Error in MedicineLucian L. Leape, MD

FOR YEARS, medical and nursing stu-dents have been taught Florence Night-ingale's dictum\p=m-\first,do no harm.1 Yetevidence from a number of sources, re-ported over several decades, indicatesthat a substantial number of patientssuffer treatment-caused injuries whilein the hospital.2-6

In 1964 Schimmel2 reported that 20%ofpatients admitted to a university hos-pital medical service suffered iatrogenicinjury and that 20% of those injurieswere serious or fatal. Steel et al3 foundthat 36% of patients admitted to a uni-versity medical service in a teaching hos-pital suffered an iatrogenic event, ofwhich 25% were serious or life threat-ening. More than half of the injurieswere related to use of medication.3 In1991 Bedell et al4 reported the results ofan analysis of cardiac arrests at a teach-ing hospital. They found that 64% werepreventable. Again, inappropriate useof drugs was the leading cause of thecardiac arrests. Also in 1991, the Har¬vard Medical Practice Study reportedthe results of a population-based studyof iatrogenic injury in patients hospi¬talized in New York State in 1984.5·6Nearly 4% ofpatients suffered an injurythat prolonged their hospital stay or re¬sulted in measurable disability. For NewYork State, this equaled 98 609 patientsin 1984. Nearly 14% of these injurieswere fatal. If these rates are typical ofthe United States, then 180000 peopledie each year partly as a result of iat¬rogenic injury, the equivalent of threejumbo-jet crashes every 2 days.

When the causes are investigated, itis found that most iatrogenic injuriesare due to errors and are, therefore,potentially preventable.4·7·8 For example,in the Harvard Medical Practice Study,69% of injuries were due to errors (thebalance was unavoidable).8 Error maybe defined as an unintended act (either

From the Department of Health Policy and Manage-ment, Harvard School of Public Health, Boston, Mass.

Reprint requests to Department of Health Policy andManagement, Harvard School of Public Health, 677Huntington Ave, Boston, MA 02115 (Dr Leape).

of omission or commission) or one thatdoes not achieve its intended outcome.Indeed, injuries are but the "tip of theiceberg" of the problem of errors, sincemost errors do not result in patient in¬jury. For example, medication errorsoccur in 2% to 14% of patients admittedto hospitals,9"12 but most do not result ininjury.13

Aside from studies of medication er¬rors, the literature on medical error issparse, in part because most studies ofiatrogenesis have focused on injuries (eg,the Harvard Medical Practice Study).When errors have been specificallylooked for, however, the rates reportedhave been distressingly high. Autopsystudies have shown high rates (35% to40%) of missed diagnoses causingdeath.1416 One study of errors in a medi¬cal intensive care unit revealed an av¬erage of 1.7 errors per day per patient,of which 29% had the potential for se¬rious or fatal injury.17 Operational er¬rors (such as failure to treat promptly orto get a follow-up culture) were found in52% of patients in a study of childrenwith positive urine cultures.18

For editorial comment see 1867.

Given the complex nature of medicalpractice and the multitude of interven¬tions that each patient receives, a higherror rate is perhaps not surprising. Thepatients in the intensive care unit study,for example, were the recipients of anaverage of 178 "activities" per day. The1.7 errors per day thus indicate that hos¬pital personnel were functioning at a 99%level of proficiency. However, a 1% fail¬ure rate is substantially higher than istolerated in industry, particularly in haz¬ardous fields such as aviation and nuclearpower. As W. E. Deming points out (writ¬ten communication, November 1987),even 99.9% may not be good enough: "Ifwe had to live with 99.9%, we would have:2 unsafe plane landings per day at O'Hare,16000 pieces of lost mail every hour,32000 bank checks deducted from thewrong bank account every hour."

WHY IS THE ERROR RATE IN THEPRACTICE OF MEDICINE SO HIGH?

Physicians, nurses, and pharmacistsare trained to be careful and to functionat a high level of proficiency. Indeed,they probably are among the most care¬ful professionals in our society. It is cu¬rious, therefore, that high error rateshave not stimulated more concern andefforts at error prevention. One reasonmay be a lack of awareness of the se¬verity ofthe problem. Hospital-acquiredinjuries are not reported in the news¬papers like jumbo-jet crashes, for thesimple reason that they occur one at atime in 5000 different locations acrossthe country. Although error rates aresubstantial, serious injuries due to er¬rors are not part of the everyday expe¬rience of physicians or nurses, but areperceived as isolated and unusualevents—"outliers." Second, most errorsdo no harm. Either they are interceptedor the patient's defenses prevent injury.(Few children die from a single misdi-agnosed or mistreated urinary infection,for example.)

But the most important reason phy¬sicians and nurses have not developedmore effective methods of error pre¬vention is that they have a great deal ofdifficulty in dealing with human errorwhen it does occur.1921 The reasons areto be found in the culture of medicalpractice.

Physicians are socialized in medicalschool and residency to strive for error-free practice.19 There is a powerful em¬phasis on perfection, both in diagnosisand treatment. In everyday hospitalpractice, the message is equally clear:mistakes are unacceptable. Physiciansare expected to function without error,an expectation that physicians translateinto the need to be infallible. One resultis that physicians, not unlike test pilots,come to view an error as a failure ofcharacter—you weren't careful enough,you didn't try hard enough. This kind ofthinking lies behind a common reactionby physicians: "How can there be anerror without negligence?"

by guest on July 4, 2009 www.jama.comDownloaded from

http://jama.ama-assn.org

Cultivating a norm of high standardsis, of course, highly desirable. It is thecounterpart ofanother fundamental goalof medical education: developing thephysician's sense of responsibility forthe patient. If you are responsible foreverything that happens to the patient,it follows that you are responsible forany errors that occur. While the logicmay be sound, the conclusion is absurd,because physicians do not have thepower to control all aspects of patientcare.22 Nonetheless, the sense of dutyto perform faultlessly is strongly inter¬nalized.

Role models in medical education re¬inforce the concept of infallibility. Theyoung physician's teachers are largelyspecialists, experts in their fields, andauthorities. Authorities are not supposedto err. It has been suggested that thisneed to be infallible creates a strongpressure to intellectual dishonesty, tocover up mistakes rather than to admitthem.25 The organization ofmedical prac¬tice, particularly in the hospital, per¬petuates these norms. Errors are rarelyadmitted or discussed among physiciansin private practice. Physicians typicallyfeel, not without reason, that admissionoferror will lead to censure or increasedsurveillance or, worse, that their col¬leagues will regard them as incompe¬tent or careless. Far better to conceal amistake or, if that is impossible, to tryto shift the blame to another, even thepatient.

Yet physicians are emotionally dev¬astated by serious mistakes that harmor kill patients.19"21 Almost every phy¬sician who cares for patients has hadthat experience, usually more than once.The emotional impact is often profound,typically a mixture of fear, guilt, anger,embarrassment, and humiliation. How¬ever, as Christensen et al20 note, phy¬sicians are typically isolated by theiremotional responses; seldom is there aprocess to evaluate the circumstancesof a mistake and to provide support andemotional healing for the fallible physi¬cian. Wu et al21 found that only half ofhouse officers discussed their most sig¬nificant mistakes with attending physi¬cians.

Thus, although the individual maylearn from a mistake and change prac¬tice patterns accordingly, the adjustmentoften takes place in a vacuum. Lessonslearned are shared privately, if at all,and external objective evaluation ofwhatwent wrong often does not occur. AsHilfiker19 points out, "We see the horrorof our own mistakes, yet we are givenno permission to deal with their enor¬mous emotional impact_The medicalprofession simply has no place for itsmistakes."

Finally, the realities of the malprac¬tice threat provide strong incentivesagainst disclosure or investigation ofmis¬takes. Even a minor error can place thephysician's entire career in jeopardy ifit results in a serious bad outcome. It ishardly surprising that a physician mighthesitate to reveal an error to either thepatient or hospital authorities or to ex¬pose a colleague to similar devastationfor a single mistake.

The paradox is that although the stan¬dard of medical practice is perfection—error-free patient care—all physiciansrecognize that mistakes are inevitable.Most would like to examine their mis¬takes and learn from them. From anemotional standpoint, they need the sup¬port and understanding of their col¬leagues and patients when they makemistakes. Yet, they are denied both in¬sight and support by misguided conceptsof infallibility and by fear: fear of em¬barrassment by colleagues, fear of pa¬tient reaction, and fear of litigation. Al¬though the notion of infallibility fails thereality test, the fears are well grounded.THE MEDICAL APPROACHTO ERROR PREVENTION

Efforts at error prevention in medi¬cine have characteristically followedwhat might be called the perfectibilitymodel: if physicians and nurses could beproperly trained and motivated, thentheywould make no mistakes. The meth¬ods used to achieve this goal are train¬ing and punishment. Training is directedtoward teaching people to do the rightthing. In nursing, rigid adherence to pro¬tocols is emphasized. In medicine, theemphasis is less on rules and more onknowledge.

Punishment is through social oppro¬brium or peer disapproval. The profes¬sional cultures of medicine and nursingtypically use blame to encourage properperformance. Errors are regarded assomeone's fault, caused by a lack of suf¬ficient attention or, worse, lack ofcaringenough to make sure you are correct.Punishment for egregious (negligent) er¬rors is primarily (and capriciously) metedout through the malpractice tort litiga¬tion system.

Students of error and human perfor¬mance reject this formulation. While theproximal error leading to an accident is,in fact, usually a "human error," thecauses of that error are often well be¬yond the individual's control. All humanserr frequently. Systems that rely on er¬ror-free performance are doomed to fail.

The medical approach to error pre¬vention is also reactive. Errors are usu¬ally discovered only when there is anincident—an untoward effect or injuryto the patient. Corrective measures are

then directed toward preventing a re¬currence of a similar error, often by at¬tempting to prevent that individual frommaking a repeat error. Seldom are un¬derlying causes explored.

For example, if a nurse gives a medi¬cation to the wrong patient, a typicalresponse would be exhortation or train¬ing in double-checking the identity ofboth patient and drug before adminis¬tration. Although it might be noted thatthe nurse was distracted because of anunusually large case load, it is unlikelythat serious attention would be given toevaluating overall work assignments orto determining if large case loads havecontributed to other kinds of errors.

It is even less likely that questionswould be raised about the wisdom of asystem for dispensing medications inwhich safety is contingent on inspectionby an individual at the end point of use.Reliance on inspection as a mechanismof quality control was discredited longago in industry.24·25 A simple procedure,such as the use of bar coding like thatused at supermarket checkout counters,would probably be more effective in thissituation. More imaginative solutionscould easily be found—if it were recog¬nized that both systems and individualscontribute to the problem.

It seems clear, and it is the thesis ofthis article, that if physicians, nurses,pharmacists, and administrators are tosucceed in reducing errors in hospitalcare, they will need to fundamentallychange the way they think about errorsand why they occur. Fortunately, a greatdeal has been learned about error pre¬vention in other disciplines, informationthat is relevant to the hospital practiceof medicine.

LESSONS FROM PSYCHOLOGICALAND HUMAN FACTORS RESEARCH

The subject of human error has longfascinated psychologists and others, butboth the development of theory and thepace of empirical research acceleratedin response to the dramatic technologi¬cal advances that occurred during andafter World War II.26 These theory de¬velopment and research activities fol¬lowed two parallel and intersectingpaths: human factors research and cog¬nitive psychology.

Human factor specialists, mostly en¬gineers, have been largely concernedwith the design of the man-machine in¬terface in complex environments suchas airplane cockpits and nuclear powerplant control rooms. Cognitive psycholo¬gists concentrated on developing mod¬els of human cognition that they sub¬jected to empirical testing. Lessons fromboth spheres ofobservation have greatlydeepened our understanding of mental

by guest on July 4, 2009 www.jama.comDownloaded from

http://jama.ama-assn.org

functioning. We now have reasonablycoherent theories of why humans err,and a great deal has been learned abouthow to design work environments tominimize the occurrence of errors andlimit their consequences.A THEORY OF COGNITION

Most errors result from aberrationsin mental functioning. Thus, to under¬stand why errors occur we must firstunderstand normal cognition. Althoughmany theories have been espoused, andexperts disagree, a unitary frameworkhas been proposed by Reason26 that cap¬tures the main themes of cognitivetheory and is consistent with empiricalobservation. It goes as follows.

Much of mental functioning is auto¬matic, rapid, and effortless. A personcan leave home, enter and start the car,drive to work, park, and enter the officewithout devoting much consciousthought to any of the hundreds of ma¬neuvers and decisions that this complexset of actions requires. This automaticand unconscious processing is possiblebecause we carry a vast array of mentalmodels, "schemata" in psychological jar¬gon, that are "expert" on some minuterecurrent aspect of our world. Theseschemata operate briefly when required,processing information rapidly, in par¬allel, and without conscious effort. Sche¬mata are activated by conscious thoughtor sensory inputs; functioning thereaf¬ter is automatic.

In addition to this automatic uncon¬scious processing, called the "schematiccontrol mode," cognitive activities canbe conscious and controlled. This "at-tentional control mode" or consciousthought is used for problem solving aswell as to monitor automatic function.The attentional control mode is calledinto play when we confront a problem,either de novo or as a result of failuresof the schematic control mode. In con¬trast to the rapid parallel processing ofthe schematic control mode, processingin the attentional control mode is slow,sequential, effortful, and difficult to sus¬tain.

Rasmussen and Jensen27 describe amodel ofperformance based on this con¬cept ofcognition that is particularly wellsuited for error analysis. They classifyhuman performance into three levels:(1) skill-based, which is patterns ofthought and action that are governedby stored patterns of preprogrammedinstructions (schemata) and largely un¬conscious; (2) rule-based, in which solu¬tions to familiar problems are governedby stored rules of the "if X, then Y"variety; and (3) knowledge-based, or syn¬thetic thought, which is used for novelsituations requiring conscious analytic

processing and stored knowledge.Any departure from routine, ie, a prob¬

lem, requires a rule-based or knowledge-based solution. Humans prefer patternrecognition to calculation, so they arestrongly biased to search for a prepack¬aged solution, ie, a "rule," before resort¬ing to more strenuous knowledge-basedfunctioning.

Although all three levels may be usedsimultaneously, with increasing exper¬tise the primary focus of control movesfrom knowledge-based toward skill-based functioning. Experts have a muchlarger repertoire of schemata and prob¬lem-solving rules than novices, and theyare formulated at a more abstract level.In one sense, expertise means seldomhaving to resort to knowledge-basedfunctioning (reasoning).MECHANISMS OFCOGNITIVE ERRORS

Errors have been classified by Rea¬son and Rasmussen at each level ofthe skill-, rule-, and knowledge-basedmodel.26 Skill-based errors are called"slips." These are unconscious glitchesin automatic activity. Slips are errors ofaction. Rule-based and knowledge-basederrors, by contrast, are errors of con¬scious thought and are termed "mis¬takes." The mechanisms of error varywith the level.

SlipsSkill-based activity is automatic. A

slip occurs when there is a break in theroutine while attention is diverted. Theactor possesses the requisite routines;errors occur because of a lack of a timelyattentional check. In brief, slips are moni¬toring failures. They are unintended acts.

A common mechanism of a slip is cap¬ture, in which a more frequently usedschema takes over from a similar butless familiar one. For example, if theusual action sequence is ABCDE, buton this occasion the planned sequencechanges to ABCFG, then conscious at¬tention must be in force after C or themore familiar pattern DE will be ex¬ecuted. An everyday example is depart¬ing on a trip in which the first part of thejourney is the same as a familiar com¬muting path and driving to work insteadof to the new location.

Another type of slip is a descriptionerror, in which the right action is per¬formed on the wrong object, such aspouring cream on a pancake. Associa¬tive activation errors result from men¬tal associations of ideas, such as answer¬ing the phone when the doorbell rings.Loss ofactivation errors are temporarymemory losses, such as entering a roomand no longer remembering why youwanted to go there. Loss of activation

errors are frequently caused by inter¬ruptions.

A variety of factors can divert atten¬tional control and make slips more likely.Physiological factors include fatigue, sleeploss, alcohol, drugs, and illness. Psycho¬logical factors include other activity("busyness"), as well as emotional statessuch as boredom, frustration, fear, anxi¬ety, or anger. All these factors lead topreoccupations that divert attention. Psy¬chological factors, though considered "in¬ternal" or endogenous, may also be causedby a host of external factors, such asoverwork, interpersonal relations, andmany other forms of stress. Environmen¬tal factors, such as noise, heat, visualstimuli, motion, and other physical phe¬nomena, also can cause distractions thatdivert attention and lead to slips.Mistakes

Rule-based errors usually occur dur¬ing problem solving when a wrong ruleis chosen—either because of a misper-ception of the situation and, thus, theapplication of a wrong rule or because ofmisapplication of a rule, usually one thatis strong (frequently used), that seemsto fit adequately. Errors result from mis¬applied expertise.

Knowledge-based errors are muchmore complex. The problem solver con¬fronts a novel situation for which he orshe possesses no preprogrammed solu¬tions. Errors arise because of lack ofknowledge or misinterpretation of theproblem. Pattern matching is preferredto calculation, but sometimes we matchthe wrong patterns. Certain habits ofthought have been identified that alterpattern matching or calculation and leadto mistakes. These processes are incom¬pletely understood and are seldom rec¬ognized by the actor. One such processis biased memory. Decisions are basedon what is in our memory, but memoryis biased toward overgeneralization andoverregularization of the commonplace.28Familiar patterns are assumed to haveuniversal applicability because they usu¬ally work. We see what we know. Para¬doxically, memory is also biased towardoveremphasis on the discrepant. A con¬tradictory experience may leave an ex¬aggerated impression far outweighingits statistical importance (eg, the ex¬ceptional case or missed diagnosis).

Another mechanism is the availabil¬ity heuristic,29 the tendency to use thefirst information that comes to mind. Re¬lated are confirmation bias, the tendencyto look for evidence that supports an earlyworking hypothesis and to ignore datathat contradict it, and overconfidence, thetendency to believe in the validity of thechosen course of action and to focus onevidence that favors it.26

by guest on July 4, 2009 www.jama.comDownloaded from

http://jama.ama-assn.org

Rule-based and knowledge-based func¬tioning are affected by the same physi¬ological, psychological, and environmen¬tal influences that produce slips. A greatdeal ofresearch has been devoted to theeffects of stress on performance. Al¬though it is often difficult to establishcausal links between stress and specificaccidents, there is little question that er¬rors (both slips and mistakes) are in¬creased under stress. On the other hand,stress is not all bad. It has long beenknown that "a little anxiety improvesperformance." In 1908, Yerkes and Dod-son30 showed that performance is best atmoderate levels of arousal. Poor perfor¬mance occurs at both extremes: bore¬dom and panic.31 Coning ofattention un¬der stress is the tendency in an emer¬gency to concentrate on one single sourceof information, the "first come, best pre¬ferred" solution.31 (A classic example isthe phenomenon of passengers in acrashed aircraft struggling to open a doorwhile ignoring a large hole in the fuse¬lage a few feet away.) Reversion understress is a phenomenon in which recentlylearned behavioral patterns are replacedby older, more familiar ones, even if theyare inappropriate in the circumstances.31

The complex nature of cognition, thevagaries of the physical world, and theinevitable shortages of information andschemata ensure that normal humansmake multiple errors every day. Slipsare most common, since much of ourmental functioning is automatic, but therate of error in knowledge-based pro¬cesses is higher.26LATENT ERRORS

In 1979, the Three-Mile Island inci¬dent caused both psychologists andhuman factors engineers to reexaminetheir theories about human error. Al¬though investigations revealed theexpected operator errors, it was clearthat prevention of many of these errorswas beyond the capabilities of the hu¬man operators at the time. Many errorswere caused by faulty interface design,others by complex interactions andbreakdowns that were not discernibleby the operators or their instruments.The importance of poor system designas a cause of failures in complex pro¬cesses became more apparent.32 Subse¬quent disasters, notably Bhopal andChernobyl, made it even clearer thatoperator errors were only part of theexplanation of failures in complex sys¬tems. Disasters of this magnitude re¬sulted from major failures ofdesign andorganization that occurred long beforethe accident, failures that both causedoperator errors and made them impos¬sible to reverse.26,32

Reason26 has called these latent er-

rors, errors that have effects that aredelayed, "accidents waiting to happen,"in contrast to active errors, which haveeffects that are felt immediately. Whilean operator error may be the proximal"cause" of the accident, the root causeswere often present within the systemfor a long time. The operator has, in areal sense, been "set up" to fail by poordesign, faulty maintenance, or errone¬ous management decisions.

Faulty design at Three-Mile Islandprovided gauges that gave a low pres¬sure reading both when pressure waslow and when the gauge was not work¬ing and a control panel on which 100warning lights flashed simultaneously.Faulty maintenance disabled a safetyback-up system so the operator couldnot activate it when needed. Similarly,bad management decisions can result inunrealistic workloads, inadequate train¬ing, and demanding production sched¬ules that lead workers to make errors.

Accidents rarely result from a singleerror, latent or active.26,32 System de¬fenses and the abilities of frontline op¬erators to identify and correct errorsbefore an accident occurs make single-error accidents highly unlikely. Rather,accidents typically result from a com¬bination of latent and active errors andbreach of defenses. The precipitatingevent can be a relatively trivial mal¬function or an external circumstance,such as the weather (eg, the freezing ofO-rings that caused the Challenger di¬saster).

The most important result of latenterrors may be the production of psy¬chological precursors, which are patho¬logic situations that create working con¬ditions that predispose to a variety oferrors.26 Inappropriate work schedules,for example, can result in high work¬loads and undue time pressures that in¬duce errors. Poor training can lead toinadequate recognition of hazards or in¬appropriate procedures that lead to ac¬cidents. Conversely, a precursor can bethe product of more than one manage¬ment or training failure. For example,excessive time pressure can result frompoor scheduling, but it can also be theproduct of inadequate training or faultydivision ofresponsibilities. Because theycan affect all cognitive processes, theseprecursors can cause an immense vari¬ety of errors that result in unsafe acts.

The important point is that successfulaccident prevention efforts must focuson root causes—system errors in designand implementation. It is futile to con¬centrate on developing solutions to theunsafe acts themselves. Other errors,unpredictable and infinitely varied, willsoon occur if the underlying cause isuncorrected. Although correcting root

causes will not eliminate all errors—individuals still bring varying abilitiesand work habits to the workplace—itcan significantly reduce the probabilityof errors occurring.PREVENTION OF ACCIDENTS

The multiplicity of mechanisms andcauses of errors (internal and external,individual and systemic) dictates thatthere cannot be a simple or universalmeans of reducing errors. Creating asafe process, whether it be flying anairplane, running a hospital, or perform¬ing cardiac surgery, requires attentionto methods of error reduction at eachstage of system development: design,construction, maintenance, allocation ofresources, training, and development ofoperational procedures. This type of at¬tention to error reduction requires re¬sponsible individuals at each stage tothink through the consequences of theirdecisions and to reason back from dis¬covered deficiencies to redesign and re¬organize the process. Systemic changesare most likely to be successful becausethey reduce the likelihood of a variety oftypes of errors at the end-user stage.

The primary objective of system de¬sign for safety is to make it difficult forindividuals to err. But it is also impor¬tant to recognize that errors will inevi¬tably occur and plan for their recov¬ery.26 Ideally, the system will automati¬cally correct errors when they occur. Ifthat is impossible, mechanisms shouldbe in place to at least detect errors intime for corrective action. Therefore, inaddition to designing the work environ¬ment to minimize psychological precur¬sors, designers should provide feedbackthrough instruments that provide moni¬toring functions and build in buffers andredundancy. Buffers are design featuresthat automatically correct for human ormechanical errors. Redundancy is du¬plication (sometimes triplication or qua-druplication) of critical mechanisms andinstruments, so that a failure does notresult in loss of the function.

Another important system design fea¬ture is designing tasks to minimize er¬rors. Norman28 has recommended a setof principles that have general applica¬bility. Tasks should be simplified to mini¬mize the load on the weakest aspects ofcognition: short-term memory, planning,and problem solving. The power of con¬straints should be exploited. One way todo this is with "forcing functions," whichmake it impossible to act without meet¬ing a precondition (such as the inabilityto release the parking gear of a car un¬less the brake pedal is depressed). Stan¬dardization ofprocedures, displays, andlayouts reduces error by reinforcing thepattern recognition that humans do well.

by guest on July 4, 2009 www.jama.comDownloaded from

http://jama.ama-assn.org

Finally, where possible, operationsshould be easily reversible or difficult toperform when they are not reversible.

Training must include, in addition tothe usual emphasis on application ofknowledge and following procedures, aconsideration of safety issues. These is¬sues include understanding the ratio¬nale for procedures as well as how er¬rors can occur at various stages, theirpossible consequences, and instructionin methods for avoidance of errors.Finally, it must be acknowledged thatinjuries can result from behavioral prob¬lems that may be seen in impairedphysicians or incompetent physicians de¬spite well-designed systems; methodsfor identifying and correcting egregiousbehaviors are also needed.

THE AVIATION MODELThe practice of hospital medicine has

been compared, usually unfavorably, tothe aviation industry, also a highly com¬plicated and risky enterprise but onethat seems far safer. Indeed, there seemto be many similarities. As Allnutt ob¬served,Both pilots and doctors are carefully se¬lected, highly trained professionals who areusually determined to maintain high stan¬dards, both externally and internally im¬posed, whilst performing difficult tasks inlife-threatening environments. Both usehigh technology equipment and function askey members ofa team ofspecialists ... bothexercise high level cognitive skills in a mostcomplex domain about which much is known,but where much remains to be discovered.31

While the comparison is apt, thereare also important differences betweenaviation and medicine, not the least ofwhich is a substantial measure of un¬certainty due to the number and varietyof disease states, as well as the unpre¬dictability of the human organism.Nonetheless, there is much physiciansand nurses could learn from aviation.

Aviation—airline travel, at least—isindeed generally safe: more than 10million takeoffs and landings each yearwith an average of fewer than fourcrashes a year. But, it was not alwaysso. The first powered flight was in 1903,the first fatality in 1908, and the firstmidair collision in 1910. By 1910, therewere 2000 pilots in the world and 32 hadalready died.32 The US Air Mail Servicewas founded in 1918. As a result of ef¬forts to meet delivery schedules in allkinds of weather, 31 of the first 40 AirMail Service pilots were killed. This ap¬palling toll led to unionization of the pi¬lots and their insistence that local fieldcontrollers could not order pilots to flyagainst their judgment unless the fieldcontrollers went up for a flight around

the field themselves. In 1922, therewere no Air Mail Service fatalities.32Since that time, a complex system ofaircraft design, instrumentation, train¬ing, regulation, and air traffic controlhas developed that is highly effective atpreventing fatalities.

There are strong incentives for mak¬ing flying safe. Pilots, of course, arehighly motivated. Unlike physicians,their lives are on the line as well asthose of their passengers. But, airlinesand airplane manufacturers also havestrong incentives to provide safe flight.Business decreases after a large crash,and if a certain model of aircraft crashesrepeatedly, the manufacturer will bediscredited. The lawsuits that inevita¬bly follow a crash can harm both repu¬tation and profitability.

Designing for safety has led to anumber of unique characteristics ofaviation that could, with suitable modi¬fication, prove useful in improving hos¬pital safety.

First, in terms of system design, air¬craft designers assume that errors andfailures are inevitable and design sys¬tems to "absorb" them, building in mul¬tiple buffers, automation, and redun¬dancy. As even a glance in an airlinercockpit reveals, extensive feedback isprovided by means of monitoring in¬struments, many in duplicate or tripli¬cate. Indeed, the multiplicity of instru¬ments and automation have generatedtheir own challenges to system design:sensory overload and boredom. None¬theless, these safeguards have servedthe cause of aviation safety well.

Second, procedures are standardizedto the maximum extent possible. Specificprotocols must be followed for trip plan¬ning, operations, and maintenance. Pilotsgo through a checklist before each take¬off. Required maintenance is specified indetail and must be performed on a regu¬lar (by flight hours) basis. Third, thetraining, examination, and certificationprocess is highly developed and rigidly,as well as frequently, enforced. Airlinepilots take proficiency examinations ev¬ery 6 months. Much of the content of ex¬aminations is directly concerned withprocedures to enhance safety.

Pilots function well within this rigor¬ously controlled system, although notflawlessly. For example, one study ofcockpit crews observed that human er¬rors or instrument malfunctions oc¬curred on the average of one every 4minutes during an overseas flight.32Each event was promptly recognizedand corrected with no untoward effects.Pilots also willingly submit to an exter¬nal authority, the air traffic controller,when within the constrained air andground space at a busy airport.

Finally, safety in aviation has beeninstitutionalized. Two independentagencies have government-mandatedresponsibilities: the Federal AviationAdministration (FAA) regulates all as¬pects of flying and prescribes safetyprocedures, and the National Transpor¬tation Safety Board investigates everyaccident. The adherence of airlines andpilots to required safety standards isclosely monitored. The FAA recognizedlong ago that pilots seldom reported anerror if it led to disciplinary action. Ac¬cordingly, in 1975 the FAA establisheda confidential reporting system forsafety infractions, the Air Safety Re¬porting System (ASRS). If pilots, con¬trollers, or others promptly report adangerous situation, such as a near-miss midair collision, they will not bepenalized. This program dramaticallyincreased reporting, so that unsafe con¬ditions at airports, communicationproblems, and traffic control inadequa¬cies are now promptly communicated.Analysis of these reports and subse¬quent investigations appear as a regularfeature in several pilots' magazines. TheASRS receives more than 5000 notifica¬tions each year.32THE MEDICAL MODEL

By contrast, accident prevention hasnot been a primary focus of the practiceofhospital medicine. It is not that errorsare ignored. Mortality and morbidityconferences, incident reports, risk man¬agement activities, and quality assur¬ance committees abound. But, as notedpreviously, these activities focus on in¬cidents and individuals. When errors areexamined, a problem-solving approachis usually used: the cause of the error isidentified and corrected. Root causes,the underlying systems failures, arerarely sought. System designers do notassume that errors and failures are in¬evitable and design systems to preventor absorb them. There are, of course,exceptions. Implementation ofunit dos¬ing, for example, markedly reducedmedication dosing errors by eliminatingthe need for the nurse to measure outeach dose. Monitoring in intensive careunits is sophisticated and extensive (al¬though perhaps not sufficiently redun¬dant). Nonetheless, the basic health caresystem approach is to rely on individu¬als not to make errors rather than toassume they will.

Second, standardization and task de¬sign vary widely. In the operating room,it has been refined to a high art. Inpatient care units, much more could bedone, particularly to minimize relianceon short-term memory, one of the theweakest aspects of cognition. On-timeand correct delivery of medications, for

by guest on July 4, 2009 www.jama.comDownloaded from

http://jama.ama-assn.org

example, is often contingent on a busynurse remembering to do so, a nursewho is responsible for four or five pa¬tients at once and is repeatedly inter¬rupted, a classic set up for a "loss-of-activation" error.

On the other hand, education andtraining in medicine and nursing far ex¬ceed that in aviation, both in breadth ofcontent and in duration, and few pro¬fessions compare with medicine in termsof the extent of continuing education.Although certification is essentially uni¬versal, including the recent introduc¬tion of periodic recertification, the ideaof periodically testing performance hasnever been accepted. Thus, we placegreat emphasis on education and train¬ing, but shy away from demonstratingthat it makes a difference.

Finally, unlike aviation, safety in medi¬cine has never been institutionalized, inthe sense of being a major focus of hos¬pital medical activities. Investigation ofaccidents is often superficial, unless amalpractice action is likely; noninjuri-ous error (a "near miss") is rarely ex¬amined at all. Incident reports are fre¬quently perceived as punitive instru¬ments. As a result, they are often notfiled, and when they are, they almostinvariably focus on the individual's mis¬conduct.

One medical model is an exceptionand has proved quite successful in re¬ducing accidents due to errors: anesthe¬sia. Perhaps in part because the effectsof serious anesthetic errors are poten¬tially so dramatic—death or brain dam¬age—and perhaps in part because theerrors are frequently transparently clearand knowable to all, anesthesiologistshave greatly emphasized safety. The suc¬cess of these efforts has been dramatic.Whereas mortality from anesthesia wasone in 10 000 to 20 000 just a decade orso ago, it is now estimated at less thanone in 200 000.33 Anesthesiologists haveled the medical profession in recogniz¬ing system factors as causes oferrors, indesigning fail-safe systems, and in train¬ing to avoid errors.3436SYSTEMS CHANGES TO REDUCEHOSPITAL INJURIES

Can the lessons from cognitive psy¬chology and human factors research thathave been successful in accident pre¬vention in aviation and other industriesbe applied to the practice of hospitalmedicine? There is every reason to thinkthey could be. Hospitals, physicians,nurses, and pharmacists who wish toreduce errors could start by consideringhow cognition and error mechanisms ap¬ply to the practice of hospital medicine.Specifically, they can examine their caredelivery systems in terms of the sys-

terns' ability to discover, prevent, andabsorb errors and for the presence ofpsychological precursors.Discovery of Errors

The first step in error prevention is todefine the problem. Efficient, routineidentification of errors needs to be partof hospital practice, as does routine in¬vestigation of all errors that cause in¬juries. The emphasis is on "routine." Onlywhen errors are accepted as an inevi¬table, although manageable, part of ev¬eryday practice will it be possible forhospital personnel to shift from a puni¬tive to a creative frame of mind thatseeks out and identifies the underlyingsystem failures.

Data collecting and investigatory ac¬tivities are expensive, but so are theconsequences of errors. Evidence fromindustry indicates that the savings fromreduction of errors and accidents morethan make up for the costs of data col¬lection and investigation.31 (While thesecalculations apply to "rework" and otheroperational inefficiencies resulting fromerrors, additional savings from reducedpatient care costs and liability costs forhospitals and physicians could also besubstantial.)Prevention of Errors

Many health care delivery systemscould be redesigned to significantly re¬duce the likelihood of error. Some ob¬vious mechanisms that can be used areas follows:

Reduced Reliance on Memory.—Work should be designed to minimizethe requirements for human functionsthat are known to be particularly fal¬lible, such as short-term memory andvigilance (prolonged attention). Clearly,the components of work must be welldelineated and understood before sys¬tem redesign. Checklists, protocols, andcomputerized decision aids could be usedmore widely. For example, physiciansshould not have to rely on their memo¬ries to retrieve a laboratory test result,and nurses should not have to remem¬ber the time a medication dose is due.These are tasks that computers do muchmore reliably than humans.

Improved Information Access.—Cre¬ative ways need to be developed for mak¬ing information more readily available:displaying it where it is needed, when itis needed, and in a form that permitseasy access. Computerization of themedical record, for example, wouldgreatly facilitate bedside display of pa¬tient information, including tests andmedications.

Error Proofing.—Where possible,critical tasks should be structured sothat errors cannot be made. The use of

"forcing functions" is helpful. For ex¬ample, if a computerized system is usedfor medication orders, it can be designedso that a physician cannot enter an or¬der for a lethal overdose of a drug orprescribe a medication to which a pa¬tient is known to be allergic.

Standardization.—One of the mosteffective means ofreducing error is stan¬dardizing processes wherever possible.The advantages, in efficiency as well asin error reduction, ofstandardizing drugdoses and times of administration areobvious. Is it really acceptable to asknurses to follow six different "K-scales"(directions for how much potassium togive according to patient serum potas¬sium levels) solely to satisfy differentphysician prescribing patterns? Othercandidates for standardization includeinformation displays, methods for com¬mon practices (such as surgical dress¬ings), and the geographic location ofequipment and supplies in a patient careunit. There is something bizarre, andreally quite inexcusable, about "code"situations in hospitals where house staffand other personnel responding toa car¬diac arrest waste precious secondssearching for resuscitation equipmentsimply because it is kept in a differentlocation on each patient care unit.

Training.—Instruction ofphysicians,nurses, and pharmacists in proceduresor problem solving should includegreater emphasis on possible errors andhow to prevent them. (Well-written sur¬gical atlases do this.) For example, manyinterns need more rigorous instructionand supervision than is currently pro¬vided when they are learning new pro¬cedures. Young physicians need to betaught that safe practice is as importantas effective practice. Both physiciansand nurses need to learn to think oferrors primarily as symptoms of sys¬tems failures.

Absorption of ErrorsBecause it is impossible to prevent all

error, buffers should be built into eachsystem so that errors are absorbed be¬fore they can cause harm to patients. Atminimum, systems should be designedso that errors can be identified in timeto be intercepted. The drug delivery sys¬tems in most hospitals do this to somedegree already. Nurses and pharmacistsoften identify errors in physician drugorders and prevent improper adminis¬tration to the patient. As hospitals moveto computerized records and orderingsystems, more of these types of inter¬ceptions can be incorporated into thecomputer programs. Critical systems(such as life-support equipment andmonitors) should be provided in dupli¬cate in those situations in which a me-

by guest on July 4, 2009 www.jama.comDownloaded from

http://jama.ama-assn.org

chanical failure could lead to patient in¬jury.Psychological Precursors

Finally, explicit attention should begiven to work schedules, division of re¬sponsibilities, task descriptions, andother details of working arrangementswhere improper managerial decisionscan produce psychological precursorssuch as time pressures and fatigue thatcreate an unsafe environment. While theinfluence of the stresses ofeveryday lifeon human behavior cannot be eliminated,stresses caused by a faulty work envi¬ronment can be. Elimination of fear andthe creation of a supportive working en¬vironment are other potent means ofpreventing errors.INSTITUTIONALIZATION OF SAFETY

Although the idea of a national hos¬pital safety board that would investi¬gate every accident is neither practicalnor necessary, at the hospital level suchactivities should occur. Existing hospi¬tal risk management activities could bebroadened to include all potentially in¬jurious errors and deepened to seek out

underlying system failures. Providingimmunity, as in the FAA ASRS system,might be a good first step. At the na¬tional level, the Joint Commission onAccreditation of Healthcare Organiza¬tions should be involved in discussionsregarding the institutionalization ofsafety. Other specialty societies mightwell follow the lead of the anesthesiolo¬gists in developing safety standards andrequire their instruction to be part ofresidency training.

IMPLEMENTING SYSTEMSCHANGES

Many of the principles describedherein fit well within the teachings oftotal quality management.24 One of thebasic tenants of total quality manage¬ment, statistical quality control, requiresdata regarding variation in processes.In a generic sense, errors are but varia¬tions in processes. Total quality man¬agement also requires a culture in whicherrors and deviations are regarded notas human failures, but as opportunitiesto improve the system, "gems," as theyare sometimes called. Finally, total qual-

ity management calls for grassroots par¬ticipation to identify and develop sys¬tem modifications to eliminate the un¬derlying failures.

Like total quality management, sys¬tems changes to reduce errors requirecommitment of the organization's lead¬ership. None of the aforementionedchanges will be effective or, for thatmatter, even possible without supportat the highest levels (hospital execu¬tives and departmental chiefs) for mak¬ing safety a major goal of medical prac¬tice.

But it is apparent that the most fun¬damental change that will be needed ifhospitals are to make meaningfulprogress in error reduction is a culturalone. Physicians and nurses need to ac¬cept the notion that error is an inevi¬table accompaniment of the human con¬dition, even among conscientious pro¬fessionals with high standards. Errorsmust be accepted as evidence of sys¬tems flaws not character flaws. Untiland unless that happens, it is unlikelythat any substantial progress will bemade in reducing medical errors.

References1. Nightingale F. Notes on Hospitals. London, Eng-land: Longman, Green, Longman, Roberts, andGreen; 1863.2. Schimmel EM. The hazards of hospitalization.Ann Intern Med. 1964;60:100-110.3. Steel K, Gertman PM, Crescenzi C, et al. Iatro-genic illness on a general medical service at a uni-versity hospital. N Engl J Med. 1981;304:638-642.4. Bedell SE, Deitz DC, Leeman D, Delbanco TL.Incidence and characteristics of preventable iatro-genic cardiac arrests. JAMA. 1991;265:2815-2820.5. Brennan TA, Leape LL, Laird N, et al. Inci-dence of adverse events and negligence in hospi-talized patients: results of the Harvard MedicalPractice Study I. N Engl J Med. 1991;324:370-376.6. Leape LL, Brennan TA, Laird N, et al. Thenature of adverse events in hospitalized patients:results of the Harvard Medical Practice Study II.N Engl J Med. 1991;324:377-384.7. Dubois RW, Brook RH. Preventable deaths: who,how often, and why? Ann Intern Med. 1988;109:582-589.8. Leape LL, Lawthers AG, Brennan TA, JohnsonWG. Preventing medical injury. Qual Rev Bull.1993;8:144-149.9. Lesar TS, Briceland LL, Delcoure K, et al. Medi-cation prescribing errors in a teaching hospital.JAMA. 1990;263:2329-2334.10. Raju TN, Thornton JP, Kecskes S, et al. Medi-cation errors in neonatal and paediatric intensive\x=req-\care units. Lancet. 1989;2:374-379.11. Classen DC, Pestonik SL, Evans RS, Burke JP.Computerized surveillance of adverse drug eventsin hospital patients. JAMA. 1991;266:2847-2851.12. Folli HL, Poole RL, Benitz WE, Russo JC.Medication error prevention by clinical pharma-cists in two childrens' hospitals. Pediatrics. 1987;

79:718-722.13. Bates DW, Boyle D, Vander Vliet M, et al.Relationship between medication errors and ad-verse drug events. J Gen Intern Med. In press.14. Anderson RE, Hill RB, Key CR. The sensitiv-ity and specificity of clinical diagnostics during fivedecades: toward an understanding of necessary fal-libility. JAMA. 1989;261:1610-1611.15. Goldman L, Sayson R, Robbins S, Conn LH,Bettman M, Weissberg M. The value of the autopsyin the three medical eras. N Engl J Med. 1983;308:1000-1005.16. Cameron HM, McGoogan E. A prospective studyof 1,152 hospital autopsies, I: inaccuracies in deathcertification. J Pathol. 1981;133:273-283.17. Gopher D, Olin M, Donchin Y, et al. The natureand causes ofhuman errors in a medical intensive careunit. Presented at the 33rd annual meeting ofthe Hu-man Factors Society; October 18,1989; Denver, Colo.18. Palmer RH, Strain R, RothrockJK, et al. Evalu-ation ofoperational failures in clinical decision mak-ing. Med Decis Making. 1983;3:299-310.19. Hilfiker D. Facing our mistakes. N Engl JMed.1984;310:118-122.20. Christensen JF, Levinson W, Dunn PM. Theheart ofdarkness: the impact ofperceived mistakeson physicians. J Gen Intern Med. 1992;7:424-431.21. Wu AW, Folkman S, McPhee SJ, et al. Do houseofficers learn from their mistakes? JAMA. 1991;265:2089-2094.22. Berwick DM. E. A. Codman and the rhetoric ofbattle: a commentary. Milbank Q. 1989;67:262-267.23. McIntyre N, Popper KB. The critical attitudein medicine: the need for a new ethics. BMJ. 1989;287:1919-1923.24. Berwick DM. Continuous improvement as anideal in health care. N Engl J Med. 1989;320:53-56.

25. Deming WE. Quality, Productivity, and Com-petitive Position. Cambridge: Massachusetts Insti-tute of Technology; 1982.26. Reason J. Human Error. Cambridge, Mass:Cambridge University Press; 1992.27. Rasmussen J, Jensen A. Mental procedures inreal-life tasks: a case study of electronic trouble\x=req-\shooting. Ergonomics. 1974;17:293-307.28. Norman DA. To Err Is Human. New York,NY: Basic Books Inc Publishers; 1984.29. Tversky A, Kahneman D. The framing of de-cisions and the psychology of choice. Science. 1981;211:453-458.30. Yerkes RM, DodsonJD. The relation ofstrengthof stimuli to rapidity of habit formation. J CompNeurol Psychol. 1908;18:459-482.31. Allnutt MF. Human factors in accidents. Br JAnaesth. 1987;59:856-864.32. Perrow C. Normal Accidents: Living With High\x=req-\Risk Technologies. New York, NY: Basic BooksInc Publishers; 1984.33. Orkin FK. Patient monitoring during anesthe-sia as an exercise in technology assessment. In:Saidman LJ, Smith NT, eds. Monitoring in Anes-thesia. 3rd ed. London, England: Butterworth Pub-lishers Inc; 1993.34. Gaba DM. Human errors in anesthetic mishaps.Int Anesthesiol Clin. 1989;27:137-147.35. Cooper JB, Newbower RS, Kitz RJ. An analy-sis of major errors and equipment failures in an-esthesia management: considerations for preven-tion and detection. Anesthesiology. 1984;60:34-42.36. Cullen DJ, Nemeskal RA, Cooper JB, ZaslavskyA, Dwyer MJ. Effect of pulse oximetry, age, andASA physical status on the frequency of patientsadmitted unexpectedly to a postoperative care unit.Anesth Analg. 1992;74:181.

by guest on July 4, 2009 www.jama.comDownloaded from

http://jama.ama-assn.org