Three Goals for Near-Miss Systems

In an overview of near-miss systems in the industrial and transportation domains, Van der Schaaf et al. (1991) distinguish three different goals¹ of near-miss reporting and analysis:

• Modeling—to gain a qualitative insight into how (small) failures or errors develop into near misses and sometimes into adverse events. Eventually this insight should make it possible to identify the set of factors leading to the initial failures, as well as those enabling/promoting timely and successful recovery. As compared with adverse events, the added advantage of the recovery component should enable a more balanced view of how patient safety can be improved, focused not only on preventative measures to address the failure factors identified but also on means of building in or strengthening the recovery factors that come into play once errors have occurred.
• Trending—to gain a quantitative insight into the relative distribution of failure and recovery factors by building a database of underlying root causes of a large number of near misses. This database allows trending of the relative frequency of the various factors over time and thus provides a way to prioritize the most prominent factors as possible targets for error-reduction or recovery promotion interventions. Near misses, being 7–100 times more frequent than adverse events (Bates et al., 1995a; Bird and Loftus, 1976; Heinrich, 1931; Skiba, 1985), allow for a much faster buildup of such databases, even at the lowest levels of a national reporting system (e.g., a single hospital department, a primary care provider's practice). Although To Err Is Human (Institute of Medicine, 2000) estimates the numbers of adverse events and associated fatalities to be very large nationwide, they are still infrequent at the lowest levels of the health care system and thus offer little insight into fundamental, frequently recurring underlying system factors on which to base the most efficacious safety improvements.
• Mindfulness (Kaplan, 2002)/alertness—to maintain a certain level of alertness to danger, especially when the rates of actual injuries are already low within an organization. For those employed in work environments with a mature safety culture, it eventually becomes difficult to maintain a minimum level of risk awareness in the absence of clearly visible adverse events. A weekly or monthly reminder in the form of a near miss in that same work situation may serve to reinforce awareness of specific safety risks that continue to exist, as well as demonstrate informal recovery defenses in action. It may be necessary to publicize the details of such near misses to ensure that all front-line workers are alerted to the continuing risks.

The Causal Continuum Assumption

Since the 1930s (Heinrich, 1931), most safety experts have assumed (based on anecdotal evidence) or claimed that the causal factors of consequential accidents are similar to those of nonconsequential incidents or near misses. Yet this so-called causal continuum assumption has not yet been firmly established as a scientific fact in health care. To date, this relationship has been documented only in recent transportation safety research (Wright, 2002). The pattern of failure factors for near misses in the railway sector was, by and large, not statistically different from that for train accidents involving injuries and damages. The claim in the health care domain that addressing the causes of near misses will also aid in preventing actual adverse events and fatalities will have to based on more than anecdotal evidence if that claim is to be widely accepted and therefore worth acting upon.

Currently available databases could be used to test the causal continuum assumption in health care. In fact, in one study that evaluated this assumption in health care, the characteristics of near misses were found to be somewhat different from those of errors that resulted in harm (Bates et al., 1995a). In particular, for medication errors, near misses involving a modest overdose were more likely to result in harm than errors involving massive overdoses since the former actions were more likely to be carried out. However, the underlying causes of near misses and adverse events (a lack of medication knowledge) were similar.

The Dual Pathway

One aspect of near-miss versus adverse event reporting that is relatively unknown but highly valued in practice is that near-miss reporting provides a dual pathway to improved system performance:

• The direct, analytical pathway, which near-miss and adverse event systems have in common, is based on collecting incident data; analyzing root causes; and acting upon the most important causes, thereby gradually improving the system and achieving better (safety) performance.
• In addition, near-miss systems appear to offer a second, indirect, cultural pathway to better performance: when reporters increasingly learn to trust the near-miss system as a means for communicating about and gradually improving patient safety, each voluntary decision on their part to report another near miss (instead of keeping it to themselves) helps change their attitude and ultimately their behavior as well, again leading to better performance. This slower, less visible, but fundamental and long-lasting cultural pathway is even regarded by some health care managers as more valuable in the long term than the straightforward analytical path (Joustra, 2003).

The Role of the Patient

As stated above, the dependence of near-miss systems on (voluntary) reporting by health care staff affects staff attitudes much more profoundly than is the case with systems not dependent on such personal commitment. However, playing an active role in detecting risks to patient safety is not necessarily limited to staff; patients themselves may be put in a position to contribute, for example, by being encouraged to ask questions about their care. In some cases, patients may help monitor their daily medications or medical treatment procedures, provided this information is supplied to them in an accessible format.

In this sense, patients (and by extension their family and friends) may be viewed as an extra, highly motivated line of defense. At the same time, involving patients in monitoring their own care clearly must be approached with caution and must be additional to, not a substitute for, the monitoring provided by systems and individual caregivers. Where patients provide an additional layer of monitoring, there could be a tendency in rushed circumstances to place total reliance on this mechanism. Moreover, many patients may be unable to contribute anything toward monitoring their own care because they lack the required information or have impaired cognitive or sensory skills.

In general, however, patients (and their family and friends) are a vastly underutilized resource for identifying things that go wrong in health care. Where possible, they should be encouraged to report incidents, especially those in which they averted potentially harmful consequences (e.g., by refusing to accept pills that differed in appearance or meals that did not conform to their dietary requirements).

Learning from Databases, Not Just from Single Incidents

One of the consequences of the traditional focus on incidents in which patients were actually harmed in the belief that such incidents can yield more fundamental lessons is a lack of data at lower levels of the health care system. Rarely (if ever) do errors or failures end up causing severe damage to a patient in any single hospital department or primary care practice. Inevitably, such occasions receive a great deal of media attention. The result is often massive investments designed to prevent such (possibly very rare) mishaps from recurring, at least in part because of the attention they attract and the desire of hospital managers to be seen as acting swiftly. Because of the salience of the outcome, the analysis is subject to hindsight bias.

An incident-by-incident learning mode is reactive, based on specific characteristics of single events, and in most organizations consumes a major portion, if not the entirety, of the budget available for improving the system. An alternative proactive learning approach (Reason, 1990), at least with regard to adverse events and fatalities, is to collect data on large numbers of events; analyze the root causes; build a database of these causes; and then act upon the underlying patterns of causes, which are much more likely than single events to point to systemic or latent (Reason, 1990) problems. Indeed, some systemic or latent causes that can be uncovered through aggregate databases can be identified not at all, or not as efficiently, by analysis of single incidents. Given that the majority of adverse events occur infrequently, large incident databases may be necessary to provide sufficient examples for purposes of analyzing rare events such as gas embolism or anaphylaxis.

Need for Root-Cause Taxonomies

If one wants to rise above the level of single events and their causes and base interventions on the most frequent and important root causes found in large databases, a root-cause taxonomy is needed. The causal factors fed into these databases should be made comparable at a general, abstract level so that they are quantifiable. Various aspects of the event will require different (sub)taxonomies:

• Failure root causes require a generic, fixed taxonomy, which should be identical over all medical/health care domains so that the system can be optimized overall, rather than within each domain This taxonomy should also acknowledge that patients themselves sometimes contribute to near misses and adverse events.
• Recovery root causes require a similar taxonomy. This taxonomy is likely to overlap somewhat with the categories of the failure taxonomy but will differ in some respects because of the more complex recovery phases of detection, diagnosis, and correction, each with their specific enablers (Van der Schaaf and Kanse, 2000).
• Context variables, although not causal, provide additional useful background information, such as the who, what, when, where, and consequences of an event. Context variables may well be largely domain specific, allowing analysis tailored to a specific reporting system. There is considerable overlap in the context variables collected for near-miss and adverse event analysis.
• Free text encompasses the reporters' narratives on which the event analysis was originally based. These narratives should be stored with the analysis results, with consideration of requirements for deidentification, to allow for later, off-line analysis, especially by external researchers.

General Functional Specifications

Van der Schaaf (1992) outlines four essential characteristics of near-miss systems:

• Integration with other systems—Not only should a near-miss system contribute to and benefit from adverse event reporting systems, it should also be integrated, wherever possible, with other approaches used to measure, understand, and improve the performance of health care systems, such as audits of employee safety conducted by the National Institute for Occupational Safety and Health, total quality programs, environmental protection programs, maintenance optimization efforts, and logistics cost reduction programs.
• Comprehensive coverage (in a qualitative sense) of possible inputs and outputs—The system should be able to handle not only safety-related near misses but also events with actual adverse consequences and with a range of different types of consequences (i.e., quality-, environment-, reliability-, and cost-related). It should cover not only negative deviations from normal system performance (errors, failures, faults) but also positive deviations (successful recoveries). Finally, it should focus not only on human errors or technical failures as factors contributing to a near miss but also on underlying latent organizational/managerial causes.
• Model-based analysis—To the extent possible, a system model of health care work situations, including a suitable description of individual behaviors in a complex technical and organizational environment, should be the basis for the design of the information processing portion of the near-miss system. Effective handling of the data encompasses (1) the required input data elements (taken from free-text near-miss reports), (2) methods for analyzing a report to identify root causes, and (3) methods for interpreting the resulting database to generate suggestions to management for specific countermeasures.
• Organizational learning as the system's only focus, that is, the development of progressively better insight into system functioning—As discussed in Chapter 6, except for clear instances of willful criminal acts (which are unlikely to be managed through such channels), the output of a near-miss system should never lead to assigning blame to or punishing individual employees or even be used to evaluate them. Rather, the emphasis should be on learning how to continuously improve patient safety by building feedback loops into the near-miss system. At the individual level, organizational learning can be improved by staff education and learning.

Types and Levels

In designing a near-miss system, two important dimensions are the medical domain it will cover and the level (from local hospital department or primary care practice, to hospital, to nationwide) at which it will function. An example is shown in Table 7-1. The four cells in this table can be divided into three levels of complexity of a near-miss system:

TABLE 7-1

Examples of Two Dimensions of a Near-Miss System.

• The basic level of the local, one-domain system (I)
• The intermediate level of the hospital-wide or the domain-specific nationwide system (II and III)
• The upper level of the nationwide system covering all domains (IV)

Ideally, the design of a near-miss system should progress from the lowest to the highest level of complexity. Doing so will ensure a continuous flow of voluntary reports, which can be expected to be produced mainly by the cell I systems; to be passed on to the aggregate intermediate-level systems; and finally to reach the highest, comprehensive level of cell IV. Continued willingness to provide such input will depend greatly on its direct effects on those reporting, that is, insight into their work situation with regard to patient safety, specifically for their single-domain department. Considering the need for root-cause taxonomies cited earlier, this approach to designing a near-miss system means that:

• To the extent possible, all of these types and levels should have identical causal taxonomies (for both failure and recovery factors) and identical free-text structures (for the original input narratives).
• Some basic context variables (i.e., those for type of patient, type of consequences) should also be fixed across levels and domains, while other specific context variables will vary with domain (i.e., type of treatment, medication, diagnosis) and/or level (i.e., codes for (sub)departments, protocols) to ensure enough specificity to provide useful and therefore motivational feedback.

As long as standard terminologies and taxonomies are used, data can be reported and acted upon at different levels of granularity. Coarser classification is necessary with the smaller collections available at the local level, but much finer granularity is possible when analyzing data from a large number of institutions. The strength of large-scale collections is that rare events can be well characterized.

Problems of Data Collection

The following specific problems involved in data collection (Lucas, 1987) must be addressed to achieve a successful near-miss system:

• Action oriented—a tendency to focus on what rather than why.
• Event focused—analyzing individual incidents rather than looking for general patterns of causes in a large database. The result is anecdotal reporting systems.
• Consequence driven—making the amount of attention and the resources devoted to investigation directly proportional to the severity of the outcome.
• Technical myopia—a bias toward hardware rather than human failures.
• Variable quality—both within and between reporting systems, leading to incomparable investigation methods and results.

Keeping It Manageable

Instituting and running a near-miss system should not burden an organization unduly. As noted in Chapter 6, automated surveillance systems, augmented by other detection methods, will increase the number of detected adverse events that might warrant further analysis. Since near misses occur much more frequently than adverse events (Bates et al., 1995b), an organization could become overwhelmed by the number of near misses that might warrant further analysis. Once a near-miss system has been functioning for a while, it is crucial to establish selection criteria that can identify a manageable number of reported events with enough learning potential to warrant full root-cause analyses.

In addition to the criteria mentioned in Chapter 6, likely candidates would include the novelty or surprise factor—new elements not seen before, even considered impossible. Another criterion could be potential fatal consequences or the realization that this event must have been latent in the organization for a long time, passing through many barriers that should have caught it earlier. Also, when an event is one that should have been prevented by a recent focused intervention, one would like to know why it still occurred.

Finally, an organization may have selected a certain type of medical event (such as wrong-side surgery or switching of patients' identities) as a topic of special concern for a limited period; in that case, it might prefer to select all such reports for full analysis until the end of the project.

Integration with Adverse Event Systems

Near misses are regarded as being on the same continuum as adverse events in terms of failure factors but differing in terms of the additional information they provide on recovery factors and in their significantly higher frequency of occurrence. Because the assumption of the causal continuum implies that the causes of near misses do not differ from those of adverse events, this leads to the claim that near misses are truly precursors to later potential adverse events and therefore valuable to report. The primary focus for improving patient safety is on identifying and eliminating the system faults that can lead to adverse events. This objective can be approached by analyzing both adverse events and near misses to identify the system faults involved.

A direct causal comparison between near misses and adverse events requires shared taxonomies for sets of events in terms of both root causes and context variables. After enough adverse events or other serious medical mishaps have been reported and analyzed to build a statistically sound database for a health care organization, the amount of overlap between the causes of near misses and adverse events should be examined. Doing so will not only clarify the relationship between these two sets of events but also demonstrate clearly and convincingly to all potential reporters the importance of near-miss systems. In some cases, adverse event descriptions also encompass recovery actions that were obviously too late, too weak, or of the wrong type to have been successful. In these cases, such failed opportunities at recovery, or at least damage limitation, can be classified using the taxonomy for near-miss recovery factors and compared with successful recoveries to understand the predictors of success.

Definitions and Models

Clear, workable definitions and models should be formulated for all system and data elements necessary for collecting, analyzing, and learning from near-miss events, as well as for sharing these data and analysis results within and among all levels and domains of the health care system. Care should be taken to ensure maximum overlap between such near-miss standards and those for adverse events. Where possible, tested definitions and models from both within and outside the medical field should be preferred. The various possible goals of near-miss systems should be reflected in these definitions and models, as well as potential roles of patients and their relatives.

Taxonomies

Classification systems for root causes (both failure and recovery) and context variables are essential for aggregating and comparing near-miss data. Failure taxonomies should allow a balanced, unbiased analysis of the human, technical, and organizational causes involved in an event. Recovery taxonomies will need further development but should at least distinguish among the detection, diagnosis, and correction phases of the recovery process. Contextual variables should be shared where possible among all domains and levels and remain specific as necessary to furnish enough detail within a certain domain or level to provide useful feedback and lessons for local improvement.

Design and Operation of System Components

Following the seven-module framework outlined above, system design and operation standards should address the following issues:

• Detection—Reporting should be as easy and quick as possible, through multiple channels, for medical staff, patients, and others present. The low threshold means that in this first module a report cannot be anonymous, as additional information may be required from the reporter. The report should, however, be strictly confidential at this phase.
• Selection—Predictably large numbers of incoming reports should be evaluated for their learning potential to determine whether root-cause analysis will be worthwhile; criteria for selection are essential to prevent the near-miss system from being flooded and should be specific for the local and national levels.
• Description—A concise description of all relevant elements, from root causes to the reported event, in their chronological and logical (i.e., cause–effect) order demands tree-like techniques. For near-miss data, these techniques should allow/be adapted for describing recovery elements as well as failure elements. After any additional information needed to complete and validate the event description has been furnished, the reporter's name is no longer needed and should be deleted, along with other possible identifiers.
• Classification—Identified failure and recovery factors and context variables require a set of transferable, learnable (and therefore relatively simple) taxonomies based on accepted safety management models and local/domain needs.
• Computation—At higher levels especially, near-miss database structures should allow for large numbers of coded events, easy queries, data mining, and state-of-the-art statistical analysis. At lower local levels, ease of use and preprogrammed recurring analyses for feedback to the reporting community are essential as well.
• Interpretation and implementation—Targeted (dominant) root causes should be linked to suggestions for methods of addressing them. The matrix should be based on accepted safety management models. Management should be supplied with this advice in a form that supports optimal decision making on the allocation of resources to patient safety improvement actions and then monitored with regard to whether these improvement programs have been implemented.
• Evaluation—It is essential that the effects of implemented programs be monitored. Monitoring not only allows for the establishment of a learning cycle (whether the right action was taken on that problem) but also provides highly motivating feedback to all (potential) reporters, who can then see for themselves how their contributions to the database help increase patient safety.