In the civil aviation, nuclear power, and railway transport industries in Europe, the rate of catastrophic accidents per exposure, such as complete failure of an airplane engine leading to loss of aircraft, is better than 1 x 10^–6. That is, the rate of death in these industries is less than 1 per million exposures. The rate of fatal adverse events among hospital patients is much greater but also varies by domain (1). In obstetrics, anesthesiology, or blood transfusion, the risk for fatal adverse events per exposure is less than 10^–5 (17). Conversely, surgery has a total rate of fatal adverse events of almost 10^–4 (14). Numerous investigators present this 10^–4 risk for accident as an extrapolated average value in health care (18, 19). However, not all statistics have the same validity, because of differences in definitions and comprehensiveness in monitoring methods (20). Some statistics derive from large databases with objective assessment, whereas others derive from local estimates. The latter is particularly true for health care. The rates of adverse events are most likely reasonably convergent in the published literature, but some investigators have pointed out the importance of an accurate numerator and denominator in the calculation (21, 22). For our purposes, however, we believe that these variations do not deeply alter the proposed safety framework. We aim to reason more in terms of relative ranking rather than precise safety values. Moreover, our working hypothesis on the stability of the relative ranking is all the more reasonable because the industries from which we are inferring were chosen on the basis of separation by many logs of safety amplitude.

What Are the Limits and Barriers to Achieving Safety in Medicine?

Bearing in mind the caveats regarding calculation of risk, the risk for catastrophic events across industries differs greatly. Some sectors continue to have a low safety level (for example, transport by microlight aircraft or helicopter, and emergency surgery), some are stuck at an average safety level (for example, road safety and occupational accidents in trade or fishing), some are at good levels (for example, the petrochemical industry and anesthesiology), and the best have achieved safety levels beyond 10^–6 (for example, the nuclear power and civil aviation industries). Five systemic successive barriers seem to characterize limitations in safety improvement.

Barrier 1: Acceptance of Limitations on Maximum Performance

The first barrier involves regulations that limit the level of risk allowed. This level is dictated in situations in which high levels of production and performance are also sought. When limits do not exist—that is, the prevailing attitude is "attain a specified high level of production, no matter what it takes"—the system in question is very unsafe. When the maximum performance is unlimited and individuals or systems are allowed to make autonomous decisions without regulation or constraints, the risk for fatal events nears 1 x 10^–2 per exposure. For example, mountain climbers who attain more than three 8000-meter Himalayan peaks have a risk for death that exceeds 1 in 30 (23). This figure has been consistent for more than 50 years. Similar figures are observed for complex, audacious surgical interventions in medicine, such as repair of complex pediatric heart anomalies (24). This level of risk also characterizes amateur and pioneering systems. Of note, the professionals who act under these conditions are often highly competent. Low safety levels do not arise from incompetence. The greater risks in complex domains are incurred by experts who challenge the boundaries of their own maximum performance. The more audacious the expert, the more risky the adopted strategies and the more frequent the adverse outcomes.

Fortunately, most industrial systems have passed beyond the pioneering phase and limit their maximum potential production and performance by comprehensive regulations and self-imposed guidelines. These systems deny even experts absolute discretion. However, overregulation also poses a risk. Flu vaccinations and blood transfusion policies offer good examples of the unintended consequences of overregulation. In the past 2 decades, an impressive series of safety restrictions on blood acquisition has successfully reduced the risks associated with the transmission of HIV and the hepatitis viruses by 10-fold (25). These restrictions have led, however, to a severe reduction in the number of accepted blood donors. This result demonstrates a classic tradeoff between ultrasafety and productivity: The limitations on circumstances under which blood may be donated greatly reduce transmission of serious diseases, but they result in the risk that blood will not be readily available when needed, for example, to treat traumatic shock. This trade-off will affect all patients until reliable synthetic alternatives to blood become available.

Barrier 2: Abandonment of Professional Autonomy

The second barrier involves restriction of the autonomy of health care professionals. In road safety, "traffic" is a collection of drivers, each of whom is pursuing a personal goal (such as destination or timing). For each individual, the other actors (such as other drivers or pedestrians) are in some sense barriers to these personal goals. Road safety requires that drivers not act purely autonomously; rather, they must each subordinate their own goals given that others share the road. In the highly charged political and legal environment of the nuclear power industry, we have seen a gradual reduction in autonomy, with improved safety. The disaster at Three Mile Island led to the emergence of norms throughout this industry (26). The dread of even 1 potential catastrophe and its implications for all industry members outweighed any objections to creating a robust reporting system for near misses and reduced autonomy of plant operators. Backed by communal pressure, local proactive safety methods became institutionalized and effective across the industry. The intensified approach to process improvement through a focus on safety led to financial gains through more efficient power production (fewer outages, fewer shutdowns, and reduction of capacity) (9). In the aviation industry, comprehensive risk management programs developed in the past 30 years (including crew resource management) have reduced the authority of pilots and have made aviation very safe. The decades-long effort to improve safety in aviation through system monitoring and feedback holds many important lessons for health care (27).

A growing movement toward educating health care professionals in teamwork and strict regulations have reduced the autonomy of health care professionals and thereby improved safety in health care (28). But the barrier of too much autonomy cannot be overcome completely when teamwork must extend across departments or geographic areas, such as among hospital wards or departments. For example, unforeseen personal or technical circumstances sometimes cause a surgery to start and end well beyond schedule. The operating room may be organized in teams to face such a change in plan, but the ward awaiting the patient's return is not part of the team and may be unprepared. The surgeon and the anesthesiologist must adopt a much broader representation of the system that includes anticipation of problems for others and moderation of goals, among other factors. Systemic thinking and anticipation of the consequences of processes across departments remain a major challenge.

Barrier 3: Transition from the Mindset of Craftsman to That of an Equivalent Actor

The third barrier appears when systems have already accepted limitations on individual discretion (after the first barrier has been crossed successfully) and can work well at team levels (after the second barrier has been crossed). We believe that to achieve the next increase in safety levels, health care professionals must face a very difficult transition: abandoning their status and self-image as craftsmen and instead adopting a position that values equivalence among their ranks. For example, a commercial airline passenger usually neither knows nor cares who the pilot or the copilot flying their plane is; a last-minute change of captain is not a concern to passengers, as people have grown accustomed to the notion that all pilots are, to an excellent approximation, equivalent to one another in their skills. Patients have a similar attitude toward anesthesiologists when they face surgery. In both cases, the practice is highly standardized, and the professionals involved have, in essence, renounced their individuality in the service of a reliable standard of excellent care. They sell a service instead of an individual identity. As a consequence, the risk for catastrophic death in healthy patients (American Society of Anesthesiologists risk category 1 or 2) undergoing anesthesia is very low—close to 1 x 10^–6 per anesthetic episode (29).

Conversely, most patients specifically request and can recall the name of their surgeon. Often, the patient has chosen the surgeon and believes that the result of surgery could vary according to that choice. This view is typical of a craftsman market. Safety outcomes for surgeons are much worse than for anesthesiologists, nearer to 1 x 10^–4 than to 1 x 10^–6 (30). This rate of risk is also seen in many small industries, such as chemical companies, charter airlines, or farm-produce industries (in companies with <50 employees). In France, the risk for catastrophe in such small companies is worse than 1 x 10^–4, whereas larger chemical companies have an average risk closer to 1 x 10^–5 and large aviation companies and food manufacturers are even safer, with a risk near 1 x 10^–6 (31). The difference between small companies and big companies lies in the "à la carte" production of products, such as cheese or fireworks. These products belong to protected commercial niches that have suffered over time from large variations in quality and product safety.

Ultrastandardization and the equivalent actor principle require stable conditions for activity. These conditions are reached in some sectors of health care, such as pharmacy, radiology, and nonemergency anesthesiology. They are less common in intensive care units and emergency surgery, in which unstable conditions, such as nonpermanent staff, variation in patient acuity, and little control of planning, are the norm.

Barrier 4: Need for System-Level Arbitration To Optimize Safety Strategies

The increase in pressure from medical malpractice liability and media scrutiny has created a need for system-level arbitration. These factors are the paradoxical consequences of systems that have reached very safe levels of performance (32). The safer a system is, the more likely it is that society will seek to hold people accountable or seek legal recourse when injuries occur. In France, for example, the rate of patients' official complaints per 1000 beds has increased from 11.5% in 1999 to 16.7% in 2004 (33). The consequence of this paradox is that the patient injuries that occur tend to be very expensive in terms of patient compensation and help to fuel the liability crisis. Accidents become politically and financially intolerable because of their consequences and cost rather than because of their frequency and severity. The public and the media can censure companies or hospitals, leading to sweeping new policies, firing of individuals, and sometimes destruction of industries. The recent passing in Florida of a constitutional amendment that makes all quality assurance data available to the public represents the public's desire to better scrutinize health care providers (34). This amendment has already led to a decrease in reporting of adverse events in Florida. Of note, the most recent safety problems can bias objective assessment of risk because a lower value is assigned to individual deaths, even if numerous, and a higher value is assigned to a concentration of deaths, even if rare. This biased view is seen, for example, with respect to aircraft accidents. In such conditions, health care professionals fear for their own position and behave accordingly. The liability crisis in Florida supports this barrier as a key to creating safer conditions when physicians feel vulnerable.

The fourth barrier results from the tendency of professionals and their unions to overprotect themselves in the face of legal pressures and threats of litigation. This overprotection occurs when insufficient consideration is given to the unintended consequences for the rest of the staff and system. This barrier echoes the second barrier, excessive autonomy, except that it is much more subtle and perverse. The actors are not ignoring the goals and constraints of their colleagues, as in the second barrier. Health care professionals and executives support their willingness to improve safety by confronting the fourth barrier and act by imposing additional constraints on other colleagues. However, the perverse effect is that their safety decisions primarily absolve them of their responsibility without clear recognition of the impact of their decisions.

An additional perverse effect of top-down safety reinforcement is the potential difference in perception of patient safety at the various levels of the organization. Top management views safety in terms of mitigating the consequences of a crisis, so as to avoid jeopardizing the total organization (35). To them, patient safety is just another source of risk, among other sources that have similar consequences to the organization, such as troubled industrial relations or inadequate cash flow. Chairs of clinical departments traditionally approach safety by confusing safety with quality and focus on production-line issues. Individual clinicians are more aware of patient safety issues because of the risks that may damage their own self-image, reputation, or financial wherewithal. Societal censure, including personal or social confrontation with one's own errors or failures, is difficult for clinicians to accept (36, 37).

The blood transfusion crises of the 1980s provide an example of the fourth barrier, with consequent overregulation and conflicts among the 3 levels. Many patients were infected with HIV because systematic testing for HIV infection was not done during blood donation in France. It was commonly believed that the public health authorities delayed the introduction of HIV testing to avoid losing money and national reputation by refusing to use a testing kit from the United States (38). In fact, the relevant medical authorities had recommended immediate action. As the crisis became public, blood donations became scarce because of a loss of donor confidence. Furthermore, the increased controls and paperwork made donation more demanding and time-consuming. The result was that many physicians voluntarily reduced the use of blood. Today, 20 years after the crisis and after implementation of dozens of additional controls, the risk for transfusion-transmitted viral infection is intrinsically much lower (39). But an unintended consequence of these events in France has been a resurgence of severe anemia. Thus, a disease that had essentially disappeared in western countries is reemerging (40).

Barrier 5: The Need To Simplify Professional Rules and Regulations

The fifth barrier typically derives from the perverse effect of excellence. It is generated by the accumulation of layers that are intended to improve safety but make the system overly complex, burdensome, and ultraprotected. Because reporting of accidents loses relevance, people forget to report them. The visibility of risk becomes small, and decisions are made without clear proof of their benefit, sometimes introducing contradictions among regulations and policies (41). New safety solutions implemented at this point have unintended effects. For example, the rate of production of new guidance materials and rules by the European Joint Aviation Regulators is substantially increasing. More than 200 new policies, guidance documents, and rules are created each year even though the safety of global commercial aviation has been at a plateau of 1 x 10^–6 for years. Because little is known about which rules or new guidelines are truly linked to safety levels, the system is purely additive: Old rules and guidance material are never discarded or removed. Regulations become difficult to apply, and pilots violate more rules in reaction to increasing legal pressure.

Some areas of medicine follow this same pattern. For example, regulations to protect against fire in hospitals in France have been revised 5 times in the past 8 years, despite few data on whether these regulations have improved fire safety as opposed to simply making the system more unwieldy. In health care, arcane vocabulary and the complexity and opaqueness of processes cause risk to be poorly visible to practitioners.

The most recent and most sophisticated safety solutions for automated aircraft are electronic cocoons and flight envelopes that protect the aircraft against pilot errors, such as excessive commands or too much or too little speed. Paradoxically, these protections have became an important cause of several recent near misses and accidents in glass cockpits, because of crew misunderstanding of the software logic (42, 43). We can extrapolate from the unintended consequences of automation and complexity in aviation to health care, pointing to the comparable negative side effects of technical complexity in medicine. When risks to patients become less observable, the best move is to simplify the system, eliminate nonproductive regulations, and give clinicians more latitude in decision making.

Designing a Health Care-Specific Framework

Health care faces many of the same barriers that other industries have faced in striving toward ultrasafety. However, health care must accommodate at least 3 additional industry-specific factors. First, risks in health care are not homogeneous. In many clinical domains, such as trauma surgery, the rate of serious complications is 1 x 10^–2, but not all complications are related to medical errors (44). Rather, the risks are inherent in the clinical circumstances. In contrast, some health care sectors, such as gastroenterologic endoscopy, are inherently very safe, with a risk for serious adverse events of less than 1 x 10^–5 per exposure. Second, the magnitude and impact of human error are unclear in medicine. Fundamentally, 3 risks are combined in health care: that of the disease itself, that entailed by the medical decision, and that of implementing the selected therapy. These 3 risks generally do not move in the same direction. This complexity makes error prevention harder to predict and grasp. The prognosis for a terminally ill patient may change because of an audacious surgical strategy. However, the most audacious strategies are less evenly distributed in the profession, are the most demanding technically, and are the most prone to errors. Finally, the risk for personal harm, such as becoming infected with HIV, weighs on the clinical staff in a unique way.

The unusual degree of stress that health care workers experience derives from at least 4 factors. First, health care is one of the few risk-prone areas in which public demand considerably constricts the application of common-sense safety-enhancing solutions, such as limiting the flow and choice of incoming patients. This demand is a direct threat to overcoming the 1st barrier (limitation of performance). Second, health care is also one of the few risk-prone areas in which the system is extensively supported by novices, such as students, interns, and residents. Several attempts have been made to evaluate the risks associated with performance by beginners by improved supervision and restricted work hours (45). A study from the U.S. Department of Veterans Affairs demonstrates that the risks of surgery remain higher in teaching hospitals, even after adjustment for case severity (46). Third, health care is one of the few risk-prone areas in which so many obvious sources of human error exist in the system, yet little has been done to reduce them. Sources of error include excessive fatigue on the job, systematic working of overtime, overloaded work schedules, and chronic shortage of staff (47-49). Finally, an endemic source of errors in medicine is the shifting of more clinical care and technology to the ambulatory setting: for example, performance of liposuction in the physician's office rather than a hospital. A recent report suggested that the risk for death associated with liposuction combined with tummy tucks is 10-fold greater when these procedures are performed in clinics as opposed to hospitals (50).

Conclusions

Health care is constantly improving in effectiveness and safety, but the industry has yet to traverse fully the 5 barriers to ultrasafety. Quality improvement programs, including a set of monitoring tools (such as reporting procedures and standardized protocols), alone cannot overcome these barriers. To paraphrase Reason, speaking of the aviation community in the 1980s, the current efforts to improve patient safety are akin to "fighting mosquitoes, but not draining the swamp [of error]" (13). The aviation industry made considerable efforts in the 1980s and 1990s to overcome the first 3 barriers and is now focusing on the fourth and fifth barriers. Health care has yet to master even the first barrier to safe performance. Consequently, efforts to emulate the aviation industry are misplaced if the health care industry focuses on the same barriers as the aviation industry. Mastering the 5 barriers will be a challenge and will require accepting limitations on performance by reducing professional discretion and pressures for productivity. Reduction of errors may also constrain the professional latitude that health care providers currently have. Specialization is constraining performance rather than treating each physician as an expert of unlimited capability and decisions.

Ultrasafe systems have a definite tendency toward constraint. For example, civil aviation restricts pilots in terms of the type of plane they may fly, limits operations on the basis of traffic and weather conditions, and maintains a list of the minimum equipment required before an aircraft can fly. Line pilots are not allowed to exceed these limits even when they are trained and competent. Hence, the flight (product) offered to the client is safe, but it is also often delayed, rerouted, or cancelled. Would health care and patients be willing to follow this trend and reject a surgical procedure under circumstances in which the risks are outside the boundaries of safety? Physicians already accept individual limits on the scope of their maximum performance in the privileging process; societal demand, workforce strategies, and competing demands on leadership will undermine this goal. A hard-line policy may conflict with ethical guidelines that recommend trying all possible measures to save individual patients. The further question is raised of how the equal-actor model can account for the patient's need for a relationship with his or her physician.

Another important lesson from other industries is the move from training, regulation, and assessment of individuals to that of teams of health care providers. Given the interdisciplinary nature of health care and the need for cooperation among those who deliver it, teamwork is critical to ensuring patient safety and recovery from and mitigation of error. Teams make fewer mistakes than do individuals, especially when each team member knows his or her own responsibilities as well as those of other team members. Teams elevate the importance of non-physician input and reduce physician autonomy. However, simply installing a team structure does not automatically ensure it will operate effectively. Teamwork is not an automatic consequence of collocating people and depends on a willingness to cooperate for the sake of a shared goal (51). Medical educators are focusing on creating explicit training that targets team-based competencies.

An improved vision by leadership of the safety and dangers of health care is needed to optimize the risk-benefit ratio. Stratification could lead to 2 tiers or "speeds" of medical care, each with its own type and level of safety goals. This 2-tier system could distinguish between medical domains that are stable enough to reach criteria for ultra-safety and those that will always deal with unstable conditions and are therefore inevitably less safe. For the latter sector of medicine, high-reliability organizations may offer a sound safety model (52). High-reliability organizations are those that have consistently reduced the number of expected or "normal" accidents (according to the normal accident theory) through such means as change to culture and technologic advances, despite an inherently high-stress, fast-paced environment (53) (Figure 2).

View larger version (39K): [in this window] [in a new window]   Figure 2. A strategic view of safety in health care. A 2-tiered system of medicine may result from the distinction between a limited number of clinical domains that can achieve ultrasafety and sectors in which a certain level of risk is inherent. HRO = high-reliability organization.

High-reliability health care organizations will be unable to constrain their production—they must inherently be innovative and require flexible risk arbitration and adaptation rather than strict limits (54). The Table shows a detailed comparison of these 2 possible tiers of health care. Physician training would have to accommodate this 2-tiered approach, and patients would have to understand that aggressive treatment of high-risk disease may require acceptance of greater risk and number of medical errors during clinical treatment.