Chapter 1:
Risk
Management
Dynamics
Healthcare can hurt…
• In the 1970’s, the fact that receiving healthcare
services can actually cause harm was brought
to the forefront with the Institute of Medicine
report “To Err is Human: Building a Safer Health
Care System”:
– In 2 studies, adverse events occurred in 2.9% and
3.7% of hospitalizations
– More than half of these adverse events were the
result of preventable medical errors
– Extrapolation: > 1 million medical errors may occur
each year resulting in 140,000 deaths
More data about medical errors
Studies indicate the following:
– Hospital employees recognize and report only 1 in
7 medical errors that harm Medicare patients
• Even after medical errors are reported and investigated,
many hospitals do not change their practices to prevent
repetition of the event
– >50% of patients treated for side effects and other
medication related injuries were 65+ years old
– Continued reporting of wrong-site surgeries
What can be done?
• The Joint Commission recommended safety
standards in 2001 that relate to:
– Providing leadership
– Improving organizational performance
– Information management
– Patient’s rights
• It is imperative to monitor adverse events
from 2 standpoints:
– Quality of care
– Legal responsibility to do no harm
How do we monitor adverse events and
ensure patient safety?
• Recognize and minimize instances where a
medical error can occur
This is the function of Risk Management
What is Risk?
Uncertainty about future events that
may threaten the safety of patients
and the assets and reputations of
providers.
What do we mean by assets?
• People – patients, clinicians, volunteers,
and employees
• Property – buildings, facilities,
equipment, and materials
• Financial – revenue, reserves, grants,
and reimbursement
• Goodwill – health and well-being,
reputation, and stature in the community
What is Risk Management?
• Discipline for dealing with the possibility
that some future event will cause harm.
– An organized effort to identify, assess and
reduce risks to patients, visitors and staff
Objective of Risk Management
• To reduce the risk of preventable
accidents and injuries and minimize the
financial loss if one occurs
– It provides strategies, techniques and an
approach to recognizing and confronting any
threat faced by an organization.
In other words…
• What can go wrong?
• What will we do to prevent harm and in the
aftermath of an incident?
• If something happens, how will we pay for
it?
What are the risks we
are trying to protect against?
•
•
•
•
•
•
•
•
Antitrust violations
Breach of contract
Casualty exposure
Defamation
Embezzlement
Environmental damage
Fraud and abuse
General liability
• Hazardous substance
exposure
• Professional
malpractice
• Securities violations
• Transportation liability
• Worker’s
compensation
So, what will be done?
In the Risk Management Process we will:
• Identify Risk
• Perform Risk Analysis
• Implement Risk Control/Treatment
• Finance Risk
Risk Identification
• Continuous collection of information to
search for the various liability risks such as
• Property risks
• Casualty/liability risks
• Employee benefit risks
Risk Analysis
• Evaluating past experience and current
exposure to limit the impact of risk,
keeping in mind that there are different
levels of Risk
• Severity to the individual and/or organization
• Number of people harmed or potentially
harmed
• Likelihood or frequency of occurrence
Risk Control/Treatment
• Most common function of risk management
programs
• Risk Management programs should categorize
potential liability into 4 categories:
• Bodily injury
• Liability loss
• Property loss
• Consequential loss
Risk Control/Treatment
• There are many methods and techniques an
organization can use to minimize risk:
• Risk Acceptance
• Loss Reduction
• Exposure Avoidance • Exposure Segregation
• Loss Prevention
• Contractual Transfer
Risk Financing
• An organization should have financing
available to fund losses and implement risk
management activities
– Self-insurance
– Commercial insurance
– Budgetary funds set for activities and/or losses
American Society of Healthcare Risk
Management (ASHRM)
Components in a risk management program:
– Designate risk manager
– Access to all data
– Organizational commitment
– System for identification, review and analysis of
adverse outcomes
– Ability to integrate and share data
– Evaluate risk management program activities
– Provide educational programs
– Provide information on staff competency
Three Major Functions of Risk
Management – Business Orientation
• Reducing the organizations’ risk of malpractice
suite by maintaining or improving the quality
of care
• Reducing the probability of a claim being filed
• Preserving the organization’s assets once a
claim has been filed
‘Red Flag’ Areas to Watch
• Treatment Conditions
• Patient Relations
• Practice Management
• Conduct of Staff
Risk Management Tools
for Identifying Risk
• Incident Reporting
• Occurrence Reporting
• Occurrence Screening
Incident Reporting
System to identify events that are not
consistent with the routine operation of a
hospital or routine care of patients
Occurrence Reporting
A policy listing specific adverse events
that MUST be reports
• Required by some states and insurers
• Can increase identification of adverse
events to 40-60%
Occurrence Screening
System that identifies deviations from
normal procedures or expected
outcomes
• Uses criteria to identify adverse events
but does not rely on staff reporting
• Increases identification of adverse events
to 80-85%
Risk and Quality of Care
• There is sometimes overlap between
these functions in the healthcare setting.
• Integrating risk management and quality
assurance functions can result in:
– Maximization of the use of limited resources
– Elimination of duplication
– Developing new solutions to problems
– Facilitation of training programs
– Improvement of budget process
Specific Risk Management Functions
• Incident Identification, Reporting and Tracking
• State Mandated Incident Reporting
• Incident Review and Evaluation
• Take action to prevent recurrence of incidents
• Internal Documentation
• Credentialing and Privileging
• Patient Complaint Programs
• Risk Management Education
Summary
• Risk Management is about reducing
preventable adverse events and minimize
financial loss should such events occur.
• There are many tools available to assist
the Risk Manager.
Chapter 3:
Risk Management in Employment
Employment Relationship carries Risk
• Risk to an organization is not limited to
provider-patient relationships
• As in any business, the healthcare organization
has responsibilities to its employees. Many of
which, if not properly implemented/enforced,
can lead to negative and litigious results
Employment-at-Will
• An employer may dismiss an employee
hired for an indefinite period of time for
any reason or no reason at all without
incurring liability to the employee
• Caveat: cannot discharge for an unlawful
reason, such as racial discrimination
Implicit Employment Contracts
• Though most states follow the employment-atwill doctrine, many organizations may
unknowingly negate their ability to apply this
principle through
– Employer policies (i.e. progressive disciplinary policy)
– Oral assurances (i.e. looks like you have a bright
future ahead of you here)
– Industry customs (i.e. after so many years in one
position, employees are promoted to the next level)
– Employer conduct (i.e. allowing some employees
more chances to correct errors than others)
Burden of Proof
• In civil litigation of discrimination, the burden of
proof is usually on the plaintiff -they must show:
• Membership in a protected group
• Satisfactory job performance or appropriate
qualifications for the job being sought
• Receipt of discipline, termination or rejection
despite having the qualifications
• Employees of another protected class were
disciplined less severely or the employer continued
to accept application of people who were no better
qualified
Sexual Harassment
• Unwelcome sexual advances, request for
sexual favors or other verbal or physical
conduct of a sexual nature when it is one of
the following:
• is a condition of employment
• is the basis of employment decisions
• interferes with work performance
• creates a hostile work environment
Minimizing Risk of Sexual Harassment
• Organization must exercise reasonable care to
prevent and correct any sexually harassing
behavior
– Written policies/procedures
– Documented staff training on policies/procedures
– Consistently adhere to and enforce policies
– Immediately investigate allegations of sexual
harassment
Responsibility of the Employee
• Employee must report occurrences of sexual
harassment to employer
– Employer must be given the opportunity to investigate
and take corrective action
• Though it is important that an employer investigate
all reports of sexual harassment, proactively
addressing situations or behavior that may be
perceived as sexual harassment is imperative.
– If management is aware of a potential situation and does
nothing, the risk of litigation and penalty is increased
People with HIV or AIDS
are protected by the ADA
Persons with HIV disease, both
symptomatic and asymptomatic, have
physical impairments that substantially
limit one or more major life activities and
are, therefore, protected by the law.
Americans with Disabilities Act
1990
• Definition of Disability:
A physical or mental impairment that
substantially limits one or more major life
activities or a record of such impairment or
being regarded as having such an impairment.
• The facility must determine the essential
job functions of a position and make
reasonable accommodations for a
disabled employee.
Due Process
• When confronting alleged misconduct, there
must be Due Process:
– A clear rule against the misconduct
– The rule must be reasonable
– A thorough and objective investigation
– Notice of the charges and penalty
– Opportunity to respond or appeal in some way
Worker’s compensation
• Mutually beneficial social insurance system
where the employer takes care of an injured
employee’s medical costs and part of the
salary in exchange for the waiver of the
employee’s right to sue.
Retaliation
• Retaliation may be said to occur when an employee
is subjected to adverse employment action (i.e.
termination) because of an action he took that was
within his rights (i.e. reported sexual harassment)
• Retaliation is more easily proved by the claimant
than other allegations. A claim includes:
– The employee engaged in protected activity
– The employer took adverse action against the employee
– A causal connection exists between the protected activity
and the adverse employment action
Whistleblowing
• Whistleblowing is the action in which an
employee reports employer misconduct to
legal authorities. It is supported by
– The Elder Justice Act
– False Claims Act
• Whistleblowers do NOT have to report the
misconduct internally to management first
Social Media
• As employees become more adept in using social
media, employers must take care in policing so as
not to impinge upon freedom of speech
• Employers need to implement policies that clearly
define what is and is not permitted during work
hours in terms of us of company computer
– Define confidential information that is not to be shared
– Prohibit defamation, harassment and use of
questionable websites
Background Checks
• Background checks are required in many
states and help minimize the risk of Negligent
hiring.
• Healthcare organizations must perform due
diligence when hiring:
– Background check for criminal record or other
disqualifying actions
– Validating credentials
Incivility and Violence
• Poor and/or disruptive behavior (some of
which is violent) by physicians and nurses is
well documented.
• Ignoring this problem can increase the risk of
patient and employee safety as well as of
litigation and penalty
Defamation
• As part of their due diligence, prospective
employers will contact previous employers to
requesting a reference. This may cause a
dilemma for the previous employer:
– Should they provide true information about the
applicant and perhaps open the organization up to
defamation charges?
– If they do not disclose information regarding the
potential for future harm to patients, is the
previous employer liable should harm take place?
Recommended Risk Management
Strategies for Employers
• Address issues of microinequity which, alone
may appear of little concern, but over time
have large implications to employee morale,
retention and patient safety
• Nurture employee engagement
• Management should be proactive in
monitoring provider and employee behavior
• Be consistent in application of policy
Summary
• It is crucial to understand employment
laws and how they relate to the facility
– Ignorance may lead to increased risk of
employment related lawsuits
– Patient safety may also be at risk if
employment laws are not followed
• Management staff and employees must
know and follow employment policies
Chapter 2:
Regulatory Environment
Most Regulated Industry
• Health Care is one of the most regulated
industries in the US.
• It is vital to be aware of and understand
what regulations may affect the facility.
Standards
Statements concerning proper procedures
taken in a given situation:
• Explicit or implicit
• National or local
• Validated or Consensual
• Used or ignored
• Periodically updated or static
Legal Standards
• Judicial system (court decisions) provides
initiative for implementing standards public
health rules
– Disease reporting requirements
– Immunizations
– Worker’s comp
– Licensing of professionals
Federal Mandatory Regulations
• CMS
• OSHA
• HIPAA
• EMTALA
• Mammography Quality Standards Act
• Safe Medical Devices Act
• MedWatch
• MWTA
• EPA
State Mandatory Regulations
• Professional Licensure of Providers
• Smoke-free Workplaces
• Smoke-free Environment
• Violence Prevention
State Mandated Risk
Management Legislation
• Risk Management Responsibility
• Governing Body Involvement
• Risk Identification
• Risk Analysis
• Risk Management Education
State Mandated Risk
Management Legislation
• Sharing Information
• Patient Grievance Procedures
• Immunity and Confidentiality for Providers
• Risk Management Follow-up Procedures
Reimbursement Standards
Payers set their own standards for
reimbursement
• Fee for service
• Negotiated fees
• Capitation
• Prospective payment
• RBRVS
Medicare Incentives to Improve Quality
• Evidence based medicine in now generally
accepted as essential to effective and safe
medical practice.
• This link was presented in 2 seminal works
from IOM:
– Crossing the Quality Chasm
– To Err Is Human
Deficit Reduction Act 2003 and Beyond
• Pay for Posting
• Pay for Performance
• Value Based Purchasing
• Scores and Withhold Determination
False Claims Act
• Anti-fraud activities
• Lawsuits
• Revocation of Medicare participation
Practice Guidelines
• Accreditation Programs develop standards
and facilities can voluntarily apply for review
– Joint Commission on the Accreditation of
Healthcare Organizations (Joint Commission)
– National Committee for Quality Assurance
(NCQA)
• Many equate facility accreditation with quality
– Medicare accepts a JCAHO accreditation as
evidence that a hospital meets Medicare
conditions of participation
Summary
• IGNORANCE of the Law is no excuse
• Know the regulations
– Identify which ones are pertinent to the facility
– Ensure that appropriate policies are in place
– Document compliance