Education and debate
developing such systems and many are pursuing internet based applications which would allow ordering andprovide a common platform. Information technology
should also improve safety in other parts of theprocess, including dispensing and administering, but
the full benefits will not be achieved until all the components are electronically linked.
The net result of the above will be a much safer system, which will still require substantial human guidance.
Moreover, the people using the system will have fewer
menial tasks and a more rewarding role: physicians will
discuss drug choices with patients and other providers
rather than worrying about missing an allergy; pharmacists will deal with complex drug orders, counsel
physicians about choices, and investigate problems that
occur, rather than simply filling prescriptions; andnurses will talk with patients and monitor for adverse
reactions, rather than just passing pills.
I thank Joshua Borus for help with preparation of themanuscript.
Competing interests: DB has received honoraria forspeaking from the Eclipsys Corporation, which has licensed therights to the Brigham and Women’s Hospital Clinical
Information System for possible commercial development, andfrom Automated Healthcare, which makes robots that dispense
drugs. He is also a consultant and serves on the advisory board
for McKesson MedManagement, a company that helps hospitals
to prevent adverse drug events, and is on the clinical advisoryboard for Becton Dickinson.
1

2

3

Brennan TA, Leape LL, Laird N, Hebert L, Localio AR, Lawthers AG, etal. Incidence of adverse events and negligence in hospitalized patients:
results from the Harvard Medical Practice Study. I. N Engl J Med
1991;324:370-6.
Leape LL, Brennan TA, Laird NM, Lawthers AG, Localio AR, Barnes BA,
et al. The nature of adverse events in hospitalized patients: results fromthe Harvard Medical Practice Study. II. N Engl J Med 1991;324:377-84.
Bates DW, Cullen D, Laird N, Petersen LA, Small SD, Servi D, et al. Incidence of adverse drug events and potential adverse drug events: implications for prevention. JAMA 1995;274:29-34.

4

Lazarou J, Pomeranz BH, Corey PN. Incidence of adverse drug reactions
in hospitalized patients: a meta-analysis of prospective studies. JAMA
1998;279:1200-5.
5 Classen DC, Pestotnik SL, Evans RS, Lloyd JF, Burke JP. Adverse drug
events in hospitalized patients. Excess length of stay, extra costs, andattributable mortality. JAMA 1997;277:301-6.
6 Bates DW, Spell N, Cullen DJ, Burdick E, Laird N, Peterson LA, et al: The
costs of adverse drug events in hospitalized patients. JAMA 1997;227:
307-11.
7 Bates DW, Leape LL, Petrycki S. Incidence and preventability of adverse
drug events in hospitalized adults. J Gen Intern Med 1993;8:289-94.
8 Sheridan TB, Thompson JM. People versus computers in medicine. In:
Bogner MS, ed. Human error in medicine. Hillsdale, NJ: Lawrence Erlbaum,
1994:141-59.
9 Bates DW, Leape LL, Cullen DJ, Laird N, Petersen LA, Teich JM, et al.
Effect of computerized physician order entry and a team intervention on
prevention of serious medication errors. JAMA 1998;280:1311-6.
10 Bates DW, Teich J, Lee J, Seger D, Kuperman GJ, Boyle D, et al. The impact
of computerized physician order entry on medication error prevention.
J Am Med Informatics Assoc 1999;6:313-21.
11 Evans RS, Pestotnik SL, Classen DC, Clemmer TP, Weaver LK, Orme
JF Jr, et al. A computer-assisted management program for antibiotics andother antiinfective agents. N Engl J Med 1998;338:232-8.
12 Raschke RA, Golihare B, Wunderlich TA, Guidry JR, Liebowitz AI, Peirce
JC, et al. A computer alert system to prevent injury from adverse drug
events. Development and evaluation in a community hospital. JAMA
1998;280:1317-20.
13 Chester MI, Zilz DA. Effects of bar coding on a pharmacy stock replenishment system. Am J Hosp Pharm 1989;46:1380-5.
14 Barker KN. Ensuring safety in the use of automated medication dispensing systems. Am J Health Syst Pharm 1995;52:2445-7.
15 Allan EL, Barker KN, Malloy MJ, Heller WM, Dispensing errors andcounseling in community practice. Am Pharm 1995;35:25-33.
16 Borel JM, Rascati KL. Effect of an automated, nursing unit-based
drug-dispensing device on medication errors. Am J Health Syst Pharm
1995;52:1875-9.
17 Barker KN, Pearson RE, Hepler CD, Smith WE, Pappas CA. Effect of an
automated bedside dispensing machine on medication errors. Am J Hosp
Pharm 1984;41:1352-8.
18 Cullen DJ, Bates DW, Small SD, Cooper JB, Nemeskal AR, Leape LL. The
incident reporting system does not detect adverse drug events: a problem
for quality improvement. Jt Comm J Qual Improv 1995;21:541-8.
19 Classen DC, Pestotnik SL, Evans RS, Burke JP. Computerized surveillanceof adverse drug events in hospital patients. JAMA 1991;266:2847-51.
20 Jha AK, Kuperman GJ, Teich JM, Leape L, Shea B, Rittenberg E, et al.
Identifying adverse drug events: development of a computer-based
monitor and comparison to chart review and stimulated voluntary
report. J Am Med Inform Assoc 1998;5:305-14.
21 Massachusetts Hospital Association Bulletin 1999 March 3.

Gaps in the continuity of care and progress onpatient safety
Richard I Cook, Marta Render, David D Woods
The patient safety movement includes a wide variety of
approaches and views about how to characterise patient
safety, study failure and success, and improve safety. Ultimately all these approaches make reference to thenature of technical work of practitioners at the “sharpend” in the complex, rapidly changing, intrinsically hazardous world of health care.1 2 It is clear that a major
activity of technical workers (physicians, nurses, technicians, pharmacists, and others) is coping with complexity
and, in particular, coping with the gaps that complexity
spawns.3 Exploration of gaps and the way practitioners
anticipate, detect, and bridge them is a fruitful means of
pursuing robust improvements in patient safety.

Gaps
The notion of gaps is simple. Gaps are discontinuities
in care. They may appear as losses of information or
momentum or interruptions in delivery of care. In
practice gaps rarely lead to overt failure. Rather, mostgaps are anticipated, identified, and bridged and their
BMJ VOLUME 320

18 MARCH 2000

www.bmj.com

Summary points
Complex systems involve many gaps between
people, stages, and processes
Analysis of accidents usually reveals the presenceof many gaps, yet only rarely do gaps produce
accidents
Safety is increased by understanding andreinforcing practitioners’ normal ability to bridge
gaps
This view contradicts the normal view thatsystems need to be isolated from the unreliable
human element

VA Patient Safety
Center of Inquiry(GAPS), Universityof Chicago,
Chicago, IL 60637,
USA
Richard I Cook
associate director
VA Patient Safety
Center of Inquiry(GAPS), Cincinnati,
VAMC, Cincinnati,
OH 45220, USA
Marta Render
director
continued overBMJ 2000;320:791–4

We know little about how practitioners identify andbridge new gaps that occur when systems change

791

Education and debate
VA Patient Safety
Center of Inquiry(GAPS), Ohio State
University,
Columbus, OH
43210, USA
David D Woods
associate director
Correspondence to:
R I Cook, Universityof Chicago, 5841 S.
Maryland Avenue,
MC 4028, Chicago,
IL 60637, USA
ri-cook@uchicago.edu

consequences nullified by the technical work done at
the sharp end. These gap driven activities are so
intimately woven into the fabric of technical work thatneither outsiders nor insiders recognise them as
distinct from other technical work.
Gaps are most readily seen when they are alignedwith organisational and institutional boundaries thatmark changes in responsibility or authority, different
roles of professionals, or formal divisions of labour. For
example, the loss of coherence in a plan of care that
occurs during changes of shift is a kind of gap. Anotherexample is the loss of information that sometimes
accompanies transfers of patients from one facility toanother, as when a patient is discharged from hospital
to a rehabilitation facility. Gaps can appear within theprocesses of care and even in association with single
practitioners. For example, when a nurse cares for two
or more patients and must divide attention between

Celebrated cases and folk models of human error
A few celebrated accidents have shaped public perceptions of safety inhealth care. Simple stories of these events obscure the multiple factors,
interacting goals, and conflicting constraints that confronted practitioners
and gave rise to the accidents. These simple stories “explain” how accidents
happen and become the basis for folk models of human error. These folk
models are strongly (but wrongly) held by the public and also by healthcare
professionals, regulators, and managers. Based on these folk models ofhuman error, various ineffective countermeasures are proposed—including
increased sanctions, blame and train approaches, and new technology toprevent human error.
Among the celebrated cases in the United States are the 1995 Florida“wrong leg” case and the 1996 Colorado nurses case. The first story of eachcase produced a simple indictment of human error as the “cause” of theaccident, but detailed study has shown that multiple factors were involved
and that the accident followed the pattern characteristic of complex system
failures.1 In both cases, strong censure of practitioners followed publicattention.
Florida wrong leg case5
Celebrated first story—Capricious surgeon amputates contralateral leg rather
than the one intended. Surgeon disciplined by state licensing board.
Some factors not included in first story:• Both legs were diseased; contralateral leg needed amputation as well
• Amputation of contralateral leg was proposed to patient• Consent identified contralateral leg as target of amputation• Operating room schedule identified contralateral leg as target of
amputation• Patient was anesthetised and contralateral leg was prepped and draped
prior to surgeon’s entry into theatre
Colorado nurses case6
Celebrated first story— Three nurses administer benzathine penicillin
intravenously, causing the death of a neonate. Nurses charged with criminal
negligence. One nurse pleads guilty to a reduced charge; another fights the
charge and is exonerated.
Some factors not included in first story:• Documentation of mother’s prior treatment for syphillis was not available,
prompting consultations with a doctor that led to order for treatment of
neonate with penicillin; it is doubtful that any treatment was required• Pharmacist miscalculated dose, resulting in 10 times overdose (1.5 million
units instead of 150 000 units) being delivered to neonatal unit
• Nurses, concerned about giving large volume of intramuscular drug to a
newborn, sought guidance about changing to intravenous administration• Syringe label was difficult to read
• Available reference materials were ambiguous about acceptable routes ofadministration• Drug was seldom used792

them there is a potential for gaps in the continuity ofcare. Skilfully managing the division of attention is ameans for bridging gaps—for example, by increasing
the frequency of “checking” on the more ill patient orby putting off routine activities such as charting to provide longer periods for observation. But bridging has
its own costs and vulnerabilities. To bridge a gap is notto eliminate it; some bridges are robust and reliable but
others are frail, brittle, and easily undone by outside
circumstances.
Gaps may arise from the unintended side effects oforganisational and technological change. Such gaps
may be either entirely new gaps or old ones that wereregularly bridged before the change undermined theeffectiveness of established bridges. To continue theprevious example, consider the effects of dividing
nursing work between nurses and “patient care technicians.” The economic benefits of division are substantial: it allows the nurse to spend virtually the entire
work shift concentrating on high level tasks that
require certain credentials (giving intravenous drugs,
for example) while other tasks are given to less skilled
personnel. Among the side effects of such a change,
however, are restrictions on the ability of the individual
nurse to anticipate and detect gaps in the care of thepatients. The nurse now has more patients to track,requiring more (and more complicated) inferences
about which patient will next require attention, where
monitoring needs to be more intensive, and so forth.
The change also limits the restructuring of work toadjust to changing demands for attention.

Gaps and technical work
Post hoc analysis often attributes healthcare accidents
to “human error.” This attribution is heavily influenced
by hindsight bias.4 More detailed exploration of theevents, however, shows multiple gaps. For example,
although popular (and regulatory) opinion regarded
the surgeon as the proximate “cause” of the Florida“wrong leg” amputation case (box), there were multiple
contributors to that event including misleading
information on the operative consent and incorrect
posting of the case on the daily schedule board.5 Similarly, in the Colorado nurses case a variety of
breakdowns in continuity eventually led to theintravenous injection of benzathine penicillin anddeath of the newborn patient.6 What these cases havein common (aside from being celebrated in the popular press as evidence of healthcare delivery run amok)
is the presence of multiple gaps that practitioners were
unsuccessful in bridging.
Gaps generate accidents only rarely. In most
instances, practitioners are able to detect and bridge
gaps. Accidents result from breakdowns in the mechanisms that practitioners use to anticipate, detect, andbridge gaps. The opportunities for failure are many but
the incidence of failure is low because practitioners are
generally effective in bridging gaps. The irony is thatstakeholders can attribute failure to human error only
because practitioners in these roles usually bridge thegaps and prevent any escalation toward bad consequences for patients.
This is tantamount to claiming that practitioners
create safety—a claim that is at once controversial andintriguing because it flies in the face of conventional
BMJ VOLUME 320

18 MARCH 2000

www.bmj.com

Education and debate

The alternative view
The alternative view, proposed here, is that accidents
occur because conditions overwhelm or nullify themechanisms practitioners normally use to detect andbridge gaps. Safety is increased primarily by understanding and reinforcing practitioners’ ability to detect andbridge gaps. Because practitioners create safety locally,
efforts to forestall errors by isolating practitioners fromthe system will misfire. Attempts at isolation are likely todecrease practitioners’ ability to detect and bridge gaps
and lead to new paths to and forms of failure.8
According to this alternative view, progress on
safety begins with the development of a detailed understanding of technical work as experienced by practitioners in context.9 Much of human practitioners’ expertisein action revolves around gaps. Work in the real world
involves detecting when things have gone awry;
discriminating between data and artefact; discarding
red herrings; knowing when to abandon approaches
that will ultimately become unsuccessful; and reacting
smoothly to escalating consequences. It involves recognising that hazards are approaching; detecting andmanaging incipient failure; and, when failure cannot be
avoided, working to recover from failure.
Past characterisations of safety and its relation totechnical work have emphasised deliberate “violations”
or failure to adhere to narrow procedural guides. But
these characterisations reflect idealised models of what
technical work entails; they largely ignore the presenceof gaps or the need to cope with them. The focus on
the pervasiveness of “error” in healthcare settings mistakes the nature of how the system works to produce
results.10 As Barley and Orr observe: “anomalies that
surface in aggregate analyses of technical work . . . areparalleled by, if not rooted in, disjunctures and ironies
that pervade day-to-day life in technical settings.”9 It is
important to note that the anomalies arise not because
human behaviour is irreducibly irrational but because
the aggregate analyses do not take account of the presence of gaps or the demands that bridging them placeson sharp end workers.

Coping with gaps
When gaps recur and there is sufficient exposure tothem, formal efforts to create bridges in anticipation
are common. Indeed, it is possible to use the many
types of forms and documents that exist in health careas pointers to the presence of and response to gaps.
Take the example of forms used to communicate
information between facilities when transferring the
responsibility and authority for patient care. The use ofdischarge planning documents marks the anticipationof a certain type of gap and also of an effort to create abridge to permit care to flow smoothly over the gap.
How well the bridge serves the purpose depends on
many factors including the institutions involved,
BMJ VOLUME 320

18 MARCH 2000

www.bmj.com

ULRIKE PREUSS

views of both how accidents occur and also how safety
might be increased.7 The conventional view holds thatthe system is safe by design but can be degraded by the
failure of its human components. Thus, it is claimed,efforts to increase safety should be directed at guarding
the system against the unreliable human element, inmost cases by isolating practitioners from the systemusing technology, rules, guidelines, etc.

Coping with discontinuities in care is a major activity of health workers

characteristics of the patient, and so forth. These are
empirical questions rather than theoretical ones, andthe issues seem mundane.
Similarly, many of the social and organisational
constructions that fill health care reflect the presenceof gaps and efforts to overcome them: the various“report” activities between shifts and between
caregivers, for instance. These easily seen gaps are auseful model for looking at the more heterogeneous
gaps that permeate practice.
Gaps are not always apparent, nor are appropriate
bridging reactions always clear. There may be only thesubtlest hints (or no hints at all) that a gap in an
individual’s care is present. Continuing the previous
example, some inconsistency between the drugs listed
in a transfer document and the list of conditions in thepatient’s history might arouse suspicion that something is missing in the history. This is a case of data in
the world triggering awareness of a potential gap.
Identifying gaps
Much experience and expertise involves having in
mind a catalogue of conditions and situations that hintthat gaps may be present, knowing about the kinds ofgaps that can and are likely to occur, and being able todelineate existing gaps and techniques for bridging
them.11 In addition, much of what counts for high quality performance in health care involves anticipating
gaps that might occur in the future. Anticipating allows
the effects of future gaps to be forestalled either bydirecting care in such a way that the gaps are neverencountered or by creating bridges that will span thegaps if they arise. For example, physicians and nurses
sometimes keep private notes, anticipating that theofficial medical record will become unavailable or be
awkward to use in the future.
A crucial aspect of gaps is how new gaps are identified. New technology, new organisational structures,new techniques and knowledge, and new demands
change the world of technical work—often in
unexpected ways. Changes may create new, unfamiliar
gaps or may change the character of old, familiar ones
so that previously constructed bridges do not spanthem. A critical (and so far unexplored) safety issue is
how practitioners recognise that new gaps are present
in their work world or that the characteristics of familiar gaps have changed. Indeed, the Colorado nurses
793Education and debatecase has the hallmarks of a gap that arises throughchange and, undetected and unappreciated, participates in catastrophe. To plan effective change, it isessential to know how people detect and understandthe new gaps produced by change.

Gaps as tools for research
The enormous complexity of health care is a daunting
obstacle to those trying to study safety systematically.
Everything, it seems, is connected to everything else,and every thread of action and cause is wound into agreat Gordian knot. The pursuit of gaps as a researchtarget is a means of cutting through the knot. Gapsthemselves mark the areas of vulnerability and show
the mechanism by which complexity flows throughhealth care to individual patients. Pursuing gaps is amethod that allows technical work to guide bothresearch into and improvement in safety.
Future work on gaps might be approached in threedifferent ways. Firstly, a catalogue of gaps would yield amap of many of the complexities and hazards in workat the sharp end of systems. Secondly, tracing out thedetails of how practitioners anticipate, detect, andbridge gaps within the context of actual practice would
provide the outlines of what constitutes practitioners’
expertise. Thirdly, discovering how gaps are created byorganisational and institutional change would link theprocesses of management to the real demands
confronting practitioners. Together, these explorationsof gaps can provide a coherent, usable view of patient

safety, a kind of landscape that can be used to identify
future safety problems, anticipate the impact ofchange, and measure progress.
Funding: Preparation of this paper was made possible in part bysupport from the Department of Veterans Affairs Midwest
Patient Safety Center of Inquiry (GAPS).
Competing interests: None declared.
1

Cook RI, Woods DD. Operating at the sharp end: the complexity ofhuman error. In: Bogner MS, ed. Human error in medicine. Hillsdale, NJ:
Lawrence Erlbaum, 1994:255-310.
2 National Patient Safety Foundation. Agenda for research anddevelopment in patient safety. 24 May 1999. www.ama-assn.org/med-sci/
npsf/research/research.htm (accessed 22 Nov 1999).
3 Woods DD. Coping with complexity: the psychology of human behavior
in complex systems. In: Goodstein LP, Andersen HB, Olsen SE, eds. Tasks,
errors and mental models. London: Taylor and Francis, 1988:128-48.
4 Woods DD, Cook RI. Perspectives on human error: hindsight biases andlocal rationality. In: Durso RS, ed. Handbook of applied cognition. New York:
Wiley, 1999:141-71.
5 Cook RI, Woods DD, Miller C. A tale of two stories: contrasting views of patient
safety. Chicago: National Patient Safety Foundation, 1998. (Report from aworkshop on assembling the scientific basis for progress on patient
safety; available as PDF file via www.npsf.org)
6 Senders JW, Schneider PJ, McCadden P, Grant RS, Torres CH, CohenMR, et al. Error, negligence, crime: the Denver nurses trial. Enhancing
patient safety and reducing errors in health care proceedings. Chicago: National
Patient Safety Foundation, 1999:65-76.
7 Cook RI. Two years before the mast: learning how to learn about patient
safety. Enhancing patient safety and reducing errors in health care proceedings.
Chicago: National Patient Safety Foundation, 1999:61-4.
8 Rasmussen J, Pejtersen AM, Goodstein LP. At the periphery of effective
coupling: human error. In: Cognitive systems engineering. New York: Wiley,
1994:135-59.
9 Barley SR, Orr JE, eds. Between craft and science: technical work in US settings.
Ithaca, NY: ILR Press, 1997:16.
10 Corrigan J, Kohn L, Donaldson M, eds. To err is human: building a safer
health system. Washington DC: National Academy Press, 1999.
11 Klein G. Sources of power: how people make decisions. Cambridge, MA:
MIT Press, 1998.

Detecting and reporting medical errors: why the dilemma?
Daniel A Pietro, Linda J Shyavitz, Richard A Smith, Bruce S Auerbach
Sturdy Memorial
Hospital, 211 Park
Street, PO Box
2963, Attleboro,
MA 02703-0963,
USA
Daniel A Pietro
medical director
Linda J Shyavitz
president and CEO
Richard A Smithchief of pathology
Bruce S Auerbach
chief of ambulatory
and emergency
services
Correspondence to:
D A Pietro
Dpietro407@
aol.com
BMJ 2000;320:794–6

Errors in medicine are a major cause of harm topatients. Though there is little controversy among
clinicians about the importance of accurate andreliable clinical data and the imperative of correct
diagnosis, that commitment to exactitude dissolves
when errors happen. Then, clinicians and managers
may behave in a way that limits investigation. We often
use the subjectivity and complexity of medicine torationalise and justify error.
Many factors explain this reluctance to investigate
and to accept error. If we are to design effective systems
to prevent errors from affecting patients, we must
understand these factors. The following case study
illustrates the concerns, fears, and practical problems
that we faced in conducting an evaluation of misinterpreted prostate biopsies.

The problem and the decision
In February 1999 a urologist at the Sturdy Memorial
Hospital in Attleboro, Massachusetts, requested aretrospective review of a 1996 biopsy result because of
the patient’s clinical course and the results of a biopsy
in 1999. The review revealed that the 1996 report wasincorrect. The urologist and pathologist (neither ofwhom was responsible for the 1996 reading)
implemented appropriate management for theaffected patient.

794

Summary points
Detection and prevention of errors are obvious
goals for any organisation
In reality, however, medicine’s approach to error
has been limited and inadequate
Motivational factors, both real and perceived, that
influence how errors in medicine are handled
must be identified, discussed, and changed if the“patient safety movement” is to succeed
Our experience with misread prostate biopsies
illustrates the concerns, fears, and practicalproblems encountered when dealing with thediscovery of medical errors

When they discovered a second misread prostatebiopsy from the same period the urologist andpathologist became concerned that the frequency ofthese errors was higher than “expected.” Fears about
malpractice suits and damaged reputations emerged.
The potential of a bigger problem meant risk to morepatients but also greater risk to the physicians whether
BMJ VOLUME 320

18 MARCH 2000

www.bmj.com