Systems-Based Practice and Safety Culture

Systems-based practice is the recognition that patient care and clinical outcomes are produced by a system — people, processes, equipment, information and the environment working together — and that the doctor's job is to understand, coordinate and improve that system, not merely to perform a technical task. It is a named core competency of postgraduate medical training worldwide: in the United States it is one of the six ACGME/ABMS competencies, and the same idea appears in the General Medical Council's Good Medical Practice domain on safety and quality, and in the surgical-college curricula examined in FRACS, FRCS, ABOS and EBOT.

The closely related concept is safety culture: the shared values, attitudes, perceptions and behaviours that determine an organisation's commitment to patient safety. A positive safety culture has four hallmarks examiners look for — people feel able to report errors and near misses without fear, leadership treats safety as a priority over throughput and rank, the organisation learns from events rather than punishing them, and the workforce is resilient, able to detect and recover from threats before they reach the patient.

Why this matters in orthopaedics specifically: our work is high-volume, team-dependent, device- and imaging-intensive, and frequently performed under time pressure in theatres where wrong-site surgery, retained implants, positioning injury, venous thromboembolism and compartment syndrome are constant threats. Wrong-site surgery and wrong-level spine surgery remain among the most damaging and most preventable never-events, and they are almost never caused by a single careless individual — they are produced by latent system weaknesses that a good safety culture would have caught.

The pivotal insight, and the one an examiner most wants to hear, is the shift from the person approach to the system approach. James Reason framed it: we cannot change the human condition, but we can change the conditions under which humans work. The mature clinician asks not "who is to blame?" but "what in the system allowed this to happen, and how do we make it harder to fail next time?"

When a candidate is asked to analyse an adverse event, the examiner is listening for a structured model applied in the correct order. Three models together give a complete answer: Reason explains how the defences failed, Vincent explains which factors contributed, and Donabedian frames where in the system to intervene.

Reason's Swiss-cheese model

Reason distinguishes latent conditions (decisions made far from the frontline — staffing levels, roster design, equipment procurement, training budgets, production pressure) from active failures (the slips, lapses, mistakes and violations committed by the person at the sharp end at the moment of harm). Between the latent conditions and the patient sit multiple layers of defence — the surgical safety checklist, the consent process, the site-marking policy, the WHO sign-out. Each defence has holes (it is imperfectly applied, circumvented, or absent). Harm occurs when the holes in several layers momentarily line up and a trajectory of accident opportunity passes straight through.

The practical point is that the people at the sharp end are usually the inheritors of system defects, not the originators. The Swiss-cheese model also classifies the unsafe acts at the sharp end, which is useful in an exam answer:

Vincent's framework of contributory factors (the London Protocol)

Reason tells you the mechanism; Vincent tells you where to look. The contributory-factor framework sets out seven domains to walk through when investigating an event. This is the structure to use in any "how would you investigate this incident?" viva.

Donabedian's structure–process–outcome framework

For designing a quality-improvement intervention, Donabedian gives the cleanest map: change the structure (equipment, staffing, electronic records), improve the process (checklists, briefings, ISBAR handover, care pathways), and measure the outcome (complication, readmission, mortality, patient-reported outcome). Examiners reward candidates who can name which level an intervention targets — a checklist is a process change supported by structure (time and team presence) and measured by outcome.

A high-reliability organisation (HRO) is one that operates in conditions of high hazard and complexity yet experiences far fewer than the expected number of catastrophic events. The canonical examples come from outside medicine — nuclear aircraft carriers, air-traffic control, nuclear power generation, and commercial aviation — and orthopaedic safety culture borrows directly from them: checklists, crew-resource management, briefings, and stop-the-line authority all migrated from aviation into the operating theatre.

Weick and Sutcliffe distilled the operating habits of these organisations into five principles of collective mindfulness. Together they are the single most asked-about HRO content in a professionalism viva:

The throughline is mindfulness: a constant, active attention to the possibility of failure rather than complacent confidence. A theatre team that preoccupies itself with failure catches the wrong-side site marking at the time-out; a team that simplifies ("this is just a routine knee scope") does not.

The hardest judgement in any adverse event is deciding how much of the harm belongs to the system and how much to the individual. Get this wrong in either direction and the organisation becomes unsafe: a pure blame culture drives error underground and guarantees repetition, while a pure no-blame culture erodes accountability and tolerates recklessness. Just culture is the framework that holds these in balance.

David Marx's just-culture model sorts every human act into one of three categories, each with a matching organisational response. The response — not the outcome — is what matters: a slip that happens to cause harm and a slip that happens to cause none are the same act and earn the same response.

The practical discriminator for the clinician is choice and awareness of risk: did the person choose the action, and did they know (or should they have known) it was risky? Console the slip, coach the drift, act on the conscious disregard — but in every case, also investigate and fix the system, because even reckless acts occur in a context the organisation shaped.

A safety culture is only as good as its information. The organisation cannot learn from events it never hears about, so a reporting system — voluntary, non-punitive, easy to use, and feeding back changes to the people who reported — is the engine of improvement. Three categories of event sit on a reporting pyramid, and the further down the pyramid you look, the richer the learning and the more abundant the data:

• Harm events — the patient was actually injured. Rare, severe, highly visible, but the least useful for prevention because the contributing failures have already converged.
• No-harm / near-miss events — the defences failed but, by luck, no patient was harmed. Far more common and far more instructive, because they expose the holes in the Swiss cheese without the bias of a bad outcome.
• System weaknesses and unsafe conditions — latent hazards spotted before any failure occurs (a tray repeatedly missing an instrument, a template that does not fit). The most abundant and most under-reported source of all.

Effective reporting shares the features that make aviation and nuclear systems learn: non-punitive protection for the reporter, independence from line management, ease of submission, timely analysis, and visible feedback that closes the loop. Without feedback, reporting collapses — staff stop filing reports that disappear into a void. Investigation itself is best done with a structured method (such as root-cause analysis or its successor, the systems-analysis approach) that builds a timeline, maps contributory factors against Vincent's domains, and produces ranked, owned, time-bound actions — never a search for a single "root" person to blame.

When a patient is harmed, the patient and their family are the first victims, the obvious ones. The clinician involved becomes the second victim — a term coined by Albert Wu for the healthcare provider who is traumatised by an adverse event or patient safety incident, whether or not they were personally at fault. This is not a marginal phenomenon: across a career, most surgeons will be involved in at least one serious event, and a substantial proportion experience lasting guilt, self-doubt, anxiety, sleep disturbance, loss of confidence, and in some cases post-traumatic stress, burnout, or departure from practice.

Scott and colleagues described a characteristic six-stage recovery trajectory that the second victim travels, which is the structure to use if asked how you would support a colleague after an event:

What the second victim needs is well defined and inexpensive: immediate psychological first aid from a trusted peer, a just-culture process that does not equate harm with blame, time and space away from the triggering work if needed, and access to professional occupational-health or counselling support. Critically, supporting the second victim does not conflict with the duty of candour owed to the patient — a department can be open and honest with the patient and family and compassionate toward the involved clinician at the same time. Failing the second victim has a system cost: traumatised clinicians make more errors, and the loss of institutional memory is itself a safety hazard.

Safety culture does not float free of the law and the professional codes — it sits inside them. The examiner wants the candidate to place the right instrument against the right question: a consent problem points to Montgomery, a negligence question to Bolam and Bolitho, a research-ethics question to Helsinki, a professional-conduct question to the relevant medical council's code. These vary by jurisdiction, and the global candidate should be able to state the UK, US and internationally shared instruments side by side.

A few points the examiner specifically probes:

• Montgomery v Lanarkshire (2015) replaced the old Bolam-based test for consent with a materiality test. A doctor must take reasonable steps to ensure the patient is aware of any material risks of all reasonably available treatments and of non-treatment. A risk is material when a reasonable person in the patient's position would be likely to attach significance to it — judged through the patient's prism, not the doctor's. This is a consent standard, not a negligence standard for treatment.
• Bolam (1957) remains the benchmark for the standard of clinical care: a doctor is not negligent if acting in accordance with a practice accepted as proper by a responsible body of relevant medical opinion. Bolitho (1997) added that the court is the final arbiter — it may reject a body of opinion that is not capable of withstanding logical analysis, ending the risk of "doctor goes into the witness box, doctor wins."
• The duty of candour is both statutory and professional: in the UK, Regulation 20 of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014 imposes a statutory duty on providers to be open with patients about notifiable safety incidents, and the GMC imposes a parallel professional duty on the individual doctor. Saying sorry is not an admission of liability — a common and important misconception.
• The Declaration of Helsinki (World Medical Association, 1964, periodically revised) is the cornerstone ethical document for research involving human subjects; it underpins research-ethics committee review, informed consent for research, and protection of vulnerable groups.
• GMC Good Medical Practice sets the professional duties that frame every safety decision in the UK — the domains of knowledge/skills and performance, safety and quality, communication/partnership and teamwork, and maintaining trust.
• AAOS Standards of Professionalism and the AAOS Choosing Wisely list carry the same spirit into orthopaedic practice in the US: professional conduct, honest communication, and the avoidance of low-value care.
• Choosing Wisely (ABIM Foundation) is the international campaign against overuse; its orthopaedic content asks surgeons and patients to question tests and procedures that offer little benefit, anchoring systems-based practice in value, not volume.

Culture is abstract; the tools below are how a team operationalises it. Each one addresses a specific failure point that an adverse-event review would otherwise rediscover after the harm.

Structured handover — ISBAR. Communication failures at handover are among the most consistently identified contributors to harm. ISBAR imposes a shared mental frame so the receiver gets the same picture the sender has, in seconds:

The WHO Surgical Safety Checklist. The single most evidence-supported theatre safety tool. It runs in three structured pauses that each close a known Swiss-cheese hole — wrong patient/wrong procedure (sign in), wrong site/wrong team planning (time out), and missed counts/missed equipment/missed follow-up (sign out):

Closed-loop communication and read-back. In a crisis, instructions are spoken and read back ("giving 1 milligram of adrenaline"), and the giver confirms receipt — eliminating the silent-assumption failures that cause drug and dose errors.

Briefings, debriefs and huddles. A short team briefing before the list sets the plan and surfaces concerns; a debrief at the end captures what went wrong and what to change tomorrow. The two-challenge rule and CUS words ("I am Concerned, Uncomfortable, this is a Safety issue") give a junior a scripted, escalating language to challenge a senior without insubordination.

Stop-the-line authority. The formal licence for any team member — nurse, anaesthetist, scrub tech, the most junior trainee — to halt the procedure when they perceive a threat to safety, and the corresponding obligation of the senior to treat a stop call with respect, not annoyance. This is deference to expertise made operational.

The evidence base for systems-based practice and safety culture rests on a small number of landmark studies, conceptual papers and legal authorities. The headline figure examiners expect is the effect of the WHO Surgical Safety Checklist: across eight hospitals in eight countries it cut complications from 11.0% to 7.0% — a fall of roughly 36%fewer complications — and in-hospital death from 1.5% to 0.8%, a relative reduction of about 47%fewer deaths. The conceptual foundations come from Reason on human error, Wu and Scott on the second victim, and a set of named legal and professional standards that frame safe practice globally.

Everything below condenses systems-based practice and safety culture for revision and viva practice — the high-yield points, the memory hooks, three worked vivas, and a one-screen cheat sheet.