Among the numerous benefits of a comprehensive risk management program are a higher quality of care, the promotion of resident and staff safety, and an adherence to federal regulations.

       Editor’s note: This is the third in a series of articles on topics being presented at the Symposium on Regulatory Issues for Management in Long-Term Care (SORIM LTC). For a list of scheduled topics and registration information, visit www.SORIMLTC.com.

T

here are many motivations in long-term care for the development of a robust and reliable risk management program, including regulatory considerations, quality of care, resident and employee safety, and legal and financial considerations. The crux of the approach described in this article is to establish and sustain an organization-wide culture of safety and develop a robust risk management program to ensure that potentially hazardous situations are detected and prevention strategies adopted and implemented—a system that is continually monitored to ensure success and improvement. A culture of safety approach addresses all of the considerations and motivations for a comprehensive long-term care risk management program.
       Regulatory considerations for risk management and a culture of safety often focus on surveyor guidance contained in Federal Tags 323 and 324 (F323 and F324). These tags derive from the Centers for Medicare & Medicaid Services (CMS) regulations at CFR §483.25(h)(1) and CFR §483.25(h)(2), respectively. The former requires for the nursing facility to ensure that the resident’s environment remains as free of accident hazards as possible. The latter requires for each resident to receive adequate supervision and assistance devices to prevent accidents.
       As stated in CMS Surveyor Interpretive Guidance, the intent of these provisions is for the nursing facility to prevent accidents by providing an environment that is free from hazards over which the facility has control (F323) and for the facility to identify each resident at risk for accidents and/or falls and implement procedures to prevent accidents (F324).
       The guidance defines an accident as an unexpected, unintended event that can cause a resident bodily injury. It does not include adverse outcomes associated as a direct consequence of treatment or care (eg, drug side effects or reactions). It describes the intent of F324 as the facility identifying each resident at risk for accidents and/or falls and adequately planning care and implementing procedures to prevent accidents.

Figure 1

Traditional Steps in the Risk Management Process

       As can be seen from the above regulatory focus and because of the numerous resident- and employee-related risks in the long-term care setting, developing and implementing a comprehensive, robust, reliable, and organization-wide risk management program is necessary. Such programs are also needed to help stem financial trends (eg, increases in monetary awards for negligence cases and increases in citations and penalties for regulatory noncompliance) and improve quality, including publicly reported measures. An organization-wide risk management program supports many providers’ mission statements.
       The purposes and goals of a long-term care risk management program include:
1. To prevent circumstances that could lead to accidents, injuries, or other adverse events involving residents, employees, visitors, students, and others
2. To minimize the adverse effects of injuries or accidents when they occur (ie, resident falls may not be 100% preventable, but steps can be taken to minimize the severity of an injury)
3. To protect the financial assets of the organization by reducing the frequency, severity (ie, dollar amount), and impact (eg, through insurance or other risk transfer) of professional liability, workers’ compensation, or general liability injury claims and lawsuits
4. To establish and sustain a culture of safety through implementation of programs and processes that demonstrate a commitment to safety as a top priority from senior leadership; a focus on building safety into the system of care; and a de-emphasis on blaming individuals for failures in the system coupled with a reexamination of the system to determine how it can be improved.
       A comprehensive risk management program applies risk management techniques to all areas of the operation of a long-term care facility, from safety issues (eg, trip hazards) and the promotion and creation of a culture of safety to employee health (eg, prevention of back injuries) and resident care (eg, prevention of medication and dietary errors). The goals of risk management can never be accomplished by one individual or committee. Thus, a long-term care administrator, performance improvement manager, or nursing director may be responsible for developing and overseeing the program, but the commitment, cooperation, and support necessary for success must come from a facility’s or organization’s senior management or owners, governing body, medical director, attending physicians, and employees.

Culture of Safety

       Underlying a robust and reliable organization-wide risk management program is a culture of safety. Culture of safety concepts are not necessarily new in all long-term care settings, but they have not often been articulated as such. These concepts should fit well in the context of the mission of many long-term care organizations and appeal to all levels of the organization, from owners and the governing board to mid-level managers and directors to frontline employees. Creating a culture that supports and promotes resident safety hinges on interdepartmental coordination and has been identified as a key element in reducing risks and improving safety. Creating a safety culture in long-term care organizations involves a process similar to that of implementing other culture change initiatives, such as the current movement to transform the traditional institutional focus to a resident-centered focus.
       Since the Institute of Medicine (IOM) issued its 1999 report on medical errors calling for the prevention of injury and death through safer healthcare, healthcare associations, professional societies, regulatory and accrediting bodies, employers and health insurers, and healthcare facilities themselves have attempted to improve the safety of patients and residents in response to IOM’s call.¹
       A culture of safety is characterized by a culture that approaches safety systematically; indeed, safety is the number-one priority, even at the expense of production or efficiency. Many experts contend that the healthcare industry is still in its infancy in becoming highly reliable. However, some forward-thinking long-term care organizations are forging ahead with a new approach—including conceptual, behavioral, and systematic processes—to deliver resident services in an organization-wide culture that embraces safety.
       Barriers to resident safety in long-term care settings identified by the Agency for Healthcare Research and Quality (AHRQ) include inappropriate use of restraints, insufficient care plans, inadequate food preparation, and inappropriate medication management.² Strategies for addressing these barriers were also set forth in the report and include practical suggestions, such as strict enforcement of hand-washing protocols for long-term care staff members in order to avoid food-borne illnesses.
       While a number of resident safety initiatives are under way across the United States—including some focused on particular issues, such as reducing falls, preventing pressure sores, and decreasing healthcare-associated infections—experts agree that focused initiatives should be preceded by culture change toward an organization-wide culture of safety in order to be successful.³ Some experts say that a culture of safety is necessary before other resident safety practices are introduced. Otherwise, individuals expected to implement the safety initiatives do not yet know how best to work together or communicate effectively.
       The first stage of developing a cohesive and successful risk management program requires gaining the support of and commitment from senior management, owners, trustees, the medical director, and senior and middle managers within the facility. Each group should understand why a cohesive risk management program is needed. In many instances, individuals will need to be educated about the functions and goals of the risk management program. Linkages with quality assurance programs and culture of safety initiatives should be demonstrated.
       Owners and/or governing bodies will be particularly interested in how risk management minimizes financial loss and improves the organization’s reputation for quality care and a safe working environment. Given the increase in litigation in the long-term care industry, organizations must take a proactive approach to respond to the following issues:
• Proliferation of federal and state regulatory changes
• Development of new and revised accreditation standards
• Poor health conditions of residents admitted to skilled nursing facilities
• Effects of aging in place on the financial obligations of the organization
• Increased public attention to the quality and price of care and services
• Consumer demand for high quality, fair prices, and more choices in care and service packages.
       A long-term care risk manager can facilitate communication with the facility board about risk management and resident safety issues by introducing concepts of a culture of safety. For some, risk management issues might be best raised in the context of initiating a program to reduce the institution’s liability and protect its assets and reputation. Providing feedback to the board in the form of regular reports on risk management activities (eg, information on claims, trends in adverse events, the process of building a culture of safety, and problem remediation) is vital.
       Since the medical director serves as the central figure in the delivery of medical care at long-term care facilities, it is crucial to enlist his or her cooperation and support for a risk management program. The medical director can also help encourage the support of key attending physicians. Attending physicians will be interested in how risk management can reduce the frequency and severity of malpractice claims and how it will affect the quality of care delivered to residents. Risk management techniques protect both the facility and the physicians from liability exposure. Physicians should be informed that risk management is not intended to shift liability exposure from the institution to the physicians. Attending physicians should be invited to participate in developing clinically related risk management programs, policies, and procedures.
       Department (eg, nursing, housekeeping, maintenance, and dietary) managers and supervisors will need to be educated about the process of risk management and the potential cost savings and reputation enhancement to the institution from improved quality and resident safety and reduced liability claims, workers’ compensation claims, and insurance premiums. Department manager support is important to ensure that a risk management program operates successfully with the support of other employees. For example, supervisors and department managers must reassure staff that the purpose of reporting events is not to punish employees but to learn from adverse events, errors, and near misses; make process improvements based on lessons learned; and prevent or mitigate resident injuries. Department managers’ input should help set priorities for risk management. Department managers should also be recognized for risk management achievements (eg, reduced falls rates and improved worker safety, preventive maintenance, and event reporting) within their department.
       The organization of the risk management program will be highly individualized based on the assessed needs of the facility, the existing departmental structure of the institution, the extent to which a culture of safety exists in the facility, and senior or corporate management’s view of the relationship among risk management, quality improvement, corporate compliance, and other monitoring functions.

Risk Management and Quality Improvement

       Quality improvement and risk management programs are similar in that both function to decrease risks within a healthcare organization. But there are differences between the two programs. Quality or performance improvement programs in healthcare facilities identify and improve areas of weakness related to the clinical care provided and make efforts to improve those areas. Risk management programs have a clinical focus, in part, but also address business-related risks, such as ensuring the organization is portrayed appropriately in marketing and advertising materials, performing investigations when adverse events occur, identifying and preventing adverse events through proactive systems analysis and near-miss reporting systems, and performing a variety of other functions for reducing the probability and severity of claims and financial losses.
       In its interpretive guidance (Tag F520) to surveyors of long-term care facilities, CMS requires for nursing facilities to maintain a quality assessment and assurance committee. In addition, accrediting agencies may require long-term care facilities, assisted living centers, and home care services to include quality assessment, improvement, and evaluation of patient and resident care. These activities may include or address reporting of resident care events, medical errors, near misses, and critical or sentinel events.
       When risk management and quality improvement functions are integrated in a single department or performed by a single department manager, it is important to be aware of the similarities and differences between the goals and purposes of each discipline. When risk management and quality improvement functions are the responsibility of different managers and departments, it is essential for formal linkages to be established.
       These linkages should aim to maximize the usefulness of data sources and data collection efforts (eg, using event reports to help identify quality-of-care issues) and eliminate or reduce duplication of effort by managers and staff (eg, consolidating overlapping forms and reports and combining data storage systems to avoid entering data twice).
       Risk management information should be shared not only with quality improvement and monitoring departments and personnel but with managers responsible for other administrative and resident care functions, including infection control, purchasing, sales and marketing, admissions, staff education, safety and security, utilization management, social services and resident/patient representation, and medical records.

Functions of the Risk Management Program

       Traditionally, risk management processes consist of six steps: risk identification, risk analysis, development of corrective actions or techniques for managing risks, selection of the best action or technique, implementation of the chosen action or technique, and evaluation and monitoring for effectiveness (see Figure 1).
       Risk managers can use both internal and external sources as well as quantitative and qualitative data for risk identification. Internal sources include:
• Event reports (for events involving residents, employees, or visitors)
• Reports of potentially compensable events or claims
• Quality improvement information
• Resident council meeting minutes or reports
• Safety council meeting minutes or reports
• Facility walk-arounds
• Safety culture surveys or discussions with physicians, nurses, and other employees
• Resident satisfaction surveys
• Resident or family complaints
• Results of proactive risk assessments (eg, evaluation of a risk-laden process using failure mode and effects analysis)
• Self-assessment questionnaires.
       External sources that can be used for risk identification include national claims data on professional liability issues and workers’ compensation; standards and guidelines from relevant professional associations; federal, state, and accreditation survey results; court opinions; and risk management publications.

Regulatory Compliance

       Long-term care is a heavily regulated industry, and facilities run a significant risk of being cited for noncompliance if they fail to follow or implement requirements of state and federal statutes and regulations. Large organizations that provide multiple services and systems, such as nursing and assisted living facilities, as well as home care and subacute care services face additional issues related to compliance with laws and regulations in multiple states and/or multiple regulatory agencies. Long-term care organizations should have a regulatory affairs program to ensure compliance with federal and state statutes and regulations. The Joint Commission’s National Patient Safety Goals for long-term care may be informative even for facilities not accredited by the Joint Commission; in some circumstances, they may provide an applicable standard of care.

Event Reports

       The risk manager is the key facilitator of accurate reporting of events and potential adverse events (ie, near misses) and is responsible for implementing and maintaining an effective event reporting system. Events should be reported for many reasons. For example, knowledge of the type and number of events allows risk management to predict future occurrences. It is also important to implement systems changes and other preventive actions; change policies, procedures, equipment, and, if necessary, personnel to prevent future events; investigate events and prepare for any future lawsuits; and develop institution-specific educational programs for staff. In addition, event reporting programs are necessary to comply with regulations and some accreditation requirements. In the past, event reports were sometimes criticized for their misuse as a punitive tool for disciplinary action; however, understanding the purposes of event reporting and implementing practices that preclude the punitive use of these reports help dispel some negative connotations. Still, event reports are discoverable in many jurisdictions, and risk managers must implement appropriate methods for maintaining them.
       When a serious or critical incident occurs, long-term care facilities should consider performing a root-cause analysis as part of their risk management plan. Root-cause analysis is a process for determining the most fundamental reason for occurrence of the incident, allowing improvement efforts to be focused on the primary contributing factors to prevent recurrence.

Information Technology and Risk Management

       The use of information technology (IT), including computer technology, telecommunications networks, and handheld electronic devices, in healthcare settings has provided assistance for performing risk management functions.⁴ This includes processes that can be performed more quickly and easily with the use of information systems, such as risk identification; analysis, tracking, and trending of events and losses; and completion of event reports. Such systems can also store necessary information (eg, updated information about regulations and statutes), access information stored in electronic libraries, complete statistical analyses of data, and facilitate communication among personnel or departments.

Table 1

       In recent years, many risk management programs have relied on computerized and Web-based event management systems. These systems provide easier methods of recording information (eg, point-and-click methods of data entry, drop-down menus, check boxes). Event reporting systems can be set up with access and security protections so that frontline staff members can access data-entry pages, only department managers can access data and reports for their particular departments, and only risk managers and administrative staff can access or modify any information in the system. Computer-generated event data and reports can immediately and easily be sent to management, whereas paper reports may not reach management in a timely manner and can be easily lost or misplaced.
       When using databases for risk management functions, users can generate reports from the data (eg, risk assessments, event reports, claims management information) stored in the system. Many types of information can be tracked, evaluated, and organized into report form from such systems. Examples include:
• Events or losses sorted by department or service, shift, and location
• Near-miss information for trending and analysis
• Events or losses sorted by date reported or date event occurred
• Most expensive or most commonly occurring events
• Updated status of open bodily injury claims
• Frequency of events by job and location
• Frequency of events, sorted by resident
• Number and types of injuries involving residents, employees, and visitors
• Characteristics of residents involved in events
• Shifts or days of the week when events occur.
       While IT systems significantly improve risk management processes, risk managers should prepare for any risks and setbacks that may occur. For example, technological failures or computer viruses may alter or destroy information stored in a facility’s system. In addition, the use of databases that contain large amounts of resident information puts the facility at risk for privacy or security issues. Facilities should ensure that IT systems are upgraded periodically and that staff members are properly trained on use of the systems.

Evaluating Risk Management Programs

       Lastly, long-term care organizations must monitor and evaluate the effectiveness of the risk management program.⁵ Risk managers, senior management, governing board and medical staff, insurers, claims managers, and legal counsel should all be involved in the evaluation process, and the risk manager should develop and submit a report on risk management functions (eg, claims activity, new or changed program elements, contract changes, insurance coverage changes) to the governing board on at least a yearly basis. The information included in the report should be compared against both organization-wide data for the previous year and data from similar organizations, if available.
       The report should also include a summary of activities undertaken with the aim of reducing risks and improving safety in the facility. In addition, positive results (eg, improved event reporting or reduced fall rates) should be reported along with opportunities for improvement and/or a plan to address these issues in the upcoming year. That plan should include the following action items:
• Ensure that individuals with risk management responsibility maintain the support of the medical director and attending physicians, facility owners and the governing body, and department managers.
• While preparing a written risk management plan, assess your organization’s needs in terms of its unique operational structure, existing resources, and experience with risk management.
• Ensure that linkages are established between the risk management function and quality assurance, utilization management, infection control, and other monitoring functions to receive and disseminate relevant risk management information
• If possible, incorporate IT for risk management functions, such as risk identification; analysis, tracking, and trending of events and losses; and completion of event reports. Establish a computerized risk management database with the ability to link risk management data with information from quality assurance, resident charts, infection control, and utilization review.
• Use ECRI Institute’s Continuing Care Risk Management System’s Self-Assessment Questionnaires and other program resources to periodically assess the strengths and weaknesses of your risk management program.