Risk Management in EHR implementation

Risk management is defined as “the act or practice of dealing with risk, which includes planning for risk, assessing, identifying and analyzing risk areas, developing risk-handling options, monitoring risks to determine how risks have changed, and documenting the overall risk management program.”¹ The goal of risk management is to lower the probability of risk and alleviate risk impacts. Health information management (HIM) students need to be able to analyze risk management scenarios in various HIM practices to control or prevent risk where possible. The authors reviewed current textbooks and journal articles and did not find sufficient practical examples for student use. Addressing this lack of information, this article describes and illustrates how to apply the risk management tool failure mode and effects analysis (FMEA) with risk register

Risk Management in Healthcare

The methods of FMEA vary in different texts. One approach, published in the AORN Journal, proposes a critical index score, which is calculated as follows:

Critical Index (CI) score = Severity × Probability × Detectability

For each of the factors, a scale of numbers ranging from 1 to 5 is assigned. Thus, the most severe, most probable, and least likely to be detected potential error event is the highest ranked event. The Joint Commission proposes a risk priority number (RPN) method, which is the same as the CI score described above, except that the scale for each factor ranges from 1–10.⁷

Yet another approach, published by Mike W. Schmidt in Medical Device and Diagnostic Industry, argues that detectability in risk assessment is suitable in manufacturing, but detection of a hazard during use of a particular device does not ensure the harm will be avoided.⁸ Therefore, in recent healthcare studies the risk score contains only two factors.‑^9,10 For example:

Risk score = Severity × Probability

Just as the methods of FMEA vary in different texts, there is currently no standardized process in actually conducting the FMEA process. The Veterans Affairs National Center for Patient Service (VA NCPS) interpreted the TJC requirement in the Leadership 5.2 standard as needing five steps:¹¹

1. Defining the FMEA topic
2. Assembling the team
3. Graphically describing the process
4. Conducting a hazard analysis
5. Actions and outcome measures

To further illustrate differences in conducting the FMEA process, Darryl S. Rich, the surveyor of TJC, specifies the following six steps:¹²

1. Constructing a detailed flow chart of the process
2. Determining each step that can “fail” and how it can “fail”
3. Determining the “effect” of each possible “failure”
4. Determining how serious the possible effect(s) can have on the patient—criticality
5. Conducting root cause analysis of top failure modes
6. Brainstorm actions that could reduce the criticality index

Healthcare managers can be flexible in deciding on the FMEA process steps based on the process under review. Regardless of the differences, both of the two methods require the key technical parts in FMEA which include conducting a workflow process, assigning the scales to the risk factors, determining the risk score, and providing actions to improve the process. Below, the authors use an arbitrary example of electronic health record (EHR) implementation to illustrate the application of FMEA in risk management.

Applying FMEA in EHR implementation

Choosing the EHR implementation process is an ideal example to illustrate the application of FMEA. Using the process proposed by VA NCPS, the first three steps are assumed. The topic is identified and a team is in place. An analysis of workflow has been completed because EHR implementation projects are generally led by a professional project team. The team will usually consist of a project manager, sponsors, and representatives from each department/unit. To illustrate FMEA, this article will focus on the next steps in the analysis, which consist of risk assessment and control.

First, what are the risks in EHR implementation? Risk identification methods include brainstorming, Delphi technique, interviews, root cause analysis, SWOT analysis, and experience. The risk management team can use any method to identify the risks. The team will assign each risk factor a rating for severity and probability. In practice, one risk item will impact several aspects of the project, including cost, time, scope, and quality, which are the key criteria to assess the implementation success. Therefore, it is more complicated than calculating one single risk score. To analyze the complexity, the following tables were created.

Table 1: Risk Assessment Table

According to the above table, the risk management team can assess each risk item’s probability, then risk score. For example, the risk score of inadequate training is found in Table 2.

Table 2. The Risk Score of Inadequate Training

The ranking legend below Table 1 is used to decide whether this risk item is assessed as high, medium, or low risk in the EHR implementation project. According to the ranking legend, inadequate training is assessed as medium risk.

Monitor and Control Risks with Risk Register

The next step is to take action to monitor and control risks. The risk management team should pay more attention to risk factors assessed as high to medium to alleviate its impacts. Actions include avoiding, transferring, mitigating, and accepting a risk. Avoiding a risk is to ensure the risk will not happen by changing the plan or process. For example, to address inadequate training, managers can prepare in advance by requiring more training from the vendor and providing additional on-site or on-line assistance.

The most common form of transferring a risk is to purchase insurance. For example, in an EHR implementation project, purchasing additional billing insurance can alleviate the potential negative impacts due to billing errors during use of the new EHR system. Outsourcing is another popular approach in risk transferring. If the hospital has limited experience in data conversion during EHR implementation, it can contract out this work to a data conversion specialist. If there is no way to avoid or transfer risk, then mitigating the risk is needed. For example, with system incompatibility, the organization can allocate more capital resources to replace obsolete systems. This will require mobilizing the contingency plan for extra resources, such as labor and cost. Finally, if nothing can be done, the organization will have to accept the risk.

The next step involves the development of a risk response plan for each of the risk items. Each risk item has its critical date, such as with EHR implementation, where some risk items are approaching, while others are not urgent. The risk team needs to assess all risk items and input them into the risk register, as illustrated in the following table.

Table 3: Risk Register

Summary

Notes

1. Spath, P. L. Introduction to Healthcare Quality Management. Health Administration Press, Chicago, IL: 2009.
2. Ibid.
3. Joint Commission on Accreditation of Healthcare Organizations. Hospital Accreditation Standard, LD 5.2. 2002.
4. Kelly, D. Applying Quality Management in Health Care: A Systems Approach. 2^nd edition. Health Administration Press, Chicago, IL: 2007.
5. Institute for Healthcare Improvement. “Improve Core Processes for Dispensing Medications.” http://www.ihi.org/resources/Pages/Changes/ImproveCoreProcessesforDispensingMedications.aspx. 2015.
6. Spath, P. L. Using failure mode and effects analysis to improve patient safety. AORN Journal. 78(1), 16-37. 2003.
7. Joint Commission Resources. Excerpts from Failure Mode and Effects Analysis in Health Care: Proactive Risk Reduction. 3^rd Edition. 2013. http://2013.march.qualityandsafetynetwork.com/downloads/JCR3_13_Risky_Business.pdf.
8. Schmidt, Mike W. “The Use and Misuse of FMEA in Risk Analysis. Medical Device and Diagnosis Industry.” March 2004 issue. p. 56. Retrieved on 4/17/2014 from http://www.mddionline.com/article/use-and-misuse-fmea-risk-analysis.
9. Reiling, J. G. et al. “FMEA – the Cure for Medical Errors.” Quality Progress 36(8), 67-71. 2003.
10. Win, K. T. et al. “Electronic health record system risk assessment: a case study form the MINET.” Health Information Management, 33(2), 43-8. 2004.
11. Veterans Affairs National Center for Patient Service. The Basics of Healthcare Failure Mode and Effect Analysis. 2001. http://www.patientsafety.va.gov/docs/hfmea/HFMEAIntro.pdf.
12. Rich, D. S. Complying with the FMEA Requirements of the New Patient Safety Standards. 2001. http://www.fmeainfocentre.com/presentations/fmea_requirements.ppt‎.

References

Department of Defense. Military Standard: Procedures for Performing a Failure Mode, Effects and Criticality Analysis. 1980. http://www.sre.org/pubs/Mil-Std-1629A.pdf.

[box] Tiankai Wang, PhD, is associate professor and Jackie Moczygemba, MBA, RHIA, CCS, FAHIMA, is associate professor and chair in the health information management department at Texas State University.[/box]