The disaster at Mid Staffordshire National Health Service (NHS) Foundation Trust raises a critical set of questions for the oversight of safety and quality in complex healthcare systems. Appalling failures of care accumulated over a number of years at the main hospital serving the English Midlands town of Stafford. The many and varied signs of these accumulating failures were either missed, misunderstood or ignored by a wide range of professionals and organisations responsible for assuring safety and quality across the NHS. Some of the most urgent and practical questions raised by this disaster are therefore: how can healthcare organisations—and those that supervise and regulate them—interpret weak signals, identify early warnings and investigate and address the risks that underlie major failures of care such as those at Mid Staffordshire? More fundamentally, how can healthcare systems be designed to ensure that the signs of systemic failure are routinely surfaced, understood and addressed? To answer these questions it is first necessary to understand why situations of organisational and supervisory failure can arise over such prolonged periods of time in healthcare systems.

Understanding disaster

Following a regulatory investigation,1 an independent inquiry,2 a public inquiry3 and an expert review,4 the complex combination of events that allowed the disaster at Mid Staffordshire to develop are no longer in dispute. At all levels of the healthcare system data on safety and quality were not systematically collected or shared, warnings were not acted on, bad news was minimised, indicators of harm were explained away and complaints were mishandled.

In short, “the overall findings reported here could be restated as the proposition that disaster-provoking events tend to accumulate because they have been overlooked or misinterpreted as a result of false assumptions, poor communications, cultural lag, and misplaced optimism.” This statement provides a pithy explanation of the circumstances that allowed the disaster at Mid Staffordshire to develop and persist—and yet it was written nearly four decades ago.5 The author was Barry Turner, a British sociologist, and his work pioneered the systematic analysis of organisational disasters.6 Turner sought to explain what he termed the “social aetiology of disaster”7: the distinct organisational, social and psychological patterns that allow the precursors of major disasters to accumulate unnoticed within complex sociotechnical systems.

Turner's work remains a classic in the field of safety and risk management and has been widely elaborated and extended.8–11 It has directly informed models of organisational accidents,12 organisational high reliability13 and organisational resilience and vigilance,14 all of which are increasingly applied in healthcare. It is therefore surprising that one of the most sophisticated bodies of theory on organisational failure has rarely been put to use in healthcare. Its implications are both practical and profound.

The incubation of healthcare disasters

Disasters are essentially organised events. To occur, they typically require the systematic and prolonged neglect of warning signs and signals of danger, creating deep pockets of organisational ignorance,15 organisational silence16 and organisational blindness.9 When signals of risk are not noticed or are misunderstood in organisations, then safeguards and defences against those risks can be allowed to degrade—or may never be created in the first place.12 Critically, it is the shared beliefs, collective assumptions, cultural norms and patterns of communication across organisations that shape what information is attended to and how it is interpreted and communicated—and most importantly, what is overlooked, discounted and ignored. Organisations can be defined by what—and whom—they choose to ignore.11 Organisational disasters develop over long periods of time: they incubate in organisations.5 During this incubation period, events and circumstances that are discrepant with people's current beliefs and assumptions about organisational safety gradually accumulate, unnoticed or misunderstood. That is, disasters develop through sustained patterns of interpretive failure.14 Systematic and routine failures in collecting, interpreting, communicating and understanding information lead, quite simply, to “the management system losing touch with its operational realities”,17 producing failures of foresight.6

In healthcare organisations some of the key sources of missed, miscommunicated or misinterpreted signals of risk are closed professional cultures, competing and conflicting demands, and the inherent ambiguity of many forms of adverse event. Nurses, doctors and managers can often harbour quite serious concerns in relation to safety issues and adverse events, but professional power relations, concerns about career advancement and even a perceived sense of complicity in any adverse outcome can prevent those concerns from being publicly acknowledged, as in the cultural censorship that developed around the malpractice of Rodney Ledward.18 At times, healthcare staff might perceive it to be professionally safer to either overlook, justify or explain away failures that they might have been involved in—even if only peripherally—rather than exposing themselves to potential blame. This is particularly the case when failures are ambiguous and hard to identify as such in the first place, as was the case in the failures in paediatric cardiac surgery at Bristol Royal Infirmary.19

More generally, many healthcare staff are used to working within systems that are deeply imperfect—where time is pressured, required equipment may not always be available and clinical demand can at times exceed the resources available. In such circumstances problems can simply be seen as a normal and accepted part of organisational life—something to be managed and to muddle through in order to keep services running for patients.20 The complicated profusion of national bodies, professional organisations, and statutory regulators that span healthcare systems such as the NHS can also create complex and competing priorities for healthcare organisations, and a diffusion of responsibility for monitoring and overseeing patient safety across the healthcare system,21 all of which generates conditions ripe for the incubation of disasters.

Viewing healthcare disasters as the result of social and organisational processes of incubation—in which existing patterns of attention, interpretation and communication systematically blind people to the implications of adverse events—has many implications for healthcare organisations and their supervisors. In particular, it points to deeply practical implications regarding the use of information, the production of warning signs and the organisation of learning across healthcare systems.

The implications of incubation

The effective oversight of safety and quality depends on recognising and addressing problems early, when they are still small—and before they have had time to develop into major failures of care.13 Identifying weak signals and interpreting early warnings is one of the most challenging and critical aspects of safety management.14 If risks and warnings signs are not identified and understood in the first place, they can gradually accumulate and enlarge. However, this long and incremental process of disaster incubation also has a curious benefit. It provides a considerable period of time in which emerging problems can be detected before they accumulate into major failures of care—if attention is organised and directed in the right way, and if indications of problems are understood and acted on swiftly. To achieve this, healthcare organisations and their supervisors must grapple with three key interpretive challenges: how to ensure attention remains focused on finding gaps in current knowledge, how to monitor for the early and weak warnings of risk, and how to routinely investigate the system-wide causes of healthcare failures.

Ignorance and the organisation of attention

Organisational disasters like Mid Staffordshire are rooted in systematic failures of information gathering, communication and interpretation that produce organisational ignorance: a catastrophic disjunction between the way people believe an organisation is performing, and the way it actually is. At Mid Staffordshire, complaints and patient safety incidents were mishandled, whistleblowers were discouraged and regulators and supervisors failed to effectively collect and share data on safety and quality. The Francis inquiry report accordingly recommends increased reporting, improved communication, greater transparency and wider sharing of information.3

One of the practical ironies of increasing the amount of information captured and communicated is that it can increase noise, spread attentional resources thinner—and therefore render weak warning signals weaker and harder to spot.22 Healthcare organisations are awash with information, and it can be hard to distinguish what is irrelevant noise and what are important signals that ought to be attended to. This is one of the most challenging tasks for healthcare managers and regulators, and is one of the earliest and critical tasks in overseeing and monitoring safety. It is also one of the most fundamental failures that underpinned the events at Mid Staffordshire. One of the most striking aspects of the Mid Staffordshire story is just how much information indicating poor performance was available across all organisations involved. The first 90 pages of the Francis inquiry are dedicated solely to cataloguing these missed warnings. Between January and March 2007, for example, staff at Mid Staffordshire reported around one patient safety incident every day regarding unsafe staffing levels.3 Contrary to the story widely promulgated in the press, staff were blowing the whistle regularly. This information was available, but it was not effectively attended to, interpreted or integrated into a meaningful picture by those responsible for overseeing safety—and it was therefore not acted on.

In healthcare systems increasingly awash with data, it is attention rather than information that can become one of the most precious and limited resources. Improving the communication processes and technical infrastructures that capture and share information on safety and quality is important in the NHS and other healthcare systems, along with making sure that oversight bodies have a clear and explicit mandate to monitor for patterns of systemic failure across all sources of data. But just as important—if not more so—is improving the social and cognitive infrastructures within which information is interpreted, attention is organised and information is made collectively meaningful.14 ,23 The story of Mid Staffordshire is in large part a story of leaders, supervisors and regulators interpreting data in a way that confirmed and supported existing beliefs and assumptions about safety, discounting or overlooking data that conflicted with those beliefs, and failing to actively seek out and explore disconfirming cases. The effective monitoring of safety and quality depends on the exact opposite: it depends on working continuously to test, disconfirm and challenge current assumptions about safety, and identify where current knowledge and beliefs are becoming outdated or are out of synch with organisational reality.

The practical implication of this is that data on safety and quality should be routinely interpreted and assessed not only in relation to patient outcomes and organisational performance, but also in terms of the extent to which those data challenge and invalidate currently accepted beliefs and assumptions about safety and quality.13 ,24 Current assumptions and beliefs about the adequacy of safety and quality need to be continually made explicit and challenged within healthcare organisations and their regulators. Any fleeting uncertainties or doubts regarding patient safety—or current understandings of it—need to be seized upon and ruthlessly explored. Uncovering the early warning signs of previously unrecognised risks is, at its earliest and most tentative stage, primarily a process of producing and amplifying ignorance.25 The interpretive orientation and attentional resources of those responsible for overseeing safety need to be explicitly organised around producing and exploring the early signs of emerging ignorance.

Actively producing early signs of ignorance is a key source of vigilance in other safety-critical industries, such as aviation.14 Safety professionals in airlines, for instance, work hard to create doubts about safety by interrelating information on relatively minor events with patterns of failure that were seen in past accidents, and combining information from a variety of different sources in ways that tenuously suggest there may be hidden underlying patterns of failure.25 These early signs of potential ignorance are inevitably fragile: they are based on limited data and would be easy to dismiss or explain away. Airlines have dealt with this challenge in part by creating distinct, independent and well-resourced safety departments whose primary role is to continually challenge, question, investigate, explore and report on safety within their organisation.14 The staff in these safety departments are professional pessimists: they are paid to fear the worst—and to spread those fears around widely.

Fear and the manufacture of warnings

Organisational disasters emerge from missing or misinterpreting the early warning signs of failure. In retrospect, after a disaster, the string of missed warnings is often startlingly clear. But at the time, managers and regulators are typically presented with masses of complex and ambiguous information, much of which appears to be urgent, and all of which is competing for finite attentional resources. Warning signs rarely arrive pre-packaged in clear and unambiguous form. For some set of information to act as a warning, managers must have an idea of what exactly it might be a warning of—otherwise, it is merely more information. The implication of this is that warning signs are not simply passively perceived but must be actively made and constructed, by relating information on organisational performance to pre-existing concerns about potential failures and future harm.

The Berwick review into patient safety following the events at Mid Staffordshire is right to argue that fear can be the enemy of improvement.4 When staff become fearful of speaking up, and when organisations become fearful of missing targets, bad news can be buried and problems hidden. But fear is also essential for the effective oversight of safety and quality—as long as it is the right kind of fear. Disasters develop through the complacency that arises from misplaced optimism5 and forgetting to be afraid.12 Fear of future organisational failures—the right kind of fear—can both activate and organise the continual search for warning signs in effective systems of safety oversight.14 An early warning is produced by relating information on organisational performance to a specific, well-defined and focused fear of some type of future organisational failure. Put another way, it is helpful to understand what you are trying to avoid when you are working to detect and prevent it.

The practical implication of this is that healthcare organisations and their regulators need to develop a clear and well-specified view of the outcomes they are seeking to avoid—in terms of both patient outcomes and organisational outcomes. Organisations should attempt to remain continually afraid of realising these outcomes, and must strive to continually search for weak indications that those circumstances are beginning to emerge. Unlike other industries, it is only relatively recently that healthcare organisations and their regulators have begun to specify what they are seeking to avoid with any precision.26 The range of these specified fears remains small and is focused largely on clinical events, including pressure ulcers, urinary tract infections, catheter related blood stream infections and other types of ‘never events’. Even fewer of the organisational outcomes that healthcare organisations should seek to avoid have been specified, such as, for example, inadequate staffing levels or missing equipment. This gap in specification, and this lack of clearly focused and organised fear, limits the search for early warnings and weak signals of risk: in other safety-critical industries, vigilance is organised through the generation and distribution of specific, focused fears.14 One of the main factors that precludes this activity in healthcare is that healthcare systems do not routinely investigate and publicise the systematic causes of major failures—which is a common mechanism of specifying, spreading and sustaining the right kind of fear in other industries, such as aviation and shipping.

Failure and the investigation of systems

Organisational disasters such as Mid Staffordshire emerge from system-wide failures that span entire healthcare systems, from regulators, policy makers and commissioners to educators, providers and professional bodies. Each of these organisations has a role to play in detecting and preventing major failures of care, and each of them in some way contributed to the emergence of the disaster at Mid Staffordshire. Systems failures are not unique to healthcare, and it is hard to avoid noticing that in the weeks running up to the release of the second Francis inquiry report3 in February 2013, another industry was experiencing its own system-wide safety crisis. In mid-January 2013, a major international investigation was launched into the new Boeing 787 ‘Dreamliner’ fleet after two separate incidents in which an aircraft battery began overheating and giving off smoke under the aircraft's floor. The contrast between how healthcare and aviation investigate and learn from system-wide failures is deeply instructive—and somewhat troubling.

Every airline accident and serious incident is routinely investigated by an independent national safety investigation organisation. These national investigators are entirely independent and stand apart from the system they investigate, but are nonetheless permanent features of the aviation system. The investigations they conduct span the entire aviation system—from the work of regulators to the manufacture of equipment to the training of crew to the culture and practices within airlines. Critically, these national air safety investigators are not regulators, or commissioners, or performance managers, or providers. They have no stake in current regulatory or policy or commissioning agendas: they are simply investigators. They work to understand the causes of the failure, circulate this knowledge widely, recommend ways that systems should be improved, and then hold all organisations within the aviation system publicly accountable for making those improvements. Similar organisations exist in, for example, the railway and shipping industries too.

The NHS, however, has no equivalent mechanism to routinely investigate and improve safety across the entire healthcare system. There is no organisation that can regularly and independently examine the system-wide causes of healthcare failures, and dispassionately and authoritatively recommend improvements. Instead, the NHS has had to rely on there being enough public outcry and political will to establish a rare, one-off, expensive and highly charged public inquiry to learn the lessons of systemic failures such as those that underpinned the disaster at Mid Staffordshire, or Bristol before that.27 While countless investigations are conducted into quality and safety failures around the NHS each year, none of these have a mandate to examine all aspects of the healthcare system as an integrated whole, and many of these investigations are coordinated by organisations that may themselves be the unwitting source of systemic risks in supervision, regulation, commissioning, policy and the like.

In the aviation system, a permanent, expert and independent investigatory organisation is routinely called upon to examine some of the most serious failures that occur in the industry. Rather like the first and second Francis inquiries combined, their responsibility is to determine how the causal factors span the entire aviation system—and to pose improvement recommendations across the entire aviation system. The difference, of course is that these independent investigations are conducted by specialists with deep expertise in safety improvement, and are conducted largely in partnership with the managers, investigators and specialists based within specific airlines, manufacturers and service providers. In the aviation system, this provides a structure within which the skills and knowledge of safety professionals in individual organisations are both drawn on and—importantly—continually developed through cooperative working. It also provides a structure within which safety issues that span the entire industry can be routinely uncovered, examined and improved.

A crucial piece of the safety and quality oversight puzzle is therefore missing in healthcare. Healthcare systems lack a routine and independent source of knowledge on the processes that lead to systemic failures of care, the kinds of warnings signs that managers and regulators should remain vigilantly attentive to and afraid of, and the location of potential pockets of ignorance in healthcare organisations and the system as a whole.When it comes to learning from systems-wide failures, the healthcare system is largely flying blind.

Disaster, deterioration and detection

Understanding the social aetiology of disaster incubation reveals a range of challenges that must be confronted in order to design effective systems of safety and quality oversight in healthcare. These challenges are largely interpretive. They relate to the identification of organisational ignorance, the management of attentional resources, the interpretation of early warnings and the investigation and circulation of system-wide learning. These translate to immediate practical challenges that safety managers, senior leaders, healthcare professionals and regulators confront every day: what to pay attention to, what to investigate, what to act on—and what to ignore. In the longer term, healthcare organisations and system supervisors must confront the complexities of designing safety oversight systems that achieve three things. First, support the sometimes subtle practices that uncover early signs of ignorance and focus attention on gaps in current knowledge. Second, continuously monitor a broad, evolving and well-specified set of both clinically and organisationally based risk factors. And third, routinely investigate the system-wide causes of healthcare failures and organise system-wide improvements. But above all, one of the most urgent and timely issues in patient safety and quality remains the challenge defined by Barry Turner almost four decades ago: determining “which aspects of the current set of problems facing an organisation are prudent to ignore and which should be attended to, and how an acceptable level of safety can be established as a criterion in carrying out this exercise”.5