Medical Error, Root-Cause Analysis and Quality Improvement

What it is. A root-cause analysis (RCA) is a structured, retrospective investigation used after a serious adverse event or sentinel event to identify the underlying system causes, not to apportion blame. It is triggered in many systems when a sentinel event occurs, and the Joint Commission requires it of accredited organisations. The question is not "who is at fault?" but "why did the system let this happen, and how do we make it impossible next time?"

The sequence.

1. Gather the facts — interviews, the notes, the timeline — and separate what happened from why it happened
2. Map the causal chain, using tools that force you past the obvious cause
3. Prioritise the root causes and convert each into a specific, owned action
4. Track every action to completion

The tools. The two staples are the "5 Whys", asking "why?" repeatedly until you reach a system cause you can act on, and the Ishikawa or fishbone diagram, which sorts candidate causes into contributory-factor categories. The healthcare fishbone most examiners recognise is Charles Vincent's contributory-factors framework: patient factors, task factors, individual and team factors, communication, equipment, environment, and organisation and management.

View larger

The classic trap is stopping at the first "why". In the example below the surgeon is the trigger, not the cause.

The substitution test. A useful rule of thumb within RCA, and the test at the heart of a just culture: if you replaced the individual with another competent person in the same role, would the same thing have happened? If yes, the cause is the system and the response is redesign. If no, the cause lies more with the individual, and the response involves coaching or accountability.

How RCAs fail. The examiner can probe each of the common failure modes:

• Stopping at the proximate cause
• Conducting the RCA in a blame culture that drives staff underground
• Producing an action list that is never closed out

The meeting. The mortality and morbidity meeting is the recurring, case-based forum through which a department learns from its complications and deaths. Done well, it is anonymised, blame-free and systems-focused: the RCA mindset applied at department scale.

How a case runs. Each case is presented against the timeline of what happened, and the discussion works back to why. The meeting ends with explicit learning points and action items that carry an owner and a deadline.

The closed loop. The discipline that separates a good M&M from a moan is the closed loop. Every action is tracked to completion and revisited at a later meeting, so that review converts into improvement rather than regret.

What earns marks. M&M is a protected, no-blame, systems discussion. It must be embedded in a wider governance structure, its action items feeding into quality-improvement work and, where appropriate, into incident reporting and the regulator.

Near misses as well as deaths. The meeting deliberately includes the near miss and the good catch, not only the disaster. A department that reviews only its deaths learns slowly; one that reviews its near misses learns cheaply.

The proactive half. If RCA is the reactive half of patient safety, quality improvement (QI) is the proactive half: the structured method by which a change is tested and embedded.

The Model for Improvement. The framework examiners expect is the Institute for Healthcare Improvement's Model for Improvement, which asks three questions before any change is made:

1. What are we trying to accomplish? — a clear, measurable aim
2. How will we know a change is an improvement? — a measurement plan
3. What change can we make that will result in improvement? — the idea

PDSA cycles. The change itself is then tested through PDSA cycles:

• Plan — state the prediction, who does what, by when, and what data you will collect
• Do — run the test
• Study — compare the result with the prediction
• Act — adopt, adapt or abandon

The cycles are deliberately small and fast: test on one patient, then a few, then a ward, scaling only what works.

Measuring over time. Measurement is by run charts or statistical process control (SPC) charts, which distinguish genuine change from random noise. A single before-and-after snapshot cannot tell you whether you improved the system or just got lucky.

Related methods. You should be able to name Lean, which eliminates waste and non-value-adding steps, and Six Sigma, which reduces variation and defects. Both are widely used in theatre-list and pathway redesign.

A worked example. To improve DVT-prophylaxis prescription after hip-fracture admission, set an aim (chemical prophylaxis within twenty-four hours in 90% of eligible patients) and measure the baseline rate. Introduce a pre-printed admission order set and an electronic prompt as the change, then run three PDSA cycles refining the prompt and the timing, tracking the rate on a run chart. The link back to the error taxonomy is direct: you are building a defence (a forcing function) against the lapse of forgetting to prescribe.

QI or research. The boundary matters for ethics. QI is a local, practice-improvement activity using existing data to improve care for the population already in the system, and it does not usually require full research-ethics approval. It must still respect the principles set out in the Declaration of Helsinki: minimise burden, protect confidentiality, and seek oversight where patients are exposed to anything beyond standard care.

Choosing Wisely. The Choosing Wisely campaign sits in this space too. Reducing low-value care (tests and procedures that offer no benefit) is itself a patient-safety and quality intervention, because every unnecessary investigation carries its own risk of harm.

Accountability without blame. A safety culture that never holds anyone accountable is as broken as one that blames everyone. Just culture, developed by David Marx, is the balance: an organisation learns from system failure and manages individual accountability in a way that is fair and predictable.

Three behaviours, three responses. Its engine is the substitution test, and it sorts human behaviour into three categories, each met with a different response rather than a uniform punishment:

• Human error (an inadvertent slip or lapse) — the person is consoled and supported, and the system is fixed
• At-risk behaviour (a shortcut in which the person did not perceive the risk, or judged the risk acceptable for a small gain) — the person is coached, and the incentives that made the shortcut attractive are removed
• Reckless behaviour (conscious disregard of a substantial and unjustifiable risk) — punished

Behaviour, not outcome. The response follows the behaviour. A slip that happens to kill a patient is consoled and system-fixed, while a reckless act that happens to cause no harm is still addressed. This is what stops a just culture from collapsing back into an outcome-driven blame culture.

The duty of candour. Closely tied to just culture is the duty of candour, the ethical and, in many jurisdictions, legal obligation to be open and honest with a patient (and their family) when they have been harmed. The expectation is prompt, clear communication:

• Say what happened
• Apologise sincerely
• Explain what is known about why
• Describe the steps being taken to prevent recurrence
• Offer support and written follow-up

Across jurisdictions. The frameworks differ in detail but converge on the same professional principle: the patient has a right to know.

• United Kingdom — the Care Quality Commission's Regulation 20 (Duty of Candour) and the General Medical Council's Good Medical Practice ("be open and honest")
• Australia — the Australian Commission on Safety and Quality in Health Care Open Disclosure Framework
• United States — apology laws in many states, often "I'm sorry" laws protecting expressions of sympathy from being used as evidence of liability

The second victim. The clinician involved in a serious adverse event frequently suffers guilt, anxiety and loss of confidence, a recognised trauma in its own right. A just culture supports, rather than discards, the second victim. This is both humane and safety-promoting, because a clinician who fears blame hides the next error.

Why the law belongs here. The legal framework around consent sets the standard against which an error in communication (a failure to warn) is judged, and it has moved decisively toward the patient.

Bolam (1957). The traditional common-law test: a doctor was not negligent if they acted in accordance with a practice accepted as proper by a responsible body of medical opinion skilled in that art.

Bolitho (1997). Bolam was refined by Bolitho, which held that a court need not accept expert opinion merely because a body of doctors holds it. That opinion must be capable of withstanding logical analysis, so the court retains the final word on whether a practice is defensible.

Montgomery (2015). The decisive shift in consent was Montgomery v Lanarkshire Health Board (UK Supreme Court, 2015). The court replaced the Bolam approach to disclosure with a patient-centred test: a clinician must take reasonable steps to ensure the patient is aware of any material risks of treatment and of reasonable alternatives. The duty is to inform, not merely to answer questions.

When a risk is material. A risk is material if either:

• A reasonable person in the patient's position would be likely to attach significance to it, or
• The doctor is or should reasonably be aware that this particular patient would attach significance to it

A global direction. Montgomery aligned the United Kingdom with jurisdictions that had already reached the reasonable-patient standard, Australia's Rogers v Whitaker (1992) and the United States' Canterbury v Spence (1972), so the direction of travel is genuinely global.

The four principles. Underpinning all of this are the four principles of biomedical ethics from Beauchamp and Childress: autonomy, beneficence, non-maleficence and justice. Autonomy drives the consent and candour duties, non-maleficence ("first, do no harm") drives the error-prevention and QI machinery, and justice drives fair allocation and equal access.

When an examiner asks you to reason through an ethical dilemma, the expected structure is to name the principles in tension (often autonomy versus beneficence) and state how you would resolve them.

Communication tools. Communication failures are themselves a leading source of preventable harm, and two tools recur. ISBAR structures handover and escalation (see the mnemonic below), and the WHO Surgical Safety Checklist structures team communication at the three peri-operative pauses. Both convert high-risk, interruption-prone conversations into a predictable script, a defence against the lapse and the slip.

Three terms that are not interchangeable.

• Medical error is the process failure: the failure of a planned action to be completed as intended, or the use of a wrong plan to achieve an aim
• Adverse event is the outcome: an injury caused by medical management rather than the underlying disease. It is preventable when it results from an error
• Near miss (or close call) is an error that was caught before it reached the patient

Why the distinctions matter. They change the response. An error that causes no harm is still a signal that a defence failed, and it is the cheapest, safest event to learn from.

Person or system. The single most important mental shift in patient safety is James Reason's distinction between the person approach and the system approach. The person approach treats error as a moral failure of an individual (name, blame, shame, retrain), and it feels natural and satisfying. The system approach accepts that humans are fallible and that errors are to be expected, and redesigns the defences, tasks and organisation so that the inevitable error is either prevented or caught before it harms anyone.

Examiners are testing whether you have made this shift. Blaming the surgeon who marked the wrong leg fixes one surgeon; redesigning the site-marking and time-out process protects every future patient.

Latent conditions. This is why the discipline measures latent conditions as much as active failures. A tired registrar, an ambiguous consent form, a theatre list that runs without a pause: these are latent conditions that wait, silently, for an active failure (the slip) to line up with them.

To Err Is Human. The landmark Institute of Medicine report (1999) put patient harm on the map. It estimated that somewhere between 44,000 and 98,000 Americans were dying in hospital each year from preventable medical error, figures comparable to deaths from motor-vehicle trauma, and it was a deliberate call to move from blame to systems.

Three families. Examiners expect you to name and separate them. A slip is an action failure, usually during a familiar, automatic task, and a lapse is a memory failure during a routine task; in both the plan was correct. A mistake is a planning or knowledge failure: the plan itself was wrong.

The cognitive level. The control levels behind this come from Rasmussen's Skill–Rule–Knowledge (SRK) framework. Slips and lapses occur at the skill-based level (automatic behaviour); mistakes occur at the rule-based and knowledge-based levels (conscious problem-solving). This matters because the fixes differ, as the last column of the table shows.

Violations. Separate from errors are violations, deliberate deviations from a rule or protocol. They are failures of motivation rather than cognition, and they map onto just culture (see later):

• Routine — cutting a corner that has become the local norm
• Situational — forced by a poorly designed system
• Optimising — for personal convenience
• Reckless — consciously disregarding a substantial risk

The pattern to remember. Slips and lapses happen to the most careful, well-trained clinician and are expected in a fallible system, so the response is to redesign the environment. Mistakes and violations point more toward knowledge, judgement and accountability.

The model. Reason's Swiss-cheese model is the examiner's favourite diagram for accident causation. Picture several slices of Swiss cheese lined up in sequence, each a layer of defence: the organisation's safety policy, supervision, the team, a checklist, the surgeon's own vigilance. Each slice has holes, representing latent weaknesses and active failures.

How harm gets through. Most of the time a hole in one slice is blocked by the next slice. A patient is harmed only when the holes in every slice line up, momentarily, and the trajectory of an error passes all the way through.

Where the blame moves. The hole nearest the patient is the active failure, the surgeon's slip. It is the most visible, but also the smallest and most transient contributor. The holes further back are latent conditions (an under-staffed theatre, an ambiguous clinic letter, a culture that discourages speaking up, a training gap), and they sit dormant for months or years, waiting for the active failure.

A root-cause analysis that stops at the active failure has found the trigger and missed the cause.

Working backwards. Reason paired the model with a sequence of failure stages, so that an investigator works back from the active failure to the latent conditions that made it possible:

1. Organisational influences
2. Unsafe supervision
3. Preconditions for unsafe acts
4. The unsafe acts themselves

The practical message for a surgeon is plain: spend your energy strengthening the back slices (the system), because you cannot eliminate holes in the front slice (human fallibility).

Never events. Wrong-site, wrong-procedure and wrong-patient surgery are the prototypical preventable adverse events in orthopaedics. They are classified as never events, Serious Reportable Events (catalogued by bodies such as the US National Quality Forum) that should never occur if the right barriers are in place.

Why exhortation fails. They are largely skill-based slips set up by latent conditions, which makes them the textbook application of everything above. You do not fix them by exhorting surgeons to "be more careful"; you fix them with forcing functions and a standardised process.

The WHO Surgical Safety Checklist (2009) is the global standard, a short set of checks split into three pauses:

• Sign In, before anaesthesia — confirm identity, site, procedure, consent, allergy and airway risk
• Time Out, before skin incision — the whole team confirms patient, site and procedure aloud; antibiotic prophylaxis and imaging are in theatre
• Sign Out, before the team leaves — instrument and swab counts are correct, the specimen is labelled, and key concerns for recovery are stated

What the checklist achieved. In its landmark global study, in-hospital complications fell by about a third (36%) and deaths by close to a half after the checklist was introduced, with no change in case mix. That is an association in a before-and-after cohort rather than a randomised demonstration of cause, and the evidence card below sets out its limits.

Orthopaedic process controls. Specialty and national bodies layer these on top:

• The American Academy of Orthopaedic Surgeons' "Sign Your Site" campaign — the operating surgeon marks the site, with their initials, in the presence of the awake patient
• The AO Foundation — teaches site-marking and the formal pause
• The Joint Commission's Universal Protocol — bundles pre-procedure verification, site-marking and the time-out

The common thread is that the check is performed aloud, by the whole team, with the patient as a participant. It is a forcing function, not a formality.

This page covers wrong-site surgery only as the worked example of a defence failure. Three sibling pages carry the detail: Patient Safety - Wrong-Site Surgery Prevention for site marking and the operational anatomy of the time-out, Systems-Based Practice and Safety Culture for high-reliability organisations, reporting systems and the second victim, and Disclosure of Complications and Adverse Events for how the conversation with the patient is actually conducted.

Everything below condenses the topic for revision and viva practice — the high-yield points, the memory hooks, two worked vivas, and a one-screen cheat sheet.