THE GAME OF RISK Staff will be more likely to buy into process improvements if they understand the rationale behind them.

Risk management is more than reviewing an incident report after a patient fall or a medication error. It's about creating a culture where you learn from mistakes and errors, and about supporting the changes that prevent them from happening again. Here are smart, simple ways to strengthen your facility's risk-management program.

Be willing to change
If your facility is reluctant to simplify or improve processes because "we've always done it this way," you won't develop a culture of safety. You need full, detailed analysis of incidents, because a knee-jerk change may end up complicating the process without adding value to overall patient safety. We know of a facility that responded to a pain-medication documentation error by implementing a process that required all nursing staff to document narcotics in 3 different areas of the medical record. This ineffective response actually increased the risk of errors and omissions.

Take human behaviors into account. Most errors aren't caused by recklessness. They're caused by workarounds, interruptions and deviations from policy and best practice, and by poorly designed processes that invite error and mistakes (a checklist that's so routine, it becomes rote, for example). A risk-management program should focus on reducing human errors, such as over-reliance on memory, by using outcome-driven protocols and by simplifying ambiguous and complex processes. You should heighten awareness of patient-safety concerns with communication and training. For example, we have a quarterly nursing "grand rounds" meeting in which we talk about incidents, how they happened, and what process changes we made as a result. We've found that staff members are more likely to buy into process improvements when they understand the rationale behind them.

Remember that reward is more effective than punishment. "The single greatest impediment to error prevention in the medical industry is that we punish people for making mistakes," says Lucian Leape, MD, a professor at the Harvard School of Public Health and author of the seminal 1994 JAMA article, "Error in Medicine." Don't fall into that trap.

Dig deep with a root-cause analysis
We all know surgery's high-risk events: retained objects, wrong-site/wrong-procedure surgery, informed-consent issues, misidentification of the patient, inadequate preoperative evaluations, and anesthesia and medication errors. When these types of incidents occur, recognize potential liability and perform a root-cause analysis (RCA), not only to determine what happened and how to prevent a reoccurrence, but also to provide background information if litigation follows.

For an RCA to succeed, participants must know that the process is non-punitive. At first, people are likely to be defensive, uncomfortable and nervous. Emotions may run high. Reassure them that the goal is only to prevent future harm, and that investigation and analysis require open and honest communication about what happened and how it happened.

Many states and the Joint Commission require that you perform an RCA after a serious event, but you can benefit from deep dives into the root causes of events regardless of whether they're required.

The Accreditation Association for Ambulatory Health Care requires facilities to develop risk-management programs. The CMS State Operating Manual stops short of requiring risk-management programs, but it does call on organizations to identify and reduce medical errors and adverse patient events. The Institute of Medicine has created some helpful definitions:

• An error is defined as the failure of a planned action to be completed as intended.
• An adverse event is an injury caused by medical management, rather than by the underlying condition of the patient.
• An adverse event attributable to error is a preventable adverse event.

CMS and AAAHC expect you to focus on high-risk, high-volume and problem-prone areas when selecting indicators for improvement activities. Both also expect you to demonstrate a link between risk management and quality-improvement activities. Review your incident-reporting policy and make sure you're tracking trends and analyzing the events defined above to determine where you need to focus your improvement efforts.

LOSS PREVENTION
Play Prevent Defense at Your Facility

Does everyone in your organization know the definition of an incident and how to report one? Do your managers know what their obligations are in reviewing incidents? When analyzing an incident, you should determine:

• the potential severity of the loss (cost/harm to patient);
• the probability that such a loss will occur; and
• the frequency with which it might occur.

You can then implement these risk-control techniques, and you'll have fewer adverse events, fewer liability claims and better compliance with state and federal regulations. Prevention is a lot less expensive than paying out claims.

— CL and JK

Risk Control	Action Step
Avoid the risk	Determine that your facility won't perform a certain procedure.
Reduce the risk	Establish policies and procedures to reduce frequency and probability, such as a correct-site surgery protocol.
Reduce the potential severity	Install fire caulk conduits in ceilings and walls.
Segregate the risk	Have IT data recovery backup systems.
Contractually limit the risk	Review contracts to determine who's responsible for breaches.

Ongoing evaluation of your plan
Once you've developed a formal risk-management plan, periodically evaluate it. What risks have you identified and what improvements have you made? In addition to the ongoing assessments, each year determine the program's effectiveness. Here are 5 action steps:

• Assess indicators to ensure you're collecting the right information to identify and reduce risk.
• Do you have ample resources to ensure prompt analyses and follow-up when there are events?
• Make sure appropriate personnel are involved in the process.
• Ensure that leadership and the board are involved and committed, and that goals and expectations are being communicated facility-wide.
• Ensure that all events — actual and potential — are being evaluated for likelihood, severity/priority and potential financial impact.