Identifying and Evaluating Risk: Patient Safety, Operations, Financial, Emergency Preparedness, Regulatory
Unit 3: Risk, Recalls, and Data Security. Lesson 13 of 60 in CHTM Academy.
Your risk manager asks for the HTM department's top five risks by the end of the week, for a report going to the board. You have incident reports, a service history, a recall folder, and a backlog list, and none of them is labeled "risk". Turning what you already know into five ranked statements somebody else can act on is the whole job of this lesson.
The five categories, with an HTM example of each
Category What it looks like in your department
Patient safety a device that shocks, burns, delivers the wrong dose, or
reads out of calibration and leads to a misdiagnosis
Operations downtime on the only device of its kind, a canceled
procedure, a surgeon who takes cases elsewhere
Financial unplanned repairs that break the budget, a contract
signed without review, a fine, the cost of a lawsuit
Emergency preparedness a utility or network failure that leaves clinicians
without working equipment and no written workaround
Regulatory a survey finding on maintenance records, an unreported
adverse event, equipment in an alternative maintenance
program that was never eligible for itThey overlap on purpose. One failed sterilizer is a patient safety risk, an operations risk, a financial risk, and a regulatory risk at the same time, and naming all four is what gets it funded.
Risk is likelihood and consequence
A risk statement that names only the bad outcome cannot be ranked. Every risk has two dimensions: how likely it is, from your own history or credible outside data, and how bad it is if it happens. A rare event with catastrophic consequence and a weekly event with a trivial consequence can carry the same score and need completely different responses. Write each risk as a sentence that holds both: if this happens, that follows, and here is how often we have seen it.
There is a trade behind every decision you will make with these numbers. Risk and cost move in opposite directions. Almost any risk can be driven close to zero if the hospital spends enough, and cost comes down only by accepting more risk. The hospital's risk management department decides how much risk is acceptable; your job is to state the risk honestly and price the options.
Where the information comes from
- Incident reports from the hospital's event system, including the ones that never mention a device by name.
- Service history in the CMMS: repeat repairs, use error codes, cannot-duplicate calls, rising failure rates.
- Recalls and advisories received and still open.
- Survey findings from your accreditor and from internal audits.
- Staff rounds in the clinical units, which surface the workaround nobody reported.
- Near misses, which are the cheapest data you will ever get and the most often thrown away.
The risk register
A risk register is one list, maintained rather than written once. Each entry holds the risk statement, the category, the likelihood and consequence, the current score, the controls already in place, the named owner, the action with a date, and the review date. It is the document the risk manager actually wants, and it is what lets you answer "what are your top five" in one minute rather than one week.
Who owns what, and when you escalate
Ownership follows the ability to act. HTM owns equipment condition, maintenance strategy, recall execution, and technical advice. The clinical department owns operator competence, device use, and reporting events. IT and the security officer own network and security controls jointly with you. Facilities own power, gases, water, and ventilation. Risk management owns the hospital's tolerance and the investigation. Escalate the moment a risk is beyond your authority or your budget to control, when a device has harmed a patient, when a recall is a Class I, or when a control you recommended has been refused. Escalate in writing, name what you recommended, and keep the copy.
Identifying and Evaluating Risk: Patient Safety, Operations, Financial, Emergency Preparedness, Regulatory, explained slowly
A risk register page, as a risk manager wants to receive it
Five entries from a real department, scored on a 1 to 5 scale for likelihood and consequence, with the product as the score.
# Risk statement Category L C Score Owner 1 The single sterilizer in the main patient 4 5 20 HTM manager OR fails and cases are canceled; safety and with surgical it has failed twice this year operations services 2 Eleven legacy monitors run an regulatory 3 5 15 HTM manager operating system no longer and patient with the supported; they cannot be patched safety security officer 3 Infusion pumps on three units are patient 3 4 12 clinical programmed without the drug safety director, library because staff bypass it nursing 4 No documented downtime procedure emergency 2 5 10 HTM manager exists for the imaging archive preparedness with IT 5 Scheduled maintenance backlog has regulatory 4 2 8 HTM manager grown for three quarters
# Controls already in place Action, owner, date
1 quarterly scheduled maintenance; capital request for a second unit
a loaner agreement with a nearby submitted; interim written transfer
hospital agreement signed; HTM, by 30 June
2 on a separate network segment; replacement in the three-year capital
no internet reachability plan; compensating controls documented
and accepted; HTM and security, by
31 March
3 library installed; training observation audit on all three units,
delivered at install then in-service on every shift;
nursing education, by 15 May
4 none downtime procedure drafted and tested
in the next drill; HTM with IT, by
31 July
5 weekly backlog review staffing analysis attached to the
budget request; HTM, by 1 SeptemberEverything a manager needs to answer "what are your top five" is on those two pages, and every line has a name and a date on it. A register without owners and dates is a list of complaints.
Likelihood and consequence, and why both are required
Risk Likelihood Consequence Score Response
Exam light bulb fails 5 1 5 spares on the cart
A defibrillator fails to 1 5 5 test it, every time,
deliver on a code and never run to
failureIdentical scores, opposite responses. That is why a score ranks work but never replaces judgment, and why the severity dimension gets read on its own before any ranked list is accepted.
Reading your own data for risk
Source What to pull What it reveals
Incident reports every event where a device was events your shop never
present, device named or not heard about
CMMS service history repeat repairs within 30 days, a bad model, a bad part,
use error codes, cannot- or a training gap
duplicate calls
Recall and advisory open notices, and the age of a compliance exposure
log the oldest
Survey findings every finding touching where the accreditor
equipment, internal or external already told you
Staff rounds the workaround nobody reported the risk that is invisible
in every database
Near misses the events that did not reach the cheapest data you
a patient will ever getOwnership and escalation
Risk area Owner HTM's part
Equipment condition and maintenance HTM all of it
strategy
Operator competence and device use clinical department measure and report
use error trends
Network and security controls IT and the security joint; inventory,
officer MDS2, and the
device knowledge
Power, gases, water, ventilation facilities which devices
depend on each
Hospital risk tolerance and the risk management state the risk and
investigation price the options
Escalate immediately when
a device has harmed a patient
a Class I recall names equipment you own
a control you recommended has been refused
the risk exceeds your authority or your budget to control
Escalate in writing, name what you recommended, keep the copy.What to memorize
Five categories patient safety, operations, financial, emergency
preparedness, regulatory
Risk likelihood and consequence, both stated
The trade risk and cost move in opposite directions; risk management
decides what is acceptable
Sources incident reports, service history, recalls, surveys, staff
rounds, near misses
Register statement, category, likelihood, consequence, score,
controls, owner, action, date, review date