Risk and patient safety are closely connected in healthcare organizations, and the disciplines of safety and risk management are therefore interrelated. While accreditation organizations such as The Joint Commission and DNV Healthcare have definite requirements related to patient safety and risk, most organizations go beyond these basic requirements and have adopted a business or quality management system incorporating risk analysis and patient safety as key elements [3]. This approach relies on the Donabedian model of healthcare delivery in which structure is created by the organization to ensure timely, efficient, and safe healthcare process delivery with favorable outcomes for the patients served [4]. The first step in assessing ERM is to identify where risk resides within the organization.

Risk can be categorized for any organization at the enterprise level, and commonly used risk domain s in healthcare are listed in Table 6.3. The domains are described with simple definitions and specific examples. The last column is devoted to key risk indicators (KRIs). A KRI is a metric for measuring how risky an organizational process or service line is and can be thought of as an early warning indicator of a potential event that may harm the process/organization/patient. Ideally the KRI is a leading indicator with a predictive value related to the particular risk identified. The ERM goal is to identify risks throughout the organization using risk domain s as a guide, and then to summarize the risks on a risk map/organizational dashboard or domain list as shown in Table 6.3. Measuring, quantifying, comparing, and prioritizing risks are the next steps.

In Chapter 33 we provide several examples of surgical risk and describe the technique of measurement for individual risk parameters based on a failure mode effect analysis (FMEA) . A standard FMEA utilizes three parameters to calculate a risk priority number (RPN) for each risk identified. The three factors are frequency of occurrence, severity, and likelihood of detection. Although this rating system works well in the clinical setting, most organizations with formal ERM systems utilize a simpler version with only the parameters of frequency (likelihood) and severity (impact) to derive a Risk Score that typically is in the range of 1–100 (in the case of a scale of 1–5 rather than 1–10 for each factor, the range would be 1–25). Scales of 1–5 for each parameter are easier to use and make decisions while scales of 1–10 afford more precision and are preferred in engineering work (Figs. 6.1 and 6.2).

After the risks have been categorized and listed using a risk domain , a Risk Score is assigned to each specific risk identified. For example, the risk of failure to appropriately credential new technology procedures may be assigned a frequency score of 2 (since the credentialing is usually done correctly) and a severity score of 6 (because the patient safety risk and liability may be high if a mishap occurs involving a provider who has not been credentialed appropriately). The Risk Score in this case would be 12. Risks may be scored using this system and they can then be grouped and compared. The numbers assigned to each risk are estimates derived by the team performing the assessment, although various data sources may certainly be used to improve accuracy in making the estimates. Risks with higher Risk Scores, or those above a given threshold value, may then be carefully evaluated and monitored.

The culture of an organization is of immense importance, and developing a great culture focused on improving patient safety and quality is paramount to success. A major component of a just culture in healthcare is trust. Without trust among peers, subordinates, clinicians, providers, and administration, many healthcare organizations will merely go through the motions and never achieve true quality improvements. Healthcare organizations, and hospitals in particular, are often highly political with poor lines of communication among various departments, and may harbor tension between administration and those clinicians that serve the needs of the patient. Individuals at varying levels within the organization may have personal agendas that impact honest communication and limit the sharing of information that would enhance higher quality and patent outcomes. One noted hospital turnaround executive, when asked how he had been so successful with institutions that struggled to provide good results, stated, “It’s simple. When faced with any decision I always ask if this action will improve servicing the needs of the patient and improve quality. If the answer is no, then we don’t do it.”

Communication and trust must drive culture with an unwavering focus on the needs of the patient [5]. If a policy or procedure does not improve patient outcomes, then it shouldn’t be adopted. In many instances, the larger and more complex the organization, the more the tendency to focus on organizational rather than customer (i.e., patient) needs. As healthcare moves to increased transparency and disclosure of both quality and costs, patients will demand higher quality services at a lower cost in the new retail environment. The organizations that can make significant improvements in patient outcomes will have the upper hand in attracting and retaining patients. This will not be accomplished without breaking down the communication barriers and increasing trust through a broader enterprise-wide risk management structure.

Risk is inherent in every business, and organizations that embed risk management practices into business planning and performance management are more likely to achieve their strategic and operational objectives [6]. Healthcare is often characterized by the statement, “good people, bad system.” Frequently the “system” (administration, politics, bureaucracy, regulations) gets in the way of individuals doing their job or doing the right thing when it is needed. The ERM processes should include both identifying issues that get in the way of better quality and patient outcomes and documenting situations in which successful workarounds occurred to avoid a bad outcome. Due to incident reporting mandates, there is often a focus on bad outcomes with limited learning about what was done correctly [7]. The true learning that should be taking place to improve quality comes from the avoidance of a bad outcome or “near miss,” with appropriate recording of the events and subsequent follow-up using an organizational structure such as a morbidity and mortality conference. A number of organizations have utilized various programs supporting a culture of ERM, including Organizing for High Reliability (HRO), Crew Resource Management (CRM), and TeamSTEPPS (from AHRQ) [8].