The USA is not alone in focusing on medical error. In May 2000, Great Britain published An Organization with a Memory, a report from the chief medical officer on learning from adverse events in the National Health Service. In 1995, Australia published The Quality in Australian Health Care Study, pointing to the fact that there are far too many preventable errors that injure patients.

What do we call these medical errors? Terms such as “misadventure” and “adverse events” have been used, but I prefer “iatrogenic injury,” which is defined as an injury causing harm to a patient resulting from medical management rather than from the patient's underlying or antecedent condition. It is important to separate an adverse event from the normal disease process, because a number of our patients have antecedent conditions that may not be compatible with life. Death is a natural part of life. One of the reasons iatrogenic injury was not well recognized in the past was that death is not an unexpected outcome of medical care, whereas it is an unexpected outcome of car or air travel.

As we intensify our study of errors in medicine, we need to keep in mind that medical errors are not unique. They share many causal factors with errors in complex situations encountered with transportation, nuclear power, and the petrochemical industry. We can learn from those industries' efforts to study error and its prevention. In addition, we need to remember that errors can provide useful information--and not just errors, but near misses as well.

Heinreich developed the iceberg model of accidents and errors (1). The part of the iceberg above the water represents errors that cause major harm; below the water are no-harm events or events that cause only minor injuries, as well as near misses. After studying automobile accidents for many years, Heinreich suggested that for every event that causes major injury, there are 29 that cause minor injury and 300 no-injury accidents (2). Sometimes the only thing separating an error that causes no injury from an error that causes major harm is pure luck or the robust nature of human physiology. A near miss is defined as an error process that is caught or interrupted: someone--usually an experienced staff member--intervenes to prevent the error. Our goal in patient safety is to use the no-harm and the near-miss occasions to study our processes. Obviously, we have to respond to and learn from disasters, but if we want to be proactive, we need to deal with the less serious events that occur, which are much more numerous.

In the sections that follow, I discuss the types of errors that can occur and apply the types to the Titanic disaster. I then discuss how different organizational cultures respond to error and consider the balance between discipline and voluntary reporting. The article closes with a discussion of ways to prevent and manage error.

TYPES OF ERRORS

Professor James Reason of Manchester University in England defined 2 types of errors: active and latent (3). Active errors are errors committed by those in direct contact with the human-system interface (in the case of health care, this is the patient); they are often referred to as human errors. Individuals who commit these errors are those at the “sharp end.” Their actions and decisions usually have an immediate effect. Latent errors are the delayed consequences of technical and organizational actions and decisions--such as reallocating resources, changing the scope of a position, or adjusting staffing. Individuals who commit these errors are at the “blunt end.” Latent failures plus active failures lead to misadventures. Unlike the transportation industry, in which “the pilot is always the first to arrive on the accident scene,” those who make the errors in medicine do not suffer the consequences of those errors. This creates an added responsibility and burden.

Jens Rasmussen, a Danish cognitive psychologist, further divided active error into 3 categories: skill-based behavior, rule-based behavior, and knowledge-based behavior (4). Routine tasks, such as driving a car, are examples of skill-based behavior. We operate in a skill-based mode at work most of the time and do so superbly. The actions are so ingrained that we do them automatically, as if we were on autopilot. Rule-based mode also involves familiar tasks but requires us to think for a moment and access stored information. An example of an error of rule-based behavior would be applying the rules for a 4-way stop to a 2-way stop. We operate in this mode almost as frequently as we do in the skill-based mode. We apply knowledge-based behavior when we consciously solve a problem. Using the driving example again, most drivers would operate in a knowledge-based mode if they approached a broken stoplight. They may or may not remember to apply the 4-way-stop rule in this situation, and even if they did remember, they would know to do so cautiously, since predicting other drivers' responses is difficult. We rarely act in a knowledge-based mode unless we are in a new job or are learning something new. The capacity for error is highest in this mode. In fact, all change--even just a change in a supplier--can increase risk of error.

Human factors are one of 4 areas included in the Eindhoven Classification System for root cause analysis (5). Also included in the system are technical factors (e.g., hardware, software, system design), organizational factors (e.g., management priorities, procedures, budget, culture), and other factors (e.g., patient-related factors). Root cause analysis is discussed in more detail in Pat Williams' article in this issue of BUMC Proceedings (5).

Errors that occurred in the sinking of the Titanic

The Titanic has become a metaphor for a disaster waiting to happen. It's part of our mythology, and we continue to find it fascinating. We can learn a great deal from the Titanic disaster. In 1912, the Titanic was the newest, largest, and most technologically advanced liner in the world. Despite all of its innovative technology, the ship sank on a clear night on its maiden voyage with the loss of >1500 lives. The unsinkable Titanic sank.

In reviewing the active failures that led to the disaster, we begin with Captain Smith. Captains are ultimately responsible for everything that happens on the ship. When he was informed of an ice field ahead, Captain Smith did not reduce his speed. He considered the fact that it was a clear night with good visibility and that no ice fields were in sight. Moreover, he was being subtly pressured by the owner to set a new speed record. The Titanic would be much more marketable if it could cut a day or two off the nearly week-long voyage from London to New York. Captain Smith went down with the ship, as he was expected to.

Wireless Officer Phillips was responsible for sending and receiving messages on the one radio channel available at the time. He placed priority on sending out personal messages for Lady Astor and others. While he did receive and pass on some iceberg warnings, he asked the senders to stop transmitting them. Officer Phillips went down with the ship because he stayed and kept sending SOSs.

The lookout, Fred Fleet, was also involved. He was an experienced seaman and was the first to spot the iceberg ahead at 500 yards, which is about a quarter of a mile. Visibility should have allowed him to spot the iceberg at 1000 yards or greater, but Fred Fleet never located the binoculars. (The binoculars were found 80 years later, after the ship had sunk.) Nobody oriented Fleet on the location of the binoculars because there had been no shakedown cruise. Fleet manned one of the lifeboats, as he was supposed to do.

Murdoch was the officer of the deck, another experienced sailor. Once he heard the notice, “Iceberg, dead ahead,” he did what he had been trained to do: he threw the engines in reverse. We now know that it would have been better for him to have increased the speed of the engines and gone around the iceberg. By backing down as he did, he exposed the Titanic's starboard side longer to the iceberg. Murdoch commanded one of the last lifeboats to leave.

These active errors are not what led to the loss of life. What caused the loss of life was the inadequate number of lifeboats. The Titanic had 16 lifeboats but needed 32 to accommodate everyone on board. At the time, the British Board of Trade had lifeboat requirements based on the tonnage of the ship and not the number of people. However, the board was considering changing its regulations to a passenger-based system. The shipowners opposed the change, stating that it would be too expensive.

Knowing that the regulations might pass before the ship would sail, the Titanic's designers planned double davits to accommodate the extra lifeboats. Sketches for these double davits were found after the ship sank. However, owner Bruce Ismay decided not to add the extra lifeboats since they would have cut down on the space on the promenade deck. He thought it was more important to pamper the first-class passengers on this floating palace (for which tickets were $500,000 each in today's money) rather than prepare for a disaster that would “never happen” on a ship with the Titanic's technology. This technology consisted of automatic watertight doors on bulkheads below the water line. If the ship was hit, the crew on the bridge could close the doors electronically, thus keeping all water confined to the damaged compartment. The problem was the lack of a transverse overhead--a lid--on those bulkheads.

Thomas Andrews was the marine architect who designed the technology. When the Titanic hit the iceberg, he surveyed the damage with Captain Smith and instantly knew he'd made an error. He predicted that the ship would sink in an hour and a half, and he was correct. Andrews also went down with the ship.

If Andrews hadn't died, he probably would have discovered a way to correct his mistake. Titanic's sister ship--which was going to be called the Gigantic and was renamed the Brittanic--addressed the technological issue by increasing the height of the bulkheads. The Brittanic sank in 1915 after being torpedoed. Just like the Titanic, it sank in an hour and a half. Fortunately, only 26 people died (compared with 1500 on the Titanic), because immediately after the Titanic disaster, regulations were changed so that there was a lifeboat seat for every passenger.

When a disaster occurs, the public wants someone to pay. Captain Smith went down with the ship. Bruce Ismay survived, but his life was ruined afterwards. Part of the desire to blame and punish is related to our expectation of perfectionism. For example, nurses in the state of Texas who make 3 medication errors in 1 year will lose their license. Even the Food and Drug Administration and the regulators are part of the problem. Their intentions are good, but their actions are counterproductive. Leape wrote:

Ironically, rather than improving safety, punishment makes reducing errors much more difficult by providing strong incentives for people to hide their mistakes, thus preventing recognition, analysis, and correction of underlying causes (6).

If Captain Smith had survived the Titanic, he probably would have been sent back to White Star lines for training on iceberg- spotting procedures. Yet, do you think he would have made that same mistake again? Not likely! Nevertheless, the example points to our blame-and-train mentality. Leape went on to say: “We must stop blaming people and start looking at our systems. We must look at how we do things that cause errors and keep us from discovering them . . . before they cause an injury” (6).

ERRORS AND ORGANIZATIONAL CULTURE

Our response to error is related to our organizational culture. An organization's culture is reflected by what it does--its practices, procedures, and processes--rather than by what it claims to espouse or believe in. Ron Westrum has identified 3 types of safety cultures (7). The first is pathologic; the organization says, “We don't make errors, and we don't tolerate people who do.” This organization is likely to “shoot the messenger.” Other organizations are bureaucratic: “If something occurs, we will write a new rule.” At the other end of the continuum is the learning or generative organization, which seeks to understand the broader implications of error.

However, while organizations want to encourage information flow, they also recognize that some discipline may be associated with professional accountability. They have to do something about the employee who is truly dangerous while still encouraging reporting from conscientious employees. David Marks has developed the concept of a just system of organizational culture (8). It considers the employees' motivation in acting when deciding on punishment so as to create a feeling of trust among all involved.

Errors can be intentional, knowing, reckless, or negligent, and only the first 3 should elicit a punitive response. If the error was intentional, the person wanted to do harm. For example, he or she may have been mad at the organization and decided to destroy some equipment. This is rare. A person who knowingly made an error did not intend the error but knew that, by cutting corners, for example, the error might occur. Behavior such as working while intoxicated can be considered reckless whether or not an error occurred. Reckless behavior is not hard to identify, but it does not occur very often. The remainder of mistakes are examples of negligence. If we are negligent under the law, we are required to make restitution. Right now, our first tendency when we harm a patient is to keep quiet. We have to take more responsibility for admitting errors to our patients and working to fix those errors--just as in automobile accidents, insurance information is exchanged and a settlement made.

The culpability of individuals on the Titanic

Using these guidelines, how culpable where those on the sharp end and those on the blunt end of the Titanic disaster? We need to recognize that knowledge of the outcome influences our objectivity, creating hindsight bias.

Whether Captain Smith knowingly or recklessly caused the error is questionable, but he was clearly negligent. He should have slowed down. He paid for that negligence with his life. Murdoch cannot be considered culpable, because he followed the standard procedure. Even Phillips, who was sending messages for the passengers, is probably not culpable.

What about the owner, Bruce Ismay? He certainly didn't intend to cause harm, but it can be debated that he behaved knowingly or recklessly. At the least, he was negligent. Andrews, the designer, was not culpable.

The higher in the organization one is, the greater one's capacity to generate latent error (3). Thus, the lack of adequate lifeboats was the single greatest cause for the loss of life on the Titanic, and that was a decision made by the chief executive officer. Top management can sometimes be the enemy of safety. Everyone in the organization is accountable for his or her decisions and actions. If we hold people at the sharp end accountable for their actions and decisions, we have to hold people at the blunt end accountable.

PREVENTING AND MANAGING ERROR

Our goal with patient safety is to reduce the risk of iatrogenic injury. We have to remove the hazards that increase the risk of injury. The British have defined risk as the possibility or probability of occurrence or recurrence of an event multiplied by the severity of the event. Level 1 severity is death or severe harm; level 2, moderate or transient harm; and level 3, minimal or no harm.

The first step in error prevention and management is detection. Errors that are not detected can have disastrous consequences (9). A high reporting rate indicates a high detection sensitivity level (DSL), and a low reporting rate indicates a low DSL. To achieve a high DSL, an organization must eliminate impediments to reporting; confidential, no-fault reporting is usually the most successful approach. As the amount of information goes up, risk will eventually go down. Our national goal should not be to reduce medical errors but ultimately to reduce the risk of iatrogenic injury to patients. In doing so, we may find that there are actually more errors than we expected.

An organization that has a very high DSL can become overwhelmed. Many organizations see as much as a 10-fold increase in reporting. There may be an initial “confessional stage,” when employees bring up high-severity events from the past. If they become overwhelmed, managers should triage the investigation of events, highlighting events that represent the greatest risk either because of high occurrence rate or high degree of severity. Investigation involves gathering basic facts--the who, what, where, when, and why; considering the number of barriers breached and the consequences; and recovering all pertinent documents. The investigators must get at the root causes and discover the latent errors. Otherwise, if they start with a human failure, they can stop there and fail to fix the system. As the management team investigates errors, the DSL rate may stay high; over time, however, the severity of events reported should go down. In addition, the team should be able to identify process weak points, determine common causal factors, see where critical barriers to error are failing, and monitor the system for long-term changes. If errors continue to recur and the investigating team cannot identify a system error, it may be worthwhile to ask an outside group to do a process audit. Sometimes the individuals within a system are too close to it to recognize its problems.

I've been asked if there are any differences between the causes of actual events and those of near-miss events. We found no differences at severity levels 1 and 2. At severity level 1, about 40% of events were caused by organizational factors, 40% by human factors, and 20% by technical factors. At severity level 2, the rates were 22% for organizational and technical factors and 55% for human factors. At severity level 3, the rates were 47% for human factors, 43% for technical factors, and 10% for organizational factors. Many disasters have a major management organizational component. Technical errors, instead, tend to lead to much less severe problems. When we compared the causes of errors in a transfusion environment against causes of errors in a petrochemical processing plant, the results were nearly identical, showing that medical errors are not unique.

A number of steps, then, can be taken to manage errors:

1. Identify system weak points before an adverse event happens
2. Report near misses and no-harm events
3. Encourage reporting
4. Look for root causes
5. Avoid the blame-and-train trap
6. Fix the latent errors that set people up for failure

As we learned from the Titanic, latent errors make the greatest contribution to major disasters. We should never place too much faith in technological solutions without backup, and we should always expect the unexpected.

1. Heinreich HW. Industrial Accident Prevention. New York and London, 1941.
2. An Organization with a Memory: A Report of an Expert Group on Learning from Adverse Events in the NHS Chaired by the Chief Medical Officer. London: The Stationery Office, 2000.
3. Reason J. Human Error. Cambridge: Cambridge University Press, 1990.
4. Rasmussen J. The definition of human error and a taxonomy for technical systems design. In Rasmussen J, Duncan K, Leplat J, eds. New Technology and Human Error. London: Wiley, 1987:23-30.
5. Williams PM. Techniques for root cause analysis. BUMC Proceedings 2001;14:154-157.
6. Leape LL. Error in medicine. JAMA 1994;272:1851-1857.
7. Westrum R. Organizational and interorganization thought. In Wise JA, Hokin D, Stager P, eds. Verification and Validation of Complex Systems: Human Factors Aspects. Berlin: Springer Verlag, 1993.
8. Marx DA. The Link Between Employee Mishap Culpability and Aviation Safety [dissertation]. Seattle, Wash: Seattle University School of Law, 1998.
9. Zapt D, Reason JT. Introduction to error handling. Appl Psychol 1994;43:427-432.