Medical error and patient safety in the emergency department

Medical error and patient safety sit at the centre of modern emergency medicine practice, and they are examined directly in Fellowship SAQ, OSCE communication and multiple-choice questions. The emergency department is, by its nature, an error-prone environment: undifferentiated patients, time pressure, cognitive overload, frequent interruptions, shift handovers, a noisy and crowded physical plant, and patients who cannot give a reliable history. Makary and Daniel's widely cited estimate placed medical error among the leading causes of death in the United States, ahead of respiratory disease, and the emergency department is the setting in which many of those errors originate or are first missed.[1] The trainee must hold two ideas in tension at every encounter — that error is inevitable because humans work in imperfect systems, and that harm from error is reducible by the disciplined application of a safety framework. The framework below resolves that tension: error is understood through the systems lens of Swiss cheese, harm is disclosed openly and promptly, incidents are reported so the system can learn, root causes are analysed rather than individuals blamed, and a just culture decides when conduct is honest error and when it is reckless.

The scope and the vocabulary

A shared vocabulary is the first requirement, because the response to an event depends entirely on what kind of event it is. Medical error is the failure of a planned action to be completed as intended, or the use of a wrong plan to achieve an aim — it is a process failure, whether or not it reaches the patient and whether or not it causes harm. An adverse event is an injury caused by medical management rather than by the underlying disease process, and it is the outcome that error, omission or system failure may produce. The two are not synonymous: an error may cause no harm, and an adverse event may arise without any identifiable error. The remaining categories refine the gradient between a system that nearly failed and one that did fail, and the examiner tests the distinction relentlessly.[1]

A near miss is an event that had the potential to cause harm but did not, either by chance or by timely recovery — the wrong drug drawn up but checked and discarded before administration, the near-allergen given but the patient was not in fact allergic. A no-harm incident reaches the patient but causes no detectable harm. A sentinel event is an unexpected occurrence involving death, serious physical or psychological injury, or the risk thereof, that signals the need for immediate investigation and response — wrong-site surgery, suicide of an inpatient, abduction of an infant, administration of incompatible blood. A never event is a particularly grave subset, a wholly preventable serious incident that should never occur if available preventive measures are in place. Negligence, finally, is a legal finding, not a clinical one: care that fell below the accepted standard of a reasonably competent practitioner and caused harm. The clinician at the bedside classifies the event to decide the response; the lawyer determines negligence, never the clinician. [1]

The systems approach — Swiss cheese and active versus latent failures

The modern understanding of medical error is built on James Reason's systems model, often called the Swiss cheese model. In any complex organisation, harm is prevented by layers of defence — alarms, double-checks, protocols, training, supervision, barriers — each represented as a slice of cheese. No defence is perfect; each has holes, created by design flaws, worn equipment, fatigue, production pressure or absent supervision. An accident occurs only when the holes in every layer momentarily align and a hazard passes all the way through to the patient. The corollary is the most important sentence in patient safety: error is not eliminated by exhorting individuals to be more careful, but by designing systems in which the holes are fewer, smaller and less likely to align. Reason's axiom frames the whole field — we cannot change the human condition, but we can change the conditions under which humans work.[1]

The model distinguishes two kinds of failure that combine to produce harm. Active failures are the unsafe acts committed by people at the sharp end, in direct contact with the patient — the slip (a lapse of attention, the right plan executed wrongly), the lapse (a memory failure, the forgotten allergy), the mistake (a wrong plan from faulty knowledge or reasoning) and the violation (a deliberate departure from a rule). Active failures are immediate, visible and often the focus of uninformed blame. Latent failures are the delayed consequences of decisions taken at the blunt end, far from the patient — staffing rosters that are too thin, equipment that is poorly maintained, protocols that are ambiguous, a culture that punishes reporting, design flaws that make the wrong drug easy to pick. Latent failures are the resident holes in the cheese, present long before the event and waiting for an active failure to pass through them. A serious investigation that concludes "the nurse gave the wrong drug" has described the active failure and stopped; a real root cause analysis keeps asking why until it reaches the latent failure that made the error both possible and likely. [1]

Differential — the event categories distinguished

The event categories are not academic labels; each carries a different response, a different reporting pathway and a different expectation of investigation. A candidate who treats a near miss like a sentinel event, or a no-harm incident like negligence, mishandles the station. The five categories below recur in every classification question, and distinguishing them is a tested competency.[1][4]

Open disclosure — the protocol and the duty

Open disclosure is the structured, frank and timely discussion of a patient safety incident with the patient, their family and their carers. It rests on the ethical principle of candour — the duty to be open about harm — and on the empirical observation that disclosure, accompanied by a genuine apology and an explanation, preserves trust and reduces, rather than increases, the likelihood and cost of litigation. Gallagher and colleagues showed that the overwhelming majority of patients want full disclosure of errors, including an explicit acknowledgement that an error occurred, an apology, and information about how the harm will be addressed and how recurrence will be prevented; clinicians, by contrast, systematically underestimate how much patients want to know and overestimate the legal risk of disclosure.[2] Kachalia and colleagues demonstrated that hospitals adopting communication-and-resolution programs — formal disclosure, apology, explanation and where appropriate early compensation — saw reductions in malpractice claims, faster claim resolution and lower total costs, directly contradicting the fear that disclosure invites litigation.[3]

The protocol that the Fellowship candidate is expected to apply is the staged open disclosure conversation, distilled here in the elements common to the ACSQHC Open Disclosure Framework used across Australasia and the statutory Duty of Candour operating in the United Kingdom. [1]

Several boundaries govern the conversation and are themselves examinable. The clinician leading disclosure describes facts and acknowledges harm, but does not allocate fault, name other staff as negligent, or admit legal liability on behalf of the organisation — questions of liability and compensation are referred to the appropriate channel. Disclosure is not a single event but a process: an initial conversation as soon as practicable, and a formal meeting once the investigation findings are available. Disclosure should occur even when the patient cannot be told directly — the unconscious or deceased patient's family receives the disclosure on the patient's behalf. Where a patient lacks capacity, the disclosure is made to the substitute decision-maker under the same principles that govern consent. [1]

Incident reporting — what, when and how

Incident reporting is the mechanism by which a healthcare system converts an event into learning. Its purpose is not to punish or to apportion blame but to capture the facts of the event, its contributory factors and its outcome, so that the latent failures can be found and removed before the next alignment of holes. The obligation is to report the what — a factual account of what happened, untainted by speculation or attribution — as soon as the patient is safe and the immediate clinical situation is managed. The when is promptly: within the shift in which the event is recognised, and certainly before the people involved have dispersed and memory decays. The how is the local incident-management system, the electronic form through which the event is recorded and routed for review — RLDatix, Safeguard or the equivalent in Australasia; the Learn From Patient Safety Events (LFPSE) system in the United Kingdom, which replaced the National Reporting and Learning Service.[1]

The rule of thumb is that every actual harm event and every near miss is reportable, because the near miss reveals a latent failure as clearly as the harmful event and is far more common. Underreporting is near-universal: even in mature safety cultures, only a fraction of identifiable events are captured, the deficit largest for near misses and events without obvious harm. The drivers of underreporting are cultural (fear of blame, fear of reputational or career damage), structural (a cumbersome form, no feedback on what changed) and cognitive (uncertainty about whether an event is reportable). The remediation is a blame-free reporting culture, a simple and accessible reporting mechanism, and a visible feedback loop so that staff see that reports lead to change. A report is a factual document, not a confession and not an accusation. [1]

Root cause analysis

Root cause analysis is the structured, retrospective investigation that follows a serious event, a sentinel event or a recurring pattern of incidents. Its aim is to identify the systemic causes — the latent failures — that combined to produce the event, so that corrective action can be designed and the event prevented from recurring. It is explicitly not a vehicle for attributing individual blame, and an analysis that stops at the active failure ("the resident gave the wrong dose") has failed in its central purpose. The discipline of the method is to keep asking why until the question reaches a system cause that the organisation can change, and to phrase every causal statement so that it links a cause to the event it produced. [1]

The steps of root cause analysis are the structure the examiner expects, and each carries a specific task. [1]

The recurring failure of root cause analysis is to convert the investigation into blame dressed as analysis, by locating the cause inside a person rather than inside the system. A second failure is to generate a long list of recommendations without owners, deadlines or measures, so that nothing changes and the event recurs. The test of a good analysis is whether its actions, if implemented, would actually prevent the event — and whether those actions act on the latent cause, not merely on the clinician who happened to be last in the chain. [1]

Common ED errors — diagnostic, medication and procedural

The emergency department concentrates the conditions under which error thrives, and three categories dominate both the harm and the malpractice data. Grenon and colleagues' analysis of closed malpractice claims confirmed the patterns that recur in every emergency department: diagnostic error is the single largest source of serious harm and litigation, medication error is the most frequent error overall, and procedural error, though less common, produces the gravest individual events.[4]

Diagnostic error in the emergency department is the failure to make a time-critical diagnosis that was reasonable to make on the available information. The high-yield examples are the diagnoses whose miss is both common and catastrophic. Missed acute coronary syndrome presents atypically — the younger patient, the woman, the diabetic with silent ischaemia, the patient whose chest pain is attributed to musculoskeletal or gastrointestinal causes without an adequate risk assessment. Missed subarachnoid haemorrhage is the thunderclap headache called a migraine and sent home without a computed tomogram or lumbar puncture; sentinel bleeds are missed in the days before the catastrophic rupture, and a normal CT does not exclude subarachnoid haemorrhage within the window that warrants lumbar puncture. Missed abdominal aortic aneurysm is the older patient with back or flank pain attributed to musculoskeletal or renal causes without palpation of the aorta or a scan. Missed aortic dissection, ectopic pregnancy, pulmonary embolism and spinal epidural abscess complete the recurring list. The latent failures are cognitive — anchoring on a benign diagnosis, premature closure, the search-satisficing error — and environmental: interruptions, fatigue, access block, and the absence of decision support.[4]

Medication error is the most common error type in the emergency department, and it clusters into wrong drug, wrong dose, wrong route, wrong patient and missed allergy. Ten-fold dosing errors (1 mg given as 10 mg, 0.1 mg given as 1 mg) arise from misplaced decimals, ambiguous prescriptions and the mg-versus-microgram trap. Look-alike, sound-alike drug pairs (hydralazine and hydroxyzine, dopamine and dobutamine) are selected wrongly from crowded shelves. Allergy is not checked because the prescribing pathway does not force the question. Paediatric weight-based dosing is the single highest-risk medication area, because every paediatric dose is a calculation and every calculation can be wrong by a factor of ten. Insulin and anticoagulants are the drugs whose errors cause the gravest harm. The latent failures are the absence of forcing functions, the storage of dangerous drugs on open shelves, the lack of an integrated electronic prescribing and allergy record, and the production pressure that dispenses with the double-check. [1]

Procedural error is less frequent but more severe event by event: wrong-site and wrong-patient procedures, retained foreign bodies, unrecognised complications (the failed lumbar puncture, the displaced chest tube, the arterial cannulation of a vein), and the procedure performed without consent or on the wrong side. The latent failures here are the absence of a surgical safety checklist, the bypassed timeout, the unmarked site, and the hierarchical team in which the nurse who sees the error does not speak. [1]

Management of the harmed patient — the immediate clinical response

The immediate response to a medical error is the patient, not the paperwork. The first duty is to recognise and treat the harm the event caused, to stabilise the patient, and only then to preserve evidence, document, report and disclose. In the emergency department this most often means the management of a medication error or an allergic reaction, where the corrective action is the prompt administration of a reversal agent or an antidote, with the dose, route and monitoring that the situation demands. [1]

Alongside the clinical response, the immediate phase has three further duties that the examiner tests. Preserve the evidence: the ampoule, the syringe, the infusion bag and the mislabelled wristband are retained, because they may be needed for the investigation. Document contemporaneously and factually: the event, the time, the assessment, the intervention and the response are recorded in the medical record, without speculation, without attribution of fault, and without any alteration — the record is the primary evidence in any later investigation, and a tampered record is both a regulatory and a criminal matter. Escalate: the senior clinician, the department lead and the incident-reporting pathway are engaged, and where the harm is serious, open disclosure begins. [1]

Culture — just culture and the second victim

The framework of error, disclosure, reporting and analysis is sustained by the culture in which it operates. A blame culture — in which error is met with punishment and the question asked after every event is "who did this?" — is self-defeating: it drives reporting underground, conceals the latent failures, and guarantees that the next alignment of holes will not be prevented. A just culture, articulated by David Marx, replaces blame with a tested distinction between the kinds of human conduct that produce error, and it matches the response to the conduct rather than to the outcome. The axiom of just culture is that the severity of harm is irrelevant to the culpability of the act: a fatal error may be blameless honest error, and a harmless act may be culpable recklessness.[5]

The clinician who causes or is associated with patient harm becomes a second victim, a term coined by Albert Wu. The syndrome is a predictable and serious occupational injury: shock, guilt, self-doubt, intrusive recall, sleep disturbance, loss of confidence, and, in the most affected, burnout, depression and post-traumatic stress. Ong and colleagues' systematic review confirmed that second victim syndrome is common across healthcare professions and that structured peer support, a clear just-culture response, and timely access to psychological care reduce its severity and duration.[5] The department's duty to the clinician after an event is therefore parallel to its duty to the patient: support, not isolation; a fact-based, blame-free investigation; and a named peer supporter. A department that consumes its clinicians after error is one that will not retain them and will not learn.

A taxonomy of error — the five domains

The event categories (near miss, adverse event, sentinel event, never event) describe the outcome of an incident; the error-type taxonomy describes its nature — where in the care process the failure occurred. Both axes are examinable, and both must be applied to the same event: a missed aortic dissection is, at once, an adverse event (outcome), a diagnostic error (nature), and — if the standard of care was breached — potentially negligence (legal). The taxonomy below, derived from the World Health Organization's International Classification for Patient Safety and the National Coordinating Council for Medication Error Reporting and Prevention (NCC MERP) index, sorts every error into one of five domains, each with its own signature failures, its own prevention strategies and its own recurring ED examples.[4][11]

Error prevention — the engineered defences

The hierarchy of controls, encountered above in the corrective actions of root cause analysis, is the master framework for prevention, and every validated patient-safety technology is an instance of it. The strongest defence is the force-function — a physical or logical barrier that makes the error impossible: the gas-pin index that prevents the wrong cylinder fitting the wall outlet, the patient wristband that must be bar-code-scanned before the drug is given, the prefilled syringe that cannot deliver ten times the dose. Below it sit constraints and simplification (limiting the available concentrations, removing dangerous drugs from open shelves, standardising the equipment), then standardisation and protocols (the single insulin infusion protocol, the standard sepsis bundle), then redundancy and double-checks (the independent dual check on a paediatric calculation), and weakest of all policy, training and reminders (the poster, the in-service, the "be careful"). Bates and colleagues showed that computerised physician order entry (CPOE) with clinical decision support cut the rate of serious medication errors by more than half — a forcing-function deployed at scale — and Poon and colleagues showed that bar-code technology reduced non-timing administration errors by over 50 per cent and potential adverse drug events by nearly as much.[6][7] The candidate must know each technology, what it prevents, what it cannot prevent, and the new failure modes it introduces.[8]

Cognitive biases and diagnostic error

Diagnostic error is not usually a gap in knowledge; it is a failure of reasoning under the cognitive load of the emergency department. The dual-process theory of Croskerry frames the mind as two systems: the fast, intuitive, pattern-recognising System 1 that operates most ED encounters, and the slow, analytic, rule-based System 2 that engages for the atypical or the undifferentiated. Most diagnostic errors arise from System 1 — a heuristic that is fast and usually right, but that produces predictable, classifiable biases when it is applied to the case that does not fit the pattern. The recurring biases are themselves examinable, and naming them is the first step to counteracting them.[4][11]

Handover and communication failures

Handover is the highest-risk transition in the patient's journey, and the emergency department — with shift changes every eight to twelve hours, inter-departmental transfers, sign-over to inpatient teams, and the constant flow of boarding patients — is the densest handover environment in the hospital. The Joint Commission identified communication failure as the root cause in the majority of sentinel events, and handover failure is the dominant communication failure: the critical pending result not handed over, the decompensation not escalated, the disposition plan lost between nurses, the verbal order not read back. The remedy is the structured handover — a forced framework that standardises the content and the sequence so that nothing is omitted — and the evidence base for it is strong.[9]

Two frameworks dominate. SBAR (Situation, Background, Assessment, Recommendation) is the brief, situation-specific tool — the nurse calling the registrar about a deteriorating patient, the escalation of a critical result. I-PASS (Illness severity, Patient summary, Action list, Situation awareness and contingency planning, Synthesis by receiver) is the comprehensive shift handover tool, designed for the transfer of care at the end of a shift. Starmer and colleagues showed that implementation of the I-PASS handoff program reduced medical errors by 23 per cent and preventable adverse events by 30 per cent across nine paediatric residency programmes — one of the few interventions with level-1 evidence for harm reduction in handover.[9]

High-alert medications — the small list that causes the large harm

The Institute for Safe Medication Practices (ISMP) defines a short list of high-alert medications — drugs that bear a heightened risk of causing significant patient harm when used in error. They are not the most frequently mis-used drugs, but they are the ones whose error is most likely to be catastrophic. The emergency department uses several of them on every shift, and the candidate must know each drug, its characteristic error, and the engineered mitigation that closes the hole.[4]

The second victim — trajectory and support

The clinician who causes or is associated with patient harm becomes a second victim, a term coined by Albert Wu to describe the predictable, serious occupational injury that follows an adverse event.[10] The syndrome is far more common than is acknowledged: most clinicians will be a second victim at least once in their career, and the symptoms — shock, guilt, self-doubt, intrusive recall, sleep disturbance, loss of confidence, social withdrawal, and in the most affected, burnout, depression and post-traumatic stress — can persist for months and end careers. Ong and colleagues' systematic review confirmed that structured peer support, a clear just-culture response, and timely access to psychological care reduce its severity and duration.[5][10]

Scott described a predictable six-stage trajectory of the second-victim experience that frames the support a department must provide: (1) chaos and accident response — the immediate clinical management of the patient; (2) intrusive reflections — the relentless replay of "what if"; (3) restoring personal integrity — seeking reassurance and searching for whether one is a competent clinician; (4) enduring the inquisition — the investigation, the incident report, the fear of sanction and litigation; (5) obtaining emotional first aid — reaching for support, often from colleagues and family, and finding it wanting or absent; (6) moving on — which takes one of three paths: dropping out (leaving the profession), surviving (coping but diminished), or thriving (using the experience to improve the system). The department's duty is to ensure the clinician lands on the thriving path, not the dropping-out path. [1]

The immediate response to a medication error — a structured sequence

Common errors and pitfalls

The recurring failures are those the framework exists to prevent. Blaming the individual at the active failure converts every event into a witch-hunt and guarantees the latent cause persists. Failing to disclose — out of fear, embarrassment or poor advice — breaches the duty of candour, erodes trust and increases litigation. Altering the medical record after an event, in any form — deleting, rewriting, back-dating, or "tidying" an entry — is the single act most fatal to a clinician's defence and is itself a regulatory and criminal matter. Delaying disclosure until the investigation is complete inverts the protocol: the initial conversation happens within a day, the formal meeting follows the findings. Stopping the root cause analysis at the active failure ("the resident forgot to check the allergy") produces a recommendation for re-education and leaves the latent failure intact. Recommendations without owners or measures generate action plans that are never implemented or never checked. A punitive response to honest error destroys reporting and learning. Ignoring the second victim abandons a colleague at the moment of greatest need. Reporting only the harmful events and never the near misses throws away the richest source of system learning. Asking "who" instead of "why" after every event is the diagnostic error of the safety system itself. [1]

Evidence and regional guidelines

The systems approach to medical error is grounded in James Reason's human-factors work and the Institute of Medicine report To Err is Human, and its modern epidemiology is captured by Makary and Daniel, whose estimate placed medical error among the leading causes of death in the United States.[1] The disclosure literature is anchored by Gallagher's study of patient and physician attitudes and by Kachalia's evaluation of communication-and-resolution programs, which together establish that disclosure with apology reduces rather than increases litigation.[2][3] The diagnostic-error burden is documented in the closed-claims analysis of Grenon and colleagues, which confirms that diagnostic error dominates emergency medicine malpractice and that its root causes are system and cognitive, not individual.[4] The second-victim literature is synthesised in Ong and colleagues' systematic review of support interventions.[5] The statutory and policy overlay differs by region but converges on the same principles of candour, structured investigation and just culture.

Exam pearls

• Error versus adverse event versus negligence: error is a process failure; adverse event is the resulting harm; negligence is a legal finding, never the bedside diagnosis.
• Active versus latent failure: the sharp-end unsafe act (slip, lapse, mistake, violation) is the active failure; the blunt-end system condition (staffing, design, culture, equipment) is the latent failure that made it possible and likely — keep asking why until you reach the latent cause.
• Swiss cheese: defences in depth, each with holes; harm occurs when the holes align — system redesign reduces the holes; exhortation does not.
• Open disclosure — OPEN: Open early, Provide the facts and an apology, Explain consequences and plan, Name next steps and follow up.
• Incident report — what, when, how: the facts, within the shift, via the local incident system; report every near miss, not only the harm events.
• Root cause analysis — FLOWEDS: Frame, Lay out the timeline, Open with the causal questions (five whys), Write causal statements, Engineer corrective actions (force-function first), Drive and delegate (named owner, deadline, measure), Share and sustain.
• Hierarchy of controls: force-function and eliminate (strongest), simplify and standardise (medium), policy and training (weakest) — an analysis that ends in a poster has chosen only the weakest layer.
• Just culture — JUST: Judge the behaviour not the outcome, Unintentional error is consoled, Safe-choice drift is coached, Truly reckless conduct is sanctioned.
• Never alter the record — document factually, contemporaneously, and add a clearly marked late addendum if needed.
• The second victim — peer support and a just-culture response, not isolation.
• The disclosure–apology paradox — disclose more, get sued less; concealment, not candour, drives litigation.
• Error-type taxonomy — the five domains: diagnostic (missed/delayed/wrong), treatment (wrong drug/dose/route/rate/patient), preventive (omitted prophylaxis/screening), communication (handover/result/escalation failure), system (staffing/equipment/crowding) — classify both the outcome AND the nature.
• NCC MERP index: grades medication errors A–I by outcome (A circumstances, B no-harm, C–D no harm with monitoring, E–F temporary harm, G–H permanent/near-death, I death) — outcome-graded, distinct from the just-culture conduct test.
• CPOE with CDS (Bates, JAMA 1998): cut serious medication errors by 55 per cent — the forcing-function at prescribing; beware alert fatigue and wrong-patient selection from drop-downs.
• BCMA (Poon, NEJM 2010): bar-code scan of wristband and drug cut administration errors by 41 per cent — the bedside force-function; beware workarounds (scanning a worksheet, not the wristband).
• Smart pumps with DERS: drug-library hard limits catch the wrong-rate error on noradrenaline, insulin, heparin — but only when run IN the library; bypassing to "basic" mode defeats the safety software entirely and is the commonest reason smart pumps fail to prevent harm.
• The WHO surgical safety checklist (Haynes, NEJM 2009): 19 items cut mortality from 1.5 to 0.8 per cent globally — the template for every ED airway, resus and procedural checklist.
• I-PASS handover (Starmer, NEJM 2014): Illness severity, Patient summary, Action list, Situation awareness/contingency, Synthesis by receiver — reduced errors by 23 per cent and preventable harm by 30 per cent.
• High-alert medications (ISMP): insulin, anticoagulants, opioids/sedatives, concentrated electrolytes (KCl, hypertonic saline), neuromuscular blockers, adrenergic infusions — the short list that causes the large harm; keep antidotes and double-checks for these specifically, even on the busy shift.
• Cognitive biases: anchoring (locked first label), premature closure (accepted too soon), search-satisficing (first finding ends the search), availability, diagnostic momentum (inherited label), framing — counter with a mandated diagnostic time-out, the rule of three, and the red-flag checklist.
• Closed-loop communication: sender states dose/route/units, receiver reads back verbatim, sender confirms — the defence against the misheard verbal order and the unacknowledged critical result.
• Second victim — Scott's six stages: chaos and accident response, intrusive reflections, restoring personal integrity, enduring the inquisition, obtaining emotional first aid, moving on (dropping out / surviving / thriving) — the department's duty is to land the clinician on the thriving path, beginning with peer contact within hours.
• The reversal agents: naloxone 0.4 mg IV (opioid), flumazenil 0.2 mg IV (benzodiazepine, caution seizure threshold), protamine 1 mg per 100 units heparin, PCC 25–50 units/kg plus vitamin K 5–10 mg (warfarin/major bleeding), IM adrenaline 0.5 mg (anaphylaxis). [1]

Red flags