BRIEF REPORT
Building an Effective Risk Management Program in a Healthcare Setting
by Louise Patrick
Louise Patrick, PhD, CHE, is Director of Quality, Utilization & Risk Management for the SCO Health Service in Ottawa. Dr. Patrick has clinical, research and business backgrounds. She is also a clinical psychologist, assistant clinical professor at the University of Ottawa, adjunct professor at Carleton University, and a surveyor with the Canadian Council on Health Services Accreditation. Prior to joining the healthcare sector, Dr. Patrick, who further holds a Bachelor of Economics Degree from Concordia University in Montreal, had a 10-year career in the telecommunications industry.
Abstract This paper outlines a step-by-step approach to implementing an integrated risk management program in a healthcare setting. The paper argues for a corporate approach to risk management, based on centralized analysis of incidents and a focus on proactive management of risk factors. The paper discusses implementation from both structural and process perspectives and within the context of Canadian accreditation standards and the National Patient Safety Steering Committee recommendations.
H
ealthcare risk management is a relatively new field that emerged primarily as a consequence of escalating medical malpractice costs in the 1970s.1 The American Society for Hospital Risk Management, a division of the American Hospital Association, was created in 1978. Similar national bodies now also exist in Great Britain (The National Patient Safety Agency) and in Australia (The Australian Council for Safety and Quality in Health Care) although they have only been in existence for a few years. Canadian efforts have more recently been initiated with the National Steering Committee on Patient Safety (2002) that recommended creation of a Canadian Patient Safety Institute, established in December 2003. The Canadian Council on Health Services Accreditation has had standards related to risk management since the introduction of its Client Centred Accreditation Program (CCAP) program in 1995, and are now closely watching patient safety developments in Canada to align future accreditation programs accordingly. Traditionally, risk management activities have focused on issues of liability and minimizing losses. However, the fast pace of change in the healthcare environment towards resource restraint, growing openness, transparency, accountability, and measurable organizational performance is increasingly yielding results-oriented approaches to risk management – more modern, integrated approaches to help clinicians and administrators better understand, manage and communicate risk and improve related decision-making. The focus of risk management has grown beyond human errors like malpractice or negligence to the study of system-based adverse events which occur as the result of a long sequence of events and processes. Issues of liability and risk management, when considered within the current context of accountability, are now conceptually linked with quality improvement. Such integrated approaches to risk and quality management are considered best practice.1 According to the Conference Board of Canada2 an Integrated Risk Management system (IRM) is defined as “a framework that pulls together a variety of disciplines in the organization to address both sides of risk - minimizing uncertainty and maximizing opportunities.” A key difference between traditional and integrated risk management is that IRM is geared to identifying new opportunities for improvement of risk practices, and prevention, in addition to minimizing losses, the traditional focus of risk management. Capitalizing on new opportunities for improvement, which can emerge from objective system-wide analysis of errors, incidents and adverse events, is the fundamental principle of an integrated risk management system. By way of example, consider the following hypothetical sentinel event: A patient residing on a locked unit went missing when the “system” in place failed to alert staff that she was wandering off the unit. Investigations revealed that the patient’s Watch Alert bracelet was not functional and, as the unit did not have bracelet testing equipment, staff were not aware of the malfunction. Furthermore, the elevator was not security code-controlled, allowing the
Healthcare Management Forum Gestion des soins de santé
27
patient to access it to exit. The traditional approach to managing risk in such a case would be to obtain testing equipment for the Watch Alert Bracelets and a Key Pad lock for the elevator, hoping to reduce the probability of such an event occurring again on this unit. An integrated approach to risk management would mean: > informing all units across the hospital of the event and coordinating an organization-wide bracelet testing exercise; > informing the organization’s policies and procedures coordinator that the wandering policy needs revision to include regular testing of the bracelets at fixed intervals; > mobilizing quality improvement teams to investigate the prevalence of such events across all units and conducting an analysis of the etiology of occurrences, thus taking a systemic view of this risk issue for the organization; > mobilizing research into bestpractices in the management of wanderings; and > mobilizing the Utilization Management Committee to investigate current utilization of existing wandering-management resources across the organization and determining the optimal resources and systems required. Lastly, an integrated approach to risk management would follow up with an audit of the prevalence of wanderings across the organization 12 months later to ensure the efficacy of remediation implemented. According to the Joint Commission on Accreditation of Healthcare Organizations (JCAHO), implementation of an integrated risk management system is one of the criteria which define a Learning Organization3 as risk information (collected and analysed) is used as a learning resource throughout the organization. This requires a culture which firmly values disclosure of errors. It is significantly different than a risk management process based on the
28
circumscribed reporting of risk events to a select group of individuals within an organization. The Canadian Council on Health Services Accreditation (CCHSA) has incorporated the concept of integrating risk management practices into the operational activities of organizations in its Achieving Improved Measurement (AIM) accreditation program, as part of the System Competency dimension of the Leadership standards (standards 9.0 to 10.0). The standards indicate that risk management practices need to be linked with Continuous Quality improvement and Utilization Management systems.
How does an organization build an effective risk management program? The Canadian Healthcare Association (2002)4 and the Canadian National Steering Committee on Patient Safety5 have identified three systemic barriers which organizations need to overcome in order to establish functional risk management systems. These include a punitive culture of blame that drives risk issues underground; failure to adopt a systemic approach that would enable employees to learn more effectively from adverse incidents; and uncoordinated reporting and analysis mechanisms. Although research into risk management strategies and outcomes is relatively still in a state of infancy, current best practice1,6 sources suggest that in addition to overcoming the above mentioned barriers, an effective risk management program further requires the following elementary building blocks: a formal structure, sufficient scope to cover all categories of risk, risk strategies and clearly defined procedures. Thus, the implementation of an effective risk management program involves the following steps:6 > determining the scope of your risk program; > selecting a type of structure and the key features to support the program; > identifying the RM strategies and regulatory processes required given your particular patient population(s); > implementing coordinated tracking, measurement and analysis mechanisms;
Healthcare Management Forum Gestion des soins de santé
> fostering a patient-safety and a disclosing culture throughout the organization; > conducting ongoing educational programs on risk management for all staff; > designing communications systems to disseminate risk incidents information widely; and > regularly monitoring and evaluating the program’s efficacy. The main generally accepted scope of RM programs6 includes patient care and patient safety, employee-related risks, property and security risks, and financial risks. Relatedly, a review of the literature3,6 reveals that two types of infrastructures predominate in how risk management is organized in healthcare organizations: 1) centralized responsibility and accountability for all risk functions where individual risk coordinators work under the leadership of a corporate risk manager and final accountability for all risk management (clinical and nonclinical) rests with the risk manager; and 2) shared responsibility with multiple sets of defined risk areas where responsibility and accountability is divided among department heads who assume responsibility uniquely for risk management activities in their departments. In terms of key structural elements, the American Society for Healthcare Risk Management recommends: 1) accountability derived from clearly defined risk management responsibilities, measurable risk management goals and related performance appraisal process, 2) formal mechanisms to ensure that risk management activities are coordinated with other functions in the organizations; and 3) computerized tracking of occurrences to provide data processing, trends and benchmarking analysis, and report generation. Establishing a formal risk management infrastructure with centralized and aggregated tracking and analysis under a corporate risk manager/patient safety officer may be an optimal way to organize the key structural elements outlined above and maximize the efficiency of the
risk management program. A corporatelevel manager can lead and integrate all risk management functions, including organization-wide education, evaluation of the corporation’s performance on riskrelated factors, and formal reporting to senior management. He or she can coordinate and synthesize unit-based risk management efforts in conjunction with unit-level coordinators, thus ensuring a standardized approach across the facility and a wide dissemination of corporate risk management objectives. Such an infrastructure can generate economies of scale with regards to ongoing risk and patient safety education, deployment of electronic systems to support tracking of risk events, and the development and implementation of risk-related policies and procedures. It should be noted, however, that comparative outcome analysis of risk management infrastructure types in the Canadian healthcare system may not yet have been conducted; thus, the issue of infrastructure superiority remains an empirical question at this time and a direction for future research.
What about process? In addition to the structural elements outlined above, an effective risk management program requires well designed processes; for example, formal communication and education mechanisms to ensure a wide dissemination of adverse events information across an organization so that we may learn from mistakes made. Processes and supports to react promptly to implementation of new safety initiatives, policies and procedures and/or new legislated changes to ensure compliance are also required, as poor corporate compliance can become a significant risk. Newly emerging initiatives7,8 in the healthcare sector – such as those of the National Steering Committee on Patient Safety and those of the Privacy Legislations – have risk management implications and require such compliance-facilitating mechanisms. Another important process to establish is one for auditing. Managing risk effectively requires significant auditing and research abilities to identify risky
practices on a proactive basis. For example, previous studies9 have revealed that 9% of physician orders contain errors leading to potential adverse events. How a given organization stands on this risk and on other similar risks which have been identified in the literature remains unknown and thus “un-managed” from a risk perspective if not proactively audited. As such, many hospitals are now making provisions for such capabilities in-house or turning to external, specialist auditors to conduct internal safety audits.10 Perhaps the most important organizational process required is one of cultural change: making a corporate commitment to a risk management and a patient safety culture. It is well-established1,4,5 that implementing a successful risk management program requires a culture which supports individuals acknowledging mistakes when they are made and a willingness to share and talk openly about these mistakes with others. Such blameless organizational cultures are challenging to create, however supportive literature is newly emerging towards this end.4,11,12 The following suggestions are offered to support implementing an open and blameless culture: > adopt a formal full disclosure policy regarding all errors made, both internally and to patients/families;13 > adopt a “Second Victim” policy to support staff who make and disclose errors, recognizing that the experience is highly distressing to most; 11
> make use of “Lessons Learned” forums or “Risk Rounds” organization-wide (or city-wide) to promote learning from mistakes; > create an Adverse Event team to ensure follow-up in terms of required systems and process changes, and move quickly from problem to solution; and > develop evidence-based safety initiatives; if you have a research department, make patient safety a main research theme.
Lastly, the cultural change needed to support effective risk management requires moving to an empirical culture regarding risk. Senior management needs to communicate its commitment to risk management to everyone in the organization by developing patient safety and risk indicators and setting performance targets for risk results. Risk results need to be included in a corporation’s Balanced Score Card to evaluate the effectiveness of risk management practices and engage in strategic decision-making regarding risks. Current best practices1 recommends that the Board of Trustees and/or other governance bodies not just receive information on sentinel events but be involved in the review of an organization’s risk management annual plan and report, in order to integrate risk management into the strategic process. References 1. Performance Management Network. A review of Canadian best practices in risk management. Report for the Treasury Board of Canada Secretariat; 1999. 2. Nottingham L. A conceptual framework for Integrated Risk Management. Ottawa: Conference Board of Canada Publications; 1997. 3. Sales A, Moscovie I, Lurie N. Implementing CQI projects in hospitals. Journal on Quality Improvement 2000;26(8):476-487. 4. Canadian Healthcare Association. Patient Safety and Quality Care: Actions required now to address adverse events. A backgrounder report; 2002. 5. National Steering Committee on Patient Safety. Building a safer system: a national integrated strategy for improving patient safety in Canadian health care. Ottawa: Royal College of Physicians and Surgeons; 2002. 6. Bryant J, Hagg-Ricket S. Development of a Risk Management Program In: R. Carroll, ed. Risk Management Handbook American Society for Healthcare Risk management. San Francisco (CA): Jossey-Bass Inc. Publishers; 2001. 7. Baker R, Norton P. Patient safety and healthcare error in the Canadian healthcare system: a systemic review and analysis of leading practices in Canada with reference to key initiatives elsewhere. Ottawa: Health Canada; 2002. 8. Gervais BL, LLP. Risk Management Health Law Seminar. Ottawa; November 2002. 9. Saxe-Braithwaite M. Walking the walk: practical tools for a culture of safety. Paper Presentation to the 5th Joint National Conference on Quality in Health Care (CCHSA, CHE), Toronto; 2003 10. Devitt R, McLellan BA. Improving patient safety through lessons learned. Paper Presentation to the 5th Joint National Conference on Quality in Health Care (CCHSA, CHE), Toronto; 2003. 11. Wu AW. Medical Error: the second victim. British Medical Journal 2000;320(7237):726-727. 12. Wu AW, Cavanaugh TA, McPhee J, Lo B, Micco GP. To tell the truth: ethical and practical issues in disclosing medical mistakes to patients. Journal of General Internal Medicine1997;12(12):770-775. 13. Hebert PC, Levin AV, Robertson G. Bioethics for clinicians: disclosure of medical error. Canadian Medical Association Journal 2001;164(4):509-513.
Healthcare Management Forum Gestion des soins de santé
29