Human factors in health and safety-critical systems

Human factors is an engineering discipline, and its evidence base is a literature of measured decrements, classified accidents and controlled redesigns. Where a failure can injure someone, the useful question is not whether the operator was careless. It is what the work made likely, and what would have to change.

Human error is real, and it is rarely the cause

Reason draws the distinction that carries most of the argument (Reason, 2000). The person approach focuses on the unsafe acts of people at the sharp end. It treats those acts as products of inattention, carelessness or recklessness, and it reaches for another procedure, retraining and blame. The system approach starts from a different premise. Humans are fallible, and errors are to be expected even in the best organisations. Errors are consequences rather than causes, with their origins in upstream factors such as recurrent error traps in the workplace and the organisational processes that produce them.

The classification follows. The unsafe acts at the sharp end are active failures: slips, lapses, fumbles, mistakes and procedural violations. The upstream problems are latent conditions, which come from decisions made by designers, builders, procedure writers and senior managers. Latent conditions create error-provoking local conditions, such as time pressure, understaffing, fatigue and inexperience, and lasting holes in the defences.

Reason's worked case is Chernobyl. The operators violated plant procedures and switched off successive safety systems, which created the immediate trigger for the explosion. His judgement is that the absence of a reporting culture in the Soviet Union contributed crucially to the disaster (Reason, 2000). The proximal act was real. The cause sits further back, and the person who acted is not where the explanation ends.

Swiss cheese, and the argument that it asks the wrong question

The Swiss cheese model is the field's best-known picture. A hazardous system has many defensive layers, engineered, human and procedural. Each has weak points, and those holes open, close and move. A bad outcome usually needs the holes in several layers to line up, so that an accident trajectory reaches the hazard (Reason, 2000). Its practical value is that latent conditions can be found and fixed before anything happens. Reason's analogy: active failures are mosquitoes to be swatted one by one, and the better remedy is to drain the swamp they breed in.

The contested question is whether that picture points at the right thing. Hollnagel, Wears and Braithwaite argue that it does not go far enough (Hollnagel, Wears and Braithwaite, 2015). Their Safety-I treats safety as a state in which as few things as possible go wrong. It presumes that failures come from identifiable malfunctions of components, and it casts people as the most variable and therefore the most suspect of those components. Safety-II redefines safety as the ability to succeed under varying conditions, treating everyday performance variability as the reason work usually goes right. It changes the purpose of investigation from explaining failure to understanding success.

The white paper is a position statement rather than a study, and it argues for combining the two views. It records that healthcare safety has improved slowly since the 2000 report To Err is Human, and that harm rates appear stable while demand and complexity rise.

Situation awareness has three levels, and the problem is measuring it

Situation awareness is the operator's picture of what is happening, defined by Endsley as the perception of the elements in the environment within a volume of time and space, the comprehension of their meaning, and the projection of their status in the near future (Endsley, 1995a). The three clauses are the three levels: perception, comprehension and projection.

The model is separate from decision making and from performance: an accurate picture can still yield a bad decision, and a wrong picture can still yield a sound one (Endsley, 1995a). Attention and working memory are the binding constraints, and mental models relieve them.

The errors follow the levels. At Level 1 a crew can fail to perceive something important, or misperceive it, and an interface that withholds a warning makes that likely. At Level 2 the cues are present and their relevance to the goal is missed; Endsley records accident reports where the information was available and the crew did not connect it to their goal (Endsley, 1995a).

Measuring the construct without disturbing the task is the hard part, and Endsley treats it as a design problem (Endsley, 1995b). Workload will not serve as a proxy: the theory paper notes that situation awareness and workload vary independently (Endsley, 1995a). Her method interrupts a running simulation and queries the operator on the state of things. In two studies the interruption did not disturb normal behaviour, and memory decay did not limit recall, which answers the objection that the technique measures memory rather than awareness. The limits matter: the validity evidence comes from aviation simulation, the technique freezes the task it observes, and the query set must be fixed in advance.

Vigilance: the decrement is larger than intuition suggests

An operator who must stay alert for a rare signal is doing a vigilance task, and sensitivity to that signal deteriorates with time on task. See and colleagues pooled 42 vigilance studies and confirmed that the sensitivity decrement is substantial (See, Howe, Warm and Dember, 1995). Their analysis also refined when it appears. Its magnitude depends on the type of discrimination the task demands and on the rate at which events are presented. The authors conclude that the taxonomy should be revised to add a dimension they call the sensory-cognitive distinction.

The practical reading is a prediction about task design. Take a successive discrimination, where the operator has to hold a standard in memory and compare each signal against it, and combine it with a high event rate. Those are the conditions under which sensitivity falls fastest. Make the comparison simultaneous, or lower the event rate, and the decrement reduces.

The translation needs care. The pooled studies are laboratory tasks, and their control is what makes the effect visible. A ward at night adds interruption, sleep debt and competing goals, which the meta-analysis cannot separate.

How more alarms made care less safe

Alarm fatigue is the case where a safety feature became a hazard, and the counts are the argument. Drew and colleagues collected every alarm from the monitors in five adult intensive care units for 31 days, covering 461 consecutive patients (Drew et al., 2014). 2,558,760 unique alarms occurred in the month. 381,560 of them were audible, a burden of 187 audible alarms per bed per day. Clinicians annotated 12,671 arrhythmia alarms, and 88.8 per cent were false positives. Of 168 true ventricular tachycardia alarms, 93 per cent were not sustained long enough to warrant treatment.

Most of those alarms were not technically broken. They came from inappropriate settings, persistent atrial fibrillation, and non-actionable events such as isolated premature beats and brief ST-segment changes. The result is an environment in which the signal carries almost no information.

The recommended responses follow from the diagnosis: use all available leads to find one with an adequate signal, prompt clinicians to tailor settings to the patient, limit atrial fibrillation alarms to onset and termination, make parameter-alarm delays configurable, and turn non-actionable events into inaudible text. The limits are real: one centre's monitors and one software version, and the mechanism, a desensitised clinician, is inferred from the alarm conditions rather than measured in the staff. The study did not test whether its own recommendations reduce harm.

The system that was meant to prevent the error also helped create it

Ash, Berg and Coiera studied patient care information systems in the United States, the Netherlands and Australia, and they report a category they call silent errors (Ash, Berg and Coiera, 2004). Their framework splits those failures in two.

The first category is entering and retrieving information. Where a system demands elaborate structured entry, clinicians spend longer recording than they did on paper, and moving through many fields and screens cost physicians their cognitive focus. The second category is communication and coordination, which the paper argues is misrepresented as information transfer. A physician may assume that entering an order replaces the previous way of communicating the plan, and that it will be carried out without further action. When that assumption fails, orders and appointments are missed and medication is not given.

Their conclusion is the sentence to keep: information systems are not on their own a sufficient fix, and a rush to implement them might endanger care more than help it. The limits are plain. The argument rests on the authors' own qualitative studies and their professional judgement, so it establishes mechanisms rather than rates.

The unit of analysis is the work system, not the worker

If error is shaped by the conditions of work, the thing to model is the conditions. Carayon and colleagues set out the Systems Engineering Initiative for Patient Safety model, or SEIPS, as a framework relating the structures, processes and outcomes of care (Carayon et al., 2006). A work-system model gives an investigation somewhere to go after it has named the person who acted, since that person is one component among several that produced the performance. The paper shows the move with an application in outpatient surgery.

This is where human factors separates itself from the vocabulary of blame. In Reason's system approach the question after an adverse event is not who blundered but how the defences failed, and the search runs back to the decisions that created the conditions (Reason, 2000). Two findings make a systemic remedy possible: error is not the monopoly of a few unreliable people, and adverse events fall into patterns, so the same circumstances provoke similar errors in different people.

The limits belong with the claim: SEIPS is a model with an illustrative application, not a comparative test, and its detail belongs in the paper.

Usability as regulated practice: what a manufacturer must prove

In healthcare the interface is not a matter of taste, because a manufacturer has to demonstrate that use error was addressed. IEC 62366-1 specifies a process for a manufacturer to analyse, specify, develop and evaluate the usability of a medical device as it relates to safety (International Electrotechnical Commission, 2020). The process permits the manufacturer to assess and mitigate risks associated with correct use and with use errors, that is, normal use.

Read that as a set of obligations, because it changes what a usability activity is for. A formative test that finds three confused users is input to design, not evidence of compliance. The file has to carry the hazard analysis, the use specification, the evaluated interface, and the evidence that the identified use errors were assessed and mitigated. Usability becomes an argument with evidence attached, which is the same shape as a safety case.

The standard is candid about its boundary. It can be used to identify but not to assess or mitigate the risks of abnormal use (International Electrotechnical Commission, 2020). Safety-case reasoning for interactive systems is thinner than in aviation or process control, and most practitioners meet it through documents such as this one.

Reporting, learning, and where enthusiasm outruns evidence

Organisational learning depends on what an organisation is willing to hear. Reason's condition is a reporting culture, and behind it a just culture, meaning a shared understanding of where the line falls between blameless and blameworthy acts (Reason, 2000). Without detailed analysis of mishaps, incidents and near misses, an organisation cannot find its recurring error traps. The person approach's remedies, which include appeal to fear, another procedure, retraining and blame, do not produce that analysis.

Safety-II changes what an investigation is for: where Safety-I seeks causes and contributory factors, Safety-II seeks an understanding of how work usually succeeds (Hollnagel, Wears and Braithwaite, 2015).

Digital health is where enthusiasm most often outruns evidence. Blandford and colleagues set out seven lessons from interdisciplinary work on interactive digital health interventions (Blandford et al., 2018). Human-computer interaction prefers formative evaluation, which asks how a design performs with users. Health research prefers summative evaluation, which asks whether the intervention worked against a comparison. The two cultures also differ in what counts as acceptable evidence and in how results are reported.

State which question the evidence answers. A usability finding does not establish a health benefit, and a trial result does not explain why an interface failed on a ward. The obligations that attach to the data such systems hold, and to the people they act on, come next.