Incident learning in radiation oncology: A review

Transcription

1 Incident learning in radiation oncology: A review Eric C. Ford a) Department of Radiation Oncology, University of Washington, Seattle, WA 98195, USA Suzanne B. Evans Department of Radiation Oncology, Yale University, New Haven, CT 06510, USA (Received 5 July 2017; revised 17 December 2017; accepted for publication 3 January 2018; published 11 April 2018) Incident learning is a key component for maintaining safety and quality in healthcare. Its use is well established and supported by professional society recommendations, regulations and accreditation, and objective evidence. There is an active interest in incident learning systems (ILS) in radiation oncology, with over 40 publications since This article is intended as a comprehensive topic review of ILS in radiation oncology, including history and summary of existing literature, nomenclature and categorization schemas, operational aspects of ILS at the institutional level including event handling and root cause analysis, and national and international ILS for shared learning. Core principles of patient safety in the context of ILS are discussed, including the systems view of error, culture of safety, and contributing factors such as cognitive bias. Finally, the topics of medical error disclosure and second victim syndrome are discussed. In spite of the rapid progress and understanding of ILS, challenges remain in applying ILS to the radiation oncology context. This comprehensive review may serve as a springboard for further work American Association of Physicists in Medicine [ Key words: incident learning systems, patient safety, quality TABLE OF CONTENTS 1. INTRODUCTION* 1.A Error and outcomes 1.B Recommendations for incident learning and current practice 1.C Definitions and terms 1.D Summary of incident learning studies in radiation oncology 1.E National and international voluntary ILS 2. INSTITUTIONAL INCIDENT LEARNING SYSTEMS 2.A Structure of a departmental incident learning system 2.B Identifying events for inclusion in the ILS 2.C Performing a root-cause analysis 2.D Developing and implementing action plans or process improvements 2.E Attitudes and barriers toward ILS participation 2.F Importance of feedback 3. PRACTICAL ADVICE FOR DEVELOPING AND MAINTAINING AN ILS PROGRAM 4. A SYSTEMS VIEW OF ERROR 4.A Safety culture and just culture 4.B Teamwork and communications 4.C Cognitive bias 4.D Addressing cognitive bias 5. RESPONDING TO INCIDENTS OF HARM 5.A Medical error disclosure 5.B The patient experience 5.C The impact of incidents on the professional 6. CONCLUSIONS *Complete, expanded version of the introduction available in online supplementary materials. 1. INTRODUCTION In January of 2010, a series of articles appeared in the New York Times highlighting recent radiation therapy accidents, 1 4 including the lethal overdose of Scott Jerome-Parks, a 41-yearold man in New York City undergoing radiation therapy for oropharyngeal cancer with curative intent. This was not the first popular media report of a radiation therapy accident. In the mid-1980s, a series of incidents was reported from Therac- 25 units with overdoses of over 160 Gy and reports of other incidents appeared in the popular press. 5 However, the highprofile front-page coverage served to galvanize the radiation oncology community, similar to the way in which the 2000 report To Err is Human 6 from the Institute of Medicine (IOM) was a wake-up call for much of medicine. Thus, in early 2010, as the radiation oncology community was galvanized into action, attention quickly focused on incident learning as a key tool to ensure the safety and quality of care. 7 In this review, we present an overview of incident learning from the radiation oncology perspective, including the key principles that underlie effective incident learning and the design and operations of institutional, national, and international incident learning systems. We also present a comprehensive survey of the history of incident learning in the radiation oncology context including studies published to date. This review is not intended to summarize the experience or literature on incident learning in healthcare more generally, which is vast and growing, but instead aims to be a practical e100 Med. Phys. 45 (5), May /2018/45(5)/e100/ American Association of Physicists in Medicine e100

2 e101 Ford and Evans: Incident learning in radiation oncology e101 guide for radiation oncology physicists, physicians, dosimetrists, therapists, nurses, administrators, and other professionals. An expanded version of this introduction section with further information and background is available as an online supplement. 1.A. Error and outcomes It is useful to consider what the evidence is with respect to the impact of error. Clearly, ethics prevents the development of randomized trials to answer this question; however, there is clinical trial data to guide us in this arena. Clinical trials have documented the occurrence of protocol variations. These protocol variations often involve prescription deviations as well as targeting deviations. The profound impact of such deviations on survival, locoregional failure, and toxicity has been shown in multiple randomized trials 8 12 as well as meta-analyses (Table S1). This evidence supports the need to aim for zero error-associated harm in radiotherapy. 1.B. Recommendations for incident learning and current practice While the objective data on the impact of ILS in healthcare are relatively weak, some data do exist. The large hospital survey data from the Agency for Healthcare Research and Quality (AHRQ) in the US indicate that a higher number of incident reports are associated with a lower rate of negative patient safety indicators (indicators developed to detect adverse events). 13 Data also exist that staff members working in an ILS environment perceive positive effects which they attribute to the ILS. For example, the qualitative observational study of Anderson et al 14 found that ILS was viewed by staff as having a positive effect on patient safety. In radiation oncology, the use of ILS has been linked with the changes in safety culture As the field matures, more outcomes-based studies will hopefully become available. Incident learning is called for by many healthcare professional societies, regulatory agencies, and accrediting bodies including the World Health Organization (WHO), 18,19 Accreditation Canada, 20 the National Patient Safety Agency in the UK, 21 and the Joint Commission (TJC) for hospital accreditation in the US 22 which supports a non-punitive approach to reporting so that the organization can report to learn. Recommendations have also appeared specifically for radiotherapy. This includes several major international reports on patient safety, all of which recommend incident learning: WHO s Radiotherapy Risk Profile, 19 Toward Safer Radiotherapy, 23 and ICRP Report No Incident learning has also been recommended by radiation oncology professional societies like American Society for Radiation Oncology (ASTRO) in the US 25 and is one of the standards in the ASTRO practice accreditation program. 26 In the US, incident learning may also be incentivized by newer reimbursement models that include quality metrics (e.g., the Merit-based Incentive Payment System or Advanced Alternative Payment Model programs under the Medicare Access and CHIP Reauthorization Act 27 ). Additionally, regulatory bodies, such as state departments of health, the Joint Commission, or the Nuclear Regulatory Commission, require reporting of incidents of a certain severity. While incident learning certainly includes events of patient harm or large-dose deviations, such events are relatively rare in any given clinic. It is, therefore, important to expand the scope of ILS beyond incidents that reach the patient to include nearmiss events and other safety-related reports. These events represent free lessons 28,29 which should not be ignored. The reports cited above explicitly call for the inclusion of near miss and other safety-related events in the ILS. The requirements and recommendations for incident learning could, in principle, be met through an ILS system that is hospital wide or organization wide. A better practice, however, is to establish an incident learning system that is specific to the clinical unit. This model allows for the use of domain expertise, efficient follow-up, and the fostering of communication and teamwork through ILS processes. A recent meta-analysis suggested that ILS is most effective when there is a sense of ownership of the ILS program by the clinical unit, 30 as this is best suited to serve the needs of that unit. Although ample data and recommendations to support incident learning systems exist, recent data suggest that many professionals in radiation oncology remain unaware of these systems or do not use them These data suggest that there is a significant room for improving the utilization of incident learning systems in the field. One recent study proposes a patient safety curriculum for learners, a major part of which is incident learning. 34 Efforts like this may promote awareness and engagement with ILS. 1.C. Definitions and terms There are numerous terms used in incident learning. Two key terms are the following: Incident : An unwanted or unexpected change from normal system behavior which has the potential to cause an adverse effect to persons or equipment. AHRQ defines the term more specifically as patient safety events that reached the patient, whether or not there was harm involved. 35 Near miss : An event or situation that could have resulted in an accident, injury, or illness but did not either by chance or through timely intervention. Although near miss is a commonly used term, some people are averse to it. Other equivalent terms are close call, near hit, good catch, or even near-error. Note that these definitions are taken from AHRQ, National Patient Safety Foundation, and the IAEA Safety glossary of 2007 and also appear in the ILS consensus document from the American Association of Physicists in Medicine, AAPM. 36 In this article, we use incident in this more specific sense of an event that reached the patient

3 e102 Ford and Evans: Incident learning in radiation oncology e102 although it should be clear that incident learning also includes near misses, not reaching the patient. The terms incident and near miss do not cleanly describe all the events encountered in radiation oncology, and it is sometimes difficult to categorize events by type. Table I provides one classification schema which is consistent with the current version of RO-ILS â. Further information and a figure can be found in the online supplement. Given the wide variety of events in Table I, it would be valuable to be able to prioritize them in some meaningful way (e.g., a potentially serious near miss event may be more of a priority than an low-severity incident). Several schemas have appeared in the literature (e.g., Macklis et al., 37 Clark et al., 38 Arnold et al., 28 and Nyflot et al. 39 ). There is, however, no consensus yet on how events should be prioritized. One potentially productive approach is to prioritize events in terms of risk, similar to the approach of AAPM TG D. Summary of incident learning studies in radiation oncology Published studies of incident reports in radiation oncology have appeared in the literature and sometimes the popular press. These include major accidents and miscalibrations. 41,42 In the late 1990s, reports began to appear of institutional experience with incident learning. 37,43 45 This literature has continued to grow, and as of 2017, there are over 50 studies in the radiation oncology literature about ILS or using ILS data ,28,29,31,32,34,37 39,43 85 Readers are encouraged to review the online supplement, which provides a list and summary of all incident learning studies published up to the end of 2017 and a discussion of these studies. This includes Table S3 (reports from institutional ILS systems), Table S4 (other ILS-related studies), and Table S5 (resources: incident reports for further study). Meta-analysis reports of RT incidents have also appeared drawn from published reports and other sources including a 2009 report from WHO 86 and more recently a study from Coeytaux et al. 87 Of particular note, some studies include not only actual incidents (i.e., events which reached a patient) but also near miss events (i.e., events that were identified before affecting a patient). The earliest study in the RO literature to explicitly make this distinction appears to be the 2002 study by Holmberg and McClean. 62 In 2010, other reports began to appear which include experience with high-volume incident learning focusing on near misses. 28,29,38 Near miss events are considered important since they offer free lessons, 28,29 that is, learning about quality without patient harm, as appreciated in other areas of healthcare. 88 All of these studies report higher event rates >10% per patient (cf. Table S3). This is due to the inclusion of near miss events. In the data from Holmberg and McClean, 62 for example, there were nearly 14 near miss events for every actual incident. 1.E. National and international voluntary ILS Although the foundation of incident learning is the process that occurs within an institution (i.e., the identification of a safety-critical problem), there is also a value in shared incident learning. Failure patterns can be uncovered that might not have otherwise been apparent in a single given clinic, issues can be identified in common hardware or software, and solutions for process improvement can be shared. A shared ILS also provides for shared learning about the ILS process itself. One of the earliest attempts at shared incident learning in radiation oncology was the Radiation Oncology Safety Information System (ROSIS) started in 2001 with funding from the European Society for Radiotherapy and Oncology (ESTRO). The 2010 report of Cunningham et al. describes the system. In December 2012, the IAEA launched the shared learning Safety in Radiation Oncology (SAFRON) Reporting and Learning System developed by some of the same people involved in ROSIS. Gilley and Holmberg 89 reported that as of 2015, SAFRON had 1238 reports from 42 participating centers. This included the ROSIS data prior to 2014, which was incorporated in the system. TABLE I. Event types in the radiation oncology context. Type Therapeutic radiation incident Other safety incident Near miss Unsafe condition Operational/process improvement Description An event involving the delivery of some part of a therapeutic dose. Dose delivered not as intended. With or without harm. Examples: improper targeting of a lung lesion results in delivery of dose to a benign nodule; overdose due to error in machine commissioning; one fraction of a 25 fraction course delivered at the wrong SSD resulting in a 2 Gy discrepancy between planned and delivered doses. An event that directly affects a patient but not involving therapeutic radiation dose. With or without harm. Examples: Fall, gantry collision with patient. An event that relates to a specific patient, but did not reach or affect the patient. Example: The absence of kidney blocking on a spine field caught by pretreatment imaging and corrected before treatment delivery. A condition that increases the probability of a safety event. Not related to a specific patient. Example: The absence of a policy related to allowed IGRT alignment tolerances for SBRT resulting in confusion and uncertainty among staff. An event that is not directly related to safety but contributes to inefficiency or confusion. Example: Physician not alerted that the patient is ready to be seen, resulting in delay for the patient and those that follow.

4 e103 Ford and Evans: Incident learning in radiation oncology e103 At present, various national ILS programs for radiotherapy are in use. These include the National Reporting and Learning System (NRLS) administered by the National Health Service (NHS) in the United Kingdom (UK). Guidance for reporting radiotherapy errors and near misses 90 to this system comes from the National Patient Safety Agency in the UK, which based its guidance on the Toward Safer Radiotherapy 23 report of Reports are available on an archived website. 91 Canada s National System for Incident Reporting in Radiation Treatment (NSIR-RT) is still early in its operations; one report describing the system has been published. 92 In the United States, voluntary incident learning relies on a system of Patient Safety Organizations (PSOs). 93 This program was authorized by an act of Congress, the Patient Safety Quality Improvement Act (PSQIA) of 2005, enacted partly in response to the Institute of Medicine report To Err is Human. 94 As of 2017, there are 85 listed PSOs. In 2014, RO-ILS â : Radiation Oncology Incident Learning System was launched by ASTRO with the support of the AAPM. This system operates under the auspices of the Clarity Group PSO and is provided free to participants. Participation in this system has been steadily increasing, with nearly 2000 reports at the 2016 published summary. 95 Publicly available quarterly RO-ILS reports detail events collected and causal factors. 95 Another PSO system specific to radiation oncology is the CARS-PSO administered by the Center for Assessment of Radiological Sciences, 96 though to date, there is no published literature on this system. One important consideration in national and international systems is the underlying structure and data elements. In 2012, the AAPM Work Group on Prevention of Errors published a report on the structure of incident learning systems for radiation oncology which included recommendations on nomenclature, data elements for collection, data structures, and other aspects on incident learning. 36 The AAPM consensus report formed the basis for RO-ILS in the US 97 and other systems as well (e.g., CARS-PSO, 96 SAFRON from IAEA 98 and NSIR-RT in Canada 92 ). 2. INSTITUTIONAL INCIDENT LEARNING SYSTEMS This section provides practical guidance for developing and managing an ILS within and institution. This guidance is drawn from literature and experience as cited. Other educational resources on ILS are available such as the recently released 12-module e-learning course on patient safety from the IAEA, 99 seven modules of which are related specifically to ILS. 2.A. Structure of a departmental incident learning system Figure 1 shows a diagram of the operation of an example institutional ILS. Further information on the structure and operation of institutional ILS can be found in an early report from Cooke et al. at the University of Calgary, 100 the AAPM consensus document on ILS, 36 and other institutional studies cited in the online supplement Tables S3 and S4. Chapter 3 of ASTRO s Safety is No Accident report 25 also provides some practical information for the operation of a departmental ILS programs. As shown in Fig. 1, the incident learning process starts with the report on an event. These reports are often from a frontline provider. There is then some mechanism to triage FIG. 1. Schematic representation of the operation of an institutional incident learning system.

5 e104 Ford and Evans: Incident learning in radiation oncology e104 the event and decide how it is managed. Major events must be handled expediently and thoroughly and may call for a full root-cause analysis (RCA). Other events may be handled differently and may be presented to a Quality Assurance (QA) or Quality Improvement (QI) committee or the equivalent that meets on some regular basis (e.g., weekly or monthly). Chapter 3 of the Safety is No Accident report 25 from ASTRO has specific mention of this QA committee and defines its role. Prior to presentation at the QA committee meeting, it is often useful to have an initial investigation by one or more staff, so that the case can be handled and presented efficiently at the QA committee meeting. The QA committee may then decide what further actions are needed. These might include further investigation to understand the care delivery problems and contributing factors at issue. For the most serious events, this might be a full RCA. In many cases, such an effort can and should extend outside the clinical unit itself. There are often professionals in the healthcare enterprise as a whole with specialized skills in RCA who can be helpful. After the investigation is complete, there is the event handling step in Fig. 1. This might include an action plan (cf. London protocol 101 ), or it might simply be the recording of the event for later tracking of trends or other actions. In the quality literature, there is a distinction made between corrective actions and preventative actions, although the importance of this distinction in practice is debatable. A corrective action eliminates the cause of nonconformities to prevent recurrence, whereas a preventive action determines and eliminates the causes of potential nonconformities to prevent occurrence. 102 To avoid this semantic distinction, these authors prefer the term action plan. Some events might be appropriate for inclusion at a departmental quality meeting, similar to a morbidity and a mortality meeting. This may represent an important component of the learning aspect for staff in the clinic. Finally, there should be a feedback loop to the clinical program as a result of the event report. Feedback is important as suggested in the study of Burlison et al. 103 Feedback might include follow-up with the initial reporter(s) of the event, feedback and recommendations to leaders and others in the various professional groups, and the further development and implementation of action plans. People reporting into the ILS may have concerns about being blamed for reporting or about what might happen if a report is filed against them. To address this, staff should be trained on how to report and the use of language and terms that avoid blame and unconstructive suggestions. This is discussed further in Sections 2.E and 4.A. Figure 1 is intended as an example only. The exact structure of ILS programs may vary by institution. For example, the QA committee may serve more of an advisory role and may not review and categorize each event, or the QA committee may directly handle all aspects of event analysis from the time of the initial report, or there may be no QA committee at all but rather a single person who serves this role, although this is not recommended (cf.25). In spite of the potential variability, several fundamental aspects are present in all systems. First, the ILS consists of much more than simply logging an incident report. It includes the entire learning process (hence the reference in this document to incident learning as opposed to incident reporting ). Second, the ILS is not the domain of any one professional group. In a healthy ILS program, all professional groups are fully engaged in the process, and broad participation has been proposed as a metric of the health of the ILS system. 39 Third, the ILS process is a continuous one of the study and improvement. The process is never complete. This is the plan-do-study-act (PDSA) cycle of W. Edwards Deming in action. 104 Several issues need to be considered in the structure and management of the ILS system as shown Fig. 1. There is very little literature to suggest what should be the best practices, so we present this as a series of questions for consideration. First, who is responsible for the triage and management of events? If this task is assigned to a person with a supervisory role, will interactions with a supervisor limit the willingness of some people to engage? Second, are all events handled through the ILS structure and QA committee or are some events suitable to mark as not a QA committee issue (i.e., handle the event directly through discussion within a professional group)? If events are handled outside the QA committee, should they still be recorded in the ILS for tracking? Finally, is anonymous reporting allowed? In theory, anonymous reporting could remove the threat of repercussions from reporting. However, if anonymous reporting is allowed, how will follow-up occur after a report is filed? 2.B. Identifying events for inclusion in the ILS There is a strong acknowledgment that errors should be reported and dealt with (e.g., 97% of physicians and staff agreeing with this in one survey 77 ). There are, however, legitimate questions as to what qualifies as reportable to a voluntary ILS. This is a question that is considered by each person logging a report and is also a consideration in the design and implementation of an ILS (cf. Fig. 1). Certainly, incidents that reach the patient should be included, but if the reporting stops there, there will not be many incidents to consider (cf. Table S3 where there are on average 53 events/year or 0.07 events per patient in systems that are restricted to actual incidents). There quickly becomes a larger volume of data when other types of events are included (i.e., near miss, unsafe conditions, and operational/process improvements as outlined in Table I). When such events are included, the event rates can increase to more than one event per patient in some studies (cf. Table S3). The studies which include near miss events report an average of 466 events/year. Even with this inclusion of near miss events, however, there is underreporting of events. Data from surveys suggest that perhaps only 1/10 th of incidents being experienced are reported. 52 Reporting patterns are strongly influenced by attitudes toward the nature of an event. An individual may perceive an event as having been averted only by chance alone, a vulnerable near miss, while others may believe that an event was

6 e105 Ford and Evans: Incident learning in radiation oncology e105 averted because of some intrinsic skill or positive attribute, (i.e. a resilient...). These views impact behavior similar to the data from Tinsley, who studied the impact of near misses on hurricane preparedness and willingness to buy flood insurance. 105,106 This data revealed disparate responses depending on whether an event was seen as a resilient near miss or a vulnerable near miss. Those who viewed the event as a vulnerable near miss were less likely to engage in risky behavior. To understand how this might translate specifically for a radiation oncology, consider the following examples of events that might be entered in an ILS: Problems identified by routine quality control measures. An example is an incorrect dose calculation which is identified on routine physics plan review. This event might be included in the ILS if it is seen as a vulnerable near miss (likely to occur again) while if it is seen as a resilient near miss (detected by the normal operations of a system), it might not be included. It is important to be cognizant of biases in making these judgments. In this example, physics plan and chart review may not be as resilient as thought given data that indicates that it identifies only half of the errors that it potentially could. 61 Operational issues like scheduling problems. An example might be a patient scheduled for the first treatment on a machine which cannot accommodate her. FIG. 2. A preoccupation with failure. A demonstration of the concept of vulnerable near misses and resilient near misses, from AHRQ. Reprinted with permission. 102 Although this may not seem to be directly safety-related at first blush, it could lead to rushing and time pressure, which is often a contributing factor in more serious incidents. Issues of medical decision-making. This is an area of ambiguity as to what might be an error vs genuine uncertainty about the best choice. Consider a case where a physician elects not to irradiate a nodal region and the patient later recurs there. Is this an error? Should it be reported to an ILS? It may be difficult to judge in this example. There may be a lack of clinical guidelines dictating which regions should be included in which patients. Every day clinicians make judgments that turn out not to be correct. This is a natural consequence of operating in an environment of uncertainty and is professionally and ethically acceptable. Equipment-related issues. For example, a treatment unit being down for service or an information technology (IT)-related outage. While these might not be errors and might be more appropriately tracked through a separate system, equipment problems can have an impact on safety either directly or through rushing and time pressure, which can contribute to other errors. 107 Ultimately, in the opinion of these authors, one should ask the question Might greater knowledge about this event help improve quality, safety, efficiency, or workflow? If the answer is yes, then reporting such events should strongly be encouraged. However, each institution will have a limited number of resources with which to address events, and threshold for reporting will in part be determined by the ability of the institution to respond to a given number of events. Depending on how the threshold is defined, the number of reports can grow quite large. This is not unique to radiation oncology and is seen in other areas of healthcare. Hospital nurses, for example, encounter 8.4 work systems failures per 8-h shift in one study 108 and one problem every 1.6 h in another. 109 Several studies outlined in Table S3 have vigorously pursued low-threshold voluntary reporting and have achieved reporting rates of over one event per patient. 29,39,59 Indeed, some programs state an objective of gathering at least one report per patient, which has proven sustainable and beneficial to safety improvement. Although there is no one right answer for setting the reporting threshold for every institution, an institutional ILS should be expected to include near miss events and other safety-related reports at some level. Such reports are important because they offer free lessons, 28,29,88 the reporting of which correlates with lower rates of patient safety events in the large data series from AHRQ Hospital Surveys. 13 Although this might at first seem counterintuitive that more reports could be correlated with safer operations, more reports lead to resolutions of latent errors, improved communication, and a stronger safety culture which leads to safer care. The ASTRO Safety is No Accident report also recommends that near miss events be included in an ILS 25 : Employees should be encouraged to report both [incidents]

7 e106 Ford and Evans: Incident learning in radiation oncology e106 and near misses ([incidents] that almost happen).... The study of near misses is powerful in identifying problems with work processes that can lead to an error allowing for preventative/prospective error prevention. The reporting of nearmisses should be met positively and not with fear of punitive action. Near misses should be addressed with a similar vigor as that applied to [incidents]. The Joint Commission (TJC) in the US also calls for the inclusion of such events (LD ): The scope of the safety program includes the full range of safety issues, from potential or no-harm errors [sometimes referred to as near misses, close calls, or good catches] to hazardous conditions and sentinel events. It is worth noting that although most reports come into an ILS from staff entering event reports, there are other ways of identifying safety-related issues for inclusion in an ILS. One approach is regular safety-rounds, as mentioned in Chapter 3 of the ASTRO Safety is No Accident report. 25 These are personal min interviews by leadership with front-line staff at the worksite that focus on safety-related issues. Based on these discussions, the staff or other designee might be asked to file an event report if the issues are to be handled through the ILS system. Another way to gather safety-related issues is through prospective risk assessment using Failure Mode and Effects Analysis (FMEA) as described in AAPM Task Group The failure modes gathered in this way can be entered and analyzed in the ILS as unsafe conditions or process improvements. Risk assessment via FMEA is complementary to the use of ILS. One study 82 reported a set of safety issues that were identified only by FMEA but not by ILS (57% of the total) and noted that another set identified only through ILS and not FMEA (17% of the total). This illustrates the value of combining FMEA risk assessment with ILS. 2.C. Performing a root-cause analysis Although not all events will require an in-depth root-cause analysis (RCA), it is one of the key tools for determining the underlying causal factors that drive error. A useful template for conducting an RCA is the London Protocol from the National Patient Safety Agency and Imperial College London in the UK. Published as a 2000 article, 101 it is updated and available as a concise report with templates and flowcharts. 110 Other approaches are available which are broadly similar such as the RCA toolkit from the Veterans Administration (VA) Center for Patient Safety. 111 The first task is to determine who will be responsible for the RCA. The RCA is the best conducted by a cross-professional team. The team may include individuals who were involved in the event itself. This has the advantage of making the task proceed more quickly. More often, though, the RCA team is composed of individuals not directly involved in the event to provide an objective outside perspective. It is often useful to assign a leader for the RCA group who coordinates the analysis and records information. It is often helpful that this not be a person in a perceived position of power, for example, a lead decision-maker or manager with human resources responsibilities. The first aim of an RCA is to determine the Care Delivery Problems (CDP) involved in the event, that is, what happened. One of the most common pitfalls in RCA is the tendency to move too quickly to discussions of what should have happened or how things could be done better next time. While these questions are important, they should only be addressed at the end of the RCA process. The main goal of the RCA at this stage is to uncover what happened. It is often helpful to outline a detailed incident chronology of the event. A great deal of information can be gained from the medical record, but in most cases, it will also be necessary to discuss the event in detail with the staff involved. Depending on the event, it may be useful to do this by assembling the people involved as group and discussing the event in a cooperative fashion. This is the best done in private, away from other, noninvolved individuals. Although the group dynamics of such a discussion can sometimes be challenging, the information is often very rich and informative. Sometimes, it is better to conduct the interviews one-on-one in a quiet, private place. In all cases, the manner of the discussion is crucial. The goal of the process should be explained to the person(s) being interviewed and it should be stressed that the RCA is a fact-finding mission for improving safety. The most productive approach is a humble inquiry 112 with the goal of trying to uncover as much information as possible. In addition to uncovering the CDP (the what of the incident), the RCA must also determine the whys of the incident. These are the casual factors (CF) or Contributory Factors in the terminology of the London Protocol. As with CDPs, interviews are an important method for gathering information about CFs. There is a good deal of confusion and misinformation in the literature as to the concept of causal factor. Some reports, for example, list issues such as technical error in treatment planning as a causal factor. This is clearly not a cause, however, but rather a care delivery problem (i.e., it is a what and not a why ). The actual CF underlying this might be something like an unknown error in the commissioning data of the treatment planning system. Another common misconception is that the goal of the RCA is to find the one causal factor, whose elimination will prevent future errors. This misperception is perpetrated by the term root cause. In reality, however, there is never a single root cause, 113 but rather a web of interdependent causal factors that act to make a particular error more likely. One recent study 78 of 300 events in radiation oncology found a median of seven CFs per event. No event had only one single CF. In investigating causal factors, it is important to penetrate beyond the superficial causal layers. An effort that lists human error as a casual factor, for example, is not very useful because it results in no deeper understanding of why an error was made and provides nothing that is actionable. Instead, it is important to understand the drivers of human error at a systems level, so that they can be addressed. (an excellent resource for understanding this concept more deeply is Sydney Dekker s book, Field Guide to Understanding Human Error 114 ). One common approach for uncovering causal

8 e107 Ford and Evans: Incident learning in radiation oncology e107 factors is the Five Whys method adapted from Toyota Production Systems, that is, asking why each successive cause occurred repeatedly until reaching a level of at least five questions deep. Parents of toddlers will be familiar with this method of questioning. In investigating causal factors, it may be useful to refer to the taxonomies and lists that have appeared in the literature. Thomadsen et al. 113 present an overview of various causal taxonomy systems and these same systems were used in developing the causal factor taxonomy described in the AAPM consensus report on ILS 36 which provides a concise reference. Another important aspect of RCA is to avoid the pitfall of hindsight or outcome bias. By definition, the RCA is being conducted at a point in time where the outcome of the error is known. With the advantage of this perspective, the right and wrong choices are known. That is, it is known which choices would have led away from error and which have led toward it. It then becomes natural to question the wrong choices and focuses on why the person in question did not make the right choice. However, if one shifts one s frame of reference back to the time the event was unfolding, where the future is unclear and it is often not even apparent that anything is wrong, then the right choice becomes much more ambiguous. Beyond these basic principles, there is, unfortunately, little in the way of guidance for a radiation oncology professional conducting an RCA. It may be helpful to read and make reference to a high-quality RCA such as that conducted by the Scottish Executive in response to the death of Lisa Norris after an overirradiation. 115 There are lists of CDPs and CFs appearing in some ILS reports in the literature (e.g., Refs. 38,46). However, these reports disagree and often mix the two concepts, that is, the what vs the why. One potentially useful reference is the list of CFs in the AAPM consensus report on ILS, 36 a list which can be fit on a single page. This CF taxonomy has been recently tested and found to be broadly applicable against a large event dataset. 78 Some of the terms used, however, are unclear to many professionals in radiation oncology. In an attempt to make this more intuitive and comprehensive, this CF list has been modified somewhat and an updated version was implemented in the RO-ILS â system in August D. Developing and implementing action plans or process improvements Once an event is investigated and understood a final and crucial step is the implementation of intervention(s) that should ideally eliminate the error recurrence or prevent patient impact. One of the most challenging aspects of incident learning is using the information to construct appropriate interventions which will improve safety. 14,67 Compared to the literature on incident learning and error investigation, there are relatively few reports about process improvement, especially in the radiation oncology literature. There is a relatively well-developed classification schema for the types of events and where are how they originate. By comparison, there is almost no formalism or classification schema for interventions. In considering process improvement and error proofing, there are three main approaches to be aware of 116 : eliminate the error from occurring, make the error more detectable if it does occur, or reduce the impact on the patient. Much of the focus in radiotherapy has been on making an error more detectable through prescriptive QA measures or by human inspection (e.g., plan review or peer review). AAPM TG-100 discusses this and focuses on how additional steps can be placed in the process as quality control measures, 40 for example, secondary verification of MU calculations. The impact of these steps can be visualized or even quantified through Fault Tree Analysis (FTA). There are other, more general process control tools, which can reveal errors. One example is external audits which may come in the form of output verification, 117 phantom irradiation (e.g., Ref. 118), or, even more generally, practice accreditation. Better than identifying an error is preventing an error from occurring in this first place. This is highlighted in AAPM TG-100, where the detectability dimension (e.g., QA) is only one aspect of error proofing. 40 Moving beyond QA brings one into the realm of systems thinking, human-factors engineering, and design. A full treatment is beyond the scope of this article, but further practical information on error proofing using human factors design approaches can be found in the work of Grout et al. 116,119 The concepts are also seen in the hierarchy of the effectiveness of interventions proposed by the Institute for Safe Medical Practices, namely, forcing functions, automation, protocols and standardization, independent double checks, rules and policies, education, and information. 120 This has been adapted and adopted in radiation oncology (e.g., Ref. 67) 2.E. Attitudes and barriers toward ILS participation Given the importance of engagement of all staff in the ILS process, it is important to identify the barriers to participation. One of the most fundamental barriers to engagement is in logging the initial report of an error. Of the many things that inhibit a person from logging a report, one is the report gathering mechanism itself. Paper forms were used in many early studies to log and track reports. While it is simple to use paper forms, they have many drawbacks including the accessibility of the form and inability to track the status of the event as it goes through the complex steps of investigation and analysis (e.g., Fig. 1). Electronic ILS has come into wider use and addresses these problems. Mutic et al. 29 described the implementation of a web-based system in 2007 to replace a system that used paper forms. The rate of reported events was increased by more than a factor of 20 with the web-based system. Other softwares have been described such as RL Solutions (e.g., Ref. 64) and the bugtracking software JIRA (Atlassian, Inc.) which was customized by the group at the University of Pennsylvania for ILS. 59 More recently, national and international systems have been launched including systems which are free to users,

9 e108 Ford and Evans: Incident learning in radiation oncology e108 RO-ILS â in the US supported by ASTRO and AAPM, 97 NSIR-RT in Canada 92 and SAFRON internationally, 98 and the fee-based service from the Center for Assessment of Radiological Sciences 96 which offers additional services such as assistance with RCA. While these systems are intended to serve as vehicles for sharing learning between centers, they may also be used as the electronic system for departmental ILS. There are, of course, many barriers to engagement beyond access to the ILS system. An institutional survey by Cooke et al. 52 in 2007 highlighted the following barriers: concerns or confusion as to whether a particular incident was important, concern on the part of the reporter about their reputation or the effects of reporting a colleague, interruption of work, and fear of disciplinary action. These barriers are seen in other studies as well. 48,50,77 The most common barrier is inertia with regard to filing the report. Providers often focus on solving the problem at hand and often do not engage in the deeper learning of the causes that drive error. In an important study from 2002, Tucker et al 109 observed nurses in eight hospitals for 197 h. The nurses encountered an average of one problem every 1.6 h. The most common response was to fix the immediate problem, that is, do what it takes to continue the care of the patient. They almost never attempted to find underlying causes or engaged in any form of incident learning. In the clinical environment, this fix-and-forget attitude often outweighs a fix-and-report approach. 121 One factor accounting for this is the busy clinical environment, and another is confusion as to what might qualify as an event that should be logged into a voluntary ILS. A recent meta-analysis suggested that ILS is most effective when there is a clear understanding of what qualifies as an event for the ILS. 30 It is important, therefore, to clearly define what qualifies as an issue that should be reported to the ILS. This helps promote the logging of reports, which is the first step to incident learning. Another barrier to ILS engagement centers on discomfort due to fear of negative consequence. This fear is often based on personal experience. In a US survey of therapists and dosimetrists, Church et al. 50 report that 16% of respondents indicated that they had been personally reprimanded for an error, and this experience was correlated with a marked increase in the discomfort with ILS. The multiinstitutional survey of Smith et al. 77 identified embarrassment, sanctions, or liability as the most important barriers to ILS engagement. Physicians in particular were concerned with these issues, most notably embarrassment. This is reflected in other studies as well. 122 High-volume incident learning is especially helpful in this regard as staff members become comfortable with the process and gain experience of its positive impact. 2.F. Importance of feedback A key component of the ILS is the feedback loop (see Fig. 1) which may come in the form of feedback to the individual(s) who initially reported the event and/or the professional group involved or may come in the form of a departmental meeting or other forum for sharing information. This might include the presentation of the results of an investigation on one or more events, the lessons learned, and the action plans. It may also be, as in the Woodhouse et al. report 17 from the University of Pennsylvania, a formal stateof-the-union style meeting for the entire department, held annually or semiannually, where quality and safety culture principles are discussed and highlighted. Another effort is the good catch program in which a particular near miss event is highlighted and the person responsible for identifying it is recognized. This has proven popular in radiation oncology 16,123 and in other areas of healthcare (e.g., Ref. 124). The good catch metaphor helps frame the program in a positive light and underscores its importance in maintaining and improving patient safety. Whatever the method, some form of feedback is crucial to the learning process and to maintaining engagement in the ILS program. This can be seen in a 2016 study by Burlison et al. 103 which used hundreds of thousands of survey data from the Hospital Survey of Patient Safety Culture administered by the US Agency for Healthcare Research to predict various outcome variables. They found that the most significant predictor for the frequency of reporting events (of all types) was feedback about errors. Although lack of punitive action was also negatively correlated, it was not nearly as strong a predictor as feedback. These data underscore the crucial need for a feedback mechanism as part of the ILS program. 3. PRACTICAL ADVICE FOR DEVELOPING AND MAINTAINING AN ILS PROGRAM Synthesizing the above information, the following key points emerge as practical foundations for developing and maintaining an ILS program: Engage departmental leadership. The need to engage in incident learning is compelling. It is supported by data and is recommended by professional societies and virtually every relevant national and international body. Clinical leaders are found in many roles and their support is essential for a nonpunitive and just culture. In particular, the impact of physician support (or obstruction) of safety culture efforts can be profound, 102 and physicians are strongly encouraged to be vocal advocates of reporting and safety and quality improvement efforts. Establish and formalize the process for logging and investigating incidents (cf. Fig. 1). Deploy an electronic ILS that is customized for radiation oncology. The radiation oncology department should manage the system since ownership by the clinical unit has proven more effective. Electronic systems lower barriers to reporting and aid in event tracking. Clearly define what qualifies as an event that should be logged into the ILS. This should explicitly include near-

10 e109 Ford and Evans: Incident learning in radiation oncology e109 miss events, unsafe conditions and operational/process improvements (cf. Table I). Ensure that all staff are familiar with the definitions and expectations. Examples may prove helpful (cf. Table I). Establish metrics to track performance of the ILS. This may include the number of reports per week, the number per person or per group, or the routing time for each incident. Actively encourage reporting, such as with leadership walk-rounds. A larger number of incidents reported indicate a stronger safety culture, not an unsafe system. Cooke et al. 100 recommended that ratio of potential to actual incidents >10 15, while a direct ratio may be problematic since the number of actual incidents is often very small and fluctuates greatly, some indicator of the engagement in near miss reporting may be helpful. One goal may be 1 report per patient. Provide feedback to staff about specific events and process improvements. This might include feedback to the initial reporter, to various professional groups (e.g., through review at staff meetings), or to the entire department in the form of morbidity and mortality style meetings that encourage discussion and promote positive culture. Most important in this feedback process is demonstrating to the team that the reports have led to a positive change in the department. Build a positive culture of safety. Engagement of leadership is a key in this. A good catch program including awards and recognition has proven valuable. The norms of the department should reinforce that safety is everyone s job, and that reporting is a part of the job description. Culture of safety can be tracked through a regular survey (e.g., each 18 months). 4. A SYSTEMS VIEW OF ERROR A central tenet of quality improvement is that all incidents should be approached from a systems perspective. That is, rather than focusing on how the individual contributed to the incident, the focus should be on how the system permitted the event to occur. There are many reasons why our systems are flawed and individual decisionmaking can fail us despite the best intentions. Therefore, it is rarely a bad apple that is to blame but rather a faulty system that is vulnerable to such events. Of course, if there is a deliberate rule violation or negligence, then the individual should be held accountable. This systems perspective holds that We cannot change the human condition, but we can change the conditions under which humans work. 125 In this section, we consider this systems view of error from several perspectives. First, the underlying culture of the clinical unit or institution which can have a broad effect on the design of the system itself and the response when errors occur. Then, we consider several important causal factors of error, in particular teamwork and communication (Section 4.B) and cognitive bias (Section 4.C). While this is by no means an exhaustive presentation of the causal factors, it serves to illustrate the essential concepts. 4.A. Safety culture and just culture Organizations are striving to become high reliability organizations. 126 This term refers to organizations, which despite performing complex and potentially hazardous tasks, can be relied upon to do them safely and accurately. Building a safety culture is considered an essential part of becoming a high-reliability organization. One crucial tenet is preoccupation with failure. 127 That is, high-reliability organizations have a focus on their failures, and work tirelessly to try to see how they can be prevented from recurring. Near misses are viewed as evidence that systems should be improved. Safety culture has been simplified into any culture in which the boss welcomes hearing bad news 128 and would rather know the truth about the organization s strengths and weakness in order to strive for excellence. It is, in short, a culture dedicated to improvement. Reports have appeared in the radiation oncology literature documenting a shift in culture and have linked it to incident learning, and several RT studies have explicitly noted the importance of just culture. 17,49 According to the AHRQ, a culture of safety has four main features: knowledge that an organization is engaged in high-risk activities, with the determination to maintain safe operations; a blame-free environment where individuals can report errors or near misses without punishment; collaboration across disciplines and titles to seek innovative patient safety solutions; and the unfailing commitment of the organization to address safety issues. 129 AHRQ has also developed safety culture surveys, as discussed in Section 2.F. So, how do radiation oncology practices fare? In a national survey of radiation therapists, 31 61% of therapists gave their department a safety grade of excellent. This was associated with the perceived concern of physicians (odds ratio 3.4) and leadership (odds ratio 5.4) with safety issues. An excellent safety rating was associated with physicians who do not blame therapists for error (odds ratio 2.1). Interestingly, there seem to be benefits to employee retention within a strong safety culture, as therapist reported that job satisfaction was associated with a safety grade of excellent (odds ratio 7.2). A concerning finding of this survey was that 17% of therapists reported workplace bullying, and 40% acknowledged that workplace stress and burnout impacted their ability to treat patients well. There remains room for improvement in the safety cultures of our practices. It has been estimated that 70 80% of medical errors occur because of poor teamwork Teamwork is facilitated by nonhierarchical systems. In medicine, the breakdown of hierarchies critical to safety culture has been slow to happen. This persists despite efforts to formalize this, as done with staff introductions during surgical time out procedures. A recent study showed that while 98% of the operating team knew the name of the attending surgeon, the attending surgeon only identified 44% of the OR staff correctly and identified their