Every high-risk industry devotes considerable time and resource to investigating and analysing accidents, incidents and near misses. Such industries employ many other methods for assessing safety but the identification and analysis of serious incidents and adverse events continues to be a critical stimulus and guide for safety improvement. Analyses of safety issues always require review of a range of information and recommendations should generally not be made on the basis of a single event. Nevertheless, an effective overall safety strategy must in part be founded on an understanding of untoward events, their frequency, severity, causes and contributory factors. In this chapter we consider how these analyses might need to be extended in the light of the arguments presented in the preceding chapters.

What Are We Trying to Learn When We Analyse Incidents?

A clinical scenario can be examined from a number of different perspectives, each of which may illuminate facets of the case. Cases have, from time immemorial, been used to educate and reflect on the nature of disease. They can also be used to illustrate the process of clinical decision making, the weighing of treatment options and, particularly when errors are discussed, the personal impact of incidents and mishaps. Incident analysis, for the purposes of improving the safety of healthcare, may encompass all of these perspectives but critically also includes reflection on the broader healthcare system.

Box 5.1 First and Second Stories

The First Story represents how people, with knowledge of the outcome and the consequences for victims and organisations, first respond to breakdowns in systems that they depend on. This is a social and political process which generally tells us little about the factors that influenced human performance before the event.

First Stories are overly simplified accounts of the apparent cause of the undesired outcome. The hindsight bias narrows and distorts our view of practice after-the-fact. As a result, there is premature closure on the set of contributors that lead to failure.

When we start to pursue the Second Story our attention is directed to people working at the sharp end of the healthcare system and how human, organisational, technological and economic factors play out to create outcomes. We need to understand the pressures and dilemmas that drive human performance and how people and organizations actively work to overcome hazards (Adapted from Woods and Cook 2002)

A critical challenge for patient safety in earlier years was to develop a more thoughtful approach to both error and harm to patients. Human error is routinely blamed for accidents in the air, on the railways, in complex surgery and in healthcare generally. Immediately after an accident people make quick judgments and, all too often, blame the person most obviously associated with the disaster. The pilot of the plane, the doctor who gives the injection, the train driver who passes a red light are quickly singled out (Vincent et al. 1998). This rapid and unthinking reaction has been described by Richard Cook and David Woods as the ‘first story’ (Box 5.1). However while a particular action or omission may be the immediate cause of an incident, closer analysis usually reveals a series of events and departures from safe practice, each influenced by the working environment and the wider organizational context (Reason 1997; Vincent et al. 2000). The second story endeavours to capture the full richness of the event without the obscuring lens of hindsight and see it from the perspective of all those involved which should, ideally, include the perspective of the patient and family.

We previously extended Reason’s model and adapted it for use in healthcare, classifying the error producing conditions and organizational factors in a single broad framework of factors affecting clinical practice (Vincent et al. 1998; Vincent 2003). The ‘seven levels of safety’ framework describes the contributory factors and influences on safety under seven broad headings: patient factors, task factors, individual staff factors, team factors, working conditions, organisational factors and the wider institutional context (Table 5.1).

Table 5.1 The ALARM/LONDON framework of contributory factors

This gave rise to a method of incident analysis published in 2000, often referred to as ALARM, because it was produced with colleagues from the Association of Litigation and Risk Management (Vincent et al. 2000). The ALARM approach was primarily aimed at the acute medical sector. A later revision and extension in 2004, known as the ‘London Protocol’, has been translated into several languages and can be applied to all areas of healthcare including the acute sector, mental health, and primary care. The method of analysis is known by different names in different countries, with some continuing to use ALARM and other referring to the London protocol. We use the term ALARM/LONDON to describe the essential elements of the previous versions, which is clumsy but avoids confusion. We also propose a new extended model, which we have christened ALARME to indicate the new European flavour that has been infused.

The approach developed by James Reason and others has been enormously fruitful and has greatly expanded our understanding of both the causes and prevention of harm. The question for us now is whether this perspective needs to be adapted or extended in the light of our previous arguments. The current model has been found to be effective in many different clinical settings but is primarily aimed at the analysis of relatively discrete events; it may need some revision if we are to also examine serious failures and harm that evolves over months or even years. We may need to broaden our approach to the investigation and analysis of incidents in a number of ways.

Essential Concepts of ALARME

The ALARM/LONDON approach set out a methodology and structured approach to reflection on the many factors that may contribute to an incident. During an investigation information is gleaned from a variety of sources: Case records, statements and other relevant documentation are reviewed and interviews are carried out with staff and ideally with the patient and family. Once the chronology of events is clear there are three main considerations: the care delivery problems identified within the chronology, the clinical context for each of them and the factors contributing to the occurrence of the care delivery problems. The key questions are: What happened? (the outcome and chronology); How did it happen? (the care delivery problems) and Why did it happen? (the contributory factors) (Vincent et al. 2000).

In the context of this book there are four new issues to be considered:

  • First, we need to look at a broader class of events which impact on the patient. Some events for analysis need to be selected from the patient’s point of view in addition to those identified by professionals.

  • Second, we need to extend the analysis to examine an episode in the patient journey rather than a single incident. The timeframe is widened to include the whole ‘event journey’. ALARME proposes an extended approach that applies the classic grid of contributory factors to each of the identified care delivery problems in the unfolding story of the ‘emerging harm’ considered for initial analysis

  • Third, we need to pay more attention to both successes and failures of detection, anticipation and recovery. We need to consider not only problems but also success, detection and recovery and how they combine to produce the overall ratio of benefit and harm for the patient. This in turn affects the nature of the learning and the subsequent safety interventions that we might recommend

  • Fourth, we potentially have to adapt both methods of analysis and recommendations to the different contexts and models of safety

Our expanded process of investigation maintains the basic approach of ALARM/LONDON and the original table of contributory factors, but extends the time frame and includes analysis and reflection on success, detection and recovery (Fig. 5.1 and Table 5.2). The changes we propose would require significant research and investment in the development of new methods but we believe this is essential if safety is to be effectively managed across clinical contexts.

Fig. 5.1
figure 1

Analysis of safety along the patient journey

Table 5.2 New features of ALARME

Select Problems for Analysis Which Are Important to Patients

We already know that patients and families are able to reliably identify adverse events that have not been detected by professionals. Patients have been shown in a number of studies to report errors and adverse events accurately and to provide additional information not available to healthcare professionals. Many patient-identified events are not captured by the hospital incident reporting system or recorded in the medical record (Weingart et al. 2005; Weissman et al. 2008). Findings from several patient surveys suggest that patients report a much higher rate of errors and adverse events of some kind than the published rates based on hospital record review (King et al. 2010; Lehmann et al. 2010). There is therefore already a case for selecting some patient identified incidents for analysis even in hospitals; outside hospitals where patients and carers probably have the most comprehensive picture of care, the argument is stronger still.

We suggest that events considered for analysis should be selected from the patient’s point of view as well as by professionals. Tragedies of course deserve full and comprehensive investigation, but insights into safety may emerge from many types of event. We do not yet know what other kind of events might be identified as worthy of investigation by patients and families. What makes an event ‘abnormal’, and therefore a potential candidate for analysis, is a complex matter of surprise, rarity, intensity, severity and perhaps also the a basic feeling of the injustice of being injured in a place of safety. The events identified by patients and families may be quite different from those identified by professionals.

Future reporting systems which seek to involve patients and families will need a balance of open-ended narratives and closed-ended questions for cause analysis and classification (King et al. 2010). Primary care patient reporting studies have used a combination of methods such as written, online or telephone reporting and telephone recruitment with a follow up in-person interview. Interviewing patients in person is particularly effective when following up hospital patients; the highest response rate overall in published studies is 96 %, achieved by in-person patient advocate interviews for a specific hospital unit. However, there are still many barriers to the use of patient derived information, particularly a lack of support for the values of patient centred care, and consequent risk of low value attached to patient involvement (Davies and Cleary 2005).

Widen the Time Frame of Analysis: Review the Patient Journey

Many serious events occur because of multiple small failures in the care of a patient rather than any single, dramatic failure. Sometimes these individual failures combine at a single time when, for instance, a young doctor is unsupervised at night with inadequate equipment, a difficult team and a very sick patient. More often though, in the care of a patient over time, we see a progressive degradation in care due to a combination of errors and system vulnerabilities and sometimes neglect. Advances in patient safety are severely hampered by the narrow timeframe used in incident detection and analysis.

We already understand that after an incident we need to look back to the series of events that led up to the problem and which are directly or indirectly linked to it. Amalberti and colleagues (2011) have previously argued that we should extent the time frame of analysis to consider an ‘event journey’ (Amalberti et al. 2011). However to examine safety over longer time periods, particularly in community settings, we now believe that we should speak simply of the patient journey. This means looking back through the medical history of the patient in search for all events that have defined the patient’s journey and contributed to the final outcome, whether or not these events have been perceived as serious at the time they occurred and assessing whether the problem was detected and resolved. Most important of all, the event would ideally be examined through the eyes of the patient and family as well as the eyes of the professionals.

The selection of the time frame of the analysis depends on the conditions suffered by the patient, the nature of the problems identified and the complexity of the patient journey. Standard episodes of care are easily identified; a hip replacement for instance could cover the period between the initial decision to operate and the completion of the rehabilitation process. Alternatively, depending on the nature of the safety issues identified, one might focus on a particular period such as from the original operation through to rehabilitation at home. The most important development is to begin by examining a period of care rather than a specific incident and its antecedents. Consider three different timeframes to detect and analyse events associated with the occurrence of complications. The shortest timeframe (A) would cover simple problems relating to the direct coupling between a wrong action and the immediate consequence to the patient (such as mistaken identification). A somewhat longer timeframe (B) would cover the events leading up to a medical complications and its subsequent management which might encompass an entire acute care episode from initial admission, to discharge and rehabilitation. The longest timeframe (C) might cover several months leading up to an avoidable hospital admission, the time spent in hospital and subsequent recovery. In-hospital and short-term (30- or 60-day) post-discharge mortality might be used as a starting point to investigate opportunity targets, avoidable mortality, and other indicators for complications.

The original ALARM/LONDON protocol proposed that, after the initial care delivery problems were identified, each should be analysed separately to consider the contributory factors (Vincent et al. 2000). In a sequence of problems different sets of contributory factors may be associated with each specific problem. For instance a young nurse or doctor might fail to ask for advice about a deteriorating patient due to inexperience, poor supervision and deficiencies in teamwork; in contrast the same patient might later fail to receive the correct medication, but this might be due to inadequate staffing and poor organisation of care. In practice the full analysis is seldom done and all the contributory factors are considered together as if all were relevant to the single event. However, this more subtle perspective becomes much more important with a longer timescale as a series of problems may be identified which are clearly separated in time and context. Each of these can be separately analysed using the ALARM grid to build up a much more detailed picture of system vulnerabilities.

Figure 5.2, describing the causes and response to an adverse drug event, provides an example of the new approach. The example shows the triple value of ALARME: first gathering the story of the event journey from the patient’s perspective to give a more complete account; second, widening the scope of the analysis to the full patient journey to include pre-admission and events after discharge from hospital; third identifying and analysing other usually disregarded events to reveal the cumulative impact of poor care, initial deterioration and eventual recovery.

Fig. 5.2
figure 2

A case analysed with ALARME

This broader approach will require a new type of meeting (probably video conference) covering longer periods in the patient’s medical history and involving the participation of both hospital and community practitioners. It would also require the development of new indicators and electronic traces, such as tools to monitor individual patients’ lab results, to record the nature and duration of all breakdowns in the continuum of care. A full picture would require tracking the treatment of all the disorders from which the patient suffered not just single diseases.

Success and Failure in Detection and Recovery

In most systems errors are relatively frequent but few impact on safety because of the capacity of humans and organisations to recover from errors. In aviation, for example, numerous studies show that professional pilots make at least one clear error per hour, whatever the circumstances and the quality of the workplace design (Helmreich 2000; Amalberti 2001). The great majority of errors made are rapidly detected by the person who made them, with routine errors being better detected than mistakes. Experts of course make fewer errors overall than novices but the best marker of high level expertise is the detection of error rather than its production. Success in detection of errors is the true marker of expertise, while error production is not. Detection and recovery are sensitive to high workload, task interruptions, and system time management (Amalberti et al. 2011; Degos et al. 2009).

What are the implications for safety and for the analysis of incidents? We commonly assume that the best way to make a system safer is to reduce the number of errors and failures. This is, in many cases, entirely reasonable. Automation for instance, or reminder systems, can have a massive impact on minor errors. A more organized handover process might enhance the transfer of essential information. However eliminating all errors, which would mean considerably restricting human behaviour, is not possible and arguably not desirable.

We need in practice to distinguish errors that have immediate consequences for the patient and those which can be considered as minor deviations in the work process which can be noticed and corrected. The first class of errors do indeed need formal, rigorous rules to protect the patient, such as clear protocols for the management of electrolytes or multiple and redundant patient identification checks. For the many millions of other minor errors it is more efficient and effective to rely on detection and recovery by means of self-awareness and good coordination and communication within the team. These findings also suggest that reliable human-system interaction will be best achieved by designing interfaces that minimize the potential for control interference and support recovery from errors. In other words, the focus should be on control of the effect of errors rather than on the elimination of error per se (Rasmussen and Vicente 1989).

The standard approach for incident analysis in healthcare has primarily focused on identifying the causes and contributory factors of the event, with the idea that this will allow us to intervene to remove these problems and improve safety. These strategies make perfect sense in any system which is either highly standardised or at least reasonably well controlled, since there it is clearly possible to implement changes that address these vulnerabilities. The recommendations from many analyses of healthcare incidents are essentially recommendations to improve reliability (such as more training or more procedures) or to address the wider contributory factors such as poor communication or inadequate working conditions. In all cases we attempt, quite reasonably, to make the system more reliable and hence safer.

We could however expand the scope of the inquiry and the analysis. There is much to learn from the ability of the system to detect and recover from failures and close calls (Wu 2011). For example, in addition to identifying failures and contributory factors we could instead ask ‘what failures of recovery occurred in the care of this patient?’ and ‘how we can we improve detection and recovery in settings such as these?’ This would have implications both for our understanding of events and, more importantly, for the recommendations which follow such analyses which might expand to include a much stronger focus on developing detection and recovery strategies.

Adapting the Analysis to Context

In addition to the developments described above we believe that we may also have to extend our thinking by adapting methods of analysis to the different contexts and models of safety we have outlined. We should be clear at this point that we do not, as yet, know how to do this. Many authors, particularly Erik Hollnagel, have drawn attention to the need for a wider array of accident models which are better adapted to fluid and dynamic environments (Hollnagel 2014). However we do not as yet have sufficient understanding to match models to environments and we have certainly not developed practical methods of analysis which are customized to different contexts.

We can however begin to consider what such an analysis might look like. Suppose we analyse an accident in a very risky unstructured environment – this might be deep sea fishing or an incident that occurred in home care involving someone with serious mental health problems. Are we looking for the same kind of causes and contributory factors as we are in a much more structured environment? The factors might be different and also the balance of factors might be different. For instance the framework of contributory factors (Vincent et al. 1998) identifies patient factors as a potential contributor to an incident. In a highly standardized environment, such as radiotherapy department, personal characteristics play a much less important role than in situations in which a person is responsible for their own care. People with serious mental health or cognitive problems are also clearly at higher risk of making drug errors in their own care. So, the relevance and influence of different types of contributory factors should be different in different contexts. This has, as far as we know, not been addressed empirically but should be entirely feasible. The next step is to ask if we should, in different contexts, be identifying different kinds of recommendations depending on the clinical context. This in turn depends on how one believes safety is achieved and realised in different settings. However before we can fully consider this issue we need to set out our proposals for a strategic approach to safety interventions addressed in the following chapters.

Key Points

  • Every high risk industry devotes considerable time and resource to investigating and analysing accidents, incidents and close calls.

  • Effective incident analysis requires a framework which includes guidance on the selection of incidents, and how the investigation and analysis should be conducted.

  • Our current framework (known both as ALARM and London Protocol) for incident analysis in medicine: (i) identifies events for analysis chosen by professionals (ii) is based on an underlying safety model examining causes and contributory factors and (iii) uses the ‘seven levels of safety’ framework to guide the identification of contributory factors and potential interventions.

  • The current framework remains relevant, but needs to be significantly adapted to reflect the new safety challenges.

  • We need to include events that reflect harm in the eyes of patients who may identify problems that are not necessarily seen by professionals.

  • We need to develop an approach which reflects the importance of poor care evolving over time, which in turn affects the nature of the learning and subsequent safety strategies that we implement.

  • We propose a new approach to incident analysis (ALARME) which considers contributory factors along the whole patient journey and which includes attention to successes, failures, recovery and mitigation.

  • This new approach to incident analysis involves the participation of the patient and family and both hospital and community practitioners. It may require the inclusion of new information such as the patient’s personal story of illness and individual laboratory results over time.

  • The changes we propose would require significant research and investment in the development of new methods but we believe this is essential if safety is to be effectively managed across clinical contexts.