safety-i, safety-ii, and the messy details of clinical work robert l wears, md, ms, phd university...
TRANSCRIPT
Safety-I, Safety-II,And the Messy Details of
Clinical Work
Robert L Wears, MD, MS, PhD
University of FloridaImperial College London
International System Safety Society8 October 2015
2
apologia and cautions
background in healthcarealmost exclusively the ERtrying to overcome my background as a doctor …
3
2 important differencesorganic vs engineered systems
4
2 important differences
irreducible ambiguity
5
motivationgeneral agreement that we are not making progress on
safety as fast as we would like
what’s typically being said …we have not been ‘Protestant enough’
more rigour (eg, EBM)greater accountability
‘just do it harder’
6
motivationgeneral agreement that we are not making progress on
safety as fast as we would like
what’s not being saidwrong mental model of safety – utopian scientism
“… enduring Enlightenment projects“… rationality can create a better, more controllable world“… taken for granted by safety researchers b/ it appears so
ordinary, self-evident and commonsensical.”*
*Dekker 2012
7
patient safety orthodoxy
technocratic, instrumental, ‘measure-and-manage’ approach
myopic – failing to question underlying nature of problems
overly simplistic – transferring sol’ns from other sectors
negligent of knock-on effects of change‘amateur social science’
“glosses over the complexities of health care organisation and delivery”
8
a missed opportunityclinical expertise necessary but not sufficient for safety
“‘errors’ in medicine, and the adverse events that may follow, are problems of psychology and engineering, not of medicine”
- J Senders, 1994
needed to partner with ‘safety sciences’psychology, human factors engineering, social science, communication, etc
but instead got ‘scientific-bureaucratic medicine’managerial rationalism wearing the mantle of science‘the safety Nazis’ ‘we have ways of making
you safe…’
9
safety is a ‘wicked problem’
“… it is far harder to make progress on safety than we thought … the programmatic approaches (checklists, team training, reporting) are all quite positive about the effects of their interventions but the experience we have when trying to apply those approaches is uniformly unsatisfying.
“… the factors that create ‘the safety problem’ are deeply embedded in the system of work [including all the incentives and organizational structures that surround and promote work] and these programs don’t alter these factors. The system we have is a product of numerous compromises and sacrifices that are needed to “make things work” and the deep system that results is far more anchored and grounded than we appreciate.
“… Instead, we have chosen to do things that give the appearance of improving safety so that we can feel better … these programs make it easier for us all to live with deeply flawed, dangerous systems.
10
safety is a ‘wicked problem’
“This explains why we have so many programs for safety: we embrace a program to make ourselves feel better about the system of work. This does make us feel better, for a while. But eventually the deep system demonstrates in clear, unambiguous fashion, that we haven’t made real progress. Instead of taking this as evidence that we have fundamentally misunderstood what is going on, we conclude that we chose the wrong program and look for another one to restore our sense that we are making progress on safety.
“To be sure there are real advances. Our technology, knowledge, and skill are constantly improving. But we choose to exploit these advances to accomplish more or to spend less rather than to make the work itself safer. We struggle to do this in a ’safety neutral’ way — ie, trying to keep the bad outcomes at about the same level as before while benefitting from the improvements — but this is always a process of discovery because the forms of failure are constantly changing.”
- R I Cook, 2014
11
limits of the Enlightenment
“good ideas that are nevertheless incorrect”- René Amalberti
12
simple models of accidents are
delusions
13
simple models of accidents are
delusions
14
complex adaptive systems
distinguish between simple, complicated, and complex problems
baking a cake
landing on the moon
raising a child
little expertise required, highly standardized, formulaic solutions work
many causes, many parts, break into simple problems & manage piece by piece
complexity emerges from interaction of parts, can’t be decomposed, must deal with the whole
15
complex adaptive systems
distinguish between simple, complicated, and complex problems
taking vital signs
placing a central line
handing off a pt or unit
little expertise required, highly standardized, formulaic solutions work
many causes, many parts, break into simple problems & manage piece by piece
complexity emerges from interaction of parts, can’t be decomposed, must deal with the whole
16
complex adaptive systems
separating complicated and complex is essential
placing a central line
handing off a pt or unit
particulars, context largely irrelevantparadigmatic mode of thinking
particulars, situatedness, context are everythingnarrative mode of thinking
17
18
19
modern theories of accidents
simple, linear, chain of events
complicated, interdependent
complex, nonlinear, coupling, resonance, emergence
evolution of system safety
1940 1960 1980 2000
20
21
view from safety-Iaccidents come from erratic acts by people
(variability, mistakes, errors, violations)
study, count accidents to understand safety(tend to look backwards)
focus on componentssafety is acquired by constraining workers via:
standardisation, guidelines, procedures, rules, interlocks, checklists, barriers
22
assumptions in safety-I
our systems are well-designed and well-understoodprocedures correct and complete
systems are basically safe, well-protectedreliability = predictable, invariant
variation is the enemy safety is an attribute
(something a system has)
conditions are well-anticipated, well-specified
23
24
view from safety-IIaccidents are prevented by people adapting to conditions
study normal work to understand safety(tends to look forward)
focus on inter-relationsaim is to manage, not eliminate, the unexpected
safety is enacted by enabling workers via:making hazards, constraints, goal conflicts visible
enhancing repertoire of responses
25
assumptions in safety-II
our designs are incomplete, procedures out-datedour systems are poorly understood
systems are basically unsafereliability = responsiveness
variation is necessary safety is an activity
(something a system does)
possible failure modes have not been anticipated‘continuing expectation of surprise’
safety-II
26
complex STS intractable, underspecified, variable demands
resources (time, people, material, information) limited, uncertain
workers adjust to meet conditions creating variability
adjustments always approximate (b/ resources limited)
approximate adjustments usually reach goals, make things go safely
approximate adjustments sometimes fail, or make things go wrong
“Knowledge and error flow from the same mental source; only success can tell one from another.”
Ernst Mach, 1905
safety-I vs safety-II summary
defined by its opposite - failurewell designed & maintained, procedures
correct & completepeople (ought to) behave as expected &
trainedaccidents
come from variability in abovetherefore
safety comes from limiting & constraining operators via
standardization, procedures, rules, interlocks, barriers
critical inquiry‘work as imagined’
defined by its goal - successpoorly understood, incomplete,
underspecifiedpeople (ought to) adjust behaviour &
interpret proceduresaccidents
come from incomplete adaptationtherefore
safety comes from supporting operators via
making boundaries, hazards, goal conflicts visible, enhancing repertoire of responses
appreciative inquiry‘work as done’
28
philosophical bases
safety-Ilinear, proportional, tractablebehaviour explained by reductionpositivist, Tayloristcause-effect simple, onewaycontrollable‘the one best way’
work as imagined
values declarative, technical knowledgecomplicated problemstechne, episteme
safety-IInon-linear, non-proportional, intractablebehaviour explained by emergenceconstructivist, interpretivistcause-effect multiple, reciprocalinfluence-ableequifinality, multifinality
work as done
values practice, tacit wisdomcomplex, ‘wicked problems’mētis, phronesis
29
empirical supportdirect observations & NSQIP
datasurgeons w/ best results
had just as many untoward events as those w/ worst
but they had better means of detectiongreater repertoire of responses
de Leval 2000Ghaferi 2009
30
another important differenceresilient vs brittle systems
31
resilience – multiple conceptions
first appeared ~1600sfrom Latin resiliens “to rebound, recoil”
re- “back” + salire “to jump, leap”
rebound from some traumatic event
32
resilience – multiple concepts
robustnessexpand base capacity to handle more disruptions
‘enlarging design basis’
brittleness vs graceful degradationbring ‘extra’ adaptive capacity to bear
in the face of potential for surprise
33
contrasting examples
directionsGPS (to bullets)CDs, mp3smost digital
mapsmapsLPsmost analog
34
resilience – formal definition
the ability of systems to adapt to sustain key operations in the face of expected or unexpected challenges
35
resilience and success
not just success in the fact of threats (resilient systems still fail)repertoire of behaviours, shifting performance, trading off goals to
dynamically forestall failure, mitigate failure in progress, or seize opportunities
“… redirect the failure pathway to another form from which recovery might be easier, less disruptive, less costly”
Cook, RI 2014
36
but a problemresilience only seen through its instantiations
like static electricity – can’t see it, but can see lightning
37
epiphenomena“… seeing holes or deficiencies in hindsight is not an explanation of the generation or continued existence and rationalization of those deficiencies.”
Dekker, S. W. A. (2011). Drift into Failure: From Hunting Broken Components to Understanding Complex Systems. Farnham, UK: Ashgate.
38
problem for engineering resilience“… seeing heroic recoveries in hindsight is not an
explanation of the generation or continued existence and rationalization of those recoveries.”
à la Dekker, S. W. A. (2011). Drift into Failure: From Hunting Broken Components to Understanding Complex Systems. Farnham, UK: Ashgate
39
hidden resilienceresilience must be present before it is manifested
“much of the stock of [a system’s] response is in the form of latent behavioural potential … outside of awareness and taken for granted until interruptions and attempts at recovery call attention to it”
Christianson, M. K., Farkas, M. T., Sutcliffe, K. M., & Weick, K. E. (2009). Learning through rare events: significant interruptions at the Baltimore & Ohio Railroad Museum. Organization Science, 20(5), 846 - 860.
40
WAI vs WADthe messy details
paramedics told to handoff to ED charge nurseget back out on street faster
charge nurse won’t be taking care of ptnot as interested in detailswill hand off to another nurse
‘secret, second handoff’
41
WAI vs WADthe messy details
diagnostic workup for cancershould be ‘fire & forget’
2/3 of cases required 1 or more additional staff actionsno difference in time to dx
42
43
risks in human activities
no system beyond this
point
10-2 10-3 10-4 10-5 10-6
civil aviation
nuclear industry
railways
chartered flight
chemical industry (total)
fatal risk
blood transfusion
elective surgery
very unsafe ultra safeunsafe safe
mountaineering
professional fishing
off shoredrilling
oil industry (total)
anesthesiology asa 1-2
radiotherapyemergencyicuoncology
medical risk (total)
fire fighting
satellite launch
space missions
rotary wing
trams, tubes
no system beyond this
point
10-2 10-3 10-4 10-5 10-6
civil aviation
nuclear industry
railways
chartered flight
drilling industry
chemical industry (total)
fatal risk
anesthesiology asa1
innovative medicine (transplant, oncology …) icu, trauma, ed
very unsafe ultra safe
professional fishing
three contrasting safety models
unsafe safe
mountaineering
combat c/c, war time
ultra resilient context: taking risks is the essence of the work cult of fighter spirit, champions, heroes, villains safety model: power to experts‘give me best chances and safest tools to survive in these adverse conditions and make exploits’safety training: learning through shadowing, acquiring professional experience, "training for zebra", working on knowing one's own limitationsunknowable events model
ultra safecontext: risk is excluded as much as possiblecult of applying procedures and safety rules by an effective supervisory organization safety model: power to the regulators of the system to avoid exposing front-line actors to unnecessary riskstraining in teamwork to apply procedures and manage work even if abnormal events occurprecluded events model
medical risk (total)radiotherapy
blood transfusionelective surgery chronic care
reliabilty modelcontext: risk is not sought out, but it is inherent in the activity cult of group intelligence and adaptation to changing situations safety model: power to the group, ability of the group to organize itself (roles), to provide mutual protection to its members, to apply procedures, to react to anomalies, to adapt, perceive changes and make sense of changes in the contexttraining in teamwork to gain knowledge of abilities and adaptability in applying procedures to suit the contextreact to events model
finance fire fightingfood industry
processing industry
more safety-Imore safety-II
46
conclusions – maybe?
health care has many resilient systemsthe sources of that resilience are not clear
resilience is being consumed to enhance productivitythis is normal
(fr Richard Cook)
47
resourceshttp://resilienthealthcare.net/
2016 workshop and call for papersWhite Paper on Patient SafetyTurning Patient Safety on its Head
http://www.resilience-engineering-association.org/Plans for 7th REA Symposium will appear here
Fairbanks et al (2014). Resilience and resilience engineering in healthcare. Joint Commission Journal on Quality and Patient Safety, 40(8), 376 - 383.
Woods, D. (2015). Four Concepts for resilience and the Implications for the Future of Resilience Engineering. Reliability Engineering & System Safety, 141, 5-9.
