Subjects and lessons to explore.

Law

Health Administration · Quality and Safety

Patient Safety

10 min read 5 practice questions
10 key termsSourcesReport an error
Want it in plain words first? Jump to Eli explains — the same idea, no jargon.
On this page 9 sections
  1. In 30 seconds
  2. Why this matters
  3. The college version
  4. Eli explains
  5. Worked example
  6. Key takeaway
  7. Quick check
  8. Study tools
  9. Sources & references

In 30 seconds

is the discipline of preventing harm that comes from health care itself rather than from a patient's disease. It began as an organized field with the Institute of Medicine's 2000 report To Err Is Human, which estimated that 44,000 to 98,000 Americans die each year from preventable hospital errors - a debated estimate, not a settled count. The field's central move is to look past individual blame to the systems in which good people make mistakes.

Why this matters

Safety is one axis of health-care quality, and it is the one an administrator can most directly design for. Understanding why errors happen - and why blaming the last person to touch the patient rarely prevents the next - shapes how you build checklists, staffing, reporting systems, and accountability policies. The vocabulary here is also load-bearing: confusing an error with an , or a with a harm, produces bad measurement and bad decisions. And because the field's founding statistic is still argued over, learning to state it as an attributed estimate rather than a fact is itself part of thinking well about safety.

The college version

Where the field came from: To Err Is Human

Patient safety is the branch of health care concerned with preventing harm that arises from medical care itself, as opposed to harm from the patient's underlying disease. As an organized field it has a clear origin point: in late 1999 the Institute of Medicine (now the National Academy of Medicine) released To Err Is Human: Building a Safer Health System, printed in 2000, and it is widely treated as the beginning of the modern patient safety movement. The report's most quoted line was a number. Extrapolating from two large chart-review studies - one in New York, one in Utah and Colorado - it estimated that somewhere between 44,000 and 98,000 Americans die each year from preventable errors in hospitals, and pointed out that even the lower figure would exceed annual deaths from motor-vehicle crashes, breast cancer, or AIDS. That comparison is what pushed safety onto the national agenda. It is important to handle the number honestly: it was an estimate built on extrapolation, and it has been debated ever since. Some critics argued the methodology overstated preventable deaths; some later analyses argued the true toll is higher, perhaps in the hundreds of thousands. The defensible statement is that the IOM estimated 44,000 to 98,000 preventable deaths, that this estimate galvanized the field, and that its precise magnitude remains contested. The report's more durable contribution was an argument, not a statistic: that most errors are not caused by careless or incompetent individuals but by good people working inside badly designed systems, and that the way to get safer is to redesign the systems.

The vocabulary: error, adverse event, near miss, and the reportable categories

Safety work depends on a precise vocabulary, because these words are easy to blur and the blurring corrupts measurement. An error is any act of commission (doing the wrong thing) or omission (failing to do the right thing) - and crucially, an error need not reach or harm the patient. An adverse event is harm that results from medical care rather than from the disease itself; a drug reaction, a surgical injury, a hospital-acquired infection. Not every adverse event is preventable: a preventable adverse event is one caused by an error or by the failure to apply an accepted safety strategy, and those are the ones safety work targets. A near miss is an event in which a patient was exposed to a hazard but escaped harm, often only by luck - the wrong medication drawn up but caught before it was given. Near misses matter enormously because they reveal the same system weaknesses as harms do, but without a victim, so an organization can learn from them cheaply. Two more categories are used for the most serious events. A , in The Joint Commission's terms, is a safety event not primarily related to the patient's illness that reaches the patient and causes death, permanent harm, or severe temporary harm; identifying one is expected to trigger a formal root cause analysis, a structured retrospective investigation covered in its own lesson. A 'never event' is a particularly egregious, clearly identifiable, largely preventable error - wrong-site surgery, a retained surgical item. The term was coined in 2001 by Ken Kizer of the National Quality Forum (NQF); the NQF now maintains a list of 29 Serious Reportable Events in seven categories. In 2007-2008 the Centers for Medicare & Medicaid Services stopped paying the added cost of treating certain of these preventable events, tying safety to payment.

Why safety thinks in systems: Reason's Swiss cheese model

The intellectual engine of modern patient safety is the systems view of error, articulated for a clinical audience by the psychologist James Reason. He contrasted two ways of responding to error. The person approach blames the individual who made the unsafe act and responds with retraining, discipline, or 'naming, blaming, and shaming.' The system approach starts from a different premise: humans are fallible, errors are expected even among the best people, and the useful question is why the system let a predictable error reach the patient. Reason split the causes into two kinds. Active failures are the unsafe acts committed by people at the sharp end - the nurse, the surgeon, the pharmacist - and their effects are usually immediate and short-lived. Latent conditions are the weaknesses already built into the system by earlier design and management decisions: understaffing, confusing labels, poor handoff routines, alarm fatigue. Latent conditions can lie dormant for years, and they are what make active failures possible or consequential. His makes this visual. Imagine a system's defenses as a stack of cheese slices; each slice has holes, and the holes represent gaps in a defense. The holes move and change as conditions shift. Any single hole is harmless, because the next slice usually blocks the hazard. An accident happens only in the rare moment when holes in every successive layer line up, opening a straight path - an accident trajectory - from hazard to patient. The lesson for administrators is that you rarely prevent the next error by punishing the person who happened to be standing where the holes aligned; you prevent it by adding or strengthening layers of defense.

From blame to a just culture

If most error is a system problem, does anyone remain accountable for anything? The answer the field settled on is the , a concept brought into health care largely through the work of David Marx. A just culture is deliberately positioned between two failures. A purely punitive culture blames and disciplines individuals for outcomes; it feels like accountability but it drives error underground, because staff who fear punishment stop reporting. A blame-free or 'no blame' culture treats every error as a system fault and holds no one responsible, which is unfair and unworkable when someone genuinely acted recklessly. A just culture keeps the system focus while restoring a defensible line for individual accountability. It sorts behavior into three kinds and responds to the behavior, not to how badly the outcome turned out. Human error - a slip or lapse - calls for consoling the person and fixing the system that set them up. At-risk behavior - drifting into unsafe shortcuts, often without realizing the risk has grown - calls for coaching and removing the incentives to cut corners. Reckless behavior - a conscious disregard of a known, substantial risk - is the narrow zone where individual sanction is appropriate, and a just culture holds a firm line there. The decisive design choice is that the response depends on the behavior, not the severity of the harm: the same slip should be handled the same way whether the patient was unharmed or died. That is what makes reporting feel safe enough to be honest.

High reliability and learning from events

Some industries operate in conditions at least as hazardous as health care - aviation, nuclear power, aircraft carriers - yet suffer very few catastrophes. Safety researchers call their exemplars high reliability organizations (HROs), and the concept has become a north star for health systems. An HRO sustains what Karl Weick and Kathleen Sutcliffe call collective mindfulness, described through five principles. Preoccupation with failure means reading minor slips and close calls as early warnings worth investigating rather than as proof that all is well. Reluctance to simplify means resisting the tidy explanation and looking for the real, messy causes. Sensitivity to operations means keeping a live, big-picture awareness of how the work is really unfolding moment to moment on the units. Commitment to resilience means assuming the system will fail and rehearsing how to catch and contain failures quickly. Deference to expertise means letting the person who knows the work make the safety call, regardless of rank. Making any of this real depends on learning from events, which is why organizations run event-reporting systems. Voluntary incident reports - and especially near-miss reports - let staff surface hazards before someone is harmed. Their great weakness is underreporting: only a fraction of events are ever entered, and serious harms are overrepresented. To lower the barrier, the Patient Safety and Quality Improvement Act of 2005 created Patient Safety Organizations and gave federal confidentiality and privilege protections to information reported to them, and AHRQ developed standardized Common Formats so that events could be compared across institutions. Reporting is not the goal; it is the raw material a safety culture turns into stronger defenses.

Eli, the EliExplains learning guide

Eli explains

The same idea, in plain words

Explain it like I’m 10

Hospitals are complicated places where even careful people sometimes make mistakes. Patient safety is the job of stopping those mistakes from hurting people. The big idea is that when something goes wrong, you usually should not just blame the last person who touched the patient. Instead you ask why the whole setup made the mistake easy - confusing labels, too few nurses, no double-check. You fix the setup, not just the person. Safety experts also keep track of tiny mistakes that almost hurt someone but did not, called near misses, because those are free warnings. And they build 'layers' of protection so that if one thing fails, another still catches it before it reaches the patient.

Picture it like this

Think of safety like the layers that protect a goalie's net: defenders, the goalie, and the posts. Each layer has gaps, but a shot only scores when the gaps in every layer happen to line up at the same instant. To let in fewer goals you do not fire the goalie after one score - you add and strengthen layers so the gaps stop lining up.

Where the picture stops working

The analogy understates two things. In sports the opponent is trying to score, whereas in a hospital no one wants harm - the 'shots' are accidents, not attacks. And it leaves out accountability: unlike a goalie who simply got beaten, a person who recklessly ignores a known safety step should still be held responsible, which is exactly the line a just culture draws.

Worked example

Consider a nurse who gives a patient a tenfold overdose of insulin. A person-approach investigation stops at the nurse: she made the mistake, so retrain or discipline her, and move on. A systems investigation asks what let the error through. It finds that the pharmacy stocked two insulin concentrations in near-identical vials (a latent condition), the unit was two nurses short that night (a latent condition), the barcode scanner was broken so the usual double-check was skipped (a failed defensive layer), and the nurse misread the vial at 3 a.m. (the active failure). In Swiss cheese terms, the holes lined up. A just-culture review then classifies the nurse's act: this looks like human error or at-risk behavior driven by the conditions, not reckless disregard, so the response is to support her and fix the vials, staffing, and scanner - not to fire her. Had she instead knowingly bypassed a working double-check she believed was pointless, that reckless behavior would warrant individual accountability. Same outcome, different response, decided by the behavior rather than the harm.

Key takeaway

Patient safety, founded by the IOM's To Err Is Human (whose 44,000-98,000 death figure is an attributed, debated estimate), treats most harm as the product of flawed systems rather than bad individuals - Reason's Swiss cheese model explains how weaknesses align, a just culture preserves accountability without suppressing reporting, and high-reliability practices and event reporting turn those lessons into stronger defenses.

Quick check

3 questions here, of 5 in this lesson’s practice set. Answers stay hidden until you check.

Question 1 of 3intermediate

How should the '44,000 to 98,000 deaths per year' figure from To Err Is Human be characterized?

Choose an answer, then check it.
Question 2 of 3intermediate

A pharmacist prepares the wrong dose but a barcode scanner catches it before the drug reaches the patient. What is this best called?

Choose an answer, then check it.
Question 3 of 3advanced

In James Reason's framework, which is an example of a latent condition rather than an active failure?

Choose an answer, then check it.
Practice all 5

Keep learning

Ready to build on this? Continue to the next lesson.

Practice this lesson
Study tools & related lessonsYou’ll learn to · Common mistakes · Easily confused · Key vocabulary · Related

You’ll learn to

  • Define patient safety and explain how the IOM report To Err Is Human founded the modern field.
  • State the 44,000-98,000 estimate as an attributed, debated estimate rather than a settled fact.
  • Distinguish error, adverse event, preventable adverse event, near miss, sentinel event, and never event.
  • Explain James Reason's system approach, active failures versus latent conditions, and the Swiss cheese model.
  • Distinguish a just culture from both a punitive culture and a blame-free culture.
  • Describe high-reliability principles and the purpose and limits of event-reporting systems.

Common mistakes

  • Stating the 44,000-98,000 figure as a settled fact about how many people die from medical errors.

    It is the IOM's 2000 estimate, extrapolated from chart-review studies, and it has been debated ever since. Attribute it and call it an estimate, not a count.

  • Using 'error' and 'adverse event' as synonyms.

    An error is a wrong act that may cause no harm at all; an adverse event is actual harm from care. Many errors cause no adverse event, and some adverse events involve no error.

  • Believing a just culture means no one is ever blamed.

    A just culture is not blame-free. It holds a firm line for reckless behavior; it just refuses to punish honest error and bases its response on the behavior rather than on how bad the outcome was.

  • Treating the Swiss cheese model as a checklist for finding the one root cause to punish.

    The model shows that harm requires many aligned weaknesses across layers. Its point is to add and strengthen defenses, not to isolate a single person to blame.

  • Assuming a low count of reported events means a unit is safe.

    Voluntary reporting badly underestimates events, and near misses go unreported most of all. Few reports may signal a weak reporting culture, not a safe one.

Easily confused

Near miss vs. Adverse event

In a near miss the patient was exposed to a hazard but escaped harm; in an adverse event the patient was actually harmed by care. Both expose the same system weaknesses.

Active failure vs. Latent condition

An active failure is an unsafe act at the point of care with immediate effect; a latent condition is a dormant, upstream system weakness that made the act likely or consequential.

Punitive culture vs. Just culture

A punitive culture disciplines individuals for bad outcomes and suppresses reporting; a just culture keeps a systems focus, responds to behavior type rather than outcome severity, and reserves sanction for reckless behavior.

Key vocabulary

Patient safety
The health-care discipline aimed at preventing harm that arises from the process of care itself rather than from the patient's underlying disease.
Error
An act of commission (doing the wrong thing) or omission (failing to do the right thing); an error may occur whether or not it reaches or harms a patient.
Adverse event
Harm to a patient that results from medical care rather than from the underlying illness.
Near miss
An event in which a patient was exposed to a hazard but escaped harm, frequently only by chance; a low-cost source of learning about system weaknesses.
Sentinel event
A Joint Commission term for a safety event, not primarily related to the patient's illness, that reaches the patient and causes death, permanent harm, or severe temporary harm; it is expected to trigger a root cause analysis.
Never event / Serious Reportable Event
A clearly identifiable, serious, largely preventable error (such as wrong-site surgery); the National Quality Forum maintains a list of 29 such events in seven categories.
Active failure vs. latent condition
Active failures are unsafe acts by people at the point of care with immediate effects; latent conditions are dormant system weaknesses built in by earlier design and management decisions.
Swiss cheese model
James Reason's image of layered defenses as slices of cheese whose holes shift; an accident occurs only when holes in successive layers momentarily line up.
Just culture
An accountability model that keeps a systems focus while distinguishing human error, at-risk behavior, and reckless behavior, responding to the behavior rather than the severity of the outcome.
High reliability organization (HRO)
An organization that operates in a high-hazard domain for long periods without catastrophic failure by sustaining collective mindfulness, characterized by five principles from Weick and Sutcliffe.

Sources & references

  1. To Err Is Human: Building a Safer Health System — Institute of Medicine (National Academies Press)
  2. Patient Safety 101 (Patient Safety Network Primer) — Agency for Healthcare Research and Quality (AHRQ) Patient Safety Network
  3. Never Events (Patient Safety Network Primer) — Agency for Healthcare Research and Quality (AHRQ) Patient Safety Network
  4. Culture of Safety (Patient Safety Network Primer) — Agency for Healthcare Research and Quality (AHRQ) Patient Safety Network
  5. High Reliability (Patient Safety Network Primer) — Agency for Healthcare Research and Quality (AHRQ) Patient Safety Network
  6. Human error: models and management — BMJ (James Reason), BMJ 2000;320:768-770
  7. The 'To Err is Human' report and the patient safety literature — Quality & Safety in Health Care / PMC (Stelfox, Palmisani, Scurlock, Orav, Bates)

EliExplains lessons are original prose written from the open, credible references above. See Copyright & Licensing.

Researched 2026-08-19

Educational content only. It is not medical, legal or professional advice. Found an error? Tell us.