Kaiser Permanente's Response to JCAHO's Sentinel Event Standards: Our Significant Event Root-Cause Analysis Program Leads to Preventing Medical Errors.
By Ricki Stajer, RN, MA, CPHQ; Bud Pate, REHS

Introduction
The prevalence of medical errors has galvanized health care leaders, regulators, politicians, and accreditors around the issue of improving patient safety. Proposals for mandatory reporting of medical errors are currently being studied by the US Congress; at the same time, the Joint Commission for the Accreditation of Health Care Organizations (JCAHO) has heightened its requirements for analyzing root causes of Sentinel Events.

Health care is an inherently risky business that is also extremely complex--and becoming increasingly so. Hospital care is more complicated, patients are sicker, choices among medications are more numerous, and technology is more sophisticated than ever before. Paradoxically, the technologic advances that help achieve medical miracles also increase the chances that something will go wrong.

Although some medical errors are inevitable, many are preventable. Most medical errors are not the result of negligence or incompetence but of faulty systems and poorly designed processes that increase the likelihood of mistakes. We believe that frank, open discussion about the vulnerabilities in our health care systems can help reduce errors and create safer environments; however, this type of discussion requires a fundamental shift in attitude. With this requirement in mind, Kaiser Permanente (KP) developed a process designed to change the culture of reporting medical errors. Our intent is threefold: to move away from defensiveness and pointing fingers, to identify flaws in the system, and to design ways to create a safer patient environment.

Root-Cause Analysis: the Push from JCAHO
Patient safety has always been a priority of our organization. Our policies and procedures provide strict internal quality control measures that far exceed those mandated by federal, state, local, and independent oversight groups. Quality and risk management committees routinely examine unexpected deaths and errors and monitor patient safety issues.

Although not a new concept for those familiar with quality improvement, root-cause analysis has attracted a resurgence of interest as a result of the Joint Commission on Accreditation of Healthcare Organizations (JCAHO) policy for identifying and managing medical errors. The process is designed to foster a blame-free environment that encourages several activities: systematic reporting of Significant Events; in-depth analyses done to identify the "root" or ultimate systemic cause of errors; implementation of barriers or safeguards to reduce the likelihood of similar errors occurring in the future; and dissemination of lessons learned.

To improve its processes of event analysis, the KP California Division incorporated theories and concepts taught by, among others, Drs Lucian Leape, Richard Cook, and James Reason as well as organizations such as the National Patient Safety Foundation and the Institute for Healthcare Improvement. Input of KP physicians, directors of quality assurance programs, risk managers, senior leaders, committee chairpersons, nursing representatives, and other internal resources are also reflected in these processes.

Defining JCAHO's "Sentinel" and KP's "Significant" Events
All would agree that a medical mistake that makes the headlines is a Significant Event. The wrong leg amputated, for example, or a chemotherapy overdose are definitely Significant Events. Most errors don't make the headlines, however, and are considerably less dramatic.

The KP definition of a Significant Event is consistent with JCAHO's definition of a Sentinel Event¹ (any unexpected occurrence involving death or serious physical or psychological injury or risk thereof), but we take this definition a step further: Our definition of a Significant Event is any unexpected clinical or nonclinical occurrence that results in loss of life or bodily harm, disrupts operations, or threatens the organization's assets and reputation. The definition also includes "near misses"--any breakdown in process that carries the risk of a serious adverse outcome.²

Significant Events range from unanticipated death of a patient to outbreaks of nosocomial infection to fires and accidental release of hazardous materials. Kaiser Permanente classifies Significant Events into three levels, with Level 1 the most serious (see sidebar).

Fostering Blame-Free Reporting
Fear of blame and its consequences tends to drive mistakes "underground." Not all mistakes are hidden, however; obviously, the more egregious errors are impossible to hide. Nonetheless, for every adverse event that sets the rumor mills abuzz, many more such events occur that we would rather ignore: mishaps where the error was caught before harm was done. Yes, our policy is to report them, but the natural inclination is not to do so.

Because health care still relies primarily on training and standards to prevent errors and enforces standards by imposing punishment for lapses, health care workers have a strong incentive not to report mistakes. This incentive robs clinicians and others of two more beneficial incentives: to investigate underlying causes that may have contributed to the error and to make the necessary changes to prevent recurrence.

Complex systems fail because of the combination of multiple small failures, each individually insufficient to cause an accident.³ Numerous steps exist along the way to completing even a simple process, and numerous steps lead to numerous opportunities for error; and any unreported error--even a "near miss"--is a lost opportunity for improvement.

The KP Significant Event policy requires regional reporting and root-cause analysis of Level 1 and 2 events, but because reporting even minor errors can help us to pinpoint flaws in the system, we encourage staff to report all errors. We emphasize that we are looking for ways in which systems fail; we are not seeking to pinpoint blame. The more we learn why things go wrong, the more safeguards can be put in place to prevent error recurrence.

An example of this is the problem of the missing identification bands for infants. When we noticed a cluster of minor (Level 3) events, our analysis revealed that the bands are very difficult to keep on small wrists. The bands slip off, and rebanding the babies is a cumbersome, time-consuming task. Postpartum obstetric units tend to be hectic places where mistakes can occur when information is transferred onto new bands. Underlying the problem was the type of bands being used: The design required nurses to slip their fingers inside the bands, thereby automatically widening them. When (as typically happens) babies lose weight, the bands become too big and fall off. The solution was a new banding system with a pull-through lock that can be tightened as the baby loses weight.

A blame-and-punishment culture would have called for discipline of the nurse who put the wrong information on the wristband. This approach would have ignored other factors that enabled the error to be made and would thus have done little to ensure that the error did not happen again. In short, nothing would have been learned.

Significant Event Defined Level One Infant abduction or discharge to the wrong family Rape of a patient Hemolytic transfusion reaction Any invasive procedure--wrong patient; wrong side, organ, or part Suicide of a patient in a 24-hour care facility Unexpected death or loss of function not related to the natural course of illness Significant deviation from the usual processes of care Adverse media attention Level Two Nosocomial outbreak or foodborne illness Reportable incident to the State Board of Medical Examiners or National Practitioners' Data Bank Internal or external disaster Regulatory sanctions Release of toxic substance Suicide within the KP Program Cluster of Level 3 events Level Three Unusual occurrences

Root-Cause Analysis of a Significant Event
To prevent errors from recurring, we need a thorough understanding of why they happened. The natural tendency is to blame the person closest to the problem (in most cases, this person is the caregiver), but doing this often diverts our attention from the system's flaws that may have contributed to the error.

Root-cause analysis drills down through the system to examine why the mistake occurred, rather than who made it; the goal is not to point fingers but to learn from the mistake so that future mishaps can be prevented.

Let's look at a hypothetical significant incident (Table 1):

At 8:10 am, Sally Trueman, a 65-year old woman, arrives at the Radiology Department for an intravenous pyelogram (IVP), scheduled for 8:30 am She checks in with the receptionist and sits down in the waiting room.

Five minutes later, she is joined in the waiting room by Anna Lui, a 75-year-old widow, who is accompanied by her son. Mrs. Lui, who did not check in with the receptionist, sits down to wait for her 8:30 am abdominal series.

The radiology technician calls Mrs. Trueman's name. Mrs. Lui stands up. The technician asks her if she is Mrs. Trueman. Mrs. Lui nods. At 8:35 am, the technician takes Mrs. Lui to the dressing room and asks her to change into a gown.

Mrs. Lui and her son are then taken into x-ray room 4. The radiology nurse comes in and asks the patient, through her son, about allergies and medications and then starts the intravenous line. Ten minutes later, at 9:10 am, the radiologist comes in to make his preprocedure assessment. At 9:20 am, the IVP is started for Mrs. Lui.

By 9:50 am, Mrs. Trueman, still in the waiting room, wants to know why she hasn't been taken in for her x-ray procedure.

Wrong patient, wrong procedure: A Level 1 Significant Event.

Now the detective work begins. Root-cause analysis is designed to reveal exactly what happened, each step along the way, from the moment the patient entered the system until the error occurred. The medical center's Risk Manager individually interviews all those involved--in our hypothetical case, this process would include the receptionist, radiology technician, nurse, and physician--makes notes, goes back if necessary to clarify discrepancies, examines charts, compares accounts, and creates a basic scenario of what happened. An interdisciplinary team is then formed with all the players in the event as well as representation from Administration and Risk Management. A facilitator keeps the process on track and discourages finger-pointing. Again, the goal is to focus on what went wrong with the system instead of just what a person might have done.

The team has two objectives: 1) Identify the root cause(s). If x had not happened, then the event would not have occurred. 2) Implement barriers, or safeguards, that will prevent the systems failure from happening again.

A chronology of action provides a clear picture of exactly what happened. In the case of Mrs. Lui, the chronology of action would look like Table 1.

Using this chronology, the team then sets out to discover what underlying conditions might have contributed to Mrs. Lui receiving the wrong procedure. During the investigation, the team discovers that Mrs. Lui did not check in with the receptionist and that she speaks no English. Asked by three different people whether Mrs. Trueman was really her name, she nodded.

Although Mrs. Lui had never been in the Radiology Department, Mrs. Trueman had been a member for many years and had received many diagnostic and treatment procedures. Mrs. Trueman apparently was accustomed to waiting. They also learned that the waiting room was full of patients and family members and that a receptionist had called in sick.

The radiology technologist, who was having a very busy day, wasn't entirely sure that the patient's son understood him, but because the son, too, kept nodding, the technologist decided he did.

When the son asked the Radiology Department RN how long the stomach x-ray films would take, she corrected him and told him the IVP would take 90 minutes. She thought he had made the mistake in terminology because he was a layperson.

The radiologist was suspicious of the patient's last name because she looked Asian, but when he asked the son whether Trueman was really the family name, the son again nodded, and the physician ignored his feeling that something was "out of sync."

Although how the error happened is fairly obvious, root-cause analysis digs much deeper. Significant Events are usually the result of multiple system failures--rather than the mistake of one person--and the team must determine all the weak points in the system before they can institute safeguards to prevent the mistake from occurring again.

Systems fail for many reasons--insufficient training, inadequate information, faulty tools and resources. In a process that might be likened to peeling away the layers of an onion, root-cause analysis keeps asking--why? This repeated questioning also identifies whether or not existing safeguards intended to prevent errors actually work.

In this instance, the chain of errors began when the technologist called for Mrs. Trueman and Mrs. Lui was taken into the exam room. Why? Because Mrs. Lui stood up. Why? Because neither she nor her son understood English. Why wasn't this recognized? Because they both kept nodding as though they understood. This scenario raises a number of systems process questions about existing safeguards--patient identification (ID) cards, charts and consent form signatures--that should have prevented the error. The scenario also brings up issues of patient and staff attitudes and communication.

Because teams often uncover contributing factors as well as root causes, improvement activities must be prioritized. The Barrier Analysis High-Level Casual Sequence Flowchart was developed to assist in the identification of key points on the chronology. They are moved to the flowchart for more intensive analysis (see Figure 1). To help teams identify what are truly root causes--causes most fundamentally linked to the event--and those that must be corrected in order to reduce risk to the next patient, participants are asked to complete a phrase: "If x had not occurred, then this Significant Event would not have happened." The team continues to ask questions until the answers are obviously beyond its realm of capability to change--budget constraints, staffing shortages, for example.

Blame is integral to human nature and, in a case like this, it is easy to see how the analysis process could lapse into finger-pointing. Why didn't the technician make sure he had the right patient? Why didn't the physician go with his hunch that something was wrong? Why didn't Mrs. Trueman stand up when her name was called? If she had, the whole thing wouldn't have happened...this time.

In performing root-cause analysis, the team must overcome blame and defensiveness so that the system can be opened up for review. To do this, participants are taught to focus on the system and away from the individual. The issue under review is not the clinical outcome but the event--the point in the system where the error occurred. In this case, the outcome was Mrs. Lui receiving the wrong procedure begun when Mrs. Lui answered to the wrong name and complicated by repeated missed clues. The Significant Event was the mix-up of the patients. The root cause was an inadequate patient identification system.

Outcomes are all about the previous patient. Root-cause analysis is designed to protect the next patient. What safeguards can be put into place to ensure that the error doesn't happen again? The idea is to create a safer patient environment by eliminating future risk instead of defending past practices.

Moving Beyond Blame and Punishment
The belief that human error is the most common cause of accidents is a comfortable one because it provides satisfying closure to an accident. The culprit is identified, removed from practice, or put through remedial training. Blame is emotionally satisfying; the problem is that it doesn't fix the problem.

In fact, blame is like a huge boulder on the road to progress. Until you can move beyond it, proceeding with the more constructive work of fixing what is wrong with the system is difficult. But although we understand how destructive blaming each other is to systems improvement, we continue to participate in it.

Through the root-cause analysis process, we have discovered that although blame is difficult to avoid entirely, it can be managed. One way to move beyond blame is simply to acknowledge its existence. Someone (in most cases, the caregiver) was to blame for the error. Mistakes happen. We can't prevent all of them or entirely eliminate the possibility that they will occur. When blame becomes an obstacle, actively recognize its presence and move on.

All this is not to say that we should not hold ourselves accountable for our performance. Patient care must be entrusted to those who can competently carry it out. If discipline is warranted, the decision must be made early in the review process, preferably right after the initial investigation and determination of the probable cause but before actual root-cause analysis. To expect much candor from anyone hovering under the cloud of possible discipline is unrealistic.

Ultimately, the opportunity to learn from the event may be more valuable than stifling participation with the threat of discipline. Remember, root-cause analysis expects that the people who are part of the process will make errors. By anticipating variation in human performance and designing our processes to account for them, we can go on to build safer systems.

Communicating Significant Event Findings
In Southern California, findings from each KP medical center's Significant Event analysis are reviewed at the Risk Managers' monthly meetings.

As a multidisciplinary clearinghouse, the Significant Event Review Committee (SERC) reviews all Significant Events occurring in KP Southern California facilities with the ultimate goal of ensuring patient safety. The committee works closely with similar structures in Northern California to coordinate and compare findings and to plan risk-reduction strategies. The committees also disseminate findings, analyses, and improvement strategies. All this information is incorporated into quarterly reports to the KFH/HP Board of Directors (see Figure 2).

Education and Training
The Root-Cause Analysis Program includes an educational support component for the methodology and uses experiential learning opportunities that include full-day workshops, learning modules, case studies, and work tools.

Participants attend workshops in which they learn to apply the methodology through the use of case studies and various work tools. Long-term consultative assistance is also available.

Training sessions are tailored to meet the needs of different audiences and management levels--leadership teams, department heads, chiefs-of-service, frontline employees, physicians, and nurses. Because these groups have diverse responsibilities, they require different levels of information regarding root-cause analysis work.

What We Have Learned to Date
Anecdotal feedback and analysis of actions taken since we implemented the root-cause analysis process tells us that measures focused totally on discipline have dropped and those aimed at systems improvement have increased.

Teams report that the Root-Cause Analysis Program methodology was helpful to them in uncovering underlying conditions and finding the root causes of the event.

Throughout the KP medical centers in California, we have also identified the following recurring themes:

• Look-alike and sound-alike medications that lead to medication errors
• Ineffective processes for patient and site identification prior to procedure and surgery
• Malfunctioning automatic staplers in perioperative areas
• Communication problems between disciplines and departments
• Coordination-of-care issues involving patients who are being cared for by many different services
• Failures in the transfer of important patient information, particularly when patients are "handed off" from one health care professional or department to another.

Conclusion
A few years ago, a KP advertising slogan was: "Good People, Good Medicine." As a philosophy, this premise has not changed. The health care professionals within our organization are competent, dedicated people, accountable for the quality of care they deliver. But we must recognize that even competent and dedicated people can make mistakes and that the mistakes are often reflections of weak points in our systems. The Institute of Medicine's recent report "To Err is Human" states: "Building safety into processes of care is a more effective way to reduce errors than blaming individuals."^4:4 The report also emphasizes that the "focus must shift from blaming individuals for past errors to a focus on preventing future errors by designing safety into the system."^4:5 In accordance with JCAHO requirements, KP has established a root-cause analysis process to better understand the underlying causes of system errors and to reduce the probability of recurrence. Although this process has already proved valuable, if we are to make significant improvement, we must move beyond the entrenched blame and punishment culture toward one of greater honesty and openness. Only in this way can we truly create a safer health care environment.

---

References
1. Sentinel Events. In: Joint Commission on Accreditation of Healthcare Organizations Department of Publications.
Comprehensive Accreditation Manual for Hospitals 2000. Oakbrook Terrace, Illinois: JCAHO Department of Publications, 2000, p. SE-1-SE-8.
2. Tolbert LD. The risk management approach at Kaiser Permanente Los Angeles Medical Center. Permanente J 1998 Summer;2(3):69-72.
3. Modified from Reason JT. Human error. Cambridge [England]; New York: Cambridge University Press, 1990.
4. Kohn LT, Corrigan JM, Donaldson MS, editors. Committee on Quality of Health Care. Institute of Medicine. To err is human: building a safer health system. Washington, DC: National Academy Press; 2000.

Related Articles
Blaming not point in sentinel event. OR Manager 1998 Dec;14(12):11.
Leape LL. A systems analysis approach to medical error. J Eval Clin Pract 1997;3:213-22.
Leape LL, Woods DD, Hatlie MJ, Kizer KW, Schroeder SA, Lundberg GD. Promoting patient safety by preventing medical error. JAMA 1998;280:1444-7.
Reason J. The contribution of latent human failures to the breakdown of complex systems. Philos Trans R Soc Lond B Biol Sci 1990;327:475-84.
Reason J. Understanding adverse events: human factors. Qual Health Care 1995 Jun;4(2):80-9.

Home | The Journal | Subscribe | For Authors | CME | Announcements | Links | Staff | Contact Us