Patient safety, human factors and systems thinking

Overview & Definition

A three-year-old on the ward receives ten times the intended morphine because a decimal point was misread in a handwritten chart, and he stops breathing. A teenager is sent home with a missed appendix because the team anchored to "gastroenteritis." A baby in the NICU gets the wrong concentration of adrenaline from a look-alike ampoule. None of these is, at its heart, a story about a bad doctor or a careless nurse. Each is a story about a system whose defences did not catch a fallible human act before it reached a child. [3] [6]

Patient safety is the prevention of harm caused by the health system rather than by the disease itself. The Harvard Medical Practice Study, which reviewed 30,000 hospital records, found that nearly 4% of admissions involved an adverse event and that around seven in ten were preventable — harm caused not by the illness but by the care meant to treat it. [1] [2] The Institute of Medicine's To Err Is Human reframed those numbers as a public health emergency and shifted the question from "who is to blame?" to "what made this possible?" [3]

The defining idea of this whole field is systems thinking: human error is inevitable, so safety lives in the layers built around people, not in the demand that people never err. Reason put it plainly — you can choose the person approach (blame individuals, rely on perfect performance) or the system approach (build defences that expect and catch human fallibility). Only the second one works. [3]

This page owns the science and practice of patient safety as it applies to children: the language of events and errors, the Swiss cheese model of harm, why paediatrics is high-risk, the interventions proven to reduce harm, and the fixed sequence that follows an adverse event. Cross-link the dedicated leaves for adverse-event reporting and medication-safety detail, for breaking bad news, and for shared decision-making and consent — this page builds the framework, it does not rebuild theirs. [3] [12]

Classification

Two sets of words cause most of the confusion in safety, and examiners test both. The first set names the event — what happened. The second set names the error — the human act inside it. Sort them separately and you can describe any incident precisely. [3] [12]

Event types. An adverse event is unintended harm caused by the health system, not by the disease. A near miss (close call) is an error that was caught before it reached the patient — the most valuable signal a system can get, because it exposes a failing defence without anyone being hurt. A never event is a serious, largely preventable incident that should never occur if basic defences are in place (wrong-site surgery, a retained item, a fatal look-alike infusion). A sentinel event is a patient-safety event resulting in death or severe, lasting harm — the term the Joint Commission uses to flag an event demanding immediate investigation. [12]

Error types. A slip is an action failure — you knew the right thing and your hand did another (picking up the look-alike ampoule). A lapse is a memory failure — you forgot to give the dose. A mistake is a planning failure — your plan itself was wrong (a rule-based or knowledge-based error, such as misjudging the diagnosis). A violation is a deliberate deviation from a rule, which may be routine (everyone takes this shortcut) or exceptional. Slips and lapses come from skilled but inattentive performance; mistakes come from incomplete knowledge or wrong reasoning. [3]

Cut across both sets with one more axis. Active failures happen at the sharp end — the unsafe act in the moment. Latent conditions live at the blunt end — the organisational decisions, designs and pressures that quietly set the trap. The same adverse event is almost always the meeting of an active failure with a long-standing latent condition. [3]

Epidemiology & Risk Factors

Harm in healthcare is common, and a large share of it is preventable. The Harvard Medical Practice Study — still the reference epidemiology — found an adverse event in 3.7% of hospital admissions, with negligence implicated in about a quarter of those events and nearly 70% of the adverse events judged preventable. [1] Leape's companion analysis showed that the largest single category was drug complications, and that most harm came from errors in execution rather than from inherently risky decisions. [2] To Err Is Human extrapolated those findings to an estimated 44,000–98,000 deaths a year in US hospitals — more than motor vehicle crashes — and made patient safety a mainstream discipline. [3]

Children are not a small version of adults when it comes to risk; they are a high-risk group in their own right. Kaushal's landmark study of two academic children's hospitals found medication errors and preventable adverse drug events at rates higher than in adult inpatients, and highest of all in the NICU and PICU. [6] The paediatric risk factors are mechanical and specific.

[1] [2] [6]

Weight-based dosing turns every paediatric prescription into a calculation, and every calculation is a chance to be out by a factor of ten. A decimal-point slip becomes a tenfold overdose in seconds. Off-label and unlicensed medicines are routine in children, so there is often no standard reference to catch a wrong dose. Narrow therapeutic margins in neonates — whose renal and hepatic function is immature — turn small errors into large harm. Limited communication means a child cannot flag "this looks wrong," and dependence on carers and staff means every transition is a handoff of responsibility. [6] [8]

High-risk situations cluster where these factors meet: handover and transfer of care, high-alert medicines (insulin, opioids, concentrated electrolytes, chemotherapy and anticoagulants), look-alike and sound-alike drugs, and emergency resuscitation when a dose must be drawn up under pressure. [7] [8]

Pathophysiology

The "mechanism" of patient harm is not biological; it is the way systems fail. Reason's Swiss cheese model is the single most useful mental image in safety science, and it is worth holding precisely. [3]

Picture several slices of Swiss cheese lined up one behind the other. Each slice is a defensive layer — the organisation, supervision, preconditions for safe work, and the acts of the individual. Each slice has holes: weaknesses where a hazard could pass through. On their own the holes are random, and most hazards hit cheese and stop. But every so often the holes line up across all the slices, and a hazard travels straight through to the patient. That alignment is an accident. [3]

The holes are made of two things. Active failures — the slip, lapse or mistake at the sharp end — open a hole in the final slice. Latent conditions — the "resident pathogens" that breed quietly inside the organisation (workload, fatigue, poor equipment design, production pressure, missing protocols, inadequate supervision) — open holes in the upstream slices. Crucially, the latent conditions are usually invisible until an active failure lines up with them. The nurse who picks up the wrong ampoule is the final slice; the stocking of two look-alike adrenaline strengths in the same drawer is the latent condition that made the error almost inevitable. [3]

This is why the system approach beats the person approach. The person approach blames the last hand on the error, demands that people be more careful, and assumes that naming and shaming will prevent the next event. The system approach assumes people will err, and instead redesigns the layers: standardise the task so there is one way to do it, add an independent double-check before high-harm drugs reach a child, force a function that physically prevents the error, remove the look-alike products, and engineer out the distraction. Only the system approach actually shrinks the holes. [3] [5]

Clinical Presentation

In practice, harm rarely announces itself with a dramatic event. It shows up as the patterns you learn to read on a ward round. [12] [5]

The deteriorating child who was not escalated. The most lethal and most preventable pattern is failure to rescue. A child's physiology usually wanders for hours before a collapse — rising respiratory rate, falling oxygen saturations, creeping tachycardia — and the observations are written down, but nobody acts. The defect is almost never a single clinician missing a single number; it is a failure of escalation culture, of the trigger that should have fired, and of the permission to call for help. [5]

The medication event. A child becomes acutely unwell after a new infusion, a dose does not match the expected effect, or a high-alert medicine was given without the planned double-check. Sometimes the family notices before anyone on the team. [6] [8]

The diagnostic trap. A teenager sent home with "gastroenteritis" returns in shock with a perforated appendix. Diagnostic error is less visible than medication error because it is invisible at the moment — there is no wrong ampoule, only a premature closure that nobody catches until the diagnosis declares itself. [12]

The warning signs of a vulnerable system. Long before harm, the system telegraphs its weakness: frequent workarounds, a string of near misses that were never reported, communication failures at handover, a culture where juniors do not dare question seniors, constant interruption during prescribing, and a team that is tired and stretched. These are the latent conditions made visible, and they are your chance to act before a hole aligns. [3] [5]

The second victim. The clinician involved in an adverse event often becomes a patient of sorts — withdrawn, anxious, sleepless, self-doubting, and at higher risk of further error in the aftermath. Recognising the second victim is itself a safety intervention, because an unsupported clinician is a latent condition for the next event. [4]

Differential Diagnosis

When something goes wrong, your first analytical job is to name the true nature of the failure, because each type demands a different response. [3] [12]

[3] [12]

The guiding principle is that the categories usually coexist. A medication error is often an active slip travelling through a latent design flaw, made by a clinician under pressure — and the family deserves an honest account of all three layers, not a search for a single culprit. [3] [4]

Clinical & Bedside Assessment

Safety at the bedside is a set of habits, not a form. Build them into the routine and the defences hold; skip them and the holes widen. [5]

Run a structured safety scan on every ward round. Allergies, weight-based doses (with the calculation shown), high-alert medicines, lines and drains, the agreed escalation plan, and whether the family understands what is happening. This is the daily version of building defensive layers. [8]

Escalate with SBAR. Situation, Background, Assessment, Recommendation turns a panicked "I'm worried about bed 4" into a structured, transmissible signal that the senior can act on. The point of SBAR is not etiquette; it is that structured handovers survive stress, panic and hierarchy better than free text. [5]

Hand over with I-PASS. Illness severity, Patient summary, Action list, Situation awareness and contingency planning, and Synthesis by receiver. The receiver repeating back the plan (synthesis) is the independent check that closes the loop. [13]

Run a time-out before any procedure. Before the knife or the cannula, the team stops and confirms together: right patient, right site, right procedure, known allergies, and that everything needed is in the room. The WHO Surgical Safety Checklist is the global standard for this. [10]

Make it safe to speak up — and receive the challenge well. Any team member, however junior, must be able to say "I think we should stop" without being dismissed. A team that punishes the voice that raises a concern is a system that has removed its own alarm. [5]

Investigations

In patient safety, the "investigation" is not a scan or a blood test; it is a structured analysis of the event that asks how the defences failed and how to rebuild them. [12]

Incident reporting is the primary tool. Report adverse events and near misses through your local system, promptly and factually, without blame or speculation. Near misses matter as much as harm, because they expose a failing defence before anyone is hurt. Voluntary, no-blame reporting is what makes the data trustworthy; a punitive culture guarantees that the most useful reports are never written. [12]

Root cause analysis (RCA) is the structured method. An RCA gathers the timeline and the facts, maps the active failure and the latent conditions, and asks repeatedly why each hole was open until it reaches the system contributors — not the individual. The output is a set of actions that change the defences, not a verdict on a person. [12]

Use the fishbone and the Five Whys to move past the person. An Ishikawa diagram sorts contributors into people, process, equipment, environment, materials and management, forcing the team to see the whole system. The Five Whys asks "why?" until the answer is a latent condition rather than a name. [3]

Detect unreported harm with trigger tools and mortality review. Voluntary reporting misses most harm, because clinicians are busy and harm is often invisible in retrospect. Trigger tools — patterns in the record that flag possible harm (an abrupt rise in a high-alert drug, an unplanned escalation, a naloxone order) — and structured mortality and morbidity review find the harm that was never reported. [12]

Management — Resuscitation

The first minutes after an adverse event are about the child, not the paperwork — but they also set up everything that follows. Get the order right. [12] [4]

Make the child safe and escalate. Treat the harm first with ABCDE, call for senior help early, and stabilise. Never delay life-saving action to fill in a form. [12]

Preserve the scene and the evidence. Keep the implicated drugs, pumps, lines, infusion bags and the chart. The investigation depends on accurate facts, and the physical items often hold the answer that the memory does not. [12]

Tell a senior and the responsible consultant immediately. A serious event is escalated to the consultant in charge and to the clinical lead for safety the same day. They own the disclosure and the analysis. [12]

Care for the family. Acknowledge what has happened, provide compassion and a senior point of contact, and avoid blame, speculation and premature fault-finding. Do not guess at cause in the heat of the moment. Full open disclosure follows once the facts are clear. [12]

Support the second victim. The clinician involved is now at risk of acute distress and of further error. Provide immediate peer support, relieve them from front-line duties as appropriate, and arrange formal follow-up. Ignoring the second victim is both unkind and unsafe. [4]

Management — Definitive & Stepwise

Once the child is safe, the work of the system begins. The fixed sequence after an adverse event is: make safe and escalate, report, investigate with root cause analysis, openly disclose to the family, learn, and then implement and measure the change. The point of investigation is not to assign blame but to rebuild the defences so the same hole cannot align again. [3] [12]

Open disclosure is a clinical act, not a legal one. An honest, timely, apologetic conversation with the family — what happened, what is known, what is being done, and an expression of regret for the harm — is the standard of care after an adverse event. Done well it supports the family, sustains trust and is associated with reduced litigation; done poorly or avoided, it deepens harm. [12]

A just culture holds people accountable without blaming them for being human. The just-culture test distinguishes honest error (console the person and fix the system), at-risk behaviour (coach the person and remove the drift), and reckless behaviour (sanction the person and fix the system). It is what makes reporting and learning possible, because people will only tell you what went wrong if they trust they will be treated fairly. [3] [4]

Build the layered defences that actually reduce paediatric harm. The interventions with the strongest evidence are structural, because structure shrinks the holes regardless of who is on shift. [3] [8]

[11] [10] [13]

Medication-safety defences. Computerised provider order entry with weight-based dose checking cuts prescribing error substantially in children. Potts showed CPOE reduced medication errors in a paediatric critical care unit, and Fortescue and the AAP (Stucky) prioritise standardisation, dose-range checking, independent double-checks of high-alert medicines, standardised concentrations, and unit alignment (for example, standardising on millimoles rather than mixing units). Tall-man lettering and separating look-alike products shrink the holes at the sharp end. [7] [8] [9]

Team and communication defences. SBAR escalation, I-PASS handover, daily safety huddles, briefs and debriefs, and checklists with time-outs are not red tape — they are the engineered layers that catch fallible human acts. The team that uses them is the team whose holes do not align. [5] [10]

Specific Subtypes & Scenarios

Medication safety in children. This is the single largest preventable risk in paediatrics. Weight-based dosing, off-label medicines and narrow neonatal margins make every prescription a calculation with a tenfold-error potential. The Fortescue and Stucky strategies converge: standardise, automate with decision support, add independent double-checks for high-harm drugs, and use standardised concentrations. Most paediatric medication harm is preventable with these structural fixes. [6] [7] [8]

Diagnostic error. Less visible than medication error but equally harmful, diagnostic error is usually a mistake (a wrong plan) rather than a slip. It is driven by cognitive biases — premature closure, anchoring, availability — and by system gaps such as untracked results and no follow-up on pending tests. The defences are structured diagnostic reasoning, closing the loop on every critical result, and a culture that encourages "I'm not sure, let me reconsider." [12]

Surgical and procedural safety. The WHO Surgical Safety Checklist (sign-in, time-out, sign-out) cut death and complications globally and is the standard for every procedure. Counting and reconciling swabs and instruments, marking the site, and a team time-out that confirms right patient, right site and right procedure are the defences against never events such as wrong-site surgery and retained items. [10]

Transitions and handover. The handover is the highest-risk moment in routine care, because responsibility and information must transfer together without loss. The I-PASS study proved that a structured handover programme reduces medical errors and preventable adverse events in children — treat every handover as a safety-critical act with an independent receiver synthesis. [13]

Deterioration and failure to rescue. Most in-hospital cardiac arrests in children are preceded by hours of documented physiological instability. The defences are early-warning scores, structured escalation pathways, rapid-response teams, and — above all — a culture that makes calling for help easy and expected. [5]

Complex chronic and technology-dependent children. Polypharmacy, enteral access and device dependence (lines, pumps, tracheostomies) create a concentrated, repeating risk across many teams. The family is part of the safety system — they often know first when something is wrong — and the care plan must travel with the child at every transition. [8] [11]

Complications & Pitfalls

• The blame culture. Punishing honest error suppresses the reporting that exposes latent conditions, so the same trap is set for the next person. [3]
• Stopping at the individual. Naming "the nurse" or "the doctor" instead of the system that let a single act reach the patient changes nothing. [3] [12]
• Reporting as compliance. Treating incident reporting as a box to tick, rather than as the system's early-warning data, wastes the signal. [12]
• The unfinished RCA. An analysis that ends at the person ("staff failed to…") leaves every latent condition intact. [12]
• The forgotten second victim. A clinician harmed by an event who is then left unsupported becomes distressed, may leave, and is a latent condition for the next error. [4]
• No closed loop. Investigating events but never implementing or measuring the corrective actions converts learning into paperwork. [12]
• Checklist without culture. A checklist done perfunctorily, or in a team where juniors cannot speak, adds little — the defence is the team behaviours around it, not the form. [5] [10]

Prognosis & Disposition

The prognosis of a safety event for the child depends on its severity, on how early it is recognised, and on whether the family is given an honest, well-supported account of what happened and what will change. [12]

For the child, preventable harm can mean a prolonged admission, lasting disability or death; the only acceptable outcome is the one prevented upstream, which is why the layered defences matter more than the response. For the family, disposition means open disclosure, an agreed and documented care plan, named follow-up, and feedback on the investigation and the changes made — silence after harm is itself a harm. [12]

For the clinician, a just-culture and peer-support pathway improves recovery and reduces attrition after an event; an unsupported second victim carries a measurable risk of leaving the profession and of further error. [4]

For the organisation, the trajectory is set by whether it learns. Teams that report near misses, measure harm reliably, close the loop on their actions, and protect a just culture trend toward high-reliability performance — low rates of harm despite operating in a hazardous, complex environment. [3] [5]

Special Populations

Neonates and infants. The highest medication-error risk in paediatrics, driven by weight-based dosing in milligrams per kilogram, off-label medicines, and immature organ function that narrows every therapeutic margin. Every neonatal prescription is a calculation and deserves a defence. [6] [8]

Children with complex chronic illness and technology dependence. Polypharmacy, enteral lines, pumps and devices create concentrated, repeating risk across many teams. The care plan must travel with the child and the family must be treated as part of the safety system. [8] [11]

Children with disability or neurodiversity. Communication barriers increase diagnostic and medication risk; adapt assessment to function and relationship, and assume the child understands more than they can express. [12]

Indigenous, migrant and refugee families. Language barriers and inequitable exposure to system failures raise risk. Always use a trained interpreter — never a child or family member — and follow locally endorsed, culturally safe pathways. [12]

Children in out-of-home care and those in socioeconomic disadvantage. Fragmented records, frequent transitions and information gaps make handover and reconciliation the danger points. Verify the history, reconcile the medicines, and close the loop at every move. [12]

Evidence, Guidelines & Regional Differences

The evidence base rests on a clear lineage: the Harvard Medical Practice Study (Brennan and Leape 1991) for the epidemiology of harm, To Err Is Human (2000) for the public reframing, Reason (2000) for the system model, Kaushal (2001) and the AAP reports (Fortescue and Stucky 2003) for paediatric medication risk, Potts (2004) for computerised order entry, Pronovost (2006) for the central-line bundle, Haynes (2009) for the WHO checklist, Starmer (2014) for I-PASS handover, Vincent (2003) for responding to adverse events, and Wu (2000) for the second victim. [1] [2] [3] [4] [6] [7] [8] [9] [10] [11] [12] [13]

Controversies: voluntary reporting under-detects most harm, so how heavily should it drive improvement; whether any punitive approach ever improves safety; the limits of checklists applied without a just culture; and the equity question of who, within a system, disproportionately experiences preventable harm. Fellowship answers show structured knowledge of the system model, the paediatric evidence, and local humility. [3] [12]

Exam Pearls

• An adverse event is harm caused by care, not by disease; most are preventable. [1] [2]
• Swiss cheese: harm = an active failure passing through aligned holes in latent conditions; build the layers, shrink the holes. [3]
• Person vs system: only the system approach — building defences that expect human error — actually reduces harm. [3]
• Error types: slip = action slip, lapse = memory slip, mistake = wrong plan, violation = deliberate deviation. [3]
• Just culture: console honest error, coach at-risk behaviour, sanction reckless behaviour. [3] [4]
• Children are high-risk: weight-based dosing, off-label medicines and narrow neonatal margins drive medication error. [6] [8]
• SBAR escalates, I-PASS hands over, and the WHO time-out prevents wrong-site and never events. [5] [10] [13]
• The second victim needs structured support — name it, never ignore it. [4]

[1] [10] [13] [3] [4] [12]

References

1. [1]Brennan TA Incidence of adverse events and negligence in hospitalized patients. Results of the Harvard Medical Practice Study I. The New England journal of medicine, 1991.PMID 1987460
2. [2]Leape LL The nature of adverse events in hospitalized patients. Results of the Harvard Medical Practice Study II. The New England journal of medicine, 1991.PMID 1824793
3. [3]Reason J Human error: models and management. BMJ (Clinical research ed.), 2000.PMID 10720363
4. [4]Wu AW Medical error: the second victim. The doctor who makes the mistake needs help too. BMJ (Clinical research ed.), 2000.PMID 10720336
5. [5]Leonard M The human factor: the critical importance of effective teamwork and communication in providing safe care. Quality & safety in health care, 2004.PMID 15465961
6. [6]Kaushal R Medication errors and adverse drug events in pediatric inpatients. JAMA, 2001.PMID 11311101
7. [7]Fortescue EB Prioritizing strategies for preventing medication errors and adverse drug events in pediatric inpatients. Pediatrics, 2003.PMID 12671103
8. [8]Stucky ER Prevention of medication errors in the pediatric inpatient setting. Pediatrics, 2003.PMID 12897304
9. [9]Potts AL Computerized physician order entry and medication errors in a pediatric critical care unit. Pediatrics, 2004.PMID 14702449
10. [10]Haynes AB A surgical safety checklist to reduce morbidity and mortality in a global population. The New England journal of medicine, 2009.PMID 19144931
11. [11]Pronovost P An intervention to decrease catheter-related bloodstream infections in the ICU. The New England journal of medicine, 2006.PMID 17192537
12. [12]Vincent C Understanding and responding to adverse events. The New England journal of medicine, 2003.PMID 12637617
13. [13]Starmer AJ Changes in medical errors after implementation of a handoff program. The New England journal of medicine, 2014.PMID 25372088