Apresentação de Carol Haraden durante o SIMPÓSIO EINSTEIN-IHI: Implantação e Disseminação de Programas de Segurança do Paciente aconteceu de 3 a 5 de novembro de 2013, em São Paulo - Brasil. Carol Haraden é PhD, Vice Presidente do Institute for Healthcare Improvement (IHI), é membro do time responsável por desenvolver desenhos inovadores no cuidado ao paciente. Atualmente, ela lidera os trabalhos do IHI na Escócia, Sul da Inglaterra, Dinamarca e Estados Unidos.

1. System Design to
Produce Safer Care:
Culture, Measurement
and Infrastructure
1st Symposium IHI-Einstein: Implementation and
Scale Up of Patient Safety Programs
November 4, 2013
Carol Haraden, PhD
Vice President

2. Safety as a Systems Property

3. Safety is not measured by the
number of times you fall through
the ice…

6. The Story of “David”
5yr boy with known Sickle Cell disease
Goes to emergency department of the local
hospital with leg pain
Dx Sickle crisis - admitted to hospital for IV fluids
and pain relief
Next morning pain is worse, and David noticed to
be jaundiced. Doctor asks for blood count and
second analgesic is added
Lab tech unable to draw blood for blood count,
says someone else will come, but no one does.
Doctor not notified - leaves for day without
drawing blood for test
Next morning, jaundice is worse, patient is weak,
another doctor is called, draws blood for other
tests – but blood count is not determined

7. The Story of “David”
Same day - doctor is called back by parents, draws the correct blood test –
shows very low Hb (3.5), needs emergency blood transfusion
No blood available at hospital (new policy blood had to come from central
blood bank),
Parents offer to collect blood declined – hospital driver sent to pick up blood.
No blood after 2 hours, parents frantic. Reassured
Further 2 hour delay - driver runs other errands while picking up blood
Pain is much worse – parents question narcotic scheduling – nurse replies
“following doctor’s orders”
David now weak, confused, agitated, laboured breathing
Parents frantic. Get nurses to call driver – dropping staff off at homes
Blood arrives – wrong type – whole blood vs packed cells
Transfusion starts - 36h after initial FBC order
20 min later David dies; primary reasons –heart failure and respiratory failure
secondary to severe anaemia

8. Case failure or
System failure?

9. Trends
and
Patterns
(run charts,
statistical analysis,
qualitative study)
System Structure
(pattern of interrelationship among key
components of the system: hierarchy,
process flows, mental models)
Leverage
for
Improvement
Systems: Leverage for Improvement
Events
(crisis, anecdotes, problems)

10. Attribution Error
A fault in the interpretation of observations,
seen everywhere, is to suppose that every
event (defect, mistake, accident) is attributable
to someone (usually the one nearest at hand),
or is related to some special event. The fact is
most troubles with service and production lie in
the system.
- Deming (1986),p. 315)
10

11. How do we know if what happened
here is special cause or common
cause (happening throughout the
organization)?
11

12. Using the information from the case,
what data would we like to have
about system performance?
What processes failed?
Are they unreliable throughout the
organization?
12

13. Model 1: “Bad Apples” theory =
someone to blame
Source: Robert Lloyd, Ph.D.
13
Reject
defectives
Requirement,
Specification or
Threshold
No
action
taken
here
QualityBetter Worse QualityBetter Worse
? Better
care

14. But what happens to the remaining
system after removing “bad apples”?
14
Increase
Fear
Micro-
manage
Kill the
Messenger
Filter
the
Information
QualityBetter
Requirement,
Specification or
Threshold
Worse
Reject
defects?
The Cycle of Fear

15. Source: Robert Lloyd, Ph.D.
15
QualityBetter Worse
Action taken
on all
occurrences
Model 2: “bad system” theory = system to
blame (work on all parts of the system)

16. Infrastructure: Portfolio
Management and Execution
16

17. In Order to Reduce Patient Harm and
Mortality…
We have to know what changes, when
taken together, will help us accomplish
this aim.
17

18. The Intuitive Structure
Very Large System
“Meso-
System”
“Meso-
System”
“Meso-
System”
Project
Project Project
ProjectProject
Project
Project
Project
Tier 1
Tier 2
Tier 3

19. Example: System Medication
Safety
Med.
reconciliation
Hospitals
SYSTEM Medication Safety
Rehab Offices
Standardized
dosing
Family
Capacity
Self med
Correct list
availability
Patient
capability
Tier 1:
Big Dot
Tier 2:
Portfolio
Tier 3:
Projects

20. Example: Hospital Medication
Safety
Med.
reconciliation
Med Surg
Hospital Medication Safety
Surgery Pharm
IV pumps
VTE
On time
antibiotics
Standardized
dosing
availability
Admix
Tier 1:
Big Dot
Tier 2:
Portfolio
Tier 3:
Projects

21. Issues
Tier 3:
Projects
Team organization and capacity matter.
Front-line leadership is critical.
Measures tracked over time and visible.
Senior leaders remove obstacles.
Clear changes important.
Ability to run PDSA cycles.

22. Issues
Tier 2:
Portfolio
Middle Management key.
What are the “drivers” of the outcomes we want?
Outcomes tracked over time.
“Connecting the Dots” – Putting the learning
together.
Continual readjustment of portfolio.
Strong linkage to finance.

23. Issues
Tier 1:
Big Dot
Aims of strategic importance to the system as a
whole.
“Big Dot” measure of progress.
Executive, Board and Senior Leader engagement.
Vision and the associated structural changes.
Strong linkage to finance.
Managing the learning, the politics, and
the risks.

24. Measurement for Safer Care

25. The purpose of collecting and
displaying data is to make better
decisions…

26. Coronary Artery Bypass Graft
Mortality Rate (%)
Jan ‘02 Jan ‘03
5.9%
1.1%

27. Coronary Artery Bypass Graft
0
1
2
3
4
5
6
7
Jan-02
Feb
Mar
Apr
May
Jun
Jul
Aug
Sep
Oct
Nov
Dec
Jan-03
CABG Mortality Rate: Clinic I

28. Coronary Artery Bypass Graft
0
1
2
3
4
5
6
7
Jan-02
Feb
Mar
Apr
May
Jun
Jul
Aug
Sep
Oct
Nov
Dec
Jan-03
CABG Mortality Rate: Clinic II

29. Coronary Artery Bypass Graft
0
1
2
3
4
5
6
7
Jan-02
Feb
Mar
Apr
May
Jun
Jul
Aug
Sep
Oct
Nov
Dec
Jan-03
CABG Mortality Rate: Clinic III

30. There is no single measure of
safety, but early warning signals
can be valuable and should be
maintained and heeded.
Berwick Report: Promise to learn,
Commitment to Act (2013)

31. Monitoring and Measuring
Measurement: data from the past, almost always
driving using the rear view mirror;
Example: Plotting your average driving
speed on a run chart over a month
Monitoring: real time understanding of the situation
so that management can be more dynamic
Example: Using the speedometer to gauge
speed as you drive.

32. Monitoring and Measuring
When asked if your organisation is safe, what exactly do
you want to know to answer that question?
Asking five critical questions can help you understand
the different dimensions of safety in your organisation.

33. • Has patient care been safe in the past?
• Are our clinical systems and processes reliable?
• Is care safe today?
• Will care be safe in the future?
• Are we responding and improving?

34. The 5 questions…
Safe in the Past: psychological and physical
measures
Reliability: ‘failure free operation over time’ applies
to measures of behaviour, processes and systems
Safe Today: Sensitivity to operations- the
information and capacity to monitor safety on an
hourly or daily basis
Safe in Future: Anticipation and preparedness- the
ability to anticipate, and be prepared for, problems
Improving: Integration and learning: the ability to
respond to, and improve from, safety information

35. “…As every clinician and manager knows,
problems and crises that potentially threaten
safety occur on a daily or even hourly basis,
such as a sudden influx of very sick patients,
staff sickness or equipment breakdowns.”
Berwick Report: Promise to learn, Commitment to Act (2013)

36. What are your sources of data?
Do you have the full picture?

37. Infection
rates
Mortality
review
Risk
management
Root cause
analysis
Readmission
data
Death and harm
What are important and recurrent issues?
Who has the data?
Incident
reports

38. Possible structures for information integration
Board
Senior Leaders
Middle Managers
Frontline Staff
Greater
outcome
focus
Relevant
process and
outcome
measures
Higher level
outcome
measures
Greater
process
focus

39. The Culture of Safety
39

40. 40
*Adapted from Safeskies 2001, “Aviation Safety Culture,” Patrick
Hudson, Centre for Safety Science, Leiden University
PATHOLOGICAL
Who cares as long as we’re not caught
Chronically Complacent
REACTIVE
Safety is important. We do a lot every
time we have an accident
CALCULATIVE
We have systems in place to manage all
hazards
PROACTIVE
Anticipating and preventing problems
before they occur
Constantly Vigilant
GENERATIVE
Safety is how we do business around here
Constantly Vigilant
Evolution of A Culture of Safety and
Reliability
40

41. The Human Component:
Appropriate Accountability:
Fair and Just Culture

42. Accountability – Fair and Just Culture
Clear, simple rules - “one set” that apply to
everyone.
Four questions:
- Was there malice involved?
- Was the individual knowingly impaired?
- Was there a conscious unsafe act?
- Did the person(s) make a mistake that
someone of similar skill and training could
make under those circumstances?

43. Drawing the Bright Line
Malicious
Substance Use
Conscious unsafe act
Substitution Test could 2-3 others make
the same mistake in similar circumstances?
Repeat Events
Remediate / replace
Safe Harbor –
Systems Approach
Reason, James

44. Organizational Fairness/Just Culture
Differentiate between:
Unsafe individuals
• Reckless behaviors
• Risky behaviors
Unsafe systems
Pascal Metrics

45. 1. First, exclude individuals with impaired judgment or whose actions might be malicious. (These cases must be
managed using other appropriate avenues – i.e. employee assistance programs for substance abuse and
psychosocial problems, legal authorities for cases with possible criminal intent.)
IMPAIRED JUDGMENT
The caregiver's thinking was impaired
- by illegal or legal substances
- by cognitive impairment
- by severe psychosocial stressors
MALICIOUS ACTION
The caregiver wanted to cause harm.
• Discipline is warranted if illegal substances
were used.
• The caregiver's mindset and performance
should be evaluated to determine whether a
temporary work suspension would be
helpful.
• Help should be actively offered to the
caregiver.
• Discipline and/or legal proceedings are
warranted.
• The caregiver's duties should be suspended
immediately.
The Fair Evaluation and Response Chart
slide-45Pascal Metrics
Pascal MetricsPartially adapted from David Marx

46. 2. Second, use best judgment to categorize each action as either Reckless, Risky or Unintentional based on the
definitions in the Chart. The categorization determines the general level of culpability and possible
disciplinary actions, however these general categories require further analysis as below prior to making a
final decision.
RECKLESS ACTION
The caregiver knowingly violated a
rule and/or made a dangerous or
unsafe choice. The decision appears
to be self serving and to have been
made with little or no concern
about risk.
RISKY ACTION
The caregiver made a potentially
unsafe choice.
Their evaluation of relative risk
appears to be erroneous.
UNINTENTIONAL ERROR
The caregiver made or participated
in an error while working
appropriately and in the patients'
best interests
• The caregiver is accountable and
needs re-training. Discipline may
be warranted
• The caregiver should participate
in teaching others the lessons
learned.
• The caregiver is accountable and
should receive coaching.
• The caregiver should participate
in teaching others the lessons
learned.
• The caregiver is not accountable.
• The caregiver should participate
in investigating why the error
occurred and teach others about
the results of the investigation.
The Fair Evaluation and Response Chart
Partially adapted from David Marx. slide-46
Pascal Metrics

47. 3. Third, perform a Substitution Test by asking at least 3 others with similar skills if they, in a similar situation,
would act similarly. If the answer is “No” the individual is accountable. If the answer is “We do it all the
time” or answers are divided, assign accountability per below - and remember that an important goal is to
ensure others perceive responses as fair:
The system supports reckless
action and requires fixing. The
caregiver is probably less
accountable for the action,
and system leaders share in
the accountability.
The system supports risky
action and requires fixing. The
caregiver is probably less
accountable for the action,
and system leaders share in
the accountability.
The system supports error and
requires fixing. The system's
leaders are accountable and
should apply error-proofing
improvements.
4. Fourth, evaluate whether the individual has a history of unsafe or problematic acts.
If they do, this may influence decisions about the appropriate responsibilities for the individual i.e. they
may be in the wrong job. Organizations should have a reasonable and agreed upon statute of limitations for
taking these actions into account.
The Fair Evaluation and Response Chart
The Substitution Test is a concept of James Reason.
slide-47
Pascal Metrics

48. The Blame Cycle
Mgt. even
even more
convinced
that…
People seen to
choose erroneous
course of action
Deliberate actions
deserve sanctions
Exhort and punish
those making errors
Little or no effect
on error rates
Management view
this as deliberate
disregard of
warnings, etc.
STARTS HERE
James Reason, 2000

50. Use of the Machine
Typically, 2 machines for each 13 room hallway
Nurse has 5 patients placed throughout the unit
On average, each patient has between 7-10 medications
2-4 times per day
Nurse takes medications out 1 at a time

51. PERFORMANCE
ACCIDENT
System Migration to Unsafe Practices to
VERYUNSAFESPACE
The
guidelines
and policy-
take meds
out for one
pt. at a time
Belief
Systems
Life Pressures
INDIVIDUAL BENEFITS
More than one
patients meds
placed in
pockets=
Legal/normal
‘
All patients
meds placed
in pockets
= ‘‘‘‘Illegal-
Illegal’’’’ space Perceived
Vulnerability

52. Why the migration to less safe
practices?
Policy unmanageable
Nurses did not have the time to make several trips back
and forth to the machine several times a day
The medication cart had been taken away
No one had studied medication administration patterns
before installation
Safe dispensing ≠ safe administration

53. What migrations occur in your practice
area and hospital?

54. The two stories with very different
endings…
54

55. 55
Why did this end so well?
55

56. …and this so badly?
pacColumbia
Destroyed February 1,
2003

57. The history of foam-problem decisions shows
how NASA first began and then continued
flying with foam losses, so that flying with
these deviations from design
specifications was viewed as normal and
acceptable…The parallels (with Challenger)
are striking. The acceptance of events that
are not supposed to happen is known as
“normalization of deviance.
Report of the Columbia Accident Investigation Board 8/26/03. P 130.

58. Over the course of 22 years, foam
strikes were normalized to the point
where they were simply a maintenance
issue – a concern that did not threaten a
mission’s success.
Report of the Columbia Accident Investigation Board 8/26/03. P 181.

59. Culture
The culture of wanting to know the truth
The courage to face reality
Listening to staff and patients

60. • Commit to knowing the ‘thickness of your ice’
• Build a portfolio of safety work and capability at every
level
• Improve the SYSTEM of safety AND events
• Monitor AND measure
• Get the best and most complete picture of the issues
(data) and display in a way that is understandable and
compelling
• Train managers and leaders on use of the just culture
decision tools
• Have courage to face reality and speak the truth.
• Listen to patients and families!
Good places to start…