Healthcare Certified Safety and

Infection Preventionist course

Module 2: Risk Management Process

Session 1
Risk Management History

Participant Manual 1
 Introduction

• Risk management is routine in most industries and has traditionally been associated
with limiting litigation costs. Usually associated with patients taking legal action
against a health professional or hospital.

• To avoid problems, hospitals and health organizations use a variety of methods to

manage risks, hospitals are potentially dangerous places for patients as well as

medical workers.

• It’s important to keep in mind that while there are a lot of potential hazards in

hospitals.

Risk Management… Definition

“Is a whole process of initiation, risk identification, evaluation,

response development, implementation, continuous monitoring,
and review to reduce the risk of injury to patients, staff, and
visitors and the risk of loss to the organization itself”.

Participant Manual 2
 Early Risk Management (Pre-20th Century)

• Informal approach to patient safety

• Ethical guidelines from Hippocrates ('Do no harm')

• No formal regulations; reliance on personal reputation

Rise of Medical Malpractice (20th Century)

• Growth of hospitals and medical advancements

• Increase in medical malpractice lawsuits (1960s-1970s)

• Need for structured risk management programs

Participant Manual 3
 Malpractice Crisis – 1970’s
• Risk Management entered the health care industry
in response to the growing national malpractice
insurance crisis
• Quality Assurance nurses performed incident
report review and trending in acute care hospitals
• Little to no proactive loss prevention or control
activities

Establishment of Risk Management Programs

• 1970s: Hospitals began hiring risk managers

• 1971: Harvard Medical Practice Study on malpractice
• Joint Commission (JCAHO) mandates risk management programs in
hospitals

Participant Manual 4
 ASHRM - 1980

• American Hospital Association developed of the

American Society for Healthcare Risk Management
(ASHRM)
• Began risk management education programs
• Hospital Risk Managers broadened their knowledge and
approach to loss prevention

Legal and Regulatory Milestones

• 1986: National Practitioner Data Bank (NPDB) established.

• 1999: Institute of Medicine report *To Err Is Human* (patient safety

focus).

• Health Insurance Portability and Accountability Act - HIPAA (1996):

Privacy and security regulations.

Participant Manual 5
 Strategic Risk Management - 1990’s

• Shift from reactive to strategic risk management

What does that mean?

• Centralized incident reporting and management

– Increased communication between departments
– Trending and analyzing incidents across the organization

Legal Collaboration

• Evolved into protecting patients, visitors and staff and assets of the
organization
• Identifying and address all sources of risks
• Collaboration with the legal department
• Working with all departments to meet regulatory requirements

Participant Manual 6
 To Err is Human

“To Err is Human:

Building a Safer Healthcare System”

• 98,000 US deaths attributable to medical errors

• Estimated cost of preventable healthcare related injuries ranged
from $17 – 29 billion
• Quality, safety and risk management become linked
Institute of Medicine, (1999) National Academy Press

Patient Safety and Quality

Current movement to integrate risk
management and quality departments
– Both look at identifying problems and
implementing solutions
– More interventions aimed at reducing likelihood
of recurrence and improving care
– Integrated database link adverse events with
outcomes

Participant Manual 7
 Risk Management in Healthcare
• Comprises the clinical and administrative systems, processes, and
reports employed to detect, monitor, assess, mitigate, and prevent
risks.

• By employing risk management, healthcare organizations

proactively and systematically safeguard patient safety as well as
the organization’s assets, market share, accreditation,
reimbursement levels, brand value, and community standing.

Scope of the Risk Management…1

Risk Management can be beneficial in the following contexts:

1. Enterprise Risk Management (ERM): Comprehensive risk management of the
organization from top down including financial and business viability.
2. Patient care (Clinical)
3. Medical staff (such as; credentialing, privileging, job description, employee
insurance, trainings, medical coverage)
4. Non-medical staff (such as; job description, training, medical coverage)
5. Financial (Budgeting, cost-benefit and cost effectiveness analysis, insurance
coverage)

Participant Manual 8
 Scope of the Risk Management…2

Risk Management can be also beneficial in the following contexts:

6. Managerial (such as organogram, job descriptions, delegation of work)
7. Project risk management (such as scope, time, cost, human resources,
operational, procedural, technical, natural and political)
8. Facility Management and Safety (such as building safety, security of the facility,
hazardous materials and waste disposals (HAZMAT), emergencies internal
and external, fire safety, medical equipment maintenance plan and
maintenance plan for each of the utility system)

The Eight Risk Domains of ERM…1

[Link]: The people, processes and systems that run the business
fall into this category. Risks arise when those operations fail, whether
that’s accidentally exposing private data or hosting a community event with
dangers present.
[Link] Safety: Delivery of care can also introduce risks. This domain
encompasses all those risks and can include incorrectly filled prescriptions
or patients acquiring an infection while at the hospital.
[Link]: The healthcare landscape changes rapidly, challenging the
company’s direction. When healthcare organizations struggle to adapt,
don’t follow new marketing or media relations regulations or fail to maintain
partnerships, risks can arise.
[Link]: Anything that could threaten an organization’s bottom line is
considered a financial threat. This could include anything from medical
malpractice to insurance to rising inflation and equipment costs.

Participant Manual 9
 The Eight Risk Domains of ERM…2
5. Human capital: At their core, healthcare organizations are people serving
people. This is essential, but it also comes with risk. Human-related risks
include employee recruitment and retention, workplace injuries and
termination.
[Link]: Healthcare is a highly regulated industry and, as such, carries
ample risk for organizations that fail to comply with regulations. The Health
Insurance Portability and Accountability Act (HIPAA) is the most well-known and
carries unique penalties, but regulatory risk also includes accreditation, licensure
and more.
[Link]: Healthcare is increasingly digital and even more so with the
adoption of virtual appointments. It’s valuable but also risky, whether that’s
technology for training, diagnosis, or managing Electronic Health Records (EHR).
[Link]: This domain encompasses risks that could impact physical locations.
Think building age, any valuables on-site, and natural disasters like earthquakes
or hurricanes.

Future Trends for Risk Management

• AI and predictive analytics in risk management

Integration of technology (electronic health records, AI)
• Emphasis on patient-centered care and safety culture
• Data-driven decision-making
• Telemedicine and its associated risks
• Stricter regulatory compliance and patient advocacy

Participant Manual 10
 Current Challenges in Health Care Risk
Management
• Financial and Operational Strain: Proposed policy shifts, such as Medicaid and Medicare cuts,
are expected to increase uncompensated care and pharmaceutical costs.
• Regulatory Compliance: Ensuring compliance with rigorous standards like HIPAA is crucial.
Violations can result in substantial fines, requiring continuous policy updates, staff training, and
practice monitoring.
• Patient Safety: Medical errors, including misdiagnoses and medication mishaps, remain a
leading cause of harm.
• Workforce Challenges: Staffing shortages, burnout, and high turnover rates affect operational
efficiency and increase the likelihood of errors.
• Technological Implementation: While technologies like AI and robotic surgery promise improved
diagnostics and treatment, they pose challenges regarding implementation, reliability, and
ethical considerations.
• Resource Allocation: Balancing financial pressures with maintaining quality care and patient
safety is challenging.

Session 2
Risk Management Professional

22

Participant Manual 11
 Session Objectives
At the end of this session, participants will be
able to:

1. Describe the roles and responsibilities of a hospital

risk manager.

2. Develop a Risk Manager job description.

Purpose of Risk Manager

The purpose of a Risk Manager in a healthcare organization is multifaceted,
focusing on ensuring patient safety, regulatory compliance, and operational
efficiency.
Creating
Conduct Promote a
and
thorough culture of
maintainin
risk safety and
Ensure the Establish g safe
assessme continuous
Develop organizati and systems of
nts to improvem
and on manage care,
identify ent by
implement complies systems designed
potential regularly
strategies with for to reduce
threats to reviewing
to mitigate healthcare reporting adverse
patient and
identified regulation and events
safety, enhancing
risks. s and analyzing and
staff, and risk
standards. incidents. improve
the managem
human
organizati ent
performan
on. practices.
ce.

Participant Manual 12
 Operations
• Encourages and fosters a culture of safety and a safe work
environment
• Reviews policies and procedures for conformance with ethical
principles, e.g. patients’ rights.
• Develops, coordinates, and evaluates the facility-wide risk
management plan for risk identification, investigation, and reduction
• Participates on committees directed towards promoting patient
safety issues, e.g. safety, quality and infection prevention

Loss Prevention & Patient Safety

• Performs risk surveys and inspects patient care areas
• Conducts proactive analysis of patient safety and medical
processes
• Participates in the process of disclosure for medical errors
• Participates in root cause analysis investigation and reporting
of adverse drug events and sentinel events
• Maintains awareness of legislative and regulatory activities
related to health care risk management

Participant Manual 13
 Data Management

• Maintains risk management statistics and files

• Receives incident reports and other information regarding
untoward occurrences in the facility
• Collates information systematically for analysis
• Prepares reports to management regarding trends/patterns
and findings
• Designs and conducts risk management surveys and studies
to assist in long-term planning and changes to facility
policies and systems that reduce risk and losses

Education
• Plans, develops and presents educational material on topics
related to bioethics and risk management
• Acts as a resource and educator for patient safety/risk
management issues
• Responds to professional and facility liability questions
• Disseminates information on claim patterns and risk control,
as well as legislative and regulatory changes

Participant Manual 14
 Risk Manager and other hospital officers
Risk Manager

Quality Officer

Safety Officer

Infection
Prevention

29

Summary
Risk Manager

Core Responsibility Key Functions Essential Skills Overall Goal

Strong analytical and

Conducts risk problem-solving
assessments and Minimize harm and
abilities.
Identifies, assesses, analyses. optimize the delivery
and mitigates risks to Excellent of safe, high-quality
Develops and communication and healthcare.
patient safety, quality implements risk
of care, and interpersonal skills.
mitigation strategies. Fosters a culture of
organizational stability. Knowledge of safety.
Ensures compliance healthcare regulations
with healthcare and best practices.
regulations and
standards
30

Participant Manual 15
 Exercise

As groups, create JOB DESCRIPTION for risk manager at your

organization.

31

Session 3
Bioethics and Risk Management

32

Participant Manual 16
 Session Objectives
At the end of this session, participants will be able to:

1. Define bioethics.
2. Identify key principles of bioethics.
3. Describe how bioethical principles relate to risk management.
4. Develop a Code of Ethics for the profession of Risk Managers.

What is bioethics?

Bio = life
Ethics = morals (right vs wrong)

Deals with issues relating to all aspects of life's beginning, ending and
quality

Can you think of some examples?

Participant Manual 17
 Human Dignity and Rights
• Human dignity, human rights and fundamental freedoms are
to be fully respected.
• The interests and welfare of the individual should have
priority over the sole interest of science or society.

Benefit and Harm

In applying and advancing scientific knowledge, medical practice and

associated technologies, direct and indirect benefits to patients,
research participants and other affected individuals should be
maximized and any possible harm to such individuals should be
minimized.

Participant Manual 18
 Autonomy & Individual Responsibility

❑The autonomy of persons to make decisions, while taking

responsibility for those decisions and respecting the autonomy of
others, is to be respected.
❑For persons who are not capable of exercising autonomy, special
measures are to be taken to protect their rights and interests.

Consent

• Any preventive, diagnostic and therapeutic medical intervention is

only to be carried out with the prior, free and informed consent of
the person concerned, based on adequate information.
• May be withdrawn at any time and for any reason without
disadvantage or prejudice

Participant Manual 19
 Human Vulnerability

• In applying and advancing scientific knowledge, medical practice

and associated technologies, human vulnerability should be taken
into account.
• Individuals and groups of special vulnerability should be protected
and the personal integrity of such individuals respected.

Which groups of patients are considered vulnerable?

Protection of Vulnerable Groups

❑ We should have an obligation to protect patients, prevent abuse or neglect from
occurring, and to report any and all information concerning occurrences where
abuse or neglect may have occurred.

❑ Adopt the following groups as vulnerable groups:

• Children
• Elderly
• Comatose patients
• Restrain patients
• Dying patient
• Disabled patient.

Participant Manual 20
 Privacy and Confidentiality
Key Differences
• Focus: Privacy is about the individual's right to control their
personal information, while confidentiality is about the duty of
healthcare providers to protect patient information.
• Scope: Privacy covers all personal information, whereas
confidentiality is specific to information shared within professional
relationships.
• Control: Privacy emphasizes individual control over information,
while confidentiality emphasizes the responsibility of professionals
to safeguard information.

Equality, Justice and Equity

Equality:
Providing the same level of care and resources to everyone, regardless of individual circumstances. It
ensures uniform treatment but doesn't account for varying needs.
Justice:
Fair distribution of resources and treatments, ensuring no group is unfairly disadvantaged. It involves
ethical decision-making to balance the needs of different groups.
Equity:
Tailoring care to meet the specific needs of individuals and groups, addressing social determinants of
health. It aims to eliminate health disparities by ensuring fair access to healthcare resources.

Participant Manual 21
 Non-discrimination

No individual or group should be discriminated against or

stigmatized on any grounds, in violation of human dignity, human
rights and fundamental freedoms.

Respect for Cultural Diversity

The importance of cultural diversity should be given due regard.

Hospitals need to recognize the various ethnic groups that they serve
and develop programs/services accordingly, e.g. accommodating
language and religious customs.

Participant Manual 22
 Addressing Bioethical Issues

• Professionalism, honesty, integrity and transparency in decision-

making
• Declarations of all conflicts of interest and appropriate sharing of
knowledge
• Use the best available scientific knowledge and methodology in
addressing and periodically reviewing bioethical issues
• Persons and professionals concerned and society as a whole
should be engaged in dialogue on a regular basis.

Ethics Committee

Multidisciplinary ethics committees should be established,

promoted and supported at the appropriate level in order to:

(a) assess the relevant ethical, legal, scientific and social issues related to research
projects involving human beings.
(b) provide advice on ethical problems in clinical settings.
(c) assess scientific and technological developments, formulate. recommendations
and contribute to the preparation of guidelines on ethical issues.
(d) foster debate, education and public awareness of, and engagement in, bioethics.

Participant Manual 23
 Bioethics and Risk Management
Bioethical principles provide the moral framework that guides risk
management practices, ensuring that they are not only effective but
also, ethically sound.
How they relate??
Autonomy Beneficence Non-maleficence Justice

• In risk management, • Risk management • This principle, "do • Risk management

respecting patient aims to maximize no harm," is should ensure
autonomy means benefits and fundamental to equitable access
ensuring informed minimize harm. risk management. to care and fair
consent is obtained
.This involves clearly This aligns directly Risk management distribution of
communicating with beneficence, practices are resources.
potential risks and which requires designed to
benefits, allowing healthcare prevent harm to
patients to make professionals to patients, staff, and
informed decisions. act in the best the organization.
interests of their
patients.
47

Session .4
PATIENT SAFETY

48

Participant Manual 24
 Take a look at this picture—what stands out to you?

49

Landmark Institute of Medicine

To
44,000-98,000
IOM
Crossing
The
blaming
are
system
to Err
improve
treated
problem
biggest
(1999)
(2001)
is is
Human
individuals
the
changing
not
the
challenge
Quality
is not
patients
as
system
personal
bad
for
the
Chasm:
to
errors
people;
and
culture
amoving
year
failures,
prevent
AtoNew
die
from
the
one
toward
from
problem
Health
but
harm.”
in
one
which
as
health
aofsafer
opportunities
System
iserrors
that
care.
health
the
for the
system
21stneeds
Century,
to be made safer . . .”
(IOM) report

44,000-98,000 patients a year die from health care.

IOM (1999)
To Err is Human The problem is not bad people; the problem is that the system needs to
be made safer . . .”

IOM (2001) The biggest challenge to moving toward a safer health

Crossing the Quality
system is changing the culture from one of
Chasm: A New Health
System for the 21st blaming individuals for errors to one in which errors
Century, are treated not as personal failures, but as opportunities
to improve the system and prevent harm.”

Participant Manual 25
 To Err is Human: Building a Safer Health
System
• More than two-thirds (70 percent) of the adverse events found in this
study were thought to be preventable, with the most common types
of preventable errors being technical errors (44 percent), diagnosis
(17 percent), failure to prevent injury (12 percent) and errors in the
use of a drug (10 percent).

51

The Scope of Medical Error

▪ Tens of thousands of people die each year and many more are
injured due to preventable medical errors.
▪ The organizational culture regarding patient safety is key to
meaningful improvements.

Institute of Medicine. To err is human: Building a safer health system, 2000.

Participant Manual 26
 International Data
▪ Two-thirds of medical errors are preventable
▪ One-quarter of adverse events are due to negligence
▪ Frequency and severity are probably underestimated
▪ Patients age 65 or older are at a greater risk

Patient Safety Definition

• Is freedom from accidental injury due to medical care, or medical

errors.
IOM, 2000

• Is a health care discipline that emerged with the evolving complexity

in health care systems and the resulting rise of patient harm in
health care facilities. It aims to prevent and reduce risks, errors and
harm that occur to patients during provision of health
care.
WHO

54

Participant Manual 27
 Patient Safety Definition

• Freedom from accidental or preventable injuries produced by

medical care. Thus, practices or interventions that improve patient
safety are those that reduce the occurrence of preventable adverse
events.

SPSC Taxonomy

55

Key Concept of Patient Safety

• Understanding the problems and solutions related to patient safety

requires understanding the concepts behind these terms:

Error Medical error

Latent errors System Error
Human factors Near-miss
Adverse event Potential AE
Preventable AE Risk management
Negligence Malpractice

56

Participant Manual 28
 Key Concept of Patient Safety

❑ Error:
The failure of a planned action to be completed as intended or use of a
wrong or incorrect plan to achieve an aim
❑ Medical Errors:
An act of omission or commission in planning or execution that
contribute to an unintended results
❑ Latent Errors:
Are hidden problems within healthcare systems—such as design flaws
or organizational issues—that may not be immediately apparent but
can contribute to adverse events when combined with other factors.
57

Key Concept of Patient Safety

❑ System errors:
Refer to failures or breakdowns within healthcare processes, structures, or policies
that can lead to adverse patient outcomes.
❑ Human Factors:
Involve the study of how humans interact with elements of a system, aiming to
optimize human well-being and overall system performance. In healthcare, this
field examines the interactions between healthcare professionals, patients,
equipment, and the environment to design systems that support safe and efficient
patient care.
❑ Near- Miss:
Patient safety event that did not reach the patient

58

Participant Manual 29
 Key Concept of Patient Safety

❑ Adverse Event:
Patient safety event that results in harm to a patient

❑ Potential AE:
Often referred to as a "near miss," is an incident that could have
resulted in harm to a patient but did not, either by chance or timely
intervention. These events highlight areas where the healthcare
system may be vulnerable and provide opportunities for proactive
improvement.

59

Key Concept of Patient Safety

❑ Preventable AE:
An injury or harm to a patient that results from medical care and could
have been avoided through appropriate measures

❑ Risk management:
A structured approach to managing uncertainty related to a threat,
through a sequence of human activities including: risk assessment,
strategies development to manage it, and mitigation of risk using
managerial resources

60

Participant Manual 30
 Key Concept of Patient Safety

❑ Negligence:
Occurs when a healthcare professional fails to provide the standard of
care that a reasonably competent professional would have delivered
under similar circumstances, resulting in harm to the patient. This can
include acts of omission or commission that deviate from accepted
medical practices.
❑ Malpractice:
Specific type of negligence involving a healthcare provider's failure to
meet the standard of care, leading to patient harm. Common examples
include misdiagnosis, surgical errors, medication mistakes, or failure to
obtain informed consent
61

Medical Error
• Error of commission • Error of omission
• An error that occurs as a result of an • An error that occurs as a result of an action
action taken. not taken.
• Providing patients with a medical • Failing to provide the patient with a medical
intervention that results in an adverse intervention from which the patient would
event. have likely benefited.
• Failure of a planned action to be • Failure to carry out some of the actions
completed as intended or the use of a necessary to achieve a desired goal.
wrong plan to achieve an aim.

Participant Manual 31
 10 Facts on Patient Safety
❑Patient safety is a serious global public health concern.
❑It is estimated that there is a 1 in 3 million risk of dying while travelling
by airplane. In comparison, the risk of patient death occurring due to a
preventable medical accident, while receiving health care, is estimated
to be 1 in 300.
❑Industries with a perceived higher risk, such as the aviation and nuclear
industries, have a much better safety record than health care does.

[Link]
facts-on-patient-safety

10 Facts on Patient Safety

❑ Fact 1: One in every 10 patients is harmed while receiving hospital care (nearly
50% of them considered preventable).
❑ Fact 2: The occurrence of adverse events due to unsafe care is likely one of
the 10 leading causes of death and disability across the world
❑ Fact 3: The provision of safe services is extremely important across all levels of
health care, including in primary and outpatient (ambulatory) care, where the
bulk of services are offered. Globally, as many as 4 out of 10 patients are
harmed while receiving health care in these settings, with up to 80% of the
harm considered to have been preventable.
❑ Fact 4: At least 1 out of every 7 Canadian dollars is spent treating the effects of
patient harm in hospital care
❑ Fact 5: Investment in patient safety can lead to significant financial savings

Participant Manual 32
 10 Facts on Patient Safety
❑ Fact 6: Unsafe medication practices and medication errors harm millions of
patients and costs billions of US dollars every year
❑ Fact 7: Inaccurate or delayed diagnosis is one of the most common causes of
patient harm and affects millions of patients
❑ Fact 8: Hospital infections affect up to 10 out of every 100 hospitalized patients
❑ Fact 9: More than 1 million patients die annually from complications due to
surgery
❑ Fact 10: Medical exposure to radiation is a public health and patient safety
concern

[Link]

Disclosure

• What does disclosure mean?

Participant Manual 33
 Disclosure of Patient Safety Events

❑There is an obligation from the

healthcare team or organization to
communicate patient safety events to
patients and families.
❑Disclosure occurs when there has been
any harm, or there is risk of future harm,
related to a patient safety event.

Objectives of Disclosure Patient Safety

Events
❑ To inform and support patient and their families about
adverse event.
❑ Earn trust/possibly forgiveness of patient.
❑ Right thing to do.
❑ Patients expect it.
❑ Professional responsibility.
❑ Required by The Joint Commission for unanticipated
outcomes.
❑ Help avoid litigation and improve results.

Participant Manual 34
 Barriers preventing them from doing so:

1. Fear of litigation/ legal liability.

2. Fear of loss of credibility and reputation.

3. Fear of punishment by organization or loss of job.

4. Fear of loss of licensure.

5. Lack of knowledge of how best to deal with the incident.

6. Shame

How to Disclose
1. Manage the Patient’s condition
2. Contact your Risk Manager, Practice Manager or Legal Counsel as
soon as possible
3. Prepare for the Disclosure Meeting
4. The Disclosure Meeting
– Aim for the meeting to occur within 24 hours of discovering the adverse event.
– Express empathy, and acknowledge the patient’s/family’s expressed feelings.
Consistently communicate what is known or requires follow-up. Ensure the
patient/family that they will be kept informed, and provide appropriate contact
names and numbers. Clarify if the adverse event is an inherent risk of the
procedure, rather than an error. Discuss future known consequences of the
injury without speculating about all possible long-term consequences.

Participant Manual 35
 How to Disclose...
• Context: Privacy, body language, eye contact.
• Opening: Setting, the agenda, "I'd like to talk to you about..."Include apology.
• Narrative: Listen to patient & family, offer to explain.
• Emotions: Address & acknowledge emotions.
• Strategy & Summary: Share the plan going forward & contact information.

Seven Steps to Patient Safety

Step 1 -Build a safety culture

Step 2 -Lead & support your staff
Step 3 -Integrate risk management activity
Step 4 -Promote reporting
Step 5 -Involve & communicate with patients & public
Step 6 -Learn & share safety lessons
Step 7 -Implement solutions to prevent harm

Participant Manual 36
 Takeaways
➢ Patient safety is everyone’s responsibility
➢ Understanding the problem is the first step toward improvement
➢ When errors are viewed as an opportunity
for improvement rather than punishment, patients will benefit
➢Focus attention on high-risk processes
➢Learn from external groups
➢Redesign processes to eliminate the chance for failure
➢Make it easier for people to do the right thing

Questions and Comments

• Please don’t miss to evaluate module and complete posttest!

74

Participant Manual 37
 End of Module

75

Reference

1. Adapted from: UNESCO. Resolutions: Records of the General Conference (Volume 1) 33rd session Paris,
3-21 October 2005
2. Kevin Elliot Public Affairs Quarterly , Volume 16, Number4, October 2002.
3. Bultas, M. W., Taylor, J., Rubbelke, C., Schmuke, A. D., & Jackson, J. (2023). Anxiety and answer-
changing behavior in nursing students. Journal of Nursing Education, 62(6), 351–354.
[Link]
4. Ni, J., Chowdhury, N., & Giles, B. L. (2023). The latest national asthma education and prevention program
guidelines: A review for the busy pediatrician. Pediatric Annals, 52(4), e153–e158.
[Link]
5. Hallaran, A. J., & Jessup, S. J. (2023). Examining predictors of intention to leave in home care and
differences among types of providers. Journal of Nursing Management, 2023, Article 4120204.
[Link]
6. HIPAA (1996). Health Insurance Portability and Accountability Act.
7. Harvard Medical Practice Study (1991). Findings on medical malpractice.

Participant Manual 38
 Healthcare Certified Safety and
Infection Preventionist course

Module Two:
Risk Management Process

Session.5
INTRODUCTION TO RISK MANAGEMENT
PROCESS

Participant Manual
1
 Session Objectives

At the end of these sessions, the participants will be able to:

1. Differentiate between hazard and risk
2. Identify the essential elements of the risk management process .
3. Describe the risk management and risk assessment process
4. Identify risk assessment approaches
5. Explain ways to Identify risk in the healthcare organization .
6. Describe the analysis treatment plan .

What is Hazard? What is Risk?

Hazard
A hazard is anything that has the potential to cause harm. This could be a physical object, a
substance, a situation, or an activity. For example:

Physical hazards: Slippery floors, sharp objects.

Chemical hazards: Toxic chemicals, flammable substances.
Biological hazards: Viruses, bacteria.
Ergonomic hazards: Poor workstation design, repetitive movements.

Risk
Risk is the likelihood that a hazard will actually cause harm, combined with the severity of the harm
that could result. It is often expressed as a combination of:

Probability: How likely is it that the hazard will cause harm?

Impact: How severe would the harm be if it occurred?
In summary, while a hazard is something that can potentially cause harm, risk is the measure of the
likelihood and severity of that harm occurring.

Participant Manual
2
 Global Top 10 Risks for Healthcare Organizations

Increasing costs Healthcare delivery Patient data privacy

Compliance Lapse
for Cybersecurity quality & patient & Information
Regulatory changes &
medical services safety Security
regulatory scrutiny

Succession
Pandemic Healthcare Supply Chain challenges
Readiness Infections disruption Rapid speed of
and ability to
disruptive innovations
attract
and new technologies
and retain top
talent

Essential Elements of Risk Management

Communication Scope, Context, Risk Monitoring and

Risk Treatment
and Consultation and Criteria Assessment Review

Risk Identification Risk Analysis

Risk Evaluation

Participant Manual
3
 Seven popular risk assessment methodologies
There’s no one-size-fits-all risk assessment methodology that caters to the
needs of every decision-maker. Based on the range of choices you need to
make; you can select from the following seven methodologies:

Semi-
Quantitative Threat-based Dynamic
quantitative

Vulnerability-
Qualitative Asset-based
based

Risk Assessment Approaches

1. Proactive approach

2. Reactive approach

Participant Manual
4
 Identify Risks Process – Tools and Techniques

Effective risk identification is essential for proactive risk management. By using these
tools and techniques,
6
organizations can better anticipate and mitigate potential risks,
ensuring smoother operations and achieving objectives.

Documentation Review: Reviewing existing documents to identify potential risks.

Brainstorming: Group activity to generate ideas and solutions for identifying risks.

Interviewing: Conducting structured interviews with stakeholders to gather information about risks.

SWOT Analysis: Analyzing strengths, weaknesses, opportunities, and threats to identify risks.

Root Cause Analysis: Identifying the underlying causes of risks to understand their origin.

Employee Feedback: Gathering input from employees based on their experiences and observations.

Assumption Analysis: Reviewing assumptions made during planning to identify associated risks.

Tips for Effective Risk Identification in Healthcare

Establish Clear
Objectives
Engage a
Perform Regular
Multidisciplinary
Audits
Team

Use Structured
Gather Patient
Tools and
Feedback
Techniques

Stay Updated Leverage

with Regulations Technology

Review Historical Conduct Regular

Data Training

Encourage Open
Communication

Participant Manual
5
 Risk Mitigation

Implementing risk mitigation strategies helps healthcare

organizations manage risks effectively, ensuring a safer
environment for both patients and staff.

Professional
Patient Safety Data Security Communication
Policy Training and Incident Liability
Programs: Measures: Regular Audits and
Management Education: Reporting Insurance:
Reduces the Prevents data and Transparency:
Ensures Enhances staff Systems: Provides
risk of hospital- breaches and Assessments: Builds trust and
consistency in knowledge and Identifies financial
acquired ensures Identifies and ensures that
operations and reduces the potential risks protection
infections and compliance with mitigates risks risks are
compliance with likelihood of and areas for against legal
other patient privacy proactively. promptly
regulations. errors. improvement. claims and
safety issues. regulations. addressed. liabilities.

Limitations of Risk Mitigation in Healthcare

• Incomplete Data and Information: Accurate risk assessment requires comprehensive data, which may
be lacking, especially for emerging risks.
• Uncertainty and Complexity: Healthcare environments are inherently complex and unpredictable,
making it difficult to foresee all potential risks.
• Resource Constraints: Limited resources can hinder the implementation of effective risk mitigation
strategies.
• Behavioral Biases: Human biases can affect decision-making, leading to underestimation or
mismanagement of risks.
• Regulatory Changes: Frequent changes in healthcare regulations can create new risks and complicate
existing mitigation plans.
• Interconnected Risks: Risks in healthcare are often interconnected, and addressing one risk might
inadvertently trigger another.
• Technological Limitations: Dependence on technology can introduce new risks, such as cybersecurity
threats.
• Communication Gaps: Ineffective communication among staff can lead to unrecognized or poorly
managed risks.

Participant Manual
6
 Second “R”- Risk Analysis

Determine which risks need to be managed

✓Frequency of the occurrence

✓Numbers that might be affected
✓Severity of likely injuries
✓Effect of potential loss on the individuals or organization

Estimate Likelihood of occurrence

Understanding the likelihood of risk occurrence is crucial for effective risk
management in healthcare. The likelihood table categorizes risks based on their
probability of occurrence, providing a clear framework for prioritizing and
addressing potential hazards. By defining each likelihood category and
assigning a probability and score, healthcare organizations can systematically
evaluate risks and implement appropriate mitigation strategies. This approach
ensures a proactive stance in managing risks, ultimately enhancing patient
safety and organizational resilience.
Likelihood of occurrence Definition Probability Score

Rare Not expected to occur 1:10,000 1

Unlikely Possible but no known data 1:5000 2

Possible Moderate probability 1:200 3

Likely High probability 1:100 4

Very likely Almost certain to occur 1:20 5

Participant Manual
7
 Estimate Severity

By categorizing the severity of risks, healthcare organizations can prioritize their

risk management efforts, focusing on those risks that have the most significant
impact on patient safety and care.

Severity (effect if happened) Score

None 1

Low/minor injury 2

Medium/moderate injury 3

Very high/major injury 4

Catastrophic/permanent injury or death 5

Risk analysis

• Risk analysis involves combining the possible consequences, or

impact, of an event, with the likelihood of that event occurring.
The result is a ‘level of risk’. That is:

Risk = Severity/Consequence x Likelihood

Participant Manual
8
 Risk Ranking
Likelihood x Severity = Risk Ranking
Risk Ranking
• Extreme Risks (15-25)
• High Risks (8-12)
• Moderate Risks (4-6)
• Low Risks (1-3)

Risk-response strategies for managing negative risks

18

Participant Manual
9
 Hierarchy of Controls

Risk Register

• Risk Description – Clear description of risk, its cause & consequence

• Controls / Actions already in place – List what is actually happening now
which reduces the impact of a risk or its likelihood
• Impact – scale of 1 to 5 (1 = minor, 5 = catastrophic)
(Note this is to be residual impact only)
• Likelihood – scale of 1 to 5 (1 = remote, 5 = unavoidable)
(Note this is to be residual likelihood only)
• Weighting – Its Risk Ranking: a calculated figure i.e.
impact x likelihood

20

Participant Manual
10
 Table - Risk Description
Name of Risk
Scope of Risk Qualitative description of the events, their size, type, number and
dependencies
Nature of Risk strategic, operational, financial, knowledge or
Compliance
Stakeholders Stakeholders and their expectations
Quantification of Risk Significance and Probability.
Risk Tolerance/ Appetite Loss potential and financial impact of risk
Value at risk Probability and size of potential losses/gains Objective(s)
for control of the risk and desired level of performance
Risk Treatment & Control Primary means by which the risk is currently managed
Mechanisms Levels of confidence in existing control
Identification of protocols for monitoring and review
Potential Action for Improvement Recommendations to reduce risk
Strategy and Policy Developments Identification of function responsible for developing strategy and policy

Monitoring and Review of the Risk Management Process

To ensure that risks are effectively identified, assessed and that

appropriate controls and responses are in place.

➢ Review risk register and submit to direct manager/director and risk manager as appropriate.

➢ Risk Review:

✓ Low risks should be reviewed at least annually.

✓ Medium should be reviewed at least biannually.

✓ High risks must be reviewed at least quarterly.

✓ Extreme risks must be reviewed at least monthly.

Participant Manual
11
 Risk Reporting & Communication

Internal Reporting External Reporting

Different levels within an The arrangements for the

organisation need different formal reporting of risk
information from the risk management should be.
management process.
• Clearly stated
• Board of Directors • Available to the stakeholders.
• Business Units
• Individuals

Session.6
COMPREHENSIVE RM PLAN

Participant Manual
12
 Session Objectives

At the end of these sessions, the participants will be able to:

Understand the Fundamentals of Risk Management Plan.
learn various tools and techniques to identify and assess risks within
Risk management Plan.
Develop and Implement Risk Mitigation Strategies.
Monitor and Review Risk Management Processes.

Risk Management Plan

• Overview of purpose
• Structure
– Scope
– Program elements
– Objectives
– Roles and Responsibilities
– Integration
• Confidentiality
• Evaluation of RM program

Participant Manual
13
 Organizing the
Risk Management Program
Structure Processes Outcomes

▪ Identification
of risks.
▪ Leaders. ▪ Reporting of
▪ Committee incidents.
s. ▪ Analyzing ▪ Reduced
▪ Policies & data. incidents of harm.
procedures. ▪ Implementin
g risk
reduction
strategies.

Risk Management Program / Structure

• Authority.

• Visibility.

• Communication.

• Coordination.

• Scope.

➢ The exact structure of a risk management program will depend on the size of the
organization, it’s complexity and the scope of services that are provided.

➢ Several key structural elements are necessary for the program to be successful.

Participant Manual
14
 Authority
• Risk manager must have authority & respect.

• Deals with highly sensitive, confidential information.

• Position should be ranked high in the organization (above department director

level).

• Report directly to the hospital director.

Visibility
• Not a one-man job.

• RM must create awareness of RM.

• Participate on related committees.

• Participate in educational activities,

e.g. orientation and in-services.

Participant Manual
15
 Communication

• Receive information about potential risks.

• Incorporate within flow of information of relevant committees, e.g. safety, QI,

mortality/morbidity.

• Regular communication with management team.

• Include description of flow in the RM plan.

Coordination
• QI Coordinator.

• Patient Safety Officer.

• Infection Prevention and Control Practitioner.

• Medical Director.

• Nursing Director.

• Human Resource Manager.

• Patient Complaints.

Participant Manual
16
 Risk Management & QI Link

• Risk Management is an integral part of a comprehensive Quality Management process.

• A commitment to identify, analyze and eliminate or reduce problems in patient care .

• Maximize patient safety.

• Prevention of harm and loss.

• A comprehensive QI/RM function is designed to gather

and evaluate important information on all undesirable

events and trends and use professional time and resources

efficiently with minimal duplication

Risk Management Program: Processes

▪ What methods of proactive assessment will be used?

▪ What MUST be reported?

▪ Who reports an incident?

▪ What are the expected time frames for reporting?

▪ How are incidents to be reported?

▪ Who is responsible for analyzing the cause of the incident?

▪ How are findings used?

Participant Manual
17
 Risk Management Program / Outcomes

▪ What are the expected outcomes of the program?

▪ How will they be measured?

Scope
Risks related to:
• Patient care.

• Medical staff.

• Employee.

• Property.

• Other.

Participant Manual
18
 Patient-Care Related Risks

• Clinical risks.

• Confidentiality and release of information.

• Protection from abuse and neglect from other patients, visitors or staff.

• Securing informed consent.

• Nondiscriminatory treatment.

• Protection of valuables.

• Appropriate triage and stabilization.

• Participation in research.
8/17/2025

Medical Staff-Related Risks

• Credentialing, appointment, privileging.

• Disciplinary procedures.

• Identification and treatment of impaired

physicians (drug / alcohol abuse).

Participant Manual
19
 Employee-Related Risks

• Safe work environment.

• Treatment and compensations for

work-related illnesses/injuries.

• Discrimination in recruitment, hiring,

promotion.

Property-Related Risks

• Destruction of property due to fires, natural disasters, etc.

• Protection of records, paper and electronic.

• Safe guarding patient cash and valuables.

Participant Manual
20
 Other Risks

• Financial.

• Use of organization vehicles, e.g., cars, ambulances.

• Visitor injuries.

• Hazardous materials.

Before initiating RM plan

• The Risk Management program is formulated to improve and ensure organizational

safety by identifying and managing real potential risks.

• People who apply risk management should have the appropriate training, skills and
experience.

• Defining how the assessment information and conclusions will be used by the decision
makers.

• Identifying the necessary resources, members of the

team who have the appropriate expertise, with the leader

clearly identified.

Participant Manual
21
 RM Plan Components
• Policy and statement of purpose.

• Goals.

• Scope of the program.

• Authority and responsibility.

• Administrative and committee structure.

• Confidentiality and conflict of interest.

• Data collection, Data sources, Documentation and reporting mechanisms (both internal and
external).

• Integration with quality management and program effectiveness reviews.

• Program evaluation, monitoring and improvement.

• Organizational chart.

• Approval signatures.

Conclusion
How to Build a Risk Management Program

Create a Make Evaluate

Proper
Strong Stakeholde and Persist
Risk Communic
Risk- rs Aware of ./ Monitor Record.
Manageme ation.
Aware Cult the Proces and
nt Policies.
ure. s. Review.

Participant Manual
22
 Group Exercise
Risk assessment & Management tool

Reference

1. Alder, S. (2024). What is Risk Management in Healthcare? HIPAA Journal.

2. Yuen, C. (2024). Healthcare Risk Management Fundamentals for Safer Practices. SNF Metrics.
3. Safety Culture. (2024). Risk Management for Healthcare Organizations.
4. American Society for Healthcare Risk Management (ASHRM). (2023). Enterprise Risk Management in Healthcare.
5. Institute for Healthcare Improvement (IHI). (2023). Risk Management Strategies in Healthcare.
6. Joint Commission. (2023). Comprehensive Accreditation Manual for Hospitals
7. World Health Organization (WHO). (2023). Patient Safety and Risk Management.
8. National Institute for Health and Care Excellence (NICE). (2023). Risk Management in Healthcare Settings.
9. Centers for Disease Control and Prevention (CDC). (2023). Risk Management in Healthcare Facilities.
10. Health Resources and Services Administration (HRSA). (2023). Risk Management in Healthcare Organizations.
11. Agency for Healthcare Research and Quality (AHRQ). (2023). Risk Management Tools and Techniques.
12. National Patient Safety Foundation (NPSF). (2023). Risk Management and Patient Safety.
13. International Society for Quality in Health Care (ISQua). (2023). Risk Management Practices in Healthcare.
14. Healthcare Financial Management Association (HFMA). (2023). Financial Risk Management in Healthcare.
15. American Hospital Association (AHA). (2023). Risk Management in Hospitals.

Participant Manual
23
 Questions and Comments
• Please don’t miss to evaluate module and complete posttest!

End of Module

Participant Manual
24