High-Reliability Organizations & Checklists
A board-focused review of high-reliability organizations—their five principles (Weick & Sutcliffe) and just-culture foundation—and the checklists and bundles (WHO Surgical Safety Checklist, central-line/CLABSI bundle, Universal Protocol Time Out) that prevent never events, plus how to analyze error using RCA vs FMEA and where standardization versus forcing functions sit in the safety hierarchy.
What HROs are and why boards test them
High-reliability organizations (HROs) sustain near-error-free performance despite operating in high-risk, complex conditions—modeled on aviation, nuclear power, and aircraft carriers. In medicine the HRO framework underpins the modern culture of safety: preventable harm is treated as a system property, not merely individual failure. Checklists are the signature HRO tool—they offload memory, standardize critical steps, and force communication at high-risk transitions.
On Step 2 CK/Step 3, this appears as patient-safety and quality-improvement (QI) vignettes: a near-miss, a wrong-site surgery averted by a Time Out, a nurse empowered to "stop the line," or a central-line bundle that drives CLABSI toward zero. The recurring exam theme is systems thinking—fix the process, build in redundancy, and make non-punitive reporting the default. Learn to distinguish the five HRO principles, the Swiss cheese model of error, and the two error-analysis tools (RCA vs FMEA).
Five HRO principles (Weick & Sutcliffe):
- Preoccupation with failure — treat every near-miss as free data; report and analyze it rather than celebrate the "save."
- Reluctance to simplify — reject easy explanations ("the nurse was careless"); dig for latent system causes.
- Sensitivity to operations — keep real-time situational awareness of frontline work.
- Commitment to resilience — build capacity to detect, contain, and recover from inevitable errors.
- Deference to expertise — in a crisis, authority shifts to whoever has the most relevant knowledge, regardless of rank ("stop-the-line" authority for any team member).
Core enablers: just culture (non-punitive reporting), standardization, redundancy, and forcing functions—design that makes the wrong action physically impossible (e.g., incompatible ENFit connectors so enteral tubing cannot attach to IV lines). Forcing functions sit at the top of the safety-intervention hierarchy, above education or reminders.
WHO Surgical Safety Checklist — three phases:
- Sign In (before anesthesia induction): confirm identity, site, procedure, consent; check allergies, airway/aspiration risk, pulse oximeter on and functioning.
- Time Out (before skin incision): whole team confirms correct patient / site / procedure, antibiotic prophylaxis within 60 min, imaging displayed, critical events anticipated.
- Sign Out (before leaving OR): instrument/sponge/needle counts, specimen labeling, equipment problems.
Central-line (CLABSI) bundle (Pronovost, Michigan Keystone): hand hygiene, maximal sterile barrier, chlorhexidine skin prep, avoid femoral site, daily review of line necessity → near-zero CLABSI.
Universal Protocol (prevents wrong-site/procedure/person): (1) pre-procedure verification, (2) mark the site, (3) Time Out.
Swiss cheese model (Reason): harm occurs when holes in successive defenses align. Active errors = frontline "sharp end"; latent errors = hidden system/design flaws at the "blunt end."
Vignette: A patient is scheduled for a left total knee arthroplasty. In the OR, the surgeon—running behind—begins prepping the right knee. The circulating nurse notices that the consent and imaging specify the left knee and speaks up before incision.
What this is / next step: the Time Out of the Universal Protocol, illustrating deference to expertise and stop-the-line authority. Best action: halt and perform (or repeat) a full Time Out—the entire team verbally verifies correct patient, site, and procedure against the consent, marked site, and imaging before skin incision.
Wrong answers to avoid: proceeding because the attending is senior; relying on memory; deferring the check until after draping. Wrong-site surgery is a "never event" / sentinel event—prevented by verification and site marking, and, when it occurs or is narrowly averted, analyzed afterward with root cause analysis (RCA).
Vignette: A nurse nearly administers a 10-fold insulin overdose because the order read "10U" and the trailing "U" was misread as a zero ("100"). She catches it before administration. Unit policy asks staff to log such events in a voluntary, non-punitive incident-reporting system.
Best next step: file a near-miss/incident report and analyze the system contributors—here, the error-prone abbreviation "U" for units (Joint Commission "Do Not Use" list). This reflects preoccupation with failure: near-misses are studied as vigorously as actual harm. Standardization fix: ban "U," require "units" spelled out. A true forcing function would be a smart infusion pump with hard dose limits that blocks the 10-fold dose outright.
Just-culture principle: because this is human error within a flawed system, the response is to console and fix the process, not discipline the nurse. Punishing honest error suppresses reporting and destroys the safety culture. Reserve discipline for reckless behavior.
RCA vs FMEA
| Feature | Root Cause Analysis (RCA) | Failure Mode & Effects Analysis (FMEA) |
|---|---|---|
| Timing | Retrospective (after event) | Prospective (before event) |
| Trigger | Sentinel/adverse event or near-miss | Designing/redesigning a high-risk process |
| Core question | "What happened and why?" | "What could go wrong?" |
| Stance | Reactive; interdisciplinary team | Proactive; risk-prioritized |
| Tools | 5 Whys, fishbone (Ishikawa) diagram | Severity × occurrence × detectability (Risk Priority Number) |
| Output | Action plan targeting system causes | Redesign to prevent predicted failures |
Just culture: matching behavior to response
| Behavior | Definition | Example | Response |
|---|---|---|---|
| Human error | Inadvertent slip / lapse / mistake | Grabs a look-alike vial by accident | Console; fix the system |
| At-risk behavior | Unsafe shortcut; risk not perceived | Skips a double-check "to save time" | Coach; remove incentives for the shortcut |
| Reckless behavior | Conscious disregard of substantial risk | Operates while impaired; ignores the Time Out | Discipline/sanction |
Practice Patient Safety now
Board-style questions, spaced-repetition flashcards, and a Socratic AI tutor — free to start.