Recommending Controls: Processes, Procedures, and Policies That Mitigate Risk
Unit 3: Risk, Recalls, and Data Security. Lesson 15 of 60 in CHTM Academy.
An investigation closes and the recommendation writes itself: retrain the staff. Six months later the same event happens on a different unit. Retraining is the weakest control available, and a manager who reaches for it first will spend a career fixing the same thing. This lesson is about choosing a control that holds and proving that it did.
The hierarchy of controls, applied to healthcare technology
Strongest first. Work down the list only when the one above it is genuinely impossible.
Control What it means here Example
Eliminate remove the hazard entirely retire the model that has
no free-flow protection
Substitute replace it with something safer standardize on one pump
with a drug library
Engineer design the hazard out so a person hard dose limits, interlocks,
cannot reach it keyed connectors, segmented
network, tamper-proof settings
Administer change what people are told to do a procedure, a policy, a
checklist, a second signature,
a maintenance interval
Protect put equipment between the person gloves, eye protection,
and the hazard lockout devicesEngineering controls work whether or not anyone is paying attention; administrative controls work only while attention lasts. That is why a device configuration change usually beats a memo, and why the committee should hear both options with their cost.
Writing a procedure or policy that actually controls the risk
A policy says what the organization requires and who is accountable. A procedure says who does what, in what order, with what, and what the record is. A control written as prose nobody can follow is not a control.
- State the risk the document exists to control, in one sentence.
- Name the trigger: what starts the procedure.
- Number the steps in the order a person performs them, one action per step.
- Name the roles, not the people, so it survives a resignation.
- Say what record is made, where it is kept, and for how long.
- Say what to do when a step cannot be completed, and who to escalate to.
- Date it, version it, name the owner, and set a review date.
Reference the organization's other policies rather than repeating them, so one change does not leave three documents disagreeing.
Training and competency as controls
Training is a legitimate control when the gap really is knowledge and when it is backed by competency assessment rather than an attendance sheet. Competency means the person demonstrated the task, was observed, and the observation was recorded. For operators, take in-service education to the pattern you measured, on every shift that touches the device, and record who was trained on what, by whom, and when. For staff, documented assessment per person and per equipment type. Training with no assessment behind it is a note in a file, and a surveyor will read it as one.
Measuring whether a control works
Decide the measure before you implement the control, and take a baseline. Then measure the same thing the same way: the event count or near-miss count, the use error code frequency on that model and unit, repeat repairs, overdue scheduled maintenance, audit results on the new procedure's records, and the completion of the training. Set a date to report. A control with no measure attached cannot be defended and cannot be withdrawn, so the department accumulates procedures forever and knows nothing about any of them.
Presenting the recommendation to the committee that owns it
Match the control to the committee. Device-related events and use error trends go to patient safety. Equipment inventory, completion rates, recalls, and the annual plan evaluation go to the environment of care committee. Investigations, device holds, and reportable events go to risk management. Metrics with targets and corrective action results go to performance improvement. Imaging and therapy equipment performance goes to radiation safety, device cleaning and disinfection to infection control. Whichever it is, bring one page: the risk, the options with cost, your recommendation, the measure you will report, and the decision you need from them.
Recommending Controls: Processes, Procedures, and Policies That Mitigate Risk, explained slowly
A control decision, worked down the hierarchy
A pump fleet has produced three wrong-concentration events in a year. Here is the same risk addressed at five different levels, with what each costs and how long it lasts.
Level Control Cost How long it holds
Eliminate retire the two models without $380,000 permanently; the
a drug library capital hazard is gone
Substitute standardize the whole fleet on $140,000 permanently for the
the model that has hard limits capital devices replaced
Engineer configure hard concentration $0 to indefinitely; it
limits in the library on every $9,000 works whether or not
pump that supports them of labor anyone is watching
Administer a policy requiring a second- staff time as long as staffing,
person check, plus a procedure only attention, and
and an audit turnover allow
Protect nothing applicable; personal n/a n/a
protective equipment does not
address a dosing errorThe recommendation here is the engineering control first, because it costs almost nothing and does not depend on attention, with the substitution carried into the capital plan and the administrative control used only on the devices that cannot take a hard limit. Bring all of it to the committee. A committee shown one option has been handed a decision, not asked for one.
A procedure that controls a risk, in full
TITLE Securing a device involved in a patient event
PURPOSE To preserve the device and its evidence so the hospital can
determine cause and meet its reporting obligations.
OWNER HTM manager VERSION 3 REVIEW BY next March
TRIGGER Any report that a patient was or may have been harmed while a
medical device was in use.
STEPS
1 The clinical staff remove the device from patient use immediately and
do not clean, adjust, reset, or power it off.
2 The charge nurse calls HTM and the risk manager. HTM responds on site.
3 HTM photographs the device, screen, controls, and connections as found.
4 HTM collects the accessories, cables, sensors, and disposables in use,
including packaging and the contents of the room's trash.
5 HTM pulls event and error logs by the manufacturer's documented method
and records who pulled them and when.
6 HTM tags the device OUT OF SERVICE, moves it to the secured location,
and records the chain of custody.
7 HTM supplies the device identification to the risk manager within one
hour: manufacturer, model, serial, software version, lot numbers.
8 No repair, calibration, update, or return to service occurs until the
risk manager releases the device in writing.
IF A STEP CANNOT BE COMPLETED
Record what could not be done and why, and notify the risk manager
immediately. Escalate to the HTM manager and the administrator on call.
RECORD The event file: photographs, logs, custody record, device
identification, and the release. Retained per the hospital's
retention schedule.Read what makes it a control rather than an essay: a trigger, numbered single actions, roles rather than names, a record, an exception path, and a review date.
Measuring a control
Control Measure Baseline Target When
Hard concentration limits wrong-concentration 3/yr 0 quarterly
in the drug library events
Second-person check policy audit compliance on 20 n/a 90% monthly
observed programmings for 6
months
In-service on every shift use error codes on this 17/qtr <5 quarterly
model
New securing procedure event files complete on 40% 100% per event
audit
Competency assessment staff assessed competent 4 of 8 of annual
on the new fleet 8 8Set the baseline before you implement, or you will spend a year arguing about whether anything improved.
Matching the control to its committee
What you are bringing Committee device-related events, near misses, use patient safety error trends, alarm issues equipment inventory, completion rates, environment of care recalls, the annual plan evaluation, utility and construction impacts investigation reports, device holds, risk management reportable events metrics with targets and trends, the performance improvement results of corrective actions imaging and therapy equipment radiation safety performance, survey results cleaning and disinfection, water systems, infection control sterilizers, loaner handling
What to memorize
Hierarchy eliminate, substitute, engineer, administer, protect
Rule of thumb engineering controls hold without attention; administrative
controls hold only while attention lasts
Retraining alone the weakest answer on any list
Procedure risk, trigger, numbered steps, roles, record, exception
path, owner, version, review date
Competency demonstrated, observed, recorded; attendance is not
competency
Measurement defined with a baseline before implementation