Steps in the Process of Risk Management in Healthcare

Read this case study and answer the questions below it

Risk is a probability/threat of damage, injury, liability loss that is caused by vulnerabilities and that may be avoided through preemptive action/s. Interaction of humans with health systems pose a threat to them mainly because of the; complex technology, intensely complex procedures, high demand on services, time pressure, high expectations from the service users, hierarchical by nature of training and responsibilities. W.H.O estimates show that in developed countries as many as 1 in 10 patients is harmed while receiving hospital care [1]. According to AHRQ national health disparities report 2013, rate of harm associated with hospital stays in U.S hospitals is 25.1 per 100 admissions [1]. Major contributors to these hospital-acquired conditions (HACs) were; adverse drug events, catheter associated urinary tract infections, patient falls, pressure ulcers, surgical site infection, central line associated infections, venous thrombo-embolism and ventilator associated pneumonia [2]. According to Institute for Healthcare improvement (IHI), medical errors have become the third leading cause of death in the United States each year, behind cancer and heart disease [1].

A 13.5 percent rate of harm was identified within the US Medicare population by the Office of Inspector General using the Institute for Healthcare Improvement's Global Trigger Tool [3].

Predominantly the underlying causes of medical errors are; communication problems, inadequate information flow, human related problems, organizational transfer of knowledge, staffing patterns and work flow, inadequate policies and procedures and technical failures [2].

Hospitals are a common setting for hospital acquired conditions in part because of the clinically compromised state of many patients admitted to the hospital and high volume of care transactions and interventions that take place during a hospital stay. Investigations into incidents frequently stop with identifying the human error and designating the practitioners as the "cause" of the event [1]. Hindsight bias occurs when the investigators work backward from their knowledge of the outcome of the event. This linear analysis makes the path to failure look as though it should have been foreseeable or predictable, although this is not the case. Often this determination is made without any evaluation of systems or processes that might have contributed to the error [4].

Organizational leaders must become "systems thinkers" who demand in-depth analyses of safety concerns, replace punitive reactions to mistakes with an open environment and proactively address any risks; there will be an opportunity to build safer health care organizations. However there is no room for reckless behavior in the healthcare environment.

Probability is the measure of the likelihood that an event will occur. Threat is any activity that represents a possible danger. Vulnerability is a weakness. Loss results in a compromise to functions, life or assets. HACs are Hospital Acquired Conditions. Incident is an undesired outcome or occurrence, not expected within the normal course of care or treatment, disease process, condition of the patient, or delivery of services. Near miss is an event or process variation that could have resulted in injury but did not, either by chance or timely intervention. Sentinel event is an unexpected occurrence involving death or serious physical or psychological injury, or the risk thereof, not related to the natural course of a patient's illness or underlying condition.

Scope of the Risk Management

Risk Management can be Beneficial in the Following Contexts

a. Enterprise Risk Management (ERM): Comprehensive risk management of the organization from top down including financial and business viability.

b. Patient care (Clinical)

c. Medical staff (Such as; credentialing, privileging, job description, employee insurance, trainings, medical coverage)

d. Non-medical staff (Such as; job description, training, medical coverage)

e. Financial (Budgeting, cost-benefit and cost-effectiveness analysis, insurance coverage)

f. Managerial (Such as; organogram, Job descriptions, delegation of work)

g. Project risk management (Such as scope, time, cost, human resources, operational, procedural, technical, natural and political)

h. Facility Management and safety (Such as building safety, security of the facility, hazardous materials and waste disposals (HAZMAT), emergencies internal and external, fire safety, medical equipment maintenance plan and maintenance plan for each of the utility system.

Risk Management Information System (RMIS) Risk Management Information system (RMIS) is a computerized system used for data collection and processing, information analysis and generation of statistical trend reports for the identification and monitoring of events, claims and finances.

Key Concepts in Risk Management

Risk management for healthcare entities can be defined as an organized effort to identify, assess, and reduce, where appropriate, risk to patients, visitors, staff and organizational assets. Risk management in its best form may be to use it in a pro-active manner in identifying and managing the risks. However in case an incident has happened; after the event handling, it should still be tackled in line with the risk management principles as outlined here. This review provides a concise material in risk management for J Epid Prev Med ISSN: 2378-5179 Page 1 of 5 Review Article Journal of Epidemiology and Preventive Medicine Open Access healthcare professionals to quickly grasp the key concepts in risk management and implement them in the healthcare organizations where they work.

Risk management as a process uses a five step management decision-making model.

Five Basic Steps of Risk Management [1]

The five basic steps of risk management are outlined below

Step 1: Establish the context y

Step 2: Identify risks y

Step 3: Analyze risks y

Step 4: Evaluate risks y

Step 5: Treat/Manage Risks

Establish the context: Context is very important in risk identification and management. ICU (Intensive care unit), O.R (Operation room), E.R (Emergency room), blood transfusion services, CCU (coronary care unit), medication management including medication administration are contextually high priority areas for risk management in relation to patient care.

Identify Risks: Risk identification is the process whereby the healthcare professional and the healthcare employees become aware of the risks in the health care services and environment. The risks identified are entered in the Risk Management Tool (RMT) as depicted in Figure 2, also sometimes known as the Risk Register.

Sources of risk identification

a. Discussions with department chiefs, managers and staff

b. Patient Tracer Activity (Tracing the journey of a patient from admission till discharge)

c. Retrospective screening of patient records

d. Reports of accreditation bodies e. Incident reporting system & sentinel events

f. Healthcare associated infections (HAI) reports

g. Executive committee reports

h. Facility management & safety committee report

i. Patient complaints and satisfaction survey results

j. Specialized committee reports (such as Morbidity and mortality committee, medication management and use, Infection control, blood utilization, facility management and safety committee).

Analyze Risks: Risk analysis is about developing an understanding of the risks identified. It includes the following:

a. Level of the risk or Risk score

b. Underlying causes

c. Existing control measures. Existing controls: When examining the existing control measures, consideration should be given to their adequacy, method of implementation and level of effectiveness in minimizing risk to the lowest reasonably practicable level. These include all measures put in place to eliminate or reduce the risk and may include:

d. Policies, procedures, protocols, guidelines

e. Alarms and beeps

f. Engineering controls

g. Insurance coverage programs

h. Code teams i. Trainings

j. Emergency arrangements

k. Preventative maintenance controls

Root Cause Analysis (RCA) represents a systematic approach to identifying the underlying causes of adverse occurrences so that effective steps can be taken to modify processes and prevent future losses. Brain storming with a team of relevant and informed people still remains the best method to do Root cause analysis.

The risk is such that no treatment option is available. Risk Treatment: (Also known as Risk reduction, Risk mitigation): The decisions in risk treatment should be consistent with the defined internal, external and risk management contexts and taking account of the service objectives and goals.

Controlling the Risk: The most effective methods of risk control are those which redesign the systems and processes so that the potential for an adverse outcome is reduced. Other methods of controlling the risk include reducing the likelihood of the risk and/or reducing the severity of the impact of the risk.

Reduce the Likelihood of the risk occurring - e.g. by preventative maintenance, audit & compliance programs, supervision, policies and procedures, testing, training of staff, technical controls and quality assurance programs.

Reduce the Severity of Impact of the risk occurring - through contingency planning (contingency plan is a back-up plan in case the identified risk actually takes place), disaster recovery plans, offsite back-up, emergency procedures, staff training, etc.

Transferring the risk: Transferring the risk involves another party bearing or sharing some part of the risk through contractual terms, insurance, outsourcing, joint ventures, etc.

Avoiding the risk: This is achieved by either deciding not to proceed with the activity that contains an unacceptable risk, choosing an alternate more acceptable activity.

Monitor & Review: Once the risk management is in place, monitoring and reviewing of the process/system which was taken care of, is an integral part of the risk management cycle.

Monitoring and Reviewing utilizes the following sources of information.

a. Incident reporting

b. Clinical Audit indicators

c. Patient Tracers

d. Safety rounds

e. Patient complains

f. Satisfaction survey

g. Staff complains

Medical records

Residual Risk: Residual risk is the risk that remains after we apply controls. It's not always feasible to eliminate all the risks. Instead, we take steps to reduce the risk to an acceptable level. The risk that's left is residual risk.

Residual Risk = Total Risk - Controls

Challenges of Risk Management

Risk management in healthcare is done by organizations which are conscious of the fact that healthcare interface poses risk. Organizations actively pursuing risk management are therefore a step higher in the ladder in ensuring safety of services and striving for quality of care as compared to the organizations that don't. Risk management is advanced and pro-active methodology of tackling healthcare risks; however it is challenging the following sense:

a. Leadership commitment for ensuring risk management.

b. Risks are proactively identified and prioritized

c. Risks are not ignored

d. Pro-active involvement of the risk management team with the employees and processes

e. Expertise availability in the team

f. Resources for risk treatment/mitigation adequate

g. Change in the process/system is accepted when indicated

h. Monitoring and control systems are in place

Answer these questions according to the case study:

1. Summarize the contextual situation by identifying the issues and defined the problem(s)

2. What principles, theories, and terminologies that can best guide the reasoning toward presenting the most appropriate solution/recommendation?

3. The analysis - here is where you would answer the questions, if stated. Assuming the case is open ended, then you will formulate your own questions arising out of the simulation and generate your own best answer to them

4. What are the basic steps in Risk management according to this document? Describe and explain each of these steps

5. How will you apply these steps in an actual setting. You could use your own place of work or a health care setting you are familiar with.

6. Summary and conclusion - what have you learnt by doing this case study and analysis?

7 Bibliography and References