trusts were analysed to identify what guidance informs the risk identification process, and to determine specific risk identification methods and tools used. To this end, the following questions were asked regarding each document: Which risk identification tools and methods are mentioned in the documents? Are the methods mentioned presented positively, neutrally, or negatively? Is there direct or indirect pressure on trusts to conduct retrospective or prospective risk identification by using specific tools and methods?
In addition to the documents provided by the trusts, the following guidance was also reviewed to determine whether there are any relevant learning points that can be borrowed from other safety-critical industries:
There are much other guidance could be borrowed from other safety-critical industries to compare with healthcare documents. However, these two documents were chosen for their particular treatment of hazard/risk identification providing comprehensive knowledge of different tools and methods from the petroleum and aviation industries.
A total of forty-eight documents, including risk management policy, procedures and strategies, were received in reply from eighteen acute trusts, two mental health trusts, and one ambulance trust (n = 21).
Most of the documents indicated that it is important for trusts to develop and promote policies and procedures that provide guidance to practitioners and managers in risk decisions. It was stated in many of these documents that such policies and procedures are available to all staff, at all levels in the organisations. Hence, it is expected that all staff have a part to play in identifying and managing risk, by being aware of and following the trusts’ policies, procedures, protocols, and guidance.
With respect to fundamental definitions, the documents used both hazard identification and risk identification terms interchangeably. In most of the documents, the definitions of hazard and risk were provided, but only a few documents showed examples of these terms and the relationship between hazard and risk. In general, the review showed that very little advice was given regarding how to identify risks, despite the list of tools and methods mentioned and (briefly) described, in contrast with other industries’ hazard identification guidance.
The documents provided showed that most trusts recognised the importance of suitable and sufficient risk assessment in managing risks. Hence, most documents mentioned the importance of having a systematic and proactive approach to identifying and assessing risks. Again, in most of the documents, risk management was defined as a proactive approach that aims to identify, assess, prioritise, and manage risk, in order to minimise its negative consequences. It was also specifically shown that risk identification is an ongoing and proactive process, and is the responsibility of all staff organisation-wide. In some documents, it was also emphasised that all staff members are encouraged and supported in taking a proactive role in identifying a comprehensive list of sources of risk and events that might have an impact on the achievement of objectives and the continuity of service delivery. The documents also showed that there are many means of identifying risks within any given organisation and circumstances, and the type of assessment may suggest a preferable method. Regardless of the method chosen, the documents often recommended being systematic. In addition, one document also highlighted the importance of identifying both possible latent organisational management failures and sharp-end failures, or adverse events, in a systematic way.
Despite the many statements recommending being proactive and systematic, however, it was found that improvement of the risk identification process through retrospective analysis of incident reports is the main tool used in the trusts. All trusts (n = 21) indicated the use of incident reports in identifying risks. After incident reporting, the documents listed other common methods used – complaints, claims reporting, and audits (n = 20 for each). These were followed by near miss reporting (n = 17), national reports, issues raised by the trust board (n = 15 for each), Root Cause Analysis (n = 13), and new legislation and patient and staff surveys (n = 11 for each).
The documents provided showed very little evidence of the use of prospective risk identification tools. Safety walkabouts (n = 8) were found to be the most commonly used proactive method supporting risk identification in the EoE region. This was followed by the use of checklists (n = 7), observation (n = 5), and brainstorming (n = 3). In addition to these, several other methods were mentioned in the documents provided by the twenty-one trusts, and are listed in Table 1.
As can be seen in the last entry in Table 1, there was no evidence found that Prospective Hazard Analysis (PHA) methods are used as part of the trusts’ risk assessment processes. Moreover, there was no evidence of system diagrams used to identify patient safety risks. Although the earlier documents produced by Department of Health and NHS stated the need for implementing systematic risk assessment and management through PHA approaches, such as Failure Mode and Effect Analysis (FMEA), Hazard Operability (HAZOP), and Structured What-if Technique (SWIFT), in the NHS [24, 25], there was no mention of such methods or direct reference to the use of such methods in the policies and procedures as provided by the trusts. Analysis of the documents supported the conclusion that PHA methods have not yet been embedded in trust-level policy and procedure documents.
Despite the lack of description of PHA tools and methods, a few trust documents did outline processes that ensure a continuous and systematic approach to risk assessment followed throughout the organisation. These processes, in general, allow for informed management decisions in the identification, assessment, treatment, and monitoring of risk to minimise the hazards that threaten the organisations. For instance, two trust documents cited their adoption of the Australia/New Zealand risk management standard, which is based on the ISO 31000 standard. However, as with the results of the earlier study [20], there was no detailed information available on the construction and use of system descriptions as part of the risk identification process.
Only limited information was presented in the documents addressing the extent to which hazards and risks should be identified. Some documents presented a comprehensive list of risks; one trust document, in particular, emphasised the importance of recording all possible risks without considering their likelihood or severity. This document showed that risks can be dynamic, continually changing according to the individual service user’s circumstances; hence, the likelihood and severity of a risk can change over the course of time. It was therefore recommended that maintaining a brief record of all possible hazards is good practice, as well as helping to avoid superfluous details.
With regard to different tools and methods used in combination, again only limited information was found in the documents provided. For instance, one of the trusts mentioned that a team of clinicians, managers, and staff is assembled to create a profile of the trust at a particular time, using a variety of these methods in combination, such as interviews, questionnaires, site visits, and facilitated group meetings. The trust expected in this way that the ward manager or senior nurse within a given ward would assess health and safety issues and clinical risk assessments as part of his or her speciality job role. Workers who need support to undertake such assessments would also be supported with guidance, which shows the use of a systematic process in risk assessment, supplied by the patient safety manager or the health and safety risk manager. Although only a few documents exhibited the use of different risk identification tools and methods in combination, the use of risk register systems seems to answer this need, at least partially, by including all identified hazards and risks in one picture.
Risk register systems provide key features that help to understand whether the current risk identification process is reactive or proactive. All the trusts (n = 21) indicated that they employ a risk register system, a systematic form of documenting and recording identified risks and risk assessments. Comprehensive use of risk registers, at a trusts-wide level, would enable a broader understanding of risk, allowing it to be better addressed. It is suggested in many trust documents that all ongoing risks identified through risk assessment should be recorded in the risk registers. Hence, consideration and documentation of the source of the risks would be important in risk registers, as this would enable the trusts to identify which risks have been identified by proactive and reactive tools; this might help workers understand whether risks are better or more often identified reactively or proactively. Such systems can also shed light on whether the risks recorded in risk registers relate to clinical, non-clinical, organizational, or financial issues.
There was an emphasis, in a few documents, on developing a positive risk and patient safety culture, to promote awareness and understanding of the benefits of proactive risk management. One document, for instance, indicated the need for a culture where risk management is integral to the everyday operation and fully supports the trust’s objectives. A few documents showed that trusts, by implementing appropriate policies and procedures, help foster a culture of risk awareness, enabling staff to play an important role in identifying and managing hazards and risks. Some trust documents emphasised various safety culture terms, such as being open, just, and nonpunitive, reporting adverse events, and identifying hazards, as a fundamental part of the work and role of all staff. In most cases, however, such terms were mentioned as part of incident reporting, but not in the use of proactive tools. Only a few documents indicated everyone in the trusts to be observant in identifying possible hazards and threats proactively, and being prepared to share their concerns about perceived hazards with other healthcare staff.
These results indicated that the trusts in the chosen region, in general, recognised the value of a systematic approach to risk management, but the documents provided insufficient support for the use of prospective risk identification tools and methods, as compared to the guidance available in other safety-critical industries. While the analysis of incident reports was the main method reported in the documents provided by the trusts, guidance from other safety-critical industries showed that those other industries have invested extensively in prospective risk assessment tools, in addition to using incident reporting. It was found that incident reports are used as a supplement to proactive risk identification tools in other safety-critical industries. Such industries also reported that a number of tools and methods, such as FMEA, HAZOP, and SWIFT, which have been used successfully and broadly, are more proactive and systematic in the identification of hazards and risks than retrospective methods, such as incident reporting. Moreover, they emphasised the value of using multiple methods in combination, and outlined further information on the features of successful risk identification processes. However, as mentioned earlier, such PHA methods have not been embedded in the healthcare settings described in the documents provided, despite the importance of these tools as recognized by the NHS [24, 25].
Discussion
It is accepted as a given that the documents provided by the trusts represent the standard, and to some degree reflect the actual level of risk identification in practice. A number of studies were conducted by analysing the policies and procedures, but there are some limitations on generalising the results of such analysis, due to the data source (procedures and policies) and specific region (EoE). First, the consistency in the policies and procedures received from the trusts limits the potential to make a definitive statement about risk identification processes in the NHS. Second, this study analysed the documents from the East of England (EoE) area of the National Health Service; the results might differ in other regions and countries. It is therefore difficult to conclude to what degree the results in this study can be generalised beyond EoE. As also mentioned in an earlier study [21], the analysis relied on the documents received from the trusts in response to a freedom of information request — although these documents were provided by the trusts, there might be other documents that might have been more relevant or might have discussed the trusts’ risk identification processes in further detail. Or, as suggested by Card et al. [21], healthcare staff who work on healthcare risk management and patient safety might contribute to the risk management process in ways not captured by the policies and procedures. As Card and colleagues also stated, the paperwork required by the risk management process might be completed with no reference made to the relevant policies and procedures, which implies that such documents might be largely or routinely ignored. Real-world risk identification practices may therefore differ from the risk management policies and procedures that putatively govern them.
A number of recommendations can be made, based on the document analysis and with the help of guidance from other safety-critical industries.
Introduce the use of PHA tools in the creation and revision of policy and procedure documents.
The value of the contribution of PHA methods to the overall risk assessment process has been pointed out in a number of studies [18, 26–28]. However, despite the utility of systems approaches, there is only a very slow and sporadic adoption of PHA methods in healthcare [29]. The low rate of adoption of such methods was particularly highlighted in the UK, where these approaches are not mandated [30]. In order to shed light on issues impeding adoption, Ward and colleagues [20] listed the following barriers to implementing PHA methods in the NHS: [1] availability and accuracy of data and information, [2] complexity, [3] process variability, [4] current risk management practice, [5] the need to train specialist facilitators, [6] availability of resources, and [7] culture. It was noted that it is not easy to adopt PHA methods in healthcare organisations where such limitations exist. Recently, Potts and colleagues [30] also identified three possible reasons why the healthcare industry has been slow to adopt PHA methods: [1] the variety of methods makes it difficult to choose the most suitable method for a particular system assessed, [2] the methods are resource-intensive, and [3] there is little evidence of their reliability and validity. In addition to adoption issues, a number of concerns were raised about the validity and reliability of such tools in healthcare contexts [31–33]. Potts and colleagues [30] stated that validation of PHA methods is methodologically challenging, despite a few investigations proving their reliability. Beyond this, only a few studies have highlighted the use of multiple reactive and proactive methods to successfully provide a comprehensive view of risk in a given healthcare system [19, 30, 38]. Potts and colleagues [30] also pointed out that PHA methods should not be used in isolation in providing a comprehensive description. However, there is no evidence in the healthcare literature of how well such an amalgamation, using multiple inputs from both reactive and proactive risk identification approaches, can be demonstrated. These issues taken together show that there is still a need to implement an improvement in risk identification, which will contribute to the improvement of patient safety.
Further, healthcare industry needs to be careful in selecting and adapting risk identification methods from other safety-critical industries, due to the implications of the differences between their natures. Moreover, a number of requirements associated with the use of prospective risk identification tools, such as the need for expertise, types of inputs and outputs, were highlighted in earlier studies [20, 29]. Lyons [29] also emphasised that there is a lack of practical experience regarding use and selection of prospective risk identification tools in healthcare. Further, it was noted that selected methods should be made accessible by healthcare users and other users new to the system. Hence, Lyons [29] indicated the need for initial guidance in supporting the selection of prospective methods, due to their large number and complexity. This can possibly be accomplished starting with the definition of basic tools and methods (such as structured brainstorming), or the current PHA Toolkit provided for the healthcare community by Clarkson et al. [34].
In addition to helping select appropriate PHA tools, potential integration between reactive and proactive methods was also recommended in the PHA toolkit as an area needing further research [34]. Similarly, the potential benefit of linking risk identification with incident reports was studied by Kessels-Habraken et al. [19, 20]. There has so far been little work done, however, on the integration of such methods in the healthcare research environment [19, 35]. As mentioned earlier, incident investigation and safety walkabouts are the main risk identification techniques used in the healthcare setting [20]. The possible use of current methods, with the support of prospective methods, might therefore improve patient safety further.
Provide individual guidance on risk identification to accelerate improvement in patient safety.
The documents provided by the trusts showed that the trusts consider different types of risks, such as clinical risks, health and safety risks, information risks, project risks, operational risks, and financial risks. Hence, it was not easy to decide, through analysis of the documents alone, which specific tools and methods are particularly available for identifying patient safety hazards and risks. It can be said that different risk sources might affect each other. For instance, one of the trusts’ documents stated that the trust does not separate clinical and nonclinical risks, as either could ultimately impact the delivery of care and the achievement of objectives. Despite this, implementation of risk identification guidance in which the specific focus is on patient safety risks can potentially promote risk culture, and awareness of particular tools and methods.
It can be said that each risk identification method prescribed in trust-level documents may have strengths. However, it is still an open question how adequately each method has been implemented so far, and how well they have been integrated to create a comprehensive list of risks in complex healthcare systems. Moreover, none of PHA tools have been extensively introduced in trust-level documents as opposed to other safety-critical industries. Research recently conducted by Hudson et al. [36] highlighted the need for healthcare organisations to adopt a new approach to identify and mitigate patient safety hazards by learning from the experiences of other safety-critical industries. The potential exists, therefore, for improving the risk identification process by identifying the areas needing improvement within current risk identification practices, and by studying the experiences of other safety-critical industries; therefore introducing them in their trust-level guidance.
The documents provided significant insight into prescribed risk identification practice from the acute, mental health, and ambulance trusts in the chosen region of the NHS. As a result of the content analysis, it was found that PHA approaches have not been introduced in trust-level documents compared to the guidance from other safety-critical industries. It can be recommended that introducing PHA tools in trust-level policies and procedures, and providing individual/specific guidance on risk identification may provide sufficient support to encourage healthcare staff to identify risks to enhance improvement in patient safety.
Conflict of interest
The authors have no competing interests.
Funding
This research received no specific grant from any funding agency in the public, commercial or not-for-profit sectors.
Provenance and peer review
Not commissioned; externally peer reviewed.