People, systems and safety: resilience and excellence in healthcare practice.

This article outlines recent developments in safety science. It describes the progression of three 'ages' of safety, namely the 'age of technology', the 'age of human factors' and the 'age of safety management'. Safety science outside healthcare is moving from an approach focused on the analysis and management of error ('Safety-1') to one which also aims to understand the inherent properties of safety systems that usually prevent accidents from occurring ('Safety-2'). A key factor in the understanding of safety within organisations relates to the distinction between 'work as imagined' and 'work as done'. 'Work as imagined' assumes that if the correct standard procedures are followed, safety will follow as a matter of course. However, staff at the 'sharp end' of organisations know that to create safety in their work, variability is not only desirable but essential. This positive adaptability within systems that allows good outcomes in the presence of both favourable and adverse conditions is termed resilience. We argue that clinical and organisational work can be made safer, not only by addressing negative outcomes, but also by fostering excellence and promoting resilience. We outline conceptual and investigative approaches for achieving this that include 'appreciative inquiry', 'positive deviance' and excellence reporting.

Introduction

Optimising patient safety is a goal of healthcare. Much has been spoken and written about it, and it is well established as a core activity for all those working in healthcare systems. This has not always been the case; historically, error and harm from healthcare was an accepted risk of treatment. However, as standards of treatment and care have improved this acceptability was questioned and refuted, and the patient safety movement born.

This article summarises the evolution of safety science, describing historical approaches, comparing them with recent concepts in safety, and describing how they affect staff working within the healthcare system. It introduces some of the models we use to explain safety‐related work and the way we view the system as a whole, and it gives examples of tools and techniques to apply in practice. It does not aim to be a systematic review 1, but instead reflects the authors’ (at times partisan) interpretation of the research literature and reflection on clinical and organisational experience. Its purpose is to give the reader an insight into the evolution of current approaches to patient safety and an appreciation of some of their limitations. It also gives an account of some of the newer concepts and the ways they can be applied in everyday safety work.

The three ‘ages’ of safety

Hale and Hovden have traced the development of safety by describing three ‘ages’ of safety, namely ‘the age of technology’, ‘the age of human factors’ and ‘the age of safety management’ 2. In the first age, it was technology that posed the main threat to safety. This was not only because machines were inherently unreliable and dangerous, but also because people had not yet learned to identify and avoid the risks they posed. This age is generally held to have begun around the time of the industrial revolution (c. 1770), but extended well into the 20th century. Both Heinrich's seminal book on industrial safety in the early 1930s 3, and the development in the 1950s and 1960s of a number of methods of analysing risks within technological systems describe this view of safety. Accidents in the first age of safety were attributed to breakdown, failure and malfunction of machinery. The models used to describe and explain accidents have evolved in parallel with the changes in safety thinking, typified by the three ages listed above. The Domino model, proposed by Heinrich in the 1930s 3 describes a set of domino pieces that fall, each knocking down the next, exemplifying simple, sequential, linear causality. Within this paradigm, event analysis is geared towards finding the step (or component) that ‘failed’. Although simple, this model guided risk management well into the 20th century and gave rise to many sophisticated prospective analytical techniques, such as hazard and operability studies and failure modes and effects analysis. Such prospective approaches are fruitful and have also been applied to healthcare, as in a previous study that attempted to identify points in the peri‐operative pathway where safety could be enhanced 4. These were used to try to anticipate the likelihood and severity of possible points of failure or malfunction in industrial systems, so that procedures and ‘fail‐safes’ could be put into place to deal with possible hazards and prevent accidents. Although they focused on the technology rather than the humans operating it, they were applied even to complex mechanical systems such as power plants and led to considerable advances in safety at the time.

The limitations of focusing on technology as the source of accidents were illustrated by the disaster at the Three Mile Island nuclear plant in the US in 1979. During the preceding 20–30 years, there had been some attempts at scientific study of the interplay between humans and technology, but these had focused on efficiency and productivity rather than safety. In comparison with technology, humans ‘came to be seen as too imprecise, variable and slow’ 5. The Three Mile Island incident evolved from a minor mistake made during routine maintenance; the operators in the plant control room interpreted conflicting instrument readings in a way that allowed them to apply standard operating procedures in an attempt to correct the problem. However, this interpretation was incorrect and made the situation worse. Only when (some hours later) a new technician was called in to the control room was the situation correctly re‐interpreted and a much more serious outcome averted. This incident struck a blow to the notion (supported implicitly by the domino model of accident explanation) that all possibilities of failure could be predicted or managed by predictable means. Furthermore, it also became generally accepted within the safety science community that it was no longer possible to ignore the role of people in complex systems. To promote human reliability, the aim became to reduce the human contribution in the processes of care to a minimum by standardising and improving basic processes, and automating work as much as possible 6.

However, there are some problems with this approach, especially as applied to healthcare. Many things cannot, or should not, be standardised (see below). Automation is helpful in some aspects of care, but unnecessary or undesirable in others. Logically, human reliability is inevitably accompanied by the potential for unreliability. Although technology can be thought of as morally neutral (it is a nonsense to suppose, for instance, that a machine might deliberately malfunction), humans carry the power of agency, meaning that intention can be ascribed to their actions and with it the possibility of blame. Thus, the idea that humans (as well as machines) should play a part in systems of safety not only introduced the concept of human reliability (to complement mechanical reliability) but also promoted identification of human error as a key part of accident analysis. The enduring legacy of the second age of safety is thus the possibility of castigation, victimisation and admonishment of humans as they are blamed for their ‘mistakes’.

This new view of safety needed a better explanatory model, and the 1980s saw the publication of Reason's ‘Swiss cheese’ model 7. This represents events in terms of composite linear causality, where adverse events can be attributed to combinations of active failures (unsafe acts) and latent conditions (hazards). The types of conditions influencing safety include team and organisational factors, as well as individual personality and behaviour. The model is still inherently linear; investigation of accidents still assumes that it is possible to work backwards and identify causative features. Using this model, a substantial amount of effort has been devoted to examining the sequence of events leading up to accidents to try to understand how the accident came about and thus help to prevent recurrence. This approach was adopted in aviation and subsequently in healthcare, in the NHS and especially in anaesthesia 8, 9, 10. A typical approach is depicted in Fig. 1.

Figure 1

A typical approach to accident investigation.

However, within 10 years or so (towards the end of the 1980s) it became clear that although the inclusion of human elements was necessary, it was not in itself sufficient to give form to a model that could explain accidents in complex organisational systems. The resulting attention given to broader safety management systems led to the name given to this ‘third age’. A move away from the probabilistic assessment of possible risks, and the linear backward search for contributing or causal factors in accidents, was accompanied by a trend towards understanding organisational culture and processes in addition to technology and human behaviour. The relationships between individual human beings, the technology they use, and the organisational setting they work within, together make up complex sociotechnical systems.

The transitions between the first and second, and especially between the second and third, ages have not been clear cut. As Hollnagel noted in 2014, ‘the practices of risk assessment and safety management still find themselves in the transition from the second to the third age’ 5 and indeed elements of all three ages may co‐exist. We should also note here that the three ages of safety (having first been described in 2001) are retrospective constructs that aim to make sense of (and possibly over‐simplify) history. Nevertheless, we believe they offer a useful perspective. A summary can be seen in Table 1.

Table 1

The ages of safety and associated models

	‘Age’	Model
1	The age of technology	Domino model
2	The age of human factors	Swiss cheese model
3	The age of safety management	Safety‐1 and Safety‐2

From Safety‐1 to Safety‐2 and two views of work

The focus in the third age of safety is more on trying to understand and strengthen everyday features of work within complex sociotechnological systems that promote safety. This is the dominant paradigm in what Hollnagel has termed ‘Safety‐2’ in comparison with ‘Safety‐1’, where the focus is essentially on errors and how they have arisen 5. The system property promoting the maintenance of safety has been termed resilience, and is well defined by Hollnagel as ‘the ability to succeed under expected and unexpected conditions alike, so that the number of intended and acceptable outcomes is a high as possible’ (p. 134) 5.

Hollnagel went on to articulate the concepts of ‘work as imagined’ and ‘work as done’ as two contrasting ways of understanding work 5. ‘Work as imagined’ is defined by the rules and standards outlining the way things should work and represents how designers, managers, regulators and authorities believe work happens or should happen. ‘Work as done’, on the other hand, describes the work as carried out by ‘front‐line’ employees at the ‘sharp end’; in the case of healthcare, clinicians who interact with patients. Those who work at this level know that although protocols and guidelines have their place, work is only possible by continually adjusting what you do, which sometimes means improvising and working outside the ‘rules’. This variability in performance is necessary, partly due to not only the inherent unpredictability of much of the work in healthcare but also sometimes due to the very organisational conditions created by those at the ‘blunt end’; the policies they have produced, or the way in which they view work. We suggest that the ‘work as done’/‘work as imagined’ model helps to explain why there are contrasting (and sometimes conflicting) views about how safety should be managed in healthcare organisations.

Taking a work‐based view of accidents, each step of the investigation model in Fig. 1 can now be seen to be at best limited in its usefulness, and at worst fundamentally flawed. Waiting for something to go wrong risks unnecessary harm if the problems within the system can be detected before they cause an accident. Finding out what happened (typically by root cause analysis, which is now well embedded in NHS culture) often focuses on the ‘first story’; that is, establishing the ‘facts’ and the timeline linking them. This is essential, but gives an account of events that is incomplete without the meanings given to them by the people concerned, or an understanding of why they acted as they did 11. The third step, that of attributing actions to people, is the most dangerous. This can very easily stray into the allocation of blame, which is bad for safety in general; humans need to feel safe to act safely, and a punitive culture will discourage reporting of error and its balanced analysis. Furthermore, safety investigations often stop as soon as human error has been identified as a causative factor. As noted above, attributing actions to one individual is undesirable and also closes off further investigation into organisational function, norms and behaviour. The fourth element (finding the root cause) is problematic, as the ‘root’ may never actually be reached, and it is also logically asymmetrical 12; although it is possible to argue that every cause must have an effect, not every event has an identifiable antecedent, let alone one that can be considered causative (reverse causality).

The final step, that of fixing the system (so that the accident does not happen again) ignores that fact that the system usually operates successfully to prevent the occurrence or propagation of accidents, and so in that sense it does not need fixing. At its simplest, safety becomes a matter of procedures and compliance with them. Means of repair such as recommendations and guidelines very much demonstrate a reinforcement of ‘safety as imagined’, and often do not mean much to those on the front line. Large enquiries offer many recommendations that are naively assumed to be independent, but which in practice may be contradictory. However, the strongest indictment of the ‘fixing’ approach is that it implies a binary view of work and outcome; that correctly functioning systems (and the humans within them) do not lead to adverse outcomes, which can only come about through malfunction or error 13. As we argued above, this is an oversimplification of work; responsiveness to changing needs and circumstances is essential to get the job done. This performance variability helps produce the right outcome, although sometimes it may contribute to an unacceptable outcome. This is illustrated in Fig. 2. It then becomes possible to posit a revised investigation model (Fig. 3).

Figure 2

Relationship between performance variability and outcome. Reproduced from Safety‐1 to Safety‐2: A White Paper. EUROCONTROL 201314.

Figure 3

Revised approach to accident investigation.

Problem areas in patient safety

Studying patient safety and applying its scientific principles to practice is complicated. Here, we deal with four factors that contribute to this.

The first is the ambivalent role of human beings in safety. On the one hand, humans bring variability and uncertainty, and hence can be thought of as increasing the risk of error. On the other (as in the Three Mile Island incident above) they also act to promote safety. Human variability is what permits us to improvise and try new responses to newly encountered situations and is therefore desirable. As Vincent notes, there are two broad approaches to this issue that fit neatly with the Safety‐1 and Safety‐2 approaches, respectively 6. One is to simplify, standardise and automate; in the other, enhanced safety comes about not through minimising the human contribution, but by understanding how people think about (and respond to) the risks in their work, overcome hazards and, in effect ‘create’ safety.

The second is related to this and deals with the advantages and disadvantages of standardisation. In a short but brilliant recent article, Wears explored the complexities behind the common and deceptively simple call for greater standardisation in healthcare 15. The benefits of standardisation are obvious in many settings and are of particular relevance to safety. Standards promote routinisation, which in turn allows the freeing‐up of ‘attentional resources, diverting them from mundane to truly complex or pressing issues' 16. Wears goes on to delineate five problematic aspects of standardisation, especially in healthcare. These include: its philosophical basis rooted in old‐fashioned production line industrial processes; its tendency to ignore existing practices, albeit without the formality and documentation usually preferred by managers (see, for instance, our previous work on recovery room handovers 17); and the fact that standardisation can be psychologically and organisationally comforting, even if it is ineffective 15. One need only refer to recently published articles within the medical literature to see that the debate as to what extent standardisation and protocolisation are effective is continuing unabated 18, 19, 20, 21. Even within industries where there are formally established safety practices such as aviation and the offshore oil industry, practical skills, support from colleagues, the creation of ‘performance spaces’ and flexibility in problem‐solving (all rooted in the informal elements of work) are important in maintaining safety 22.

The third problem area is transferability. Ideas from safety science have been applied to healthcare and have much to offer, but there are barriers to transferability. First, safety is rightly seen as only one dimension of healthcare quality 23, but as in industry, timeliness, efficiency and customer focus (‘patient‐centred care’) are also important. However, effectiveness and equity of care must also be included in healthcare quality 23. Second, although patient safety is a clinical and policy priority, the ideas and principles outlined above can be quite abstract, and it may be that this presents difficulties for healthcare staff. Perhaps for this reason, there is often a rather reductionist feel to many patient safety initiatives in healthcare. For instance, substantial resources are expended on preventing and managing healthcare‐associated infections (the UK Government have made infection rates with certain organisms one measure of the quality of care in hospitals) and the World Health Organization surgical checklist, whose use has been mandated in the UK National Health Service (NHS). However, unless the underlying principles and ideas are fully understood, there is a risk that patient safety will be interpreted superficially as a series of single issues and without appreciation of the importance of culture.

Finally, safety science may be politically neutral, but its application is not. Notions of risk and safety have come to shape private and public discourse so powerfully that they are sometimes used towards ends which, on careful examination, have little bearing on safety per se. For instance, as Fischhoff has noted, couching problems in terms of safety may lead them to be taken more seriously within organisations, where people discover that being disgruntled does not have legal standing, but complaining about risks does 24. It has also been argued that the notion of patient safety has been used as an instrument of governmental control; Yeung and Dixon‐Woods refer to ‘discourse creep’ as issues within healthcare are redefined as safety problems to legitimise intervention and potentially limit professional autonomy 25. Thus, safety is closely related to personal/professional identity and roles. In this context, it is worth noting that despite numerous initiatives to improve patient safety, we have little idea whether they have worked. Although Vincent has argued that this is because we lack the systematic measures to evaluate possible changes, it is also possible (though speculative) that it is more important politically for care to appear to be getting safer than for this to be actually achieved 26. He and Amalberti have also more recently made the point that care envisaged by standards and guidelines differs from the care given to patients. They note that much care falls below the levels envisaged by standards and guidelines, but point out that it is politically unpalatable for organisations (let alone governments) to admit this openly. They argue that this has two consequences for the management of risk. First, ‘it becomes very difficult to study or to value the many adaptive ways in which staff cope in difficult environments to prevent harm coming to patients’. Secondly, and more importantly, ‘attempts to improve safety may not be targeting the right levels (of the organisation) or the right behaviours’ 27.

Creating safety and promoting resilience

We suggested above that the key property of safe systems as understood within the Safety‐2 paradigm is robustness in the face of error‐creating conditions – resilience. Resilience can be defined as the ‘everyday performance variability that provides the adaptations that are needed to produce good outcomes, both when conditions are favourable and when they are not’. Although this review has chosen not to focus on individual resilience, well‐being and mental health (these are well dealt with elsewhere), like many, we believe these underpin the resilience of organizations 28, 29. We would simply point out that human performance is poorer if people are tired 30, 31 hungry, stressed, sad or are the victims or even witnesses of rudeness or coercion 32, 33. Mental state also influences how people deal with the consequences of error. They need to feel safe to be safe 5, but we would argue that anaesthetists also need to feel safe to act safely; working within a system where individuals are punished for ‘mistakes’ does not create a good working atmosphere. They also need to feel able to ask for help 34 and to raise concerns 35 without being criticised. As professionals, we need to learn to balance comfort with constant vigilance and ‘intelligent wariness’ without becoming overwatchful 36. A ‘sixth sense’ for safety 37, coupled with the conscientiousness to act on one's diagnostic hunches (whether clinical or organisational) are probably the two most important traits of the resilient professional. At whatever level we might look, the principle is the same; nurturing both individual and organisational resilience must be considered fundamental to the safe delivery of healthcare.

The Institute for Healthcare Improvement takes this concept one step further. In 2017, it published a White Paper describing a ‘Framework for Improving Joy in Work’ 38. This paper sets out the link between the level of staff engagement and the quality of patient care, including safety. It references the ‘burnout epidemic’ affecting healthcare, citing the link between physician burnout and medical error 39. Hypothesising that joy is the antithesis of burnout, it describes a framework of factors that facilitate joy, one of which is physical and psychological safety (Fig. 4). These factors should not be considered as optional extras to our workplace, but rather the starting point to ensure that staff can deliver safe, high‐quality care. Fostering joy in work, or even just one aspect of it – psychological safety – can be a challenge when the language we use when we talk about safety is primarily negative. We discuss critical incidents 10, error 7, never events 40, 41, 42 and colloquially the names of incident reporting systems have become verbs, for example, ‘I'm Datix‐ing that’. What is more significant is that we do not have a similar vocabulary for successful events. We have succeeded in developing our ability to describe human factors and non‐technical skills thanks to frameworks like the SHELL (software, hardware, environment, liveware) model, Oxford NOTECHS (non‐technical Skills) and ANTS (anaesthetist's non‐technical skills) 43, 44, 45, but regarding positive interactions at work our tendency is, at best, to gratefully accept these and move on. Could we improve our safety culture and introduce some balance by discussing ‘great catches’ (a positive spin on the near miss), episodes of excellence or ‘always conditions’ 46?

Figure 4

Institute for Healthcare Improvement framework for improving joy in work 38. Reproduced with permission.

This brings us to a definition of safety culture. The culture of an organisation is important, as it is logical that the success of efforts to create safe systems is inherent in the behaviours that support them. The Health and Safety Executive quote the Confederation of British Industry's description of safety culture as ‘the ideas and beliefs that all members of the organisation share about risk, accidents and ill health’ 47. Therefore, the description of the ‘ages’ of safety gives context to the current safety culture within safety‐focussed organisations.

Healthcare is similar, and the subject of safety culture in healthcare was discussed at a Health Foundation roundtable event in 2013 with experts in the field of patient safety. The event report offers the following description:

‘A safety culture in healthcare can be thought of as one where staff have positive perceptions of psychological safety, teamwork, and leadership, and feel comfortable discussing errors. In addition, there is a ‘collective mindfulness’ about safety issues, where leadership and front‐line staff take a shared responsibility for ensuring care is delivered safely’ 48, 49.

We believe that a strength of this definition is that it highlights the conditions needed to promote resilience. The report goes on to suggest that an active approach to safety must be developed with a focus on creating safety and not just identification of and measurement of harm.

Resilience and excellence – methodology and models

If we are to effectively manage our systems and create safety, it is logical that we must first properly understand how they work in order to recognise why problems occur. It is imperative that we measure quality and safety appropriately and accurately, which as mentioned previously 26 is arguably not happening currently.

Our traditional approaches to quantify safely (or risk) only tell part of the story; focusing on excellence in practice is also vital 50, 51. To understand things fully, a different approach is required, one that ‘gets under the skin’ of how people behave within systems of work and digs deeper into how their interactions ‘create safety’.

This requires qualitative approaches 52, 53, 54, 55, 56 such as that used by the ‘Sign up to Safety’ campaign launched by the Department of Health in 2014 57. The campaign focuses on improving safety by helping individuals and organisations create a ‘safety culture’ in the context of the limitations of the system described above and to better understand what we need to enable us to work safely. The current focus of the campaign is to find ways to encourage conversations about ‘work as done’. If this can be managed in a safe and supportive way, without fear of retribution when this deviates from ‘work as imagined’, then we can learn from these differences and use both examples of success and failure to improve.

With the above definition of resilience, how can we identify examples of everyday performance variability that contribute to good outcomes? If our current focus on safety only captures examples of when safety is lacking, can we learn from examples of good practice to find and fix problems and generate further examples of standardised processes and policies? A possible answer may emerge from many of the positive reporting systems emerging in healthcare. Initially described in Birmingham 58, the Learning from Excellence initiative is designed to capture examples of individual good practice, or the system working despite challenging and variable circumstances. This appears to offer a simple but potentially effective approach to improving quality and safety. Pilot data suggest that rates of best‐practice antibiotic prescriptions increased when positive feedback from reports occurred 59. In contrast to focussing on finding and fixing errors, this asset‐focussed approach is being used in quality improvement methodology in a Health Foundation funded project, positive reporting and appreciative inquiry in sepsis 60.

Noticing and showing appreciation for good work also has the potential to help staff feel valued and improve engagement, potentially fostering ‘joy in work’ 38. As the concepts of Safety‐2 and resilience have become more commonplace, so have positive reporting systems. Since 2014, the initiative has spread to over 100 other organisations in the NHS. Some organisations use the terminology Learning from Excellence, but variation in nomenclature exists with ‘Favourable Event Reporting Forms’ in Southampton, ‘Sharing Outstanding Excellence’ in Salisbury 61, ‘Excellence Reporting’ in County Durham 62 and ‘Greatix’ in the East Midlands 63. The practicalities of the systems vary, with some organisations using paper reporting systems; they all provide a means for noticing, appreciating and giving feedback on good practice to staff involved.

Although a Safety‐2 approach to improving safety in healthcare is relatively new, studying success is less so. Two similar strengths‐based approaches are increasingly being used to identify what is working within systems; Appreciative Inquiry and Positive Deviance. The philosophy behind Appreciative Inquiry is that human systems move in the direction of what they study 64. Studying examples of what is working therefore provide insights into how to improve and develop further, such as improving handover by identifying what factors make this work well 65.

Appreciative Inquiry methodology is a natural fit for positive reporting systems and has been adopted for investigation of Learning from Excellence reports. One example of this reverses the current approach to root cause analysis, replacing the existing Serious Incidents Requiring Investigation meetings with a renamed ‘Improving Resilience, Inspiring Success’ approach 58. A strength of these meetings is that individuals and teams cocreate the improvement strategies for their areas of practice. Appreciative Inquiry can also be used outside positive reporting systems. Deficits or problems are reframed, and generative conversations create solutions based on what can be achieved 66. One author (EP) has used appreciative inquiry conversations to establish ‘what makes a good day’ with anaesthetic and intensive care colleagues in service development meetings with teams and during study days. An example of an appreciative conversation can be seen in Fig. 5.

Figure 5

An example of an appreciative conversation. Taken from EP's work with appreciating people and reproduced with permission.

Positive Deviance is similar in its philosophy to Appreciative Inquiry. It harnesses variation in a system to drive improvement and involves identifying helpful adaptations ‘positive deviants’ to generate hypotheses about improvement methodologies. This approach has been advocated in a patient safety setting, with examples of improving hand hygiene and improving ‘door‐to‐balloon’ time for treatment of acute myocardial infarction 67.

Critics of these positive approaches might feel uncomfortable with the absence of criteria to define what constitutes excellence, but this would seem to be a strength of the systems. If we wish to better understand what makes a system perform well under pressure and identify novel approaches to improvement, we need to allow freedom to describe the system when it is working. Perhaps this reflects a reluctance to accept that ‘work as done’ can vary from ‘work as imagined’, as well as the ingrained nature of our prevailing approach to safety. However, the repeated occurrence of never events (despite patient safety alerts), improved frameworks and procedures suggest that innovative strategies should be encouraged.

Conclusion

The unspoken expectation is that healthcare practitioners of every profession are to undertake three roles. The first is to undertake the clinical function for which they are engaged, whatever that might be. The second is to not only maintain and enhance patient safety in their own work but also by intervening as necessary in the organisational systems they work within. The third is to seek out opportunities for improving quality and make sure that positive changes are made. We hope that our review has contributed to understanding how these roles intersect and has provided conceptual and practical tools for making sense of some of the demands of the politicised activity that is modern healthcare.