Michael Appel: The Risk of Unknown Risks

AAMI President Mary Logan’s March quarterly update to the AAMI community describes precisely the essence—and challenge—of safety management: Risk, not outcomes, is what determines safety.

A shared challenge among medical device companies, as well as other industries whose focus is safety, is that a low tolerance for risk is confounded by the difficulty of identifying risk which is not yet known. However, just because a risk has not been detected, or its probability has been severely underestimated, does not mean it goes away. In fact, risks can remain latent for a long time, cloaking them even deeper in a disguise of “normal” until tragedy strikes. This month’s Germanwings’ air disaster is a case in point.

In the aftermath of the Sept. 11, 2001 terrorist attacks, the global air transport industry addressed a single, newly visible (but long-present) risk: the invasion of a cockpit for the purpose of seizing control of the airliner and using it as a weapon of mass murder. That risk was mitigated by modifying cockpit doors to ensure that the risk of a repeat takeover scenario was as low as reasonably practicable. That made us safe, right? This safety myth was further reinforced by 14 years of commercial flight without another 9/11-type attack. But to establish this “safety,” a new risk was immediately created: somebody with legitimate access to the cockpit (but with nefarious goals) could use this safety measure—cockpit doors that are much harder to penetrate from the outside—to again use a jet as a weapon of mass murder. That’s exactly what happened in the crash of Germanwings flight, according to authorities who say the co-pilot locked out the pilot and deliberately slammed the plane into the French Alps.

As that event tells us, this risk—latent for 14 years and probably considered as far-fetched as the pre-9/11 perceived likelihood that anyone would ever commandeer an airliner and crash it into a skyscraper—was there for every flight since 9/11. Once again, it became painfully clear that the absence of bad outcomes does not equal safety.

Thus, the ultimate challenge of risk management—for whatever its purpose—is to properly identify all risks because it’s the least visible ones that seem to come out of nowhere with each new catastrophe.

AAMI member Michael Appel, MD, is the chief patient safety officer with Northeast Georgia Health System, Inc.




Subscribe to our RSS feed and social profiles to receive updates.

7 Comments on “Michael Appel: The Risk of Unknown Risks”

  1. apgar1010 Says:

    Dr. Hyman:

    Excellent comments, thank you.

    To illustrate the essence of the perennial “outcomes” vs “risk” debate over what “safety” really is, consider your statement: “If there were no adverse outcomes, then the risk and safety effort was … totally effective …”

    If this were true, then how would we reconcile the following scenario?

    “I drive drunk (with a blood alcohol level of 0.10) from the pub to my house every night for a year, and I DON’T CRASH.”

    Question: Was I “safe”?

    Michael Appel


    • William Hyman Says:

      That would be an anecdotal case, and anecdotes are rarely a good basis for action or inaction. If no one ever crashed from driving drunk, then we might reasonably conclude that there isn’t actually a real-world risk from that behavior.


      • apgar1010 Says:

        Very true.

        Except that catastrophes are all “anecdotes”:

        American 191
        ValuJet 592
        Texas City refinery disaster

        How great were each of the relevant “safety management programs” the DAY BEFORE each of these events?

      • William Hyman Says:

        The vast majority of medical adverse events are not one-off catastrophes.

        Which of the above were reasonably preventable other than in retrospect?

      • apgar1010 Says:

        Every single one of these events was prospectively foreseeable on the basis of the risks which were known yet ignored.

        I agree that “adverse events” are typically not “one off.” Also, not all “adverse events” are catastrophes.

        And when certain “adverse events,” such as a preventable iatrogenic patient deaths, occur repeatedly due to the same causes, we must question whether our risk tolerance is in fact much higher than we care to admit. Perhaps patient death catastrophes are NOT “one off” (unlike the dramatic disasters in other industries) because we allow them to occur repeatedly?

  2. whyman2013 Says:

    I am confused by the statement that “risk, not outcomes, is what determines safety.” Isn’t the purpose of the risk/safety effort to prevent adverse outcomes whenever reasonably possible? If there were no adverse outcomes, then the risk and safety effort was either totally effective or it was a mere amusement. If adverse outcomes occur then the risk/safety effort was not productive, at least for that adverse outcome. When there are adverse outcomes, I don’t think we want to hear how great your safety management program was.


  3. Joe Brown Says:

    Dr. Appel, I completely agree with your summary of the “risk of unknown risks” as it pertains to safety management. In healthcare, the focus of safety and quality management is primarily directed at outcomes only. This approach is contrary to other high-risk, high-reliability industries such as commercial aviation. In commercial aviation, outcomes are nothing more than “box scores” and box scores don’t tell anyone how the game was played.

    Productive safety and quality management focuses primarily on the quality and risk exposure present in each system and their supporting working level processes. This way, over time, as relevant data is collected outcomes begin to become predictable. However, since this is typically not the approach used in healthcare today, it comes as no surprise that (patient) safety, quality, and risk management continues to remain in a constant state of disarray. This is truly a disservice to healthcare professionals and their patients.

    An interesting note about safety management is that it really is risk management. “Safety” is an arbitrary term. What may be safe to me may not be safe to you. The key is that an organization (hospital or medical device manufacturer) must have and appropriately apply a quantifiable definition of risk for it to be usable. As an airline pilot and safety consultant for many types of healthcare organizations, I do not know of any hospitals that do this.

    Another interesting aspect of safety management is that in industries like commercial aviation, organizations physically inspect and aggressively look for risk in their systems (flight, ground, maintenance, etc.). Contrary, healthcare is predominantly reactive in their approach to safety. Only when something bad happens does someone take notice. Resulting corrective action does not usually address the source issues (root causal factors) at a system level and this leads to the repetition of mistakes. I’ve seen this happen over and over again.

    You are spot on in your discussion of medical device companies’ challenges regarding risk identification, especially risk that is not yet known or perhaps obvious. Your discussion speaks directly to the lack of the primary tenet of system safety: Who’s in charge? Who is responsible for leading the team or department that really goes out into the system and looks for actual and potential risk? Usually, no one is responsible. It’s as the saying goes in healthcare: Everyone’s assumed responsible yet no one’s actually responsible. A safety, quality, and risk management program operated this way either by design or just because is a recipe for disaster and would be completely unacceptable in an industry like commercial aviation.

    As for the Germanwings’ air disaster, it’s important to remember that while the initial outcome may appear obvious, all accidents/adverse events are a “chain of events.” There is never an accident that has only one causal factor. While it seems mental illness played a significant factor in this air disaster, one question that begs asking is: Why was there only one crew member left alone in the cockpit? Granted, several European carriers operated with a policy of having only one pilot in the cockpit during brief rest breaks. However, the answer to the question of why may reveal latent risk factors that become contributing causal factors not presently realized. Time will tell…

    Joe Brown
    President, The Salus Network


Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: