Abstract
The Lilypond is a new conceptual model to describe patient safety performance. It radically diverges from established patient safety models to develop the reality of complexity within the healthcare systems as well as incorporating Safety II principles. There are two viewpoints of the Lilypond that provide insight into patient safety performance. From above, we are able to observe the organisational outcomes. This supersedes the widely used Safety Triangle and provides a more accurate conceptual model for understanding what outcomes are generated within healthcare. From a cross-sectional view, we are able to gain insights into how these outcomes come to manifest. This includes recognition of the complexity of our workplace, the impact of micro-interactions, effective leadership behaviours as well as patterns of behaviour that all provide learning. This replaces the simple, linear approach of The Swiss Cheese Model when analysing outcome causation. By applying the principles of Safety II and replacing outdated models for understanding patient safety performance, a more accurate, beneficial and respectful understanding of safety outcomes is possible.
Introduction
There are several models to describe patient safety, which have become almost universal. These represent the healthcare workplaces and culture of the time in which they were created and have contributed hugely to our understanding and improvements in patient safety systems. Reason’s Swiss Cheese Model (SCM) was developed in 1990, and Heinrich’s Safety Triangle (ST) was first published in 1931. Since the development of these models, our workplaces, patients and treatments are more complex, our use of technology has transformed our healthcare practices and societal awareness of emotional and psychological health has increased dramatically. There has been critique of the SCM within literature and many safety scientists, including Reason himself, have identified limitations of the model. For example “one of the disadvantages of the Reason model is that it does not account for the detailed interrelationships among causal factors. Without these distinct linkages, the results are too vague to be of significant practical use. 1 ” Despite this critique, the traditional models remain the most widely taught, understood and used when analysing adverse events and patient safety outcomes. 2
In 2014, Erik Hollnagel outlined two approaches to Safety management. 3 Safety I describes an organisational system focussed upon the measurement of adverse events, and subsequent attempts to reduce these as much as possible. The SCM and ST were developed within the perspective of Safety I. Hollnagel has since identified the need to adopt a Safety II approach, whereby the importance of successful outcomes is recognised and valued. 3 There is learning and improvement that can be made to organisational systems and individual practice when these are also explored.
Safety II begins to describe a paradigm shift in our understanding of safety management, much like accepting a world outside of Newtonian physics for the complexity of physics at quantum level. Newtonian physics provides an excellent understanding of the nature of large objects and forces like gravity but ceases to be of value at the sub-atomic world were entangled particles can affect the nature of another particle in a different place. It is not surprising therefore, that patient safety models from the Newtonian era of Safety I are not fit for purpose within the quantum Safety II world. Simple linear models fail to offer valuable insights of organisational outcomes when the complex, non-linear nature of the modern workplace is applied.
The Lilypond Model breaks from the Newtonian approaches of Safety I, enabling organisations to apply Safety II principles in the complex workplace. There are two views of the Lilypond, both of which are vital for understanding Safety II principles in the workplace. The first is a view of the surface from above. The second, a cross-sectional view through the Lilypond.
From above
Outcome representation
Traditionally, safety outcomes have been presented within Heinrich’s ST (Figure 1). 4
The Safety Triangle. 5
Hollnagel critiques the choice to present these data in a triangle, due to it misleading the reader into inferring a relationship of causation. A near miss is defined as “an event not causing harm, but has the potential to cause injury or ill health. 6 ” The conventional wisdom is that an organisation should desire to identify and record as many near misses as possible, as this will result in a reduction in the number of more major adverse outcomes. The inference created representing the data in a triangle is that both the near miss and the fatality share the same cause. The research conducted by Heinrich only demonstrated a proportional relationship, not a causal one. 6 The widely accepted presentation and resultant interpretation of these data are therefore incorrect. Hollnagel describes that the most ideal way to represent different severities of adverse events would be as a series of unrelated circles. 3 This removes the inference of causality within the ST. The Lilypond Model extends this idea. Whilst it is important to challenge a frame of a direct causal relationship, it is possible that different adverse events may be related.
Every adverse event is a product of the organisational system. The Lilypond Model places each adverse event as lily pads floating on the surface of the pond, which vary in size based on the frequency of their occurrence. This allows the adverse events to be related to each other directly by the root, or associatively by recognising they are all products of the same system; the ecosystem within the Lilypond will impact on multiple lily pads. The Lilypond does not consider adverse events to be isolated and discrete (Figure 2).
The Lilypond: adverse outcomes.
For example, an increase in near miss reporting may indicate that there is high potential for patients having slips, trips and falls, which may or may not share any direct cause with a healthcare worker losing time to work due to a serious back injury. Classical thinking using the ST would suggest that the more near misses of falls reported, the fewer serious adverse events that occur. The near miss lily pad would be huge on the surface of the Lilypond, with a very small lily pad representing major events. On initial investigation, these two adverse events do not share the same cause, but because they are products of the same Lilypond, there may be an indirect linking factor. For example, lack of suitable hoisting equipment may be a current within the Lilypond that has contributed to both adverse outcomes.
The ST only measures adverse events. Initially, the Lilypond has only a small number of different sized lily pads on the surface, but Safety II challenges the convention of only measuring and valuing adverse events.2,3,5,7 The same system that creates the adverse events also creates a far higher number of successful events. If the lily pads already on the pond represent adverse events, we colour them black. There are many more white pads; these are successful events. The Lilypond Model allows for a more realistic and healthier view of workplace performance because it focuses on all outcomes; the 95% which are white and successful as well as the 5% that are black and unsuccessful.
A non-monochrome world
So far, we have a Lilypond covered with a majority of white lily pads and a small number of black lily pad outcomes, all proportionally sized by outcome frequency. The Lilypond Model recognises that our organisational outcomes are more complex than that. Within every performance spectrum, there will be excellence grading through to poor performance. The Lilypond Model recognises the importance of acknowledging excellence as part of a high-performance culture. Out of the 95% of white lily pads, some will be the very best; the optimal, the brilliant and the most beautiful. These too need to be measured, valued and analysed. If there is an opportunity to learn from the worst possible outcomes, there should equally be opportunities to learn valuable lessons from successful events. 8
A balanced approach to measuring and learning from all outcomes would be a powerful shift towards a Safety II approach. It does, however, still utilise some vestiges from traditional Safety I. Safety I applies value judgements to patient outcomes, which then bias all subsequent analysis and investigation. When an adverse event is identified, our behaviour is primed with a desire to right the wrong for those affected and apportion blame. Likewise, for successful outcomes, the most beautiful lily pads, the excellence is rightfully celebrated, but we are at risk of tacitly accepting or ignoring aspects of poor practice within the process. The score drives our analysis of the performance. Classical approaches to patient safety rely heavily on classification of the patient outcome, rather than on developing a deep understanding of the event and learning from an outcome of any nature. Our human brains work well in such a simplified framework. We like dichotomies. Unfortunately, the real world of organisational performance is not binary.
The Lilypond Model is not driven by value judgements regarding outcomes. The purpose is always on learning for improvement. The classification of the outcome is of secondary concern. There could be significant learning from every event. Consequently, the Lilypond is multicoloured. There will be a small number of black lily pads that are poor quality and represent poor outcomes. These need to be analysed and eradicated as much as possible. This is the Safety I world. There are many more lily pads with a range of colours and traits that need to be explored and understood. It is the quality of the learning from investigation of the processes that produce the lily pads that drives improvements in patient safety and organisational performance.
In the ST, the wide base represents near miss events. According to the principles of the complex, non-monochrome world of the Lilypond, the requirement for a discrete categorisation for a near miss would ultimately cease to exist. An organisation would no longer wait for an event where someone nearly got hurt, or had the potential to do so, to recognise the potential for learning. The near miss lily pad would have dissipated through the other, multi-coloured pads within the Lilypond (Figure 3).
The Lilypond: a non-monochrome world.
The view from above, the Lilypond provides us with a more accurate and balanced perspective of organisational outcomes than previous models have encouraged. It challenges the existing precondition of judging how bad or good an outcome is before responding. Embracing this will help shape our patient safety management approach towards optimising learning from all events.
From below
An intricate ecosystem
The cross-sectional view of the Lilypond provides an opportunity to understand how the wide range of patient outcomes manifest. We are able to explore why some lily pads are black and some are beautiful. This is an intricate ecosystem, with multiple interactions, hierarchies, and influences from the outside world. It is complex and behaviours consistently change within it, as creatures adapt to their immediate situation.
Each outcome begins within the system as a seed on the bed of the Lilypond. This is a natural mechanism of the workplace. The nature of the seed is not pre-ordained; it may become a beautiful lily pad, or it could become a black one. There are no seeds that are inherently bad or inherently good. As the seed germinates and grows into its lily pad, its nature is influenced by the system. Whilst the view from above represents the frequency of each type of outcome by the size of a single lily pad, it would be more beneficial to consider each individual process as having its own stem, which contribute to and combine to form the view from above. This allows for learning from individual processes rather than grouped outcomes.
The ecosystem of the Lilypond acknowledges the complexity of our modern healthcare workplaces. Until now, we have used The SCM to infer simple attribution of cause and effect. An adverse event is viewed as a laser beam passing through defined, discrete layers of opportunity for intervention. But the growth of a lily pad is not a simple linear process. This is a significant limitation of Newtonian models being applied into the complex world of Safety II.
Woodward describes how "we need to look for patterns in the behaviour of the system. We need to look for interconnections within the system rather than isolated problems... We need to be careful when attributing cause and effect in complex adaptive systems, as we have seen it is very rarely that simple.7."
The Lilypond: a cross-sectional view.
Interactions
If we are to understand the size and colour of the lily pads, we need to understand the whole process of their growth from seed through to breaking the surface of the water. Throughout this process, complex interactions occur with the Lilypond. The seed, root and stem also have to survive encounters with the other creatures of the Lilypond, where a single act could change the size of the lily pad or its colouration. These simple interactions may help to provide some basic insight to the development of the lily pad, but it is likely that most processes are far more complex.
Macroscopically, we could consider the structure of the root, how healthy it is, and how able to withstand the currents and creatures of the Lilypond. Then, microscopically, our understanding of the Lilypond could consider activity at a cellular level; the efficiency of the stomata in gaseous exchange or the process of production of glucose. It is useful to note that some of the influences affecting the growth of the lily pad are external. Light and warmth come from outside forces which affect the outcomes just as much as biochemical interactions within the Lilypond. Political pressures, targets, seasonal demands will also have an impact on organisational performance and patient outcomes. Just as the development of a lily pad is more complex than the need for light, nutrients, and warmth, organisational outcomes are more complex than whether or not the layers within the SCM prevent adverse events occurring.
Scanlon and his colleagues have researched complexity within the workplace as part of a broader AHRQ-funded study (1 R01 HS013610). Work-as-imagined would easily be able to provide a simple, linear flow chart outlining the correct process of drug administration to a patient. 9 Over 100 h of medication administration process were observed by human factors trained researchers, resulting in a 44-page document, detailing multiple long complex flow charts of the process (M Scanlon 2019, personal communication, 10 December). Simple, linear models of workplace processes are likely to be highly flawed. They do not provide real insights into the nature and development of a lily pad, and therefore are unhelpful in analysing organisational outcomes.
At any point, the interactions between the Lilypond and the lily stem can alter its outcome. Whilst each lily pad has its own roots, the Lilypond Model does not suggest that every individual lily pad is entirely independent of one other. They are associated. The ripples they make will impact on other lily pads and their development. These are the “patterns in behaviour of the system” Woodward identifies. 6 For example, in complex organisations, we may achieve a very successful outcome for an individual patient, but the way in which that outcome is achieved may have a negative ripple effect on other outcomes. An example of which would be the work collated by Turner and his colleagues, measuring the impact of incivility in teams. 10 An individual patient could have a fantastic outcome, but the way in which the team communicated could negatively impact on future teamworking and therefore affect many future events. This is why performance improvement should not be dominated by outcome classification.
For example; an individual Surgical Consultant may avoid using the WHO Checklist pre-operatively. This is ignored because his usual team complete the checklist without his involvement, ensuring that all paperwork is correct before any procedure begins. In these situations, there are micro-interactions within the team that are helpful, ensuring patients are not exposed to increased risk, but mask a weakness. With a Safety I approach, we would have to wait for an adverse event before these patterns of behaviour would be investigated. A single event could appear to be a “one-off”, or bad luck as a result of the Surgical Consultant working out with their usual team. But there may be complex challenges around team working, communication, leadership, and respect. The Lilypond Model provides a mechanism for learning to be sought irrespective of the final outcome of events.
Hierarchies
There are a small number of large fish who reside near the bottom of the pond. The progressively smaller fish are nearer the surface. There are also frogs, insects and crustaceans, algae and other micro-organisms, all who play their part in the continuing stasis of the Lilypond. These creatures represent our healthcare workforce. Every creature has their own specialism, function, and domain. This is essential. It also creates an important distinction from the classical Safety I approach. Safety I places responsibility for the wellbeing of the Lilypond to the largest fish. They are the most powerful creatures in the pond. But this perception increases the likelihood of authority deference within the other creatures of the pond. Authority deference is a construct that shapes a person’s likelihood of intervening, given their perceived place within a hierarchy. In a workplace with a pronounced sense of hierarchy, a subordinate is less likely to challenge their superior, even if they feel a decision is incorrect or dangerous. An example is the case of Elaine Bromiley who tragically passed away as a result of a failed intubation under anaesthesia in 2005. Subsequent investigation of the incident identified several contributory factors, including team communication. 11 Organisations with more mature safety cultures strive to flatten hierarchies and empower all parts of the workforce to accept responsibility for the nature and performance of the workplace. 10 The nature of a lily pad, and therefore safety outcomes, can be created by the smallest fish near the surface, by effective adaptations to their situation irrespective of what caused the stem to develop to that point.
The Lilypond Model reinforces the importance of mutualism. For the Lilypond to thrive, the roles that all creatures play is recognised and valued. This requires the largest fish to display genuine humility and respect, so that all feel sufficiently empowered to speak up, and have the most positive impact possible within the Lilypond ecosystem. A workplace that acknowledges and celebrates the roles each creature plays, and their mutual responsibility for the health of the Lilypond, will become more reliable, sustainable, and safe. It is the creatures that are smallest and nearest the surface that are most likely to be able to prevent a black lily pad from breaking the surface, by their acts or omissions. These are the work-as-done adaptations of a complex system. An effective intervention just below the surface by one of the creatures traditionally considered to be less powerful or influential, can terminate the growth of a black lily pad, or transform its appearance to something more beautiful.
In such a complex ecosystem, the water can become murky. There are many interactions occurring, adaptations and growth, in an environment darkened by the sheer scale of lily pads produced above. It can be difficult for creatures, in any part of the pond, to clearly see and understand what has created their immediate environment. Equally, they may not be able to foresee the impact of their actions on other parts of the pond. It is difficult therefore for creatures to know what changes they can enact in order to improve the overall health of the Lilypond. This helps to understand why change within complex systems is difficult to achieve and sustain. To date, many attempts to improve the patient safety within healthcare have had negligible results. Wears and Sutcliffe cite the example of the UK Health Foundations Safer Patient Initiative, where improvement in intervention hospitals could not be directly attributed to the interventions and improvement may be explained by a rising tide effect. 12 We will all be well served to better understand the complexity of our own Lilypond in as much detail as possible before trying to change it.
Summary
The traditional models for workplace safety management are simple and linear. They focus only on failure; primarily the classification of it and where to apportion the consequential liability. The Lilypond model creates the opportunity for the complexity of the modern workplace to be accounted for, and non-linear processes to be incorporated into our understanding of patient safety and organisational performance. It also allows all spectrums of performance outcomes to be considered providing opportunities to learn and improve from every event.
Safety II focuses on achievement of high performance, rather than failure avoidance. The Lilypond Model will enable organisations to apply these Safety II principles in the modern workplace, providing more insightful and accurate analysis of the underlying causation for all outcomes and improve patient safety in our healthcare organisations.
Footnotes
Acknowledgements
Many thanks to Dr Catherine Stretton for her comments on the initial concept and feedback on multiple drafts of this article.
Author’s contribution
All work (both conceptual in developing The Lilypond model, and in writing this article) has been completed by the primary and corresponding author, Paul Stretton.
Declaration of conflicting interests
The author(s) declared no potential conflicts of interest with respect to the research, authorship, and/or publication of this article.
Funding
The author(s) received no financial support for the research, authorship, and/or publication of this article.
