Mistake-Proofing

the Design of

Health Care

Processes

Mistake-Proofing 

the Design of

Health Care

Processes

Advancing Excellence in Health Care • www.ahrq.gov

Agency for Healthcare Research and Quality PATIENT

SAFETY
Mistake-Proofing the

Design of Health Care

Processes

Prepared for:

Agency for Healthcare Research and Quality

U.S. Department of Health and Human Services

540 Gaither Road

Rockville, MD 20850

Prepared by:

John Grout, Ph.D.

Berry College

Rome, GA

AHRQ Publication No. 07-0020

May 2007
This document is in the public domain and may be used and reprinted without permission except those copyrighted

materials noted for which further reproduction is prohibited without the specific permission of the copyright holders.

Citation of the source is appreciated.

Suggested Citation:

Grout J. Mistake-proofing the design of health care processes. (Prepared under an IPA with Berry College). AHRQ

Publication No. 07-0020. Rockville, MD: Agency for Healthcare Research and Quality; May 2007.

ii
Preface

It has been more than 7 years since the Institute of Medicine (IOM) released its landmark report, To Err Is Human:

Building a Safer Health System, which galvanized attention on the serious and pervasive problem of errors in health care.

Research into the causes of medical errors and ways to prevent them increased dramatically in the ensuing years after

publication of the IOM report in 1999. We certainly have made great progress, but we still have much more to do to

improve patient safety at all levels of our health care system. 

The Agency for Healthcare Research and Quality (AHRQ) has been involved in research on patient safety and medical

errors for many years. This publication is the latest in a long line of AHRQ-sponsored resources devoted to patient safety.

It sheds light on a little-known but very promising approach to preventing medical errors and reducing the adverse

outcomes that result from them. 

Mistake-Proofing the Design of Health Care Processes was compiled for AHRQ by John Grout, Ph.D., of Berry College in

Rome, GA. Dr. Grout has been working for many years to disseminate information about the use of mistake-proofing

devices in health care. This volume represents a compendium of information and ideas to broaden our understanding of

mistake-proofing and its emerging role in health care and patient safety.

Our hope is that the information and resources presented in this publication will lead to more and better error-prevention

efforts in our Nation’s hospitals, medical offices and clinics, laboratories, and residential care settings. Mistake-proofing

has great potential as a quality improvement tool. It has been successfully applied over many years in industry, and many

mistake-proofing devices are already being used to improve health care here in the United States and in other countries.

We have only scratched the surface, however; as many other devices and applications are still in the pipeline or have yet to

be discovered and disseminated.

We thank Dr. Grout for his hard work in putting together this excellent resource and for his dedication to improving the

safety of health care in America. We welcome your feedback on this publication. Comments and questions may be sent in

writing to AHRQ, Office of Communications and Knowledge Transfer, 540 Gaither Road, Rockville, MD 20850.

Carolyn M. Clancy, M.D.

Director

Agency for Healthcare Research and Quality

iii
Acknowledgments

I thank Hal Kaplan, M.D., of Columbia University Medical Center, and Jim Battles, Ph.D., of AHRQ’s Center for

Quality Improvement and Patient Safety, for their support, expert advice, and encouragement during the development of

this text. Sonny Rigas and Brad Roberts, who were MBA students at Berry College while this document was in

development, researched and contributed many examples of mistake-proofing devices, as did many other individuals and

organizations. Special thanks go to Douglas M. Stewart, who wrote the first draft of the lost skills section in Chapter 4,

and to those contributors who participated in the Patient Safety Improvement Corps and the participants in workshops

sponsored by Health Insights, Inc., the National Patient Safety Agency in the United Kingdom, the Georgia Hospital

Association, and hospitals in the State of Georgia. Thanks also to Steve Newlon, Becky Smith, Deborah Branton, Mike

Silver, and Lynda Eden, as well as the many individuals and organizations who gave permission for their photographs to

appear in this book. 

I want to recognize the significant contributions of AHRQ staff from the Office of Communications and Knowledge

Transfer, Division of Print and Electronic Publishing. They include Randie Siegel, Barry Nix, and Mary Grady, who

provided editorial support; Frances Eisel, graphic designer for the project; and David Lewin, Eve Shaprio, and Salina

Prasad who also provided support for this endeavor. 

Lastly, I thank my family for their unfailing patience and support throughout this project.

John Grout

About Dr. Grout

John Grout, Ph.D., is the David C. Garrett, Jr., Associate Professor of Business Administration in the Campbell School

of Business, Berry College, Rome, GA, where he joined the faculty in 1997. Dr. Grout has also taught at Pennsylvania

State University and Southern Methodist University in Dallas, TX. Dr. Grout earned his doctorate from Pennsylvania

State University and a bachelor’s degree from Brigham Young University. He has researched mistake-proofing extensively

for the past 12 years. To learn more about Dr. Grout and his extensive body of knowledge about mistake-proofing, visit

his Web site at www.mistakeproofing.com.

iv
Contents

Chapter 1. What is Mistake-Proofing?..................................................................................................................1

Introduction ................................................................................................................................................................1

Mistake-Proofing Defined ............................................................................................................................................1

A Review of Human Error ..........................................................................................................................................3

Mistake-Proofing Approaches ......................................................................................................................................5

Attributes of Mistake-Proofing ..................................................................................................................................14

Creating Simplicity Is Not Simple..............................................................................................................................17

Implementing Mistake-Proofing in Health Care ........................................................................................................17

Conclusion ................................................................................................................................................................20

References ..................................................................................................................................................................21

Chapter 2. Relationships to Existing Patient Safety Efforts and Tools ..............................................................23

Introduction ..............................................................................................................................................................23

Relationships to Existing Patient Safety Efforts ..........................................................................................................23

Knowing What Errors Occur and Why Is Not Enough ............................................................................................33

Using the Tools Together............................................................................................................................................34

Conclusion ................................................................................................................................................................35

References ..................................................................................................................................................................37

Chapter 3. How to Mistake-Proof the Design....................................................................................................39

The Design Change Imperative..................................................................................................................................39

Multiple Fault Trees....................................................................................................................................................44

Designing Mistake-Proofing Devices that Cause Benign Failures ..............................................................................47

An Application Example ............................................................................................................................................53

Conclusion ................................................................................................................................................................59

References ..................................................................................................................................................................61

Chapter 4. Design Issues, Caveats, and Limitations ..........................................................................................63

Introduction ..............................................................................................................................................................63

Mistake Proof the Mistake-Proofing ..........................................................................................................................63

Avoid Moving Errors to Another Location ................................................................................................................65

Prevent Devices from Becoming Too Cumbersome ....................................................................................................65

Commit the Appropriate Resources............................................................................................................................66

Avoid Type I Error Problems ......................................................................................................................................67

Avoid Unintended Utilization of Benefits ..................................................................................................................67

Prevent Worker Detachment from the Process ..........................................................................................................70

v
Conclusion ................................................................................................................................................................70

References ..................................................................................................................................................................71

Chapter 5. Examples of Alternative Approaches to Mistake-Proofing................................................................73

Introduction ..............................................................................................................................................................73

Example Sets 5.1 to 5.21............................................................................................................................................73

References ..................................................................................................................................................................95

Chapter 6. Medical and Non-Medical Examples: Differences and Similarities ..................................................97

Introduction ..............................................................................................................................................................97

Example Pairs 6.1 to 6.19 ........................................................................................................................................97

A Future Mistake-Proofing Wish List ......................................................................................................................114

References ................................................................................................................................................................115

Chapter 7. Examples of Mistake-Proofing in Health Care ..............................................................................117

Introduction ............................................................................................................................................................117

Examples 7.1 to 7.30................................................................................................................................................117

References ................................................................................................................................................................132

Chapter 8. More Examples of Mistake-Proofing in Health Care......................................................................133

Introduction ............................................................................................................................................................133

Examples 8.1 to 8.30................................................................................................................................................133

References ................................................................................................................................................................147

Chapter 9. Summary ........................................................................................................................................149

Introduction ............................................................................................................................................................149

Example Summary ..................................................................................................................................................149

Sources of Supply ....................................................................................................................................................152

Industrial Glossary ..................................................................................................................................................153

A Path Forward ........................................................................................................................................................154

Example Contributions ............................................................................................................................................154

References ................................................................................................................................................................154

Acronyms..........................................................................................................................................................155

vi
Chapter 1. What Is

Mistake-Proofing?

Introduction

The process of turning on a burner on a stove is a simple

one. It is an everyday task that most people have

performed hundreds of times. Have you ever turned on

the wrong burner? Have you ever gone from one room to

another in your house only to forget why you went there

in the first place? Have you ever put something in the

refrigerator that belonged in the cupboard? 

Patients should experience health care processes that are

more reliable than manufacturing processes. Regrettably,

that is not yet the case.1

These are common errors. Their consequences are usually

not very serious. Once you have made these errors, what

can you do to ensure that they never happen again? Are

willpower and determination enough to avoid them? If

one believes that “to err is human,” then the answer to

these questions is, “No.” People who make these errors are

not unmotivated or negligent. More importantly, they

cannot eliminate the errors simply by telling themselves to

do better and deciding not to commit them. The Joint

Commission on Accreditation of Healthcare Organizations

(JCAHO)2 adds that “it assumes that no matter how

knowledgeable or careful people are, errors will occur in

some situations and may even be likely to occur.” 

If executed correctly, many of the tasks that medical

professionals perform as part of their jobs offer the

potential to heal. The same tasks performed incorrectly,

however, can also contribute to harming patients.

Clinicians need to become comfortable performing a wide

variety of tasks, some of which are not very different from

those performed in everyday life. If the infusion pump

does not behave the way a nurse intended it to because the

wrong control was adjusted, is the cause of the error really

much different from turning on the wrong burner on the

stove? The main difference between health care errors and

errors in everyday life is that errors that occur in a health

care setting can result in serious harm or death. 

Whether outcomes are insignificant or life threatening,

one question remains to be asked: “What can be done to

reduce or eliminate errors and their negative

consequences?” Part of the answer, mistake-proofing, is the

focus of this book. No single tool can solve every problem;

often, the answer will lie in the discovery, implementation,

and execution of several tools. Croteau and Schyve3 state

that “techniques for designing safe processes are known,

waiting only to be adapted to health care.” Mistakeproofing is one of these techniques; it is a crucial addition

to the tools employed to improve patient safety. 

Mistake-Proofing Defined

Mistake-proofing is the use of process or design features to

prevent errors or the negative impact of errors. Mistakeproofing is also known as poka-yoke (pronounced pokayokay), Japanese slang for “avoiding inadvertent errors.”

Shigeo Shingo4 formalized mistake-proofing as part of his

contribution to the production system for Toyota

automobiles. There are substantial differences between

automotive manufacturing and health care operations, yet

at least a few health care organizations are beginning to

incorporate aspects of the Toyota production system into

their efforts to reduce medical errors.5,6,7,8

Shingo,4 Hinckley,9 and other authors of books on

manufacturing11 include many examples of mistakeproofing that can be adapted to health care settings, some

of which are included in this book. The examples are

intended to serve as as a catalog of solutions that can be

directly implemented to reduce the number of errors and

as a catalyst for creating new ways to think about

mitigating human error. The approaches taken in the

examples can be modified to fit specific situations. 

Everyday Examples 

The 3.5-inch diskette is an example of mistake-proofing.

The diskette can only be inserted if it is oriented correctly.

It cannot be inserted sideways because it is not square; the

sides are too long to fit. It cannot be inserted backwards or

1
inverted. The drive is designed to stop the diskette unless

the right front corner is chamfered (angled) (Figure 1.1).

When the disk is inserted correctly, the mistake-proofing

device is not noticeable. When it is inserted incorrectly,

however, the device completely stops the process. The only

cost is that of initial design implementation. No user

training is required. The members of the design team that

created the disk drive believed that getting the orientation

right was important enough to design a process that

allowed users only one way to use the device. Their

decision also indicates a preference for using design as an

error-prevention strategy instead of alternatives such as

training, instructions, or warning labels. 

Mistake-proofing has even been applied to yo-yos. Most

yo-yo tricks require that the yo-yo spin freely or “sleep” at

the end of its string. The common (and dreaded) human

error that occurs while one is doing tricks with a yo-yo is

that of failing to snap the yo-yo up while it still has

enough spin to make it back up to the top. The yo-yo

shown in Figure 1.2 has been equipped with a clutch that

reduces the level of expertise and attention to detail

needed to execute tricks. On either side of the axle is a jaw

that is held in position by a post on one end and a spring

in the middle. On the far end of the jaw is a round

weight. As the yo-yo spins, the centrifugal force of the

weights pushes out against the springs, allowing the jaw to

disengage from the axle, and causing the yo-yo to “sleep.”

When the rate of spin slows, the jaws come back into

contact with the axle, and the yo-yo automatically stops

sleeping. The spring and the weight in the jaws are

engineered to provide just enough spin to propel the yo-yo

back up to the user’s hand. 

Tons of paper are stored in file cabinets. If more than one

file drawer is opened at a time, the center of gravity might

move forward enough to cause the file cabinet to fall on

the user. Modern file cabinets are designed to avoid this

type of injury (Figure 1.3). Opening one drawer locks the

rest. The design facilitates (perhaps even forces) correct

behavior and only allows for proper use. 

If engineers found it worthwhile to reduce human error

in performing yo-yo tricks, wouldn’t it be worthwhile to

focus similar attention on the more consequential errors

of health care?

History of Mistake-Proofing

Although it was formalized by Japanese manufacturers in

the 1960s (and published in English in the 1980s),

mistake-proofing did not start in Japan and its utility was

not limited to factories. Inventors, designers, and problem

solvers led by common sense implemented mistakeChapter 1: What Is Mistake-Proofing?

2

Figure 1.2. A yo-yo clutch.

Figure 1.1. A 3.5-inch diskette with chamfered corner.
proofing devices long before the 1960s. The question of

which mistake-proofing device appeared first remains

unanswered. However, an example of mistake-proofing

from 1853 disproves that mistake-proofing first appeared

in the 1960s. 

The device was the Otis elevator brake. At the Crystal

Palace Exposition of 1853 in New York, Elisha Otis rode

an elevator above the crowd and had an assistant cut the

cable. The elevator brake stopped the elevator and Otis

from falling (Figure 1.4). Examples from everyday life

such as this one and others demonstrate that the

usefulness of mistake-proofing is not limited to

manufacturers.12

Disk drive, yo-yo, and file cabinet designers were able to

design processes that reduced or eliminated certain errors.

Medical organizations should incorporate these safety

considerations in their processes more often.

A Review of Human Error

A brief review of the concepts and language of human

error will be useful. Human error has been studied

extensively by cognitive psychologists. Their findings

provide concepts and language that are vital to this

discussion. 

Errors of Intent vs. Errors in

Execution 

The process humans use to take action has been described

in several ways. One description divides the process into

two distinct steps: 1) determining the intent of the action,

and 2) executing the action based on that intention.

Failure in either step can cause an error. Norman13 divided

errors into two categories, mistakes and slips. Mistakes are

errors resulting from deliberations that lead to the wrong

intention. Slips occur when the intent is correct, but the

execution of the action does not occur as intended. 

Generally, mistake-proofing requires that the correct

intention be known well before the action actually occurs.

Otherwise, process design features that prevent errors in

the action could not be put in place. This means that

Shingo's4 concept of mistake-proofing is more effective on

slips than on mistakes. Norman's definition14 of the term

mistake is more precise and narrower than the common

usage of the word.a

Chapter 1: What Is Mistake-Proofing?

3

Figure 1.3. Donald Norman calls this type of mistakeproofing a “forcing function.” Figure 1.4. Illustration of an elevator brake. Note: Elisha

Otis made elevators safe by installing an elevator brake. Otis

and his invention are widely credited with making skyscrapers

feasible. Photo: © 2003 James E. White, Taletyano Press.

Used with permission.

a

Andrew P. Dillon translated Shingo's book. His selection of the

term “mistake” might have been different had he read Norman.13

Perhaps it would now be referred to as “slip-proofing.” However,

since the term mistake-proofing is common, no attempt is made

to alter that terminology here.
Rasmussen14 and Reason15 divide errors into three types,

based on how the brain controls actions. They identify

skill-based, rule-based, and knowledge-based actions.

Their theory is that the brain minimizes effort by

switching among different levels of control, depending on

the situation. 

Common activities in routine situations are handled using

skill-based actions, which operate with little conscious

intervention. These are actions that are done on “autopilot.” Skill-based actions allow you to focus on the

creativity of cooking rather than the mechanics of how to

turn on the stove. Errors that occur at the skill-based level

are comparable to Norman's concept of slips. 

Rule-based actions utilize stored rules about how to

respond to situations that have been previously

encountered. When a pot boils over, the response does not

require protracted deliberations to determine what to do.

You remove the pot from the heat and lower the

temperature setting before returning the pot to the burner. 

When novel situations arise, conscious problem solving

and deliberation are required. The result is knowledgebased actions. Knowledge-based actions are those actions

that use the process of logical deduction to determine

what to do on the basis of theoretical knowledge. Every

skill- and rule-based action was a knowledge-based action

at one time. Suppose you turn a burner on high but it

does not heat up. That is unusual. You immediately start

to troubleshoot by checking rule-based contingencies.

When these efforts fail, you engage in knowledge-based

problem solving and contingency planning. Substantial

cognitive effort is involved. 

Knowledge in the Head vs.

knowledge in the World

Norman13 introduces two additional concepts that will be

employed throughout this book. He divides knowledge

into two categories: 

1. Knowledge in the head is information contained in

human memory (Figure 1.5). 

2. Knowledge in the world is information provided as

part of the environment in which a task is performed

(Figure 1.6).

Historically, medicine has focused on improving

knowledge in the head. A comprehensive and elaborate

mental model of physiology is an example of knowledge in

the head. A significant infrastructure has been developed

to support this dependence on memory, including lengthy

standard operating procedures that indicate how tasks are

to be performed. These procedures are not intended to be

consulted during the actual performance of the task, but

rather to be committed to memory for later recall.

Retaining large volumes of instructions in memory so that

they are ready for use requires significant ongoing training

efforts. When adverse events occur in health care,

organizational responses also tend to involve attempts to

change what is in the memory of the health care worker.

These include retraining the worker who errs, certifying

(i.e., testing) workers regularly, attempting to enhance and

manage worker attentiveness, and altering standard

Chapter 1: What Is Mistake-Proofing?

4

Figure 1.6. Work instructions: designed to put

knowledge in the world.

Figure 1.5. Work instructions: intended to put

knowledge in the head.
operating procedures. The passage of time will erase any

gains made once the efforts to change memory are

discontinued.

The traditional approach ... was to stress the

responsibility of the individual ... the way to eliminate

adverse events is to get individual clinicians to perfect

their practices.16

Putting “knowledge in the world” is an attractive 

alternative to trying to force more knowledge into the

head. Knowledge can be put in the world by providing

cues about what to do. This is accomplished by

embedding the details of correct actions into the physical

attributes of the process. In health care, for example,

mental energies that were used to generate precise action

and monitor compliance with procedures stored in

memory are now freed to focus on those critical, nonroutine deliberations required for the best possible patient

care. 

How do you recognize knowledge in the world when you

see it? Here is a crude rule of thumb: if you can't take a

picture of it in use, it probably is not knowledge in the

world. Mistake-proofing involves changing the physical

attributes of a process, and mistake-proofing devices can

usually be photographed. Mistake-proofing is one way of

putting knowledge in the world.

The rule is crude because there are gray areas, such as

work instructions. If the instructions are visible and

comprehensible at the point in the process where they are

used, then they would probably be classified as knowledge

in the world. Otherwise, work instructions are a means of

creating knowledge in the head. 

Mistake-Proofing Approaches

There is no comprehensive typology of mistake-proofing.

The approaches to error reduction are diverse and

evolving. More innovative approaches will evolve, and

more categories will follow as more organizations and

individuals think carefully about mistake-proofing their

processes. Tsuda17 lists four approaches to mistakeproofing:

1. Mistake prevention in the work environment. 

2. Mistake detection (Shingo's informative inspection).

3. Mistake prevention (Shingo's source inspection).

4. Preventing the influence of mistakes.

Each of these four approaches is discussed in more detail

below. Additional information about the basics of mistakeproofing and other typologies is available.4,9,10,16,18

Tsuda's approaches are similar to those recommended by

the Department of Health and the Design Council19 in

England:

• Prevent user error from occurring.

• Alert users to possible dangers.

• Reduce the effect of user errors.

Mistake Prevention in the Work

Environment 

This approach involves reducing complexity, ambiguity,

vagueness, and uncertainty in the workplace. An example

from Tsuda17 is having only one set of instructions visible

in a notebook rather than having two sets appear on facing

pages. When only one set of instructions is provided,

workers are unable to accidentally read inappropriate or

incorrect instructions from the facing page.

In another example, similar items with right-hand and

left-hand orientations can sometimes lead to wrong-side

errors. If the design can be altered and made symmetrical,

no wrong-side errors can occur; whether the part is

mounted on the left or right side, it is always correct. The

orientation of the part becomes inconsequential. Likewise,

any simplification of the process that leads to the

Chapter 1: What Is Mistake-Proofing?

5
elimination of process steps ensures that none of the errors

associated with that step can ever occur again. 

Norman13 suggests several process design principles that

make errors less likely. He recommends avoiding wide and

deep task structures. The term “wide structures” means

that there are lots of alternatives for a given choice, while

“deep structures” means that the process requires a long

series of choices. Humans can perform either moderately

broad or moderately deep task structures relatively well.

Humans have more difficulty if tasks are both moderately

broad and moderately deep, meaning there are lots of

alternatives for each choice, and many choices to be made.

Task structures that are very broad or very deep can also

cause difficulties. More of Norman's recommendations are

summarized in Table 1.1. 

Another method of mistake prevention in the work

environment is the implementation of “visual systems,”19

also known as 5Ss (Figure 1.7). The term comes from

Japanese manufacturing, in which the 5Ss are Seiri

(organization), Seiton (orderliness), Seisou (cleanliness),

Seiketsu (standardization), and Shitsuke (discipline). 

Visual systems involve sharing information in the work

environment visually. Individuals in the work environment

should be able to “know by looking.”20 A visual workplace

is “a work environment that is self-ordering, selfregulating, and self-improving—where what is supposed to

happen does happen, on time, every time, day or night—

because of visual devices.”21

Seiri (organization) focuses on removing unneeded items

from the workplace. Items that are actually used all the

time are sorted from those that are superfluous. Unneeded

items are tagged and removed to a holding area to await

alternate allocation or disposal.

Chapter 1: What Is Mistake-Proofing?

6

Figure 1.8. No natural mapping here. The right switch

turns on the light at left. Illustration Courtesy of

BadDesigns.com. Used with permission.

Table 1.1. Summary of Norman’s13 strategies for putting knowledge in the world

Natural Mappings Design one-to-one physical correspondence (See figure1.8) between the

arrangement of controls and the objects being controlled.

Affordances Provide guidance about the operation of an object by providing features that 

allow or afford certain actions.

Visibility Make observation of the relevant parts of the system possible.

Feedback Give each action an immediate and obvious effect.

Constraints Provide design features that either compel or exclude certain actions. 

Constraints may be physical, semantic, cultural, or logical in nature.

Figure 1.7. Visual systems also known as the 5Ss in Japanese

manufacturing.
Seiton (orderliness) involves arranging needed items so

that they are easy to find, use, and put away. Often, the

focus of these efforts is to minimize motion.

Seisou (cleanliness) involves making sure that the

workplace is clean and stays clean on a daily basis.

Galsworth20 emphatically states, “It's not about being

clean.” Rather, it is about creating an environment that

can effectively contain and communicate information.

This step reduces the visual “noise” that would impede

communication.

Seiketsu (standardization) focuses on maintaining and

institutionalizing organization, orderliness, and

cleanliness. It includes preventive steps that reduce the

effort required to maintain the improvements already

made.

Shitsuke (discipline) involves avoiding a return to the

comfortable behavior of the past. It focuses on aligning

the culture and habits of the organization with its new

approach to organizing work.

Figure 1.9 shows a series of before and after photos of

5S implementations at a large urban hospital. The

photos illustrate how dramatic changes in the

environment can encourage the addition of more

knowledge in the world. 

Note that there are fringe benefits to the 5Ss (in

addition to patient safety): Sometimes the unneeded

items found while implementing 5S are still valuable.

Cleaning two rooms as shown in Figure 1.9 yielded the

following: 

• $1,600 in hoses (four hoses @ $400 each)

• $1,000 OSI cart

• $ 500 case cart table

• $1,000 in numerous rigid containers

--------------

• $4,100 Total

The reduction in clutter also reduced the time spent

moving and searching for items by an estimated 156

person hours per year. 

Mistake Detection

Mistake detection identifies process errors found by

inspecting the process after actions have been taken.

Often, immediate notification that a mistake has

occurred is sufficient to allow remedial actions to be

taken in order to avoid harm. Shingo called this type of

inspection informative inspection.5 The outcome or

effect of the problem is inspected after an incorrect

action or an omission has occurred. Informative

inspection can also be used to reduce the occurrence of

incorrect actions. This can be accomplished by using

data acquired from the inspection to control the process

and inform mistake prevention efforts. Another

informative inspection technique is Statistical Process

Control (SPC). SPC is a set of methods that uses

statistical tools to detect if the observed process is being

adequately controlled. 

SPC is used widely in industry to create and maintain

the consistency of variables that characterize a process.

Shingo5 identifies two other informative inspection

techniques: successive checks and self-checks. Successive

checks consist of inspections of previous steps as part of

the process. Self-checks employ mistake-proofing devices

to allow workers to assess the quality of their own work.

Self-checks and successive checks differ only in who

performs the inspection. Self-checks are preferred to

successive checks because feedback is more rapid. 

Setting functions 

Whether mistake prevention or mistake detection is

selected as the driving mechanism in a specific

application, a setting function must be selected. A

setting function is the mechanism for determining that

an error is about to occur (prevention) or has occurred

(detection). It differentiates between safe, accurate

conditions and unsafe, inaccurate ones. The more

precise the differentiation, the more effective the

mistake-proofing can be. Chase and Stewart19 identify

four setting functions that are described in Table 1.2. 

Chapter 1: What Is Mistake-Proofing?

7
Chapter 1: What Is Mistake-Proofing?

8

Figure 1.9. Examples of 5S implementation. Is the before or the after environment capable of communicating more information?

Before After
Control functions. Once the setting function

determines that an error has occurred or is going to occur,

a control function (or regulatory function) must be

utilized to indicate to the user that something has gone

awry. Table 1.3 describes four categories of control

functions for detecting and preventing mistakes.22 Table

1.4 shows medical examples for each cell described in

Table 1.3. 

Not all mistake-proofing is equally useful. Usually, mistake

prevention is preferred to mistake detection. Similarly,

forced control, shutdown, warning, and sensory alert are

preferred, in that order. The preferred devices tend to be

those that are the strongest and require the least attention

and the least discretionary behavior by users.

Mistake Prevention

Mistake prevention identifies process errors found by

inspecting the process before taking actions that would

result in harm. The word “inspection” as it is used here is

broadly defined. The inspection could be accomplished by

physical or electronic means without human involvement.

The 3.5-inch disk drive is an example of a simple

inspection technique that does not involve a person

making a significant judgment about the process. Rather,

the person executes a process and the process performs an

inspection by design and prevents an error from being

made. Shingo5 called this type of inspection “source

inspection.” The source or cause of the problem is

inspected before the effect—an incorrect action or an

omission—can actually occur. Donald Norman's concept

of forcing functions13 is also included in mistake

prevention. He calls them forcing functions because they

are designed to force, or ensure, that correct actions occur.

Preventing the Influence of

Mistakes

Preventing the influence of mistakes means designing

processes so that the impact of errors is reduced or

eliminated. This can be accomplished by facilitating

correction or by decoupling processes. 

Chapter 1: What Is Mistake-Proofing?

9

Table 1.2. Setting functions

Setting Function Description

Physical (Shingo's contact) Checks to ensure the physical attributes of the product or process are 

correct and error-free.

Sequencing (Shingo's motion step) Checks the precedence relationship of the process to ensure that steps

are conducted in the correct order.

Grouping or counting Facilitates checking that matched sets of resources are available when 

(Shingo's fixed value methods) needed or that the correct number of repetitions has occurred.

Information enhancement Determines and ensures that information required in the process is 

available at the correct time and place and that it stands out against 

a noisy background.
Facilitating correction. This could include finding easy

and immediate ways of allowing workers to reverse the

errors they commit. While doing things right the first time

is still the goal, effortless error corrections can often be

nearly as good as not committing errors at all. This can be

accomplished through planned responses to error or the

immediate reworking of processes. Typewriters have joined

mimeograph machines and buggy whips as obsolete

technology because typing errors are so much more easily

corrected on a computer. Errors that once required

retyping an entire page can now be corrected with two

keystrokes. Software that offers “undo” and “redo”

capabilities also facilitates the correction of errors (Figure

1.11). Informal polls suggest that people use these features

extensively. Some users even become upset when they

cannot “undo” more than a few of their previous

operations. Also, computers now auto-correct errors like

“thsi” one. 

Chapter 1: What Is Mistake-Proofing?

10

Table 1.3. Control (or regulatory) functions

Regulator function Mistake prevention Mistake detection

Forced control Physical shape and size of object or Physical shape and size of object or 

electronic controls detect mistakes that are electronic controls detect incorrect actions 

being made and stop them from resulting or omissions before they can cause harm.

in incorrect actions or omissions. 

Shut down The process is stopped before mistakes can The process is stopped immediately after

result in incorrect actions or omissions. an incorrect action or omission is detected.

Warning A visual or audible warning signal is given A visual or audible warning signal is given 

that a mistake or omission is about to occur. that a mistaken action or omission has just

Although the error is signaled, the process occurred. 

is allowed to continue.

Sensory alert A sensory cue signals that a mistake is A sensory cue signals that a mistake

about to be acted upon or an omission has just been acted upon or an omission

made. The cue may be audible, visible, has just occurred (Figure 1.10).

or tactile. Taste and smell have not proved 

to be as useful. Sensory alerts signal 

mistakes but allow the process to continue.

Figure 1.10. Smell as a sensory alert has been used

in natural gas delivery. An additive, mercaptan, is

used to create an unpleasant smell, so that gas leaks

can be detected. 23,24

Figure 1.11. “Undo and Redo” allow users to prevent

the influence of mistakes.
Chapter 1: What Is Mistake-Proofing?

11

Table 1.4. Medical examples of control functions

Effect Prevent error Detect error

Forced control Pre-mix scald anti-scald valve Infant abduction sensor locks the exit in 

case of an abduction

For a detailed description, see Chapter 5,

example 5.2.

For a detailed description, see Chapter 8,

example 8.1. 

Shut down Medical gas connectors with BloodlocTM

indexing pins

For a detailed description, see Chapter 7, example

7.8.

For a detailed description, see Chapter 5,

example 5.4.

(continued)
Chapter 1: What Is Mistake-Proofing?

12

Table 1.4. Medical examples of control functions (continued)

Effect Prevent error Detect error

Warning Computerized physician order entry Esophageal intubation detector

For a detailed description, see Chapter 8,

example 8.9.

For a detailed description, see Chapter 5,

example 5.6.

Sensory alert Broselow® Tape Sign your site

For a detailed description, see Chapter 7,

example 7.1.

For a detailed description, see Chapter 7,

example 7.11.
Chapter 1: What Is Mistake-Proofing?

13

These features significantly increase the effectiveness of

users. They did not come into being accidentally but are

the result of intentional, purposeful design efforts based

on an understanding of the errors that users are likely to

make. 

Automotive safety has been enhanced by preventing the

influence of mistakes. Air bags do not stop accidents.

Rather, they are designed to minimize injuries experienced

in an accident. Antilock brakes also prevent the influence

of mistakes by turning a common driving error into the

correct action. Prior to the invention of antilock brakes,

drivers were instructed not to follow their instincts and

slam on the brakes in emergencies. To do so would

increase the stopping distance and cause accidents due to

driver error. Pumping the brakes was the recommended

procedure. With anti-lock brakes, drivers who follow their

instincts and slam on the brakes are following the

recommended emergency braking procedure. What once

was an error has become the correct action. 

“Decoupling” means separating an error-prone activity

from the point at which the error becomes irreversible.

Software developers try to help users avoid deleting files

they may want later by decoupling. Pressing the delete

button on an unwanted e-mail or computer file does not

actually delete it. The software merely moves it to another

folder named “deleted items,” “trash can,” or “recycling

bin.” If you have ever retrieved an item that was previously

“deleted,” you are the beneficiary of decoupling.

Regrettably, this type of protection is not yet available

when saving work. The files can be overwritten, and the

only warning may be a dialogue box asking, “Are you

sure?” 

Sometimes the separation of the error from the outcome

need not be large. Stewart and Grout25 suggest a

decoupling feature for telephoning across time zones.

The first outward manifestation of forgetting or

miscalculating the time difference is the bleary eyed

voice of a former friend at 4:00 a.m. local time instead

of the expected cheery voice at a local time of 10:00

a.m. One way to decouple the chain would be to

provide an electronic voice that tells the caller the

current time in the location being called. This allows

the caller to hang up the phone prior to being

connected and thus avoid the mistake.

Customer and provider mistake-proofing. Chase and

Stewart26 point out that in service operations, as opposed

to manufacturing, mistake-proofing is needed for both the

person providing the service and the person receiving the

service. They assert that “one-third of customer complaints

relate to problems caused by the customers themselves.” In

health care, this means that mistake-proofing that helps

the health care professional perform tasks correctly is not

Figure 1.12. Problem (Left): Where is the chart in the photo?

Solution (Right): hang the chart on a door knob where other items are less likely to be placed over it, and where the number of

possible locations to search for it is dramatically reduced.
Chapter 1: What Is Mistake-Proofing?

14

enough. Chase and Stewart26 divide the mistake-proofing

of both providers' efforts and customers' actions into

three categories each. As shown in Table 1.5, the

categories for providers are task, treatment, and tangibles;

the categories for customers are preparation, encounter,

and resolution. 

Preparation for mistake-proofing. Patients should know

the location of their charts so home health workers can

consult the charts to ensure the care they are planning to

provide is correct and appropriate. The patient error lies

in not keeping the chart accessible. It takes only a few

moments for the chart to be covered with clutter (Figure

1.12).

The “solution” presented in Figure 1.12 is not “strong

mistake-proofing.” A patient would not be prohibited

from moving the chart to a good hiding place. However,

in actual practice the solution improves safety and

productivity. (For a detailed description, see Chapter 7,

example 7.2).

Attributes of MistakeProofing

Several attributes of mistake-proofing are presented below.

Although this book extols its benefits, mistake-proofing

can encompass liabilities as well as benefits. It is equally

important to know what mistake-proofing cannot do and

which liabilities need to be addressed, as it is to know

what mistake-proofing can do to reduce errors. 

Mistake-Proofing is Inexpensive

The cost of mistake-proofing devices is often the fixed

cost of the initial installation plus minor ongoing

calibration and maintenance costs. Shingo's book contains

112 examples.4 He provides the cost (in 1986 U.S.

dollars) of each example. Their distribution is shown in

Table 1.6. The median cost of a device is approximately

$100. Ninety percent of the devices cost $1,000 or less.

Others26,27 implementing mistake-proofing report similar

outcomes. A device's incurred cost per use can be zero, as

it is with the 3.5-inch diskette drive. The cost per use can

also be negative in cases in which the device actually

enables the process to proceed more rapidly than before. 

Table 1.5. Areas of focus for service provider and

customer mistake-proofing

Service Providers

Task Doing work incorrectly, not 

requested, wrong order, too slowly.

Treatment Lack of courteous, professional 

behavior.

Tangible Errors in physical elements of service.

Customers

Preparation Failure to bring necessary materials, 

understand role, or engage correct 

service.

Encounter Inattention, misunderstanding, or

memory lapses. 

Resolution Failure to signal service failure, provide 

feedback, or learn what to expect.

Table 1.6. Implentation cost for Shingo’s 

mistake-proofing examples4

Cost Cumulaltive

(1986 U.S. Dollars) Probability Probability

Cost <$25 25.5% 25.5%

$25 < Cost <$100 29.1% 54.6%

$100 < Cost <$250 23.6% 78.2%

$250 < Cost <$1,000 13.6% 91.8%

Cost > $1,000 8.2% 100.0%
The costs of implementing mistake-proofing in health care

may be greater than the associated costs in manufacturing.

More caution will be required to assess all possible risks of

implementation. In some cases, clinical trials will be

needed to ensure the efficacy of the device. In others,

regulatory approval will be needed. All these steps will add

to the cost.

At this writing, many health care providers are

implementing bar coding, computerized physician order

entry (CPOE), and robotic pharmacies (Figure 1.13).

These are technologically sophisticated examples of

mistake-proofing, which are effective responses to human

error but are very complex and expensive to implement.

They are not typical of the majority of mistake-proofing

approaches, which are based on simplicity and ingenuity.

Bar coding and CPOE are technologically sophisticated

examples of mistake-proofing.

In manufacturing, where data are available, mistakeproofing has been shown to be very effective. There are

many management tools and techniques available to

manufacturers. However, many manufacturers are unaware

of mistake-proofing. 

The TRW Company reduced its defect rate from 288

parts per million (ppm) defective to 2 parts per million.29

Federal Mogul had 99.6 percent fewer customer defects

than its nearest competitor and a 60 percent productivity

increase by systematically thinking about the details of

their operation and implementing mistake-proofing.30

DE-STA-CO manufacturing reduced omitted parts from

800 omitted ppm to 10; in all modes, they reduced

omitted parts from 40,000 ppm to 200 ppm and, once

again, productivity increased as a result.31 These are very

good results for manufacturing. They would be

phenomenal results in health care. Patients should be the

recipients of processes that are more reliable than those in

manufacturing. Regrettably, this is not yet the case.1

Mistake-Proofing Can Result in

Substantial Returns on Investment

Even in manufacturing industries, however, there is a low

level of awareness of mistake-proofing as a concept. In an

article published in 1997, Bhote32 stated that 10 to 1, 100

to 1, and even 1,000 to 1 returns are possible, but he also

stated that awareness of mistake-proofing was as low as 10

percent and that implementation was “dismal” at 1 percent

or less.

Exceedingly high rates of return may seem impossible to

realize, yet Whited33 cites numerous examples. The Dana

Corporation reported employing one device that

eliminated a mode of defect that cost $.5 million dollars a

year. The device, which was conceived, designed, and

fabricated by a production worker in his garage at home,

cost $6.00. That is an 83,333 to 1 rate of return for the

first year. The savings occur each year that the process and

the device remain in place. 

A worker at Johnson & Johnson's Ortho-Clinical

Diagnostics Division found a way to use “Post-It® Notes”

to reduce defects and save time that was valued at $75,000

per year. If the “Post-It® Notes” cost $100 per year, then

the return on investment would be 750 to 1. These are

examples of savings for a single device. 

Lucent Technologies' Power System Division implemented

3,300 devices over 3 years. Each of these devices

contributed a net savings of approximately $2,545 to their

Chapter 1: What Is Mistake-Proofing?

15

Figure 1.13. The inventory picking arm of a robotic

pharmacy.
company's bottom line The median cost of each device

was approximately $100. The economics in medicine are

likely to be at least as compelling. A substantial amount of

mistake-proofing can be done for the cost of settling a few

malpractice suits out of court. 

Mistake-proofing Is Not a 

Stand-Alone Technique 

It will not obviate the need for other responses to error.

Chapter 2 includes a discussion of how mistake-proofing

relates to other common patient safety initiatives.

Mistake-Proofing Is Not Rocket

Science

It is detail-oriented and requires cleverness and careful

thought, but once implementation has been completed,

hindsight bias will render the solution obvious. Chapter 3

presents tools and techniques that help to create mistakeproofing devices and analyze their impact on the process. 

Mistake-Proofing Is Not a

Panacea

It cannot eliminate all errors and failures from a process.

Perrow34 points out that no scheme can succeed in

preventing every event in complex, tightly-linked systems.

He argues that multiple failures in complex, tightly-linked

systems will lead to unexpected and often

incomprehensible events. Observers of these events might

comment in hindsight, “Who would have ever thought

that those failures could combine to lead to this?” Perrow's

findings apply to mistake-proofing as they do to any other

technique. Mistake-proofing will not work to block events

that cannot be anticipated. Usually, a good understanding

of the cause-and-effect relationship is required in order to

design effective mistake-proofing devices. Therefore, the

unanticipated events that arise from complex, tightlylinked systems cannot be mitigated using mistakeproofing.

Although health care is a complex, tightly-linked system,

many potential adverse events can be anticipated. In fact,

some of the more common errors occur in hospitals daily

or hourly. When a patient is misidentified, a specimen is

mislabeled, or a wrong-site operation occurs, people

familiar with patient safety will not say, “Wow. Who

would ever have believed that could happen?” It is in this

domain of anticipated events that mistake-proofing is

beneficial. 

Mistake-Proofing Is Not New

It has been practiced throughout history and is based on

simplicity and ingenuity. Mistake-proofing solutions are

often viewed post hoc as “common sense.” Senders and

Senders35 provide an example of mistake-proofing, the

dispensing of medications in the mid-1800s (Figure 1.14).

Bottles of poison are variously identified by their

rectangular shape, blue-colored glass, or the addition of

small spikes to make an impression on inattentive

pharmacists. Most organizations will find that examples of

mistake-proofing already exist in their processes. The

implementation of mistake-proofing, then, is not entirely

new but represents a refocusing of attention on certain

design issues in the process.

Chapter 1: What Is Mistake-Proofing?

16

Figure 1.14. “Dangerous” medication bottle 

from mid-1800s.
Chapter 1: What Is Mistake-Proofing?

17

Creating Simplicity Is Not

Simple

In hindsight, mistake-proofing devices seem simple and

obvious. A good device will lead you to wonder why no

one thought of it before. However, creating simple,

effective, mistake-proofing devices is a very challenging

task. Significant effort should be devoted to the design

process. Organizations should seek out and find multiple

approaches to the problem before proceeding with the

implementation of a solution. 

This book is intended to help organizations design

mistake-proofing devices. Its goal is to provide a process

and a vocabulary for thinking about patient safety and

error reduction. It is hoped that this book will also help

reduce the amount of creativity needed to devise novel

approaches to eliminating problems and reducing risk.

Each organization's mistake-proofing needs may be

different, depending on the differences in their processes.

Consequently, some mistake-proofing solutions will

require new, custom-made devices designed specifically for

a given application. Other devices could be off-the-shelf

solutions. Even off-the-shelf devices will need careful

analysis—an analysis that will require substantial process

understanding–in the light of the often subtly

idiosyncratic nature of their own processes. 

Chapter 2 reviews current patient safety tools and

proposes a flowchart view of how existing tools inform the

process of mistake-proofing device design or selection.

Existing tools provide the foundation of process

understanding that enable us to make sense of events and

errors, which is vital to effective mistake-proofing.

Mistake-proofing cannot be effective without a sound

understanding of what happens in the process and why.

Chapter 3 proposes a new use for an existing tool and

combines it with other tools to facilitate mistake-proofing

efforts. Chapter 4 is devoted to discussing important

design issues, caveats, and limitations of mistake-proofing.

Chapters 5, 6, 7, and 8 provide examples of mistakeproofing in health care. Chapter 9 describes a path

forward and suggests resources to help make mistakeproofing successful. 

Implementing MistakeProofing in Health Care

Implementing mistake-proofing in medical environments

will probably be more challenging and difficult than

implementing the same techniques in manufacturing. An

unranked list of opportunities and difficulties is provided

in Table 1.7. The difficulties are not provided as excuses or

reasons why mistake-proofing should not be implemented

but rather as guides to what can be expected as

implementation progresses. The impact of these concerns

can be mitigated by early acknowledgment of their effects

on the process. 

Legal Liability and Discoverability

Telling quality improvement stories requires great care.

Claiming great improvements could implicitly reveal

previous shortcomings. In claiming the “after,” one must

own up to the “before.” This is not a significant concern

in manufacturing applications because the problems are

rarely safety related. Disgruntled customers simply get

their money back or receive a replacement product.

Remedies for poor quality in medicine are not as easily

attained. 

Mistake-proofing devices are physical evidence that actions

have been taken to ensure patient safety. Although this

book contains only examples of good practices, many of

its contributors prefer to remain anonymous. Risk

managers and medical system lawyers differ widely in their

levels of concern about disclosing mistake-proofing

devices. For this book, the range of concerns included

individuals who were proud of their efforts and willing to

receive all credit due them to those who required

significant assurances of anonymity.
Concerns with the litigious environment surrounding

health care will remain an impediment to mistakeproofing implementation for some time to come. In

addition to existing channels like the Agency for

Healthcare Research and Quality's (AHRQ) Web M&M

(Morbidity and Mortality) and the National Patient Safety

Foundation's (NPSF) listserv, more options for “safe”

(perhaps anonymous) dialogue and information sharing

should be sought. 

Lack of Shared Examples

Manufacturing benefits from a set of four resources4,9,10,11

with 702 published examples. These examples provide a

large set of existing solutions and approaches to problems;

solutions that can stimulate thinking about additional

approaches. Until now, there was no comparable set of

examples of mistake-proofing in medicine. This book

provides a starting place for sharing medical examples. It is

not comprehensive. There are many more examples to

collect for this ongoing effort. 

Add to the body of knowledge in medical mistakeproofing: Submit any examples that you know of that do

not appear in this book. Submissions can be made

(anonymously, if desired) at www.mistakeproofing.com/

medical. 

Careful Assessment of Down-Side

Risk

In manufacturing, one can afford to be more cavalier in

trying new things. In fact, Hirano36 proposes the following

heuristic: if a device is found to have greater than a 50

percent chance of success for mistake-proofing, then it

should be tried immediately. The parts can be discarded if

the experiment does not work. In health care, this

approach is often unacceptable, given the requirement of a

careful assessment of the patient safety risk of each new

mistake-proofing device. Where there is risk of patient

harm, careful analysis and clinical trials may be needed.

However, experimenting with a device theoreticallyb will

Chapter 1: What Is Mistake-Proofing?

18

b

Practically, experimenting with a device could reduce patient

safety if users depend on the device instead of exercising normal

levels of care and attentiveness. See the discussion of Risk

Homeostasis in Chapter 4 for more information.

Table 1.7. Comparison of medical mistake-proofing applications with those in other industries 

1. Legal liability and discoverability (need for anonymity?). Difficulty

2. Lack of shared examples. Difficulty

3. Careful assessment of down-side risk. Difficulty

4. Culture of depending on individuals, not on systems. Difficulty

5. Processes that depend on individuals, not on systems: lack of consistent process. Difficulty

6. Resource shortages. Difficulty

7. Medical applications that focus more on information counter-measures. Difficulty

8. Low barriers to diffusion. Opportunity

9. Substantial buying power. Opportunity
not make the patient “worse off” in cases in which current

controls depend entirely on human attentiveness for their

accuracy. If the mistake-proofing device is also a medical

device, it must adhere to the same rigorous regulatory

approval process required for any other device. 

A Culture of Depending on

People, Not on Systems

The traditional approach within medicine has been to

stress the responsibility of the individual and to encourage

the belief that the way to eliminate adverse events is to get

individual clinicians to perfect their practices. This

simplistic approach not only fails to address the important

and complex system factors that contribute to the

occurrence of adverse events but also perpetuates a myth

of infallibility that is a disservice to clinicians and their

patients.37

The reasons are found in the culture of medical

practice... Physicians are socialized in medical school

and residency to strive for error-free practice...

Physicians are expected to function without error, an

expectation that physicians translate into the need to be

infallible.38

The medical culture makes implementing mistakeproofing more difficult because health care professionals

are accustomed to looking for solutions involving

“knowledge in the head.” Getting them to consider

“knowledge in the world” can be very challenging. Some

aspects of the implementation may challenge long-held

assumptions, beliefs, and values associated with behavior

and accountability.

Barry, Murcko, and Brubaker39 discuss this issue regarding

medical software interfaces. 

The complex displays allow the specialists to apply

their mastery and preserve the special knowledge they

have acquired. The experts do not see a need for any

help, and they do not want any help. In fields other

than health care, giving experts help, even if they do

not want it, is found to reduce error rates.

Perhaps this is the case in the health care field, too:

even though experts do not want help, maybe they

could use a little anyway, for the good of the cause.

Computer displays should make doing the right thing

easier than doing the wrong thing... They should

make it obvious, immediately, when the wrong thing

has been done... All these ideas are not only common

sense, they are poka-yoke.

Processes that Depend on People,

Not on Systems

In medicine, the dependence on the individual is cultural,

and it is exhibited in processes managed within that

culture. As a result, medical processes are often customized

by each practitioner of the art. Noted doctors and patient

safety advocates have questioned whether there are

processes in medicine at all. The lack of consistent

processes will make implementation of mistake-proofing

more difficult in medicine than in manufacturing.

Inconsistent processes are more difficult to mistake-proof

because there are fewer predictable elements that can be

used to check the process. 

Resource Shortages

Ideally, changes will liberate additional resources, but

adequate resources are required to make those changes

possible. Adequate resources and staffing levels enable

process improvement. A shortage of nurses, other staff, or

resources will generally make mistake-proofing more

difficult. See the section of Chapter 4, titled, “Spending

Too Much or Not Enough” for additional information

about the ironic situations that can prevent organizations

from allocating resources to process improvement efforts.

More Focus on Information

Enhancement Devices

Mistake-proofing in manufacturing has primarily focused

on physical, sequencing, and grouping and counting

mistake-proofing devices. More information-enhancement

Chapter 1: What Is Mistake-Proofing?

19
devices should be anticipated as mistake-proofing is more

widely implemented in service industries. Health care

services involve numerous “matching” tasks. These are

tasks in which specific medications, medical devices,

processes, and procedures are matched to specific,

individual patients during specific time intervals. These

tasks require the availability of substantial amounts of

usable, accurate information. Mistake-proofing devices for

information enhancement are needed in these

circumstances. Increasing the proportion of theses devices

will be challenging. There is a need for the invention and

documentation of newer and better examples of these

mistake-proofing devices. 

Low Barriers to Diffusion

Health care enjoys an advantage over manufacturing.

Because much of health care competition is geographically

based, new devices can be shared with less impact on

competitive advantage than there would be in the

manufacturing sector. Consequently, mistake-proofing

devices that would be cloaked in secrecy to foster a

competitive advantage in manufacturing are more likely to

be shared in the health care environment.

Substantial Buying Power

Vendors have already begun to use patient safety

improvements as a marketing tool. Hospital systems and

large payers possess the buying power to specify safer

designs and to seek out vendors willing to provide them.

Health care providers should employ a practice that

Leenders and Blenkhorn40 called “reverse-marketing.”

Their concept is to reverse the roles of supplier and buyer

so that buyers are marketing ideas to their suppliers.

Traditionally, the supplier tries to persuade the buyer to

buy, but in reverse marketing the buyer tries to persuade

the supplier to supply. That is, the buyer exerts influence

on suppliers to encourage them to produce what the buyer

wants. Leenders and Blenkhorn38 argue that purchasing

managers are mistaken in their impression that they have

most of the power in the transaction because they make

the final purchasing decision. The authors make a

convincing case that suppliers, by having control over

which product configurations are offered, have much

more power to shape transactions, and that purchasers

should attempt to take some of that power back by trying

to influence what is offered. The British National Health

Service is making an effort to shape the product offerings

that affect them by seeking improved labeling of

medications using this type of proactive approach (see

Chapter 8, example 8.29). Larger medical systems, forprofit hospital chains, government-run hospital systems,

and payer groups could be very persuasive in convincing

suppliers to change the designs of equipment, devices, and

supplies.

Conclusion

Mistake-proofing involves designing changes into the

physical aspects of the design of processes. Design changes

can prevent mistakes by simplifying or clarifying the work

environment, making mistakes less likely. Mistakes can

also be prevented by inspecting the source or cause of

errors so that the effect cannot occur. When this is not

possible, mistakes should be detected rapidly, prior to

causing harm, or while remediation is still relatively easy.

If the mistake itself cannot be prevented or effectively

detected, then preventing the influence of mistakes (the

harm) may be warranted. These mistake-proofing

techniques should be applied to actions taken by patients

and their loved ones as well as to the actions of health care

professionals. 

Changing the design of health care processes and creating

mistake-proofing devices is not a simple task. Careful

deliberation and analysis will be required. In some ways,

implementing mistake-proofing will be more difficult in

health care environments than in other industries. There

are, however, efforts to lay the foundation for successful

implementation already underway. Chapter 2 describes

these efforts.

Chapter 1: What Is Mistake-Proofing?

20
References 

1. Kohn LT, Corrigan JM, Donaldson MS, eds. Institute of

Medicine, To err is human: building a safer health system.

Washington, DC: National Academies Press; 2000.

2 Joint Commission on Accreditation of Healthcare

Organizations. www.jointcommission.org. Search entry:

FMECA (Failure Modes Effect and Criticality Analysis).

Accessed October 2004. 

3. Croteau RJ, Schyve PM. Proactively error-proofing health

care processes. In: Spath PL, ed. Error reduction in health

care. Chicago: AHA Press; 2000.

4. Shingo S. Zero quality control: source inspection and the

poka-yoke system. trans. by Dillion AP. New York:

Productivity Press; 1986.

5. Spear SJ. Fixing health care from the inside, today.

Harvard Business Review. 2005 Sep;83:78-91.

6. Winter D. Get health-care suppliers lean. Ward's Auto

World 2004 July 1: http://waw.wardsauto.com/ar/auto_

healthcare_suppliers_lean_2/). Accessed: October 2006. 

7. Connolly C. Toyota assembly line inspires improvements

at hospital. Washington Post. 2005 June 3:

http://www.washingtonpost.com/wp-dyn/

content/article/2005/06/02/AR2005060201944_pf.html.

Accessed: October 2006. 

8. Weber DO. Toyota-style management drives Virginia

Mason. Physician Executive. 2006 Jan-Feb. Available at:

http://www.findarticles.com/p/articles/mi_m0843/is_1_3

2/ai_n16016072. Accessed: October 2006.

9. Hinckley CM. Make no mistake. Portland, OR:

Productivity Press; 2001.

10. Shimbun NK Factory Magazine, ed. Poka-yoke:

improving product quality by preventing defects.

Portland, OR: Productivity Press; 1988.

11. Confederation of Indian Industry. Poka-yoke book on

mistake-proofing. New Delhi: Confederation of Indian

Industry; 2001. 

12. Petroski H. To engineer is human: the role of failure in

successful design. New York: Vintage Books; 1992. 

13. Norman DA. The design of everyday things. New York:

Doubleday; 1989.

14. Rasmussen J. Skills, rules, and knowledge: signals, signs,

and symbols, and other distinctions in human

performance models. IEEE Transactions on Systems,

Man, and Cybernetics; 1983;13(3):257-67. 

15. Reason J. Human Error. New York: Cambridge University

Press; 1990.

16. Nakajo T, Kume H. The principles of foolproofing and

their application in manufacturing. Reports of Statistical

Application Research. Union of Japanese Scientists and

Engineers. 1985;32(2):10-29.

17. Tsuda Y. Implications of foolproofing in the

manufacturing process. In: Quality through engineering

design. Kuo W, ed. New York: Elsevier; 1993.

18. Chase RB, Stewart DM. Mistake-proofing: designing

errors out. Portland, OR: Productivity Press; 1995.

19. Department of Health and the Design Council. Design

for patient safety. London: Department of Health and

Design Council; 2003.

20. Galsworth GD. Visual workplace: visual thinking.

Presentation at 16th annual Shingo Prize Conference.

Lexington, KY; May 2004. 

21. Galsworth GD. Visual systems: harnessing the power of a

visual workplace. New York: American Management

Association; 1997.

22. Mistake-proof it! workbook. Tolland, CT: Resource

Engineering, Inc.; 2000.

23. What you need to know about natural gas detectors.

National Institute on Deafness and Other

Communication Disorders, National Institutes of Health.

http://www.nidcd.nih.gov/health/smelltaste/gasdtctr.asp.

Accessed: October 2006. 

24. What is mercaptan? Columbia Gas of Virginia.

http://www.columbiagasva.com/safety_info/

mercaptan.htm. Accessed: July 30, 2004.

25. Stewart DM, Grout JR. The human side of mistakeproofing. Production and Operations Management.

2001;10(4):440-59. 

26. Chase RB, Stewart DM. Make your service fail-safe. Sloan

Management Review. 1994 Spring; 35-44.

27. Marchwinski C, ed. Mistake-proofing. Productivity. 1995;

17(3):1-6. 

28. Grout J. Personal interview with Jean Jacques Poux.

Weber Aircraft LP. Gainesville, TX; 1995.

29. Raub III GR. Personal communication from manager of

quality systems, inflatable restraints for TRW. 1995.

30. Skalbeck JP. Poka-yoke as a continuous improvement tool.

Presentation at the Mistake-Proofing Forum. Oshkosh,

WI; August 1998.

Chapter 1: What Is Mistake-Proofing?

21
31. Frye RH. Personal communication from the product

manager for De-STA-CO. April 1997.

32. Bhote KR. A powerful new tool kit for the 21st century.

National Productivity Review. 1997 Autumn; 16(4):29.

33. Whited HM. Poka-yoke varieties. The power of mistakeproofing forum. Moline, IL: Productivity, Inc.; 1997

August 6.

34. Perrow C. Normal accidents: living with high-risk

technologies. Princeton, NJ: Princeton University Press;

1999.

35. Senders JW, Senders SJ. Failure mode and effects analysis

in medicine. In: Medication errors: causes, prevention,

and risk management. Cohen MR, ed. Sudbury, MA:

Jones and Bartlett; 1999.

36. Hirano H. Overview. In: Nikkan K. Shimbun/Factory

Magazine, ed. Poka-yoke: improving product quality by

preventing defects. Portland, OR: Productivity Press;

1988.

37. Small P, Barach SD. Patient safety and health policy: a

history and review. Hematol Oncol Clin N Am. 2002;

(16):1463-1482, 1478.

38. Leape LL. Error in medicine. JAMA. 1994;272:1851-

1857.

39. Barry R, Murcko AC, Brubaker CE. The six sigma book

for healthcare. Chicago: Health Administration Press;

2002. 

40. Leenders MR, Blenkhorn DL. Reverse Marketing. New

York: Free Press; 1988.

Chapter 1: What Is Mistake-Proofing?

22
Chapter 2. Relationships

to Existing Patient Safety

Efforts and Tools 

Introduction

After the publication of the Institute of Medicine (IOM)

report, To Err is Human,

1 patient safety deficits moved to

the forefront of public attention. The goal of the report

was a challenging one: to reduce medical errors by half in

5 years. Those 5 years have passed, and substantial effort

has been invested in reducing errors in health care. This

chapter focuses on how many of these efforts relate to

mistake-proofing and how new tools can contribute to

improved patient safety. 

Mistake-proofing has been used effectively in other

industries and has been adopted in medicine as an artifact

of common sense applied to processes. More can be done.

In many cases, mistake-proofing will fit into a variety of

existing efforts to improve patient safety. In other cases, it

provides an effective alternative direction to seek

improvement in the face of ineffective actions.

Relationships to Existing

Patient Safety Efforts

The relationship of mistake-proofing to current patient

safety efforts is shown in Table 2.1. Many of the efforts to

improve patient safety are important enablers of mistakeproofing. They create a foundation for, or aid in, mistakeproofing implementation. Others are areas of opportunity

in which existing patient safety efforts create resources for

identifying likely mistake-proofing projects. Some efforts

address the same problems as mistake-proofing. While

these techniques are listed as competing there is no

requirement for mutual exclusivity. Multiple approaches

are not only possible, they are recommended. In cases in

which some competing approaches are onerous or

ineffective, mistake-proofing can reduce the scope and

burden of these efforts so that they may be used only

where they are needed most. Table 2.1 includes some

overlapping concepts; both “creating a just culture” and

“enhancing attentiveness,” for example, can be seen as

subsets of safety culture. Each of the relationships in Table

2.1 is also discussed in the next several pages. 

Mistake-proofing has been used effectively in other

industries and has been adopted in medicine as an

artifact of common sense as applied to processes.

Safety Culture

Safety culture is a set of attitudes, values, perceptions,

norms, and behaviors that tend to reduce the likelihood of

unsafe acts, and which encourage thorough disclosure of,

and learning from, adverse events.3 Safety culture also

includes norms of high reliability organizations, as

described by Weick and Sutcliffe:4

1. Preoccupation with failure.

2. Reluctance to simplify interpretations.

3. Sensitivity to operations.

4. Commitment to resilience.

5. Deference to expertise.

Just Culturea

Just culture refers to a working environment that is

conducive to “blame-free” reporting but also one in which

accountability is not lost.5 Blame-free reporting ensures

that those who make mistakes are encouraged to reveal

them without fear of retribution or punishment. A policy

of not blaming individuals is very important to enable and

facilitate event reporting which in turn, enables mistakeproofing. The concern with completely blame-free

reporting is that egregious acts, in which punishment

would be appropriate, would go unpunished. Just culture

divides behavior into three types: normal, risk-taking, and

reckless. Of these, only reckless behavior is punished.

Chapter 2: Relationships to Existing Patient Safety Efforts and Tools

23

a

For more information on Just Culture, see Patient Safety and the

just culture: A primer for health care executives by David Marx, JD

(2001), on the Web at www.mers-tm.net/support/

Marx_Primer.pdf.
Table 2.1. How mistake-proofing fits into common patient safety improvement efforts

Direction Relationship Comment

Safety culture Enabler Efforts to shape the norms and values of an 

organization to focus on creating safety-conscious 

behaviors and to commit significant 

organizational resources to achieve patient and 

worker safety. 

Just culture Enabler A subset of safety culture. Provides an open 

environment—one in which errors are viewed as 

opportunities to learn rather than events to be 

punished—which encourages increased event 

reporting.

Event reporting Enabler Disclosing adverse events and errors that need 

remedial action to prevent them in the future.

Root cause analysis Enabler Identifies causes “that we can act upon such that 

it meets our goals and objectives and is within our 

control.”2

Mistake-proofing cannot be done without a clear 

knowledge of the cause and effect relationships in 

the process.

Corrective action systems Area of opportunity Policies and procedures that ensure causes of 

events are properly resolved and remedial actions 

are taken.

Specific foci Areas of opportunity Those efforts in which the special focus is on 

particular outcomes or events, including falls, 

nosocomial infections, medication errors, and 

wrong-site surgery. 

Simulation Area of opportunity and Builds correct, conditioned responses; provides a 

venue for validation laboratory for identifying and validating the 

effectiveness of mistake-proofing projects.

Technology Subset Includes bar coding, computerized physician 

order entry (CPOE), and robotic pharmacies; 

expensive, complex, more technologically 

sophisticated version of mistake-proofing.

Chapter 2: Relationships to Existing Patient Safety Efforts and Tools

24
Table 2.1. How mistake-proofing fits into common patient safety improvement efforts (continued) 

Direction Relation Comment

Facility design Complementary or a Using building layout and design to put 

subset knowledge in the world is effective but difficult

with large, long-lived existing infrastructure.

Revise standard operating Competing or Choosing to lengthen SOPs or increase their 

procedures (SOPs) complementary complexity is an easy but often ineffective 

alternative to mistake-proofing. 

Simplifying processes and providing clever work 

aids can complement or border on being mistakeproofing.

Attention management Competing (partially) Mistake-proofing can reduce the need for some 

aspects of attentiveness; it frees staff members to 

attend to more important issues that are more 

difficult to mistake-proof.

Crew resource Complementary Some mistake-proofing devices reduce the need to 

management (CRM) attend to process details. This reduced cognitive 

load can free resources and facilitate effective 

participation in decisionmaking typical in CRM.

Failure modes and effects Area of opportunity FMEA and FMECA identify and prioritize 

analysis (FMEA) or failure modes, design tool improvement efforts. Effective FMEA requires 

effects, and criticality analysis actions that lead to redundancy or mistake-

(FMECA) proofing.

Fault trees/probabilistic risk Area of opportunity Identify all known causes of an event and the

assessment design tool probabilities of their occurrence. This is vital 

information in creating informed design decisions 

about mistake-proofing devices. A non-traditional 

application of this tool is presented in Chapter 3.

Chapter 2: Relationships to Existing Patient Safety Efforts and Tools

25
Event Reporting

Event reporting refers to actions undertaken to obtain

information about medical events and near-misses. The

reporting reveals the type and severity of events and the

frequency with which they occur. Event reports provide

insight into the relative priority of events and errors,

thereby enabling the mistake-proofing of processes.

Consequently, events are prioritized and acted upon more

quickly according to the seriousness of their consequences.

Root Cause Analysis

Root cause analysis (RCA) is a set of methodologies for

determining at least one cause of an event that can be

controlled or altered so that the event will not recur in the

same situation. These methodologies reveal the cause-andeffect relationships that exist in a system. RCA is an

important enabler of mistake-proofing, since mistakeproofing cannot be accomplished without a clear

knowledge of the cause-and-effect relationships in the

process. Care should be taken when RCA is used to

formulate corrective actions, since it may only consider

one instance or circumstance of failure. Other

circumstances could also have led to the failure. Other

failure analysis tools, such as fault tree analysis, consider all

known causes and not just a single instance. Anticipatory

failure determination6 (AFDTM) facilitates inventing new

circumstances that would lead to failure given existing

resources.

Corrective Action Systems

Corrective action systems are formal systems of policies

and procedures to ensure that adverse events are analyzed

and that preventive measures are implemented to prevent

their recurrence. Normally, the occurrence of an event

triggers a requirement to respond with counter-measures

within a certain period of time. Mistake-proofing is an

effective form of counter-measure. It is often inexpensive

and can be implemented rapidly. 

It is also important to look at all possible outcomes and

counter-measures, not just those observed. Sometimes,

mistake-proofing by taking corrective action is only part of

the solution. For example, removing metal butter knives

from the dinner trays of those flying in first class

effectively eliminates knives from aircraft, but does not

remove any of the other resources available for fashioning

weapons out of materials available on commercial

airplanes.7 This is mistake-proofing but not a fully

effective counter-measure.

Corrective action systems can also serve as a resource to

identify likely mistake-proofing projects. Extensive

discussion and consultation in a variety of industries,

including health care, reveal that corrective actions are

often variations on the following themes: 1) an

admonition to workers to “be more careful” or “pay

attention,” 2) a refresher course to “retrain” experienced

workers, or 3) a change in the instructions, standard

operating procedures, or other documentation. All of these

are essentially attempts to change “knowledge in the

head.”8

Mistake-proofing is an effective form of counter-measure.

It is often inexpensive and can be implemented rapidly. 

Chappell9 states that “You’re not going to become world

class through just training, you have to improve the system

so that the easy way to do a job is also the safe, right way.

The potential for human error can be dramatically

reduced.”

Mistake-proofing is an attempt to do what Norman8

recommends, put “knowledge in the world.”

Consequently, corrective actions that involve changing

“knowledge in the head” can also be seen as opportunities

to implement mistake-proofing devices. These devices

address the cause of the event by putting “knowledge in

the world.”

Not all corrective actions deserve the same amount of

attention. Therefore, not all corrective actions should be

allotted the same amount of time in which to formulate a

response. Determining which corrective actions should be

allowed more time is difficult because events occur

sequentially, one at a time. Responding to outcomes that

are not serious, common, or difficult to detect should not

consume too much time. For events that are serious,

common, or difficult to detect, additional time should be

spent in a careful analysis of critical corrective actions.

Chapter 2: Relationships to Existing Patient Safety Efforts and Tools

26
Specific Foci

Substantial efforts to improve patient safety have been

focused on specific events such as falls, medication errors,

use of anesthesia, transfusions, and communication. These

specific foci provide areas of opportunity for the

implementation of mistake-proofing. 

Simulation

There have been many discussions in health care circles

concerning the application of methods developed in the

aviation industry to improve patient safety. In aviation,

simulation is used to train pilots and flight crews.

Logically enough, simulators have also begun to be

employed in medicine. In addition to training, simulation

can provide insights into likely errors and serve as a

catalyst for the exploration of the psychological or causal

mechanisms of errors. After likely errors are identified and

understood, simulators can provide a venue for the

experimentation and validation of new mistake-proofing

devices.

Technology

Technological solutions to patient safety problems have

generated substantial interest. Bar coding and

computerized physician order entry (CPOE) systems, in

particular, are being widely implemented. Both of these

technologies are, in fact, forms of mistake-proofing,

despite their tendency to be more expensive and complex

than the mistake-proofing characterized in Table 1.6.

Facility Design

The study of facility design complements mistake-proofing

and sometimes is mistake-proofing (Figure 2.1).

Adjacency, proper handrails and affordances,

standardization, and the use of Failure Modes and Effects

Analysis (FMEA) as a precursor are similar to mistakeproofing. Ensuring non-compatible connectors and pinindexed medical gases is mistake-proofing.

Revising Standard Operating

Procedures

When adverse events occur, it is not uncommon for

standard operating procedures (SOPs) to be revised in an

effort to change the instructions that employees refer to

when providing care. This approach can either improve or

impair patient safety, depending on the nature of the

change and the length of the SOP. If SOPs become

simpler and help reduce the cognitive load on workers, it

is a very positive step. If the corrective responses to adverse

events are to lengthen the SOPs with additional process

steps, then efforts to improve patient safety may actually

result in an increase in the number of errors. Evidence

from the nuclear industry suggests that changing SOPs

improves human performance up to a point but then

becomes counterproductive. Chiu and Frick10 studied the

human error rate at the San Onofre Nuclear Power

Generation Facility since it began operation. They found

that after a certain point, increasing procedure length or

adding procedures resulted in an increase in the number of

errors instead of reducing them as intended. Their findings

are shown in Figure 2.2. Their facility is operating on the

right side of the minimum, in the region labeled B.

Consequently, they state that they “view with a jaundiced

eye an incident investigation that calls only for more rules

(i.e., procedure changes or additions), and we seek to

simplify procedures and eliminate rules whenever

Chapter 2: Relationships to Existing Patient Safety Efforts and Tools

27

Figure 2.1. Floor plan of a hospital room designed

with patient safety in mind.

Source: Joint Commission Resources “Enhancing the

traditional hospital design process: a focus on patient

safety.” Joint Commission Journal on Quality and Safety.

2004;30(3):115-24. Reprinted with permission.
possible.” While there is no comparable study in health

care, prudence suggests that increases in the complexity of

standard operating procedures should be considered

carefully to ensure that the benefits of the additional

instructions exceed the problems generated by the added

complexity. Simplifying processes and providing clever

work aids complement mistake-proofing and in some

cases may be mistake-proofing. When organizations

eliminate process steps, they also eliminate the errors that

could have resulted from those steps. 

Attention Management

Substantial resources are invested in ensuring that workers,

generally, and medical personnel, particularly, are alert and

attentive as they perform their work. Attention

management programs range from motivational posters in

the halls and “time-outs” for safety, to team-building

“huddles” (Figure 2.3). Eye-scanning technology

determines if workers have had enough sleep during their

off hours to be effective during working hours.11 When

work becomes routine and is accomplished on “autopilot”

(skill-based12), mistake-proofing can often reduce the

amount of attentiveness required to accurately execute

detailed procedures. The employee performing these

procedures is then free to focus on higher level thinking.

Mistake-proofing will not eliminate the need for

attentiveness, but it does allow attentiveness to be used

more effectively to complete tasks that require deliberate

thought. 

Crew Resource Management 

Crew resource management (CRM) is a method of

training team members to “consistently use sound

judgment, make quality decisions, and access all required

resources, under stressful conditions in a time-constrained

environment.”13 It grew out of aviation disasters where

each member of the crew was problem-solving, and no

one was actually flying the plane. This outcome has been

common enough that it has its own acronym: CFIT –

Controlled Flight Into Terrain. 

Mistake-proofing often takes the form of reducing

ambiguity in the work environment, making critical

information stand out against a noisy background,

reducing the need for attention to detail, and reducing

cognitive content (see details on cognitive content in

Chapter 4). Each of these benefits complements CRM

and frees the crew’s cognitive resources to attend to more

pressing matters.

FMEA or FMECA?

FMEA and FMECA are “virtually the same,”14 except for a

few subtleties that have been more or less lost in practice

(hereafter simply referred to as FMEA). These two related

tools enable teams to analyze all of the ways a particular

component or process can fail, predict what the

consequences of that failure would be, and prioritize

remedial change actions. 

Chapter 2: Relationships to Existing Patient Safety Efforts and Tools

28

Figure 2.2. Increasing the number of rules can lead

to increased error rates. Adapted from Chiu, Frick.10

Figure 2.3. “Huddle for Excellence” location marked

on pavement near a jet way at Atlanta’s Hartsfield

Jackson International Airport.
FMEA and FMECA are form- or worksheet-based

approaches. Since forms are easily manipulated to meet

users’ needs, rarely are two forms exactly the same.15,16,17,18

Regardless of which version of FMEA is selected, certain

aspect of the analysis will be included. The FMEA process

is begun by creating a graphical description of the

sequence of tasks being analyzed, referred to as a process

map. Several books are devoted exclusively to process

mapping.19,20,21,22,23 The team lists all the failures that could

occur at each task on the FMEA form. The scope of this

step must be managed carefully to keep it from becoming

tremendously onerous. Often, only a small subset of tasks

is considered at one time. After failures have been

identified, the potential effects of each failure are specified,

and the severity of each is assessed. Potential causes are

identified. The team then assesses the likelihood of each

occurrence and the probability of detecting the cause

before harm is done. The severity, the likelihood of

occurrence, and the detectability of each cause are

combined into a priority ranking. A common method is

to rank severity (sev), likelihood of occurrence (occ), and

detectability (det) on a 10-point scale and then multiply

them together. The product is often called the risk priority

number (RPN). An example of these RPN calculations is

shown in Figure 2.4. With FMECA, the risk priority

number of each cause is summed to create a mode

criticality number. Failure causes (or failure modes for

FMECA) are then prioritized, and preventive actions are

taken. In Figure 2.4, the cause “strip of labels with

multiple patient names mixed” is the highest priority

cause. “Order entry error” is the lowest priority. Little

indication of what actions should be taken is provided by

authors writing about FMEA. However, the logic of

FMEA implies that the RPN after the prevention effort

should be less severe, less likely to occur, or more easily

detected. A detailed discussion is included in Chapter 3.

In an FMEA analysis, rank severity, likelihood, and

detectability on a 10-point scale and multiply them to

determine the risk priority number (RPN).

Fault Trees

FMEA is a bottom-up approach in the sense that it starts

at the component or task level to identify failures in the

system. Fault trees are a top-down approach. A fault tree

starts with an event and determines all the component (or

task) failures that could contribute to that event. 

Chapter 2: Relationships to Existing Patient Safety Efforts and Tools

29

Generate

label

Wrong

label

Wrong

patient

is drawn 10

10

10

10

3

5

5

5

1

Strips of labels

with multiple

pt names

mixed in

Miscommunication

of order

Order entry

error

RN/PCT*

inspects

Wrong

label

No label/

wrong label

500 (10x10x5)

150 (10x3x5)

50

(10x5x1)

?

Process

function/

requirement

Potential

failure

mode

Potential

effects of

failure

Potential

cause of

failure

Current

process

control

Recommended

actions

?

?

High RPNs

deserve

concentrated effort

& the best possible

solutions as

recommended

actions

Recommended

actions for low

RPNs should not

be allowed to

distract attention

from higher RPNs

RPN calulations: SEV X X OCC DET = RPN

* Patient care technician

Figure 2.4. RPN calculations.
A fault tree is a graphical representation of the

relationships that directly cause or contribute to an event

or failure. Figure 2.5 shows a generic fault tree. The top of

the tree indicates the failure mode, the “top event.” At the

bottom of the tree are causes, or “basic failures.” These

causes can be combined as individual, independent causes

using an “OR” symbol. They can be combined using an

“AND” symbol if causes must co-exist for the event to

occur. The tree can have as many levels as needed to

describe all the known causes of the event. 

These failures can be analyzed to determine sets of basic

failures that can cause the top event to occur, cut sets. A

minimal cut set is the smallest combination of basic

failures that produces the top event. A minimal cut set

leads to the top event if, and only if, all events in the set

occur. This concept will be employed in Chapter 3 to

assess the performance of mistake-proofing device designs.

These minimal cut sets are shown with dashed lines in

Figure 2.5.

Fault trees also allow one to assess the probability that the

top event will occur by first estimating the probability that

each basic failure will occur. In Figure 2.5, the

probabilities of the basic failures are combined to calculate

the probability of the top event. The probability of basic

failures 1 and 2 occurring within a fixed period of time is

20 percent each. The probability of basic failure 3

occurring within that same period is only 4 percent.

However, since both basic failures 1 and 2 must occur

before the top event results, the joint probability is also 4

percent. Basic failure 3 is far less likely to occur than

either basic failure 1 or 2. However, since it can cause the

top event by itself, the top event is equally likely to be

caused by minimal cut set 1 or 2. 

Two changes can be made to the tree to reduce the

probability of the top event: 1) reduce the probability of

basic failures, 2) increase redundancy in the system. That

is, design the system so that more basic failures are

required before a top event occurs. If one nurse makes an

error and another nurse double checks it, then two basic

failures must occur. One is not enough to cause the top

event. 

FMEA and fault trees are useful in understanding the

range of possible failures and their causes.

The ability to express the interrelationship among

contributory causes of events using AND and OR symbols

provides a more precise description than is usually found

in the “potential cause” column of an FMEA. Potential

causes of an FMEA are usually described using only the

conjunction OR. It is the fault tree’s ability to link causes

with AND, in particular, that makes it more effective in

describing causes. Gano2 suggests that events usually occur

due to a combination of actions and conditions; therefore,

fault trees may prove very worthwhile. FMEA and fault

trees are not mutually exclusive. A fault tree can provide

significant insights into truly understanding potential

failure causes in FMEA. 

Chapter 2: Relationships to Existing Patient Safety Efforts and Tools

30

P(F1)=0.2

Top Event

P(top event) = P(F1F2)+P(F3)=0.08

OR

AND

Basic

Failure

#1

Basic

Failure

#2

P(F2)=0.2

Minimal Cut Set 1 Minimal Cut

Set 2

P(F3)=0.04

P(F1F2) = P(F1)*P(F2)=0.04

Basic

Failure

#3

Figure 2.5. A fault tree example. P= probability, F= basic

failure.
Knowing What Errors Occur,

and Why, Is Not Enough 

FMEA and fault trees are useful in understanding the

range of possible failures and their causes. The other

tools—safety culture, just culture, event reporting, and

root cause analysis—lead to a situation in which the

information needed to conduct these analyses is available.

These tools, on their own, may be enough to facilitate the

design changes needed to reduce medical errors. Only

fault tree analysis, however, comes with explicit

prescriptions about what actions to take to improve the

system. These prescriptions, which will be discussed

further in Chapter 3, are: increase component reliability or

increase redundancy. Fault trees are also less widely known

or used than other existing tools. FMEA is far more widely

used, in part because it is a popular method of meeting

JCAHO’s requirement to perform proactive risk

assessment.

FMEA calls for action. Most versions of FMEA do not

provide explicit prescriptive information about what action

to take. Only JCAHO explicitly prescribes redesigning the

process. With the exception of the less-utilized fault tree

analysis, the tools used in patient safety improvement

efforts are currently focused on determining what events

and errors occur and what causes them. They are silent

about how to fix the problem or prevent the cause of

failure from recurring. Even JCAHO,24 which explicitly

identifies redesign as the preferred approach for increasing

patient safety, provides little direction about how to

accomplish it. JCAHO provides three questions that must

be answered at the “redesign the process” step:

1. How can we change the process to prevent this failure

mode from occurring?

2. What design/redesign strategies and tools should we

use? How do we evaluate their likely success?

3. Who should be involved in the design/redesign

process?

These are the crucial questions and, like Fermat’s Last

Theorem,b are left as an exercise for the reader. 

A recurring theme in quality improvement literature is

that we are good at identifying problems but not so good

at devising methods to solve them. Numerous tools are

available to define, measure, and analyze quality problems

and control processes. Six-sigma is a popular quality

improvement framework. It has an improvement cycle that

involves five problem-solving steps: define, measure,

analyze, improve, and control. The tools available to

actually conceive of what the improvement should be are

limited. In a 191-page quality management quick

reference guide,25 only 12 pages were devoted to tools for

actually improving the process (Figure 2.6). Worse, those

pages are devoted to managing the process of

implementing the improvement, not how to determine

what the improvement should be.

Chapter 2: Relationships to Existing Patient Safety Efforts and Tools

31

b

Pierre de Fermat (1601-1665) was a French lawyer and number

theorist known for his last theorem, which was discussed for

hundreds of years until it was solved in 1995 by mathematician

Andrew John Wiles (1953-). Wiles had been working on solving

the theorem since 1963. The Last Theorem states that xn + yn =

zn has no non-zero integer solutions for x, y, and z when n > 2. 

See http://www. groups.css.st-and.ac.uk/~history/HistTopics/

Fermat’s_Last_theorem.html.

1. Define

2. Measure

3. Analyze

4. Improve

5. Control

0 20 40 60 80

29

12

56

73

14

Pages

Figure 2.6. Six-sigma process improvement step—

distribution of coverage length in pages.
Determining what the improvement should be is an

inventive problem that will require some creativity. Tools

to facilitate the inventive solution to determining how to

design devices that will mistake-proof the process are

introduced in the next section and presented in detail in

Chapter 3. 

Using the Tools Together 

Figure 2.7 shows a flowchart of how patient safety tools

can be used together with other management tools to

reduce human error and create mistake-proofing devices.

Enabling Tools

The box to the left in Figure 2.7 contains enabling tools

that provide a foundation for designing effective mistakeproofing devices. The design tools in the center box

require detailed information about the process and a

thorough understanding of cause-and-effect relationships

as inputs to be analyzed. The enabling tools provide these

inputs. 

Process mapping defines the current process. A process is

“a collection of interrelated work tasks, initiated in

response to an event, achieving a specific result for the

customer and other stakeholders of the process.”16

Thinking of health care as a process and then mapping

that process is a critical step in improving the process.

Chapter 2: Relationships to Existing Patient Safety Efforts and Tools

32

Process mapping

Just culture

Event and near-miss

reporting

Root cause analysis

Visual systems (5S)

Enabling tools

Failure Modes and

Effects Analysis (FMEA)

Fault tree analysis

Multiple fault

tree analysis

TRIZ**

Weaker cues

Change focus or

give up

Design tools

Brainstorm

Brainstorm

Brainstorm

Brainstorm

Brainstorm

0 Solutions

Solution set

Lots of tools,

but beyond

the scope of

this book

Implementation

tools

>n*

>n

>n

>n

>1

* The variable n equals the number of solutions you would like to generate before selecting the best one.

** TRIZ is the acronym for the “Theory of Inventive Problem Solving” translated from Russian.

<n*

<n

<n

<n

Figure 2.7. Flowchart of mistake-proofing tools.
Process mapping is also an early step in performing

FMEA. “Graphically describing the process” is Step 3 in

healthcare failure modes and effects analysis

(HFMEA)TM.12 Flow charting, one style of process

mapping, is utilized in Steps 1 and 2 in JCAHO’s

recommended FMECA process.16 A detailed

understanding of the process also provides insights into

where specific errors might be detected and how likely that

detection is to occur.

Having a just culture that is fair and open will foster event

and near-miss reporting. Reporting provides insights into

what events occur, how often they occur, and the

outcome’s level of seriousness when they occur.

Information about the frequency and severity of adverse

events facilitates the prioritization of process improvement

efforts. Knowing a failure occurred should trigger an event

investigation and subsequent root cause analysis. 

Root cause analysis determines what cause-and-effect

relationships lead to events in the process. There is an

implicit expectation that the cause-and-effect relationships

of a process are understood in FMEA. The potential

causes of an event must be listed for each failure mode.

Fault tree analysis also assumes an understanding of cause

and effect. Fault trees go beyond FMEA by stating the

relationships among multiple causes that would lead to the

event taking place.

Visual systems create an environment where mistakeproofing can be used more effectively (See Chapter 1).

Visual cues indicating what action to take are more

obvious when distractions are removed, and

standardization provides points of reference to enable

employees to detect and prevent errors.

Design Tools

The central box in Figure 2.7 contains tools that facilitate

the design of mistake-proofing devices. The tools are listed

and employed in a sequential manner. FMEA is first. No

additional design tools are needed if, after conducting an

FMEA and brainstorming for possible solutions, an

adequate number of possible solutions is generated. The

next step is to select and implement the best solution

available. 

There is no reason to think that the first solution arrived

at will be the best overall solution. Teams should

determine the optimal number of solutions to be

developed before deciding on the best one, shown as “n”

in Figure 2.7. Pella WindowTM engineers26 reported that

they develop and test seven solutions before making a

decision. One step in their decisionmaking process is to

fabricate cardboard and scrap-wood prototypes of

equipment that can be tested and compared by workers

and engineers. 

A similar approach was used by St. Joseph’s Hospital in

West Bend, WI. The team focused on creating a patient

safety-centered design for their new building.27 To facilitate

the design process, they tore out two rooms of the existing

hospital and mocked up one new room so that staff

members could walk through it, visualize working in it,

and identify improvements. The St. Joseph’s room is

shown in Figures 2.8, 2.9, and 2.10. Figure 2.10 shows a

page of comments taped to the wall. This page is

concerned only with the bathroom light fixture. Staff

members filled several sheets as they explored the mock-up

room. 

St. Joseph’s Hospital relied heavily on FMEA. The mockup room helped them to identify failure modes and think

through creative new solutions. The new facility opened in

August 2005.27

Teams can employ a similar approach on a smaller scale

for most mistake-proofing device implementation. As

mentioned in Chapter 1, Hirano28 suggests that if a device

has a greater than 50-percent chance of success, teams

should stop analyzing the situation and immediately

attempt a mock-up of the solution. Some refer to this

approach as “trystorming.” Trystorming extends

brainstorming by quickly creating mock-ups that can be

rapidly and thoroughly evaluated. Given many mistakeproofing devices’ low implementation cost and simplicity,

it is logical to fabricate an early mock-up before

continuing with analysis. 

A fault tree is used to model the situation further in cases

where FMEA does not yield a sufficient number of

potential solutions. Fault trees add information that may

not appear in FMEA. The use of AND and OR nodes, the

Chapter 2: Relationships to Existing Patient Safety Efforts and Tools

33
concept of minimal cut sets, and the use of probabilistic

information in fault tree analysis enable a more accurate

assessment of the impact of potential mistake-proofing

devices. More brainstorming is called for after the

completion of the fault tree analysis. Teams should

proceed to selection and implementation only after

generating a sufficient number of solutions. 

If, after employing FMEA and fault tree analysis, teams

still do not generate enough potential solutions, the next

logical step is to employ multiple fault trees, a technique

discussed in detail in Chapter 3. Multiple fault tree

analysis aids in converting the problem from one of how

to stop failures from happening into one of how to make

failures happen. The question here is, “Which failure

would be more benign, and how can we generate that

failure?” Fault trees that were initially used to analyze

undesirable failures are used here to explore resources and

generate benign failures. 

If the number of design changes resulting in benign

failures is still not sufficient, the next step is to employ

creativity, invention facilitation techniques, or software. A

variety of techniques, methodologies, and software could

be used here. One promising approach, TRIZ, has its

genesis in the work of Genrich Altschuller.

29,30,31 He created

an inventive algorithm called the “Theory of Inventive

Problem Solving.” Its Russian acronym is TRIZ. The

TRIZ algorithm is designed for groups to find new ideas

on how to approach a problem; to formulate the specific

problem in general terms, then identify past approaches—

which originate in a Russian patent database—that have

been successful. TRIZ is complex and requires extensive

reading and/or training. Learning is made somewhat easier

by the TRIZ software, which assists in the learning

process.

Chapter 2: Relationships to Existing Patient Safety Efforts and Tools

34

Figure 2.8. Extra wide door and nursing alcove.

Figure 2.9. Headwall mock-up with restroom door 

in background.

Figure 2.10. St. Joseph’s Hospital mock-up comment

form.
Chapter 2: Relationships to Existing Patient Safety Efforts and Tools

35

If teams still need more potential solutions, they might

consider designing a process that embeds cues about how

to do the work correctly.c Norman’s concepts from Table

1.1—natural mappings, affordances, visibility, feedback,

and constraints—are used here.

It would be unrealistic to assume that all problems lend

themselves to a solution. If every attempt fails, teams may

have to give up, at least in the short run. Before giving up,

though, teams should consider a change in focus; explore

sub-systems or super-system changes that might provide

an alternative problem that is more easily solved. Can the

process step be moved to a more advantageous area or

combined with another step? What would need to change

in order for this task to be entirely unneeded and

eliminated? 

Selecting a solution

Let us assume that a team is not forced to give up, and

that the process described above yielded a cornucopia of

possible solution approaches. There are now many

directions in which to embark in the search for

improvement, especially when employing TRIZ software.

The team is now confronted with a delightful dilemma:

how to determine which solutions are the most promising.

Godfrey et al.,32 provide an answer, the solution priority

number (SPN). The SPN concept is very similar to

FMEA’s risk priority number (RPN). The SPN is the

product of a solution’s effectiveness, cost, and ease of

implementation, as shown in Table 2.2. The best solutions

will have high SPN scores: 12, 18, and 27 are the highest

possible scores. (Because SPN is the product of integer

scores, no intermediate scores, such as 13, 19, or 26, are

possible). These high-scoring solutions will be very

effective, cost very little, and be exceptionally easy to

implement. 

A high SPN (Table 2.3) is an indication that a solution is

promising. It does not obviate the need for careful

consideration of device design issues. Human factors like

process usability and time constraints placed on workers

still must be considered. Devices must not negatively

affect the usability of a process or slow the process

noticeably, particularly when resources such as nurse

staffing levels are constrained. Staff will find ways to

accomplish their responsibilities, even if it means disabling

devices (see Chapter 4)

Conclusion

Mistake-proofing does not obviate the need for many of

the tools currently in use in patient safety environments; it

uses the insights these tools generate to aid in the design

of safer systems and processes. 

Regrettably, even with these tools at teams’ disposal,

determining what design change to make is not as welldefined as Figure 2.7 would suggest. Creativity, at its core,

is not a linear process. The tools contribute to our ability

to make sense of a situation, determine what needs to be

done, and decide how to do it. The actual solutions could

yet require a leap of creativity, a flash of inspiration. The

intent of Figure 2.7 and the tools it contains is to reduce

the size of the leap. 

c Embedded cues about how to use the process should be placed

throughout facilities, regardless of which mistake-proofing

efforts are undertaken. Mutual exclusivity of tools or approaches

is not warranted or advisable. Cues are often less effective in

stopping errors. They can still be quite effective, however, in

avoiding them.
Chapter 2: Relationships to Existing Patient Safety Efforts and Tools

36

Table 2.2. Solution priority number calculations

Variable

Solution priority number (SPN) SPN= Effectiveness x cost x implementation.

Effectiveness Very effective solution (3) The probability of occurrence can be 

eliminated or reduced dramatically, or a control measure 

capable of detecting the error can be installed. 

Effective solutions (2) The probability of occurrence can be 

reduced. Despite the reduction there is still significant risk of 

hazard. Measures capable of detecting the error are not in 

place. 

Ineffective solutions (1) The probability of occurrence cannot be 

reduced, and measures capable of detecting the error are not 

in place.

Cost Low cost (3) can be paid for out of daily operating budget.

Moderate cost (2) needs to be paid for out of unit-level budget. 

High cost (1) requires payment from hospital-level budget.

Implementation Easy (3) requires no training. 

Moderate (2) requires a training course, and some resistance 

is expected. 

Difficult (1) implementation means that a culture change is 

needed, and strong resistance is expected. 

Note: Godfrey, et al32 described their scales for effectiveness, cost, and implementation more precisely than that

presented here by tightly linking it to hazard scores in the Department of Veterans Affairs HFMEA.
References

1. Kohn LT., Corrigan JM, Donaldson MS, eds. Institute of

Medicine, To err is human: building a safer health system.

Washington, DC: National Academies Press; 2000.

2. Gano DL. Apollo root cause analysis – A new way of

thinking. Yakima, WA: Apollonian Publications; 1999. 

3. Reason JT. Managing the risks of organizational

accidents. Aldershot, UK: Ashgate; 1997.

4. Weick KE, Sutcliffe KM. Managing the unexpected:

assuring high performance in an age of complexity. San

Francisco: Josey-Bass; 2001. 

5. Marx D. Patient safety and the “just culture”: A primer

for health care executives. www.mers-tm.net/support/

Marx_Primer.pdf; Accessed March 2004. 

6. Kaplan S, Visnepolschi S, Zlotin B, Zusman A. New tools

for failure and risk analysis: anticipatory failure

determinationTM (AFDTM) and the theory of scenario

structuring. South Field, MI: Ideation International;

1999. 

7. Marx D. Personal communication. 2002.

8. Norman DA. The design of everyday things. New York:

Doubleday; 1989.

9. Chappell L. The Poka-yoke solution. Automotive News

Insights. 1996; (August 5) 24i.

10. Chiu C, Frick W. Minimizing the human error rate by

understanding the relationship between skill and rulebased errors. Proceedings of the 16th Reactor Operations

International Topical Meeting. Long Island, NY: 1993;

274-8.

11. Hotchkiss E. Pulse medical instruments (PMI).

http://www.pmifit.com; Accessed March 2004. 

12. Reason J. Human error. New York: Cambridge University

Press; 1990.

13. Kern T. Culture, environment & CRM. Controlling pilot

error series. New York: McGraw-Hill; 2001.

14. Bahr, NJ. System safety engineering and risk assessment: a

practical approach. Philadelphia: Taylor & Francis; 1997.

15. DeRosier J, Stalhandske E, Bagian JP, Nudell T. Using

health care failure mode and effect analysis: The VA

National Center for Patient Safety’s prospective risk

analysis system. Jt Comm J Qual Improv 2002;

28:248–267, 209.

16. Joint Commission on Accreditation of Healthcare

Organizations. www.jointcommission.org. Search entry:

FMECA (Failure Modes, Effect, and Criticality Analysis).

http://www.jcaho.org/accredited+organizations/patient+saf

ety/fmeca/fmeca.pdf; Accessed October 2004. 

17. Krasker, G.D. Failure modes and effects analysis: building

safety into everyday practice. Marblehead, MA: HCPro;

2004.

18. AIAG Workgroup. FMEA-3: Potential failure modes and

effects analysis, 3rd ed. Southfield, MI: Automotive

Industry Action Group; 2002.

19. Sharp A, McDermott P. Workflow modeling: tools for

process improvement and application development.

Boston: Artech House; 2001.

20. Frazier J. Swimlane process mapping: coordinating work

across functional groups and information systems. Walnut

Creek, CA: Frazier Technologies, Inc; 2001.

21. Jacka JM, Keller P. Business process mapping: improving

customer satisfaction. New York: John Wiley & Sons;

2001.

Chapter 2: Relationships to Existing Patient Safety Efforts and Tools

37

Table 2.3. Possible SPN scores and combinations

Possible SPN Number of combinations 

scores resulting in that score

1 1

2 3

3 3

4 3

6 6

8 1

9 3

12 3

18 3

27 1
22. Tapping D, Shuker T, Luyster. T. Value stream

management. New York: Productivity Press; 2002.

23. Hunt D. Process mapping: how to reengineer your

business processes. New York: John Wiley & Sons; 1996.

24. Joint Commission on Accreditation of Healthcare

Organizations. Patient safety: essentials for health care,

2nd ed. Oakbrook Terrace, IL: Joint Commission

Resources; 2004.

25. Rath X, Strong X. Six-sigma pocket guide. Lexington,

MA: Rath and Strong Management Consultants; 2002.

26. Grout J. Unpublished conversation with engineer. Pella

Windows plant tour. Mistake-Proofing Forum.

Productivity Inc.: Des Moines, IA; November 3, 2000.

27. Reiling JG, Knutzen BL, Allen TK, et al. Enhancing the

traditional hospital design process: a focus on patient

safety. Jt Comm J Qual Safety 2004; 30(3):115-124. 

28. Hirano H. Overview. In: Shimbun Factory Magazine.

Poka-yoke: improving product quality by preventing

defects. Portland, OR: Productivity Press; 1988.

29. Kaplan S. An introduction to TRIZ: the Russian theory

of inventive problem solving. South Field, MI: Ideation

International; 1996. 

30. Altshuller G. The innovation algorithm: TRIZ systematic

innovation and technical creativity. Trans. Shulyak L,

Rodman S. Worcester, MA: Technical Innovation Center;

1999.

31. Rantanen K, Domb E. Simplified TRIZ: new problemsolving applications for engineers and manufacturing

professionals. Boca Raton, FL: CRC Press; 2002.

32. Godfrey AB, Clapp T, Nakajo T, et al. Application of

healthcare-focused error proofing: principles and solution

directions for reducing human errors. Proceedings, ASQ

World Conference on Quality and Improvement. Seattle,

WA: American Society for Quality; May 2005.

Chapter 2: Relationships to Existing Patient Safety Efforts and Tools

38
Chapter 3. How To

Mistake-Proof the Design

The Design Change

Imperative

Donald Berwick of the Institute for Healthcare

Improvement (IHI) argues that improving patient safety

requires changes in the design of health care systems:

...We are human and humans err. Despite outrage,

despite grief, despite experience, despite our best

efforts, despite our deepest wishes, we are born fallible

and will remain so. Being careful helps, but it brings

us nowhere near perfection...The remedy is in

changing systems of work. The remedy is in design.

The goal should be extreme safety. I believe we should

be as safe in our hospitals as we are in our homes. But

we cannot reach that goal through exhortation,

censure, outrage, and shame. We can reach it only by

commitment to change, so that normal, human errors

can be made irrelevant to outcome, continually found,

and skillfully mitigated.1

Berwick is not the only proponent of employing design as

the chief approach to improving patient safety. The British

Department of Health and The Design Council issued a

joint report in the early stages of their patient safety

program, calling for “A system-wide design-led approach

to tackling patient safety in the National Health Service.”2,a

FMEA Implicitly Requires Changes

in Design

In Chapter 2, we reviewed the basic steps involved in

performing failure modes and effects analysis (FMEA).

With the exception of JCAHO,3 the various versions of

FMEA do not explicitly state that design changes are

required. JCAHO’s FMEA Step 6 is “redesign the

process.” In versions of FMEA that do not explicitly

require them, design changes generally, and mistakeproofing particularly, are implicit requirements of FMEA. 

Figure 3.1 illustrates the FMEA form used by the auto

industry.4 Failure modes and effects are prioritized

according to three 1- to 10-point scales: severity,

likelihood, and detectibility (a term used in the

automotive version of FMEA that serves the purpose of

“ensuring that the hazard is obvious”). The results are

multiplied to create an overall assessment called the Risk

Priority Number, or RPN. In Figure 3.1, two columns are

labeled RPN. The first is an initial priority. The second is

a recalculation after taking action. The idea is that any

worthwhile action should improve the second RPN. 

In the health care version of FMEA (HFMEATM),

proposed by the Department of Veterans Affairs (VA)

National Center for Patient Safety,5 the assessments of

severity, likelihood, and detectibility are accomplished by

employing a decision flowchart instead of merely rating

them on a 1- to 10-point scale. 

The decision flowchart is shown in Figure 3.2.

The flowchart determines if action is required (proceed) or

if existing systems are adequate and action is not required

Chapter 3: How To Mistake-Proof the Design

39

Figure 3.1. Automotive industry failure modes and effects

analysis form.

a The British Department of Health and The Design Council’s

book Designing for Patient Safety is available at

http://www.designcouncil.org.uk/resources/assets/assets/

pdf/Publications/Design for Patient Safety.pdf 
(stop). HFMEATM does not explicitly state the followup

step that is explicit in the automotive version of FMEA.

After the recommended actions have been taken, the

improvements should eliminate the need for action the

next time that an HFMEATM analysis is revisited.

Otherwise, further action is called for. The decision after

taking action should be “stop (no action required).”

This implies that the actions must accomplish at least

one of the following three objectives in order to be

considered effective and to avoid the implied iterations

of the FMEA process: 

1. Remove a single-point weakness. 

2. Create one or more effective control measures.

3. Make the hazard so obvious that control measures

are not needed.

Removing Single-Point

Weaknesses

The term single-point weakness refers to the creation of

redundancies in the system. Fault trees explicitly

recommend redundancy as an approach to improving

system reliability. Redundancy is created by increasing

the number of systems or individuals involved in the

process. There are many examples from everyday life of

how processes can be made more understandable. One

example is shown in Figure 3.3. Having more back-up

systems or more checks (double, triple, or more)

increases the probability that the process will proceed

correctly. Too often in health care, this redundancy is

created when a second trained health care professional

double-checks the first to ensure that the process has

been performed correctly. However, at the time of this

writing, many health care organizations are experiencing

a nursing shortage; utilizing several nurses to repeat a

Chapter 3: How To Mistake-Proof the Design

40

Single point weakness?

(criticality)

Effective control

measures? (controlled)

Is hazard so obvious

control measures are not

needed? (detectibility)

Proceed

(take action)

Start

Single point weakness?

(criticality)

Stop

(No action

required)

YES

YES

YES

YES

NO NO

NO

NO

Figure 3.2. Healthcare failure modes and effects analysis decision flowchart.
task for the sake of redundancy is an approach that is

too costly, if not impossible, to implement. 

An alternative that would not require more staff would be

to involve patients themselves, where possible, or a

concerned family member or friend. In order for this

alternative to work, medical processes must be rendered

transparent to untrained individuals; errors must be made

obvious. Creating transparency in health care’s jargon-rich,

complex processes can be very challenging. Implementing

visual systems (5Ss, see Chapter 1, Figure 1.7) and

providing the clear process cues suggested by Norman6

could increase transparency significantly. Another option

would be to employ mistake-proofing devices or design

features in the error-detection process. 

Effective control measures

In their article explaining HFMEATM, DeRosier, et al,5

cite the pin indexing system in medical gases as an

example of an effective control measure. They state:

If your hospital does not use universal adaptors (for

regulators), and all the connectors in the building have

the correct pin index, the pin indexing would be an

effective control measure; it would prevent the

incorrect gas from being connected to the regulator. 

An example of pin-indexing is shown in Figure 3.4. The

implication is that an effective control measure stops the

process when an error occurs. This is mistake-proofing.

Effective control measures are design changes that prevent

or stop processes from continuing when an error has

occurred by introducing a process failure (see Figure 3.5). 

Chapter 3: How To Mistake-Proof the Design

41

Figure 3.3. Processes that are simple can be

made more easily understood. This aid

appears on the streets in London.

Figure 3.4. A typical pin-indexed medical air

outlet. The pins on the regulator fit into the

holes at 12 and 5 o’clock. Each gas regulator

has a 12 o’clock pin and one other pin.

Figure 3.5. “Won’t Connect? Don’t Connect!” Here is

where a “safety culture” is needed for mistakeproofing. If users do not understand that the process is

communicating important information to them, they

may try to override the protections provided by the

process. www.fda.gov/cder/dmpq/medgas_mixup/

default.htm.
Chapter 3: How To Mistake-Proof the Design

42

Make Hazards Obvious

If hazards are made obvious, HFMEATM does not require

further action. Color-coding is a common approach to

making mistakes more obvious. The face of the gauge in

Figure 3.6A uses color changes to indicate the range of

correct settings. 

Other everyday examples of making aspects of a system

more obvious are shown in Figure 3.6B-D. Figure 3.7A

provides an example of a design to make errors more

obvious and Figure 3.7B a secondary safeguard—the

warning label. 

Design changes are required actions in response to FMEA.

The answer to the question of what the design changes

should look like is an odd one. To create patient safety

through mistake-proofing, the thing to design into

processes is failure. The design changes should be carefully

designed process failures. 

Experts Agree on Designing

Failures

Findings from engineering, cognitive psychology, quality

management, and medicine all agree that to avoid human

error or its impact, it is necessary to create a process that

ensures failure.

Henry Petroski,7 a noted engineering author, states:

We rely on failure of all kinds being designed into

many of the products we use every day, and we have

come to depend upon things failing at the right time

to protect our health and safety... Failure is a relative

concept, and we encounter it daily in more frequent

and broad ranging ways than is generally realized. And

that is a good thing, for certain types of desirable

failures, those designed to happen, are ones that

engineers want to succeed at effecting. We often thus

encourage one mode of failure to obviate a less

desirable mode. 

This approach is supported by recommendations from

psychology as well. Norman6 recommends the installation

of “forcing functions.” Forcing functions create “situations

in which the actions are constrained so that failure at one

stage prevents the next step from happening.” Forcing

functions are attractive because they rely “upon properties

of the physical world for their operation; no special

training is necessary.”6

From a quality management perspective, Shigeo Shingo

recommends that “when abnormalities occur, shut down

the machines or lock clamps to halt operations, thereby

preventing the occurrence of serial defects.” Source

inspections “are based on the idea of discovering errors in

conditions that give rise to defects and performing

feedback and action at the error stage so as to keep those

errors from turning into defects.”8

This approach is not unheard of in medicine. Croteau and

Schyve9 discuss this approach:

A process that is designed to detect failure and to

interrupt the process flow is preferable to a process

that continues on in spite of the failure...We should

favor a process that can, by design, respond

automatically to a failure by reverting to a

predetermined (usually safe) default mode.

Petroski7

, Norman6, Shingo8, and Croteau and Schyve9

each approach the problem from a different perspective

and discipline, yet their prescriptions are identical. To

reduce human error, make design changes that prevent or

stop processes from continuing when an error has

occurred. When a process stops, it is a process failure.

Under other circumstances, having the process stop would

be undesirable. However, a process stoppage can be a far

more benign failure than allowing a medical error to

progress. Stopping the process will not always be the

appropriate action. Some errors can be more benign, and

stopping the process may not be necessary.

The term “benign” is used here in a relative sense to mean

favorable or propitious.10 It is possible that what is

perceived to be a benign failure in some circumstances

might actually be perceived to be very undesirable in

others. An example will illustrate this point. 
Chapter 3: How To Mistake-Proof the Design

43

Figure 3.6. Examples of making errors more obvious. 3.6A. Clear markings on the gauge make mistakes more obvious. 

3.6B - D. Color coding (in this illustration, shading) indicates when the door lock is open, when the toothbrush should be

replaced, and when the safety harness is buckled correctly.

A. Gauge B. Color coding

C. Toothbrushes. New Replace

D. Buckles, Incorrect Correct
In the decade prior to the U.S. Civil War (1853), Elisha

Otis demonstrated his safety elevator at the New York

World’s Fair.11 The novel feature of the safety elevator was

the Otis Elevator Brake (see Chapter 1, Figure 1.4). This

device would prevent the elevator from falling when the

cable broke. What was the failure? The brake was designed

to get the elevator stuck, usually between floors. Being

stuck in an elevator between floors is a very undesirable

failure. However, when compared with falling to one’s

death at the bottom of an elevator shaft, the option of

being stuck between floors becomes a much more

palatable alternative. 

Multiple Fault Trees

Multiple fault trees can be seen in the flowchart of

mistake-proofing tools (Chapter 2, Figure 2.7). Multiple

fault trees are used to help design benign failures. The

traditional use of fault trees is to carefully define the

current situation, determine causes of undesirable failure,

and identify the resources required to generate that

undesirable failure. The new, second use of multiple fault

trees is to determine ways to cause or create benign failures

and use them as preventive measures. The use of multiple

fault trees provides insights into the causes of desired

failures and identifies the “resources” required to generate

them. The design of the process must be changed so that

the failure associated with the undesirable event causes the

more benign event (desired failure) to occur instead. The

objective is to move failures from the harmful event fault

tree to the benign failure fault tree.

Figures 3.8 and 3.9 show both fault trees before and after

the failures are moved.

In the “before” picture (Figure 3.8), the harmful event has

three minimal cut sets. The first set, containing failures 1

and 2 in a redundant system (AND), has an overall

probability of 0.01. The other two sets, containing single

failures 3 and 4, respectively (OR), have no redundancy

and have a probability of occurrence of 0.05 each.

Suppose that Cause 4 is selected as the first target for

improvement. Assume that a benign failure that would

adequately safeguard patient safety, because it would

prevent the harmful event from occurring, has been

identified. The fault tree for the benign failure is shown in

its initial state on the right side of Figure 3.8. The fault

tree shows substantial redundancy. Three failures must

occur simultaneously in order for a failure to occur, a

situation that has a 0.001 chance of happening. 

Figure 3.9 shows the fault trees after the mistake-proofing

has been accomplished. Cause 4 now appears in the fault

tree of the benign failure. The probability of the harmful

event occurring has been reduced by approximately 45

percent. However, as the diagram shows, more can be

done. Mistake-proofing Cause 3 by moving it to another

fault tree should also be considered. If it can be moved

successfully, the probability of the harmful event would be

reduced to 0.01. Perhaps 0.01 is still unacceptably high. It

is, however, a substantial improvement. To further reduce

the probability of the harmful event would require that

either Cause 1 or Cause 2 be moved to a more benign

fault tree. 

The fault trees in Figures 3.8 and 3.9 illustrate the logic of

the changes sought through mistake-proofing. See Chapter

4 for a more technically precise version of these fault trees

Chapter 3: How To Mistake-Proof the Design

44

Figure 3.7.A - B. Polarized plugs fit into polarized

outlets only one way.

A. Polarized plug

B. Polarized plug warning label
Chapter 3: How To Mistake-Proof the Design

45

Harmful event

P(harmful event)=0.11

OR

AND

P(F1)=0.1

Cause

#1

Cause

#2

P(F2)=0.1

P(C1C2)=0.01

P(F3)=0.05

Cause

#3

P(F4)=0.05

Cause

#4

P(F1)=0.1

Cause

#A

Cause

#B

P(F2)=01

Cause

#C

Benign failure

AND

P(F2)=0.1

P(benign failure)=0.001

No redundancy

Multiple

redundancies

Redundancy

Figure 3.8. Fault trees before Cause 4 is moved.

Harmful event

P(harmful event)=0.11

OR

AND

P(F1)=0.1

Cause

#1

Cause

#2

P(F2)=0.1

P(C1C2)=0.01

P(F3)=0.05

Cause

#3

P(F4)=0.05

Cause

#4

P(F1)=.1

Cause

#A

Cause

#B

P(F2)=.1

Cause

#C

Benign failure

AND

P(F2)=.1

OR

P(F4)=.05

Cause

#4

P(Benign Failure)=.051

P(C1C2)=0.001

X

Figure 3.9. Fault trees after Cause 4 is moved.
that model mistake-proofing devices but which may be

less than perfectly reliable.

Fault trees enable process designers to anticipate how the

process will behave after mistake-proofing has been

implemented. After mistake-proofing, the benign failure is

far more likely to occur than before. When the benign

failure occurs, the staff member using the process must

troubleshoot it to determine the reason for the failure. The

benign failure in Figure 3.9 is nearly ideal for use with one

of the causes. If the benign failure shown occurs, the most

likely cause is Cause 4. That cause can be confirmed

quickly, and the process can be reset and restarted as

needed. 

It is important to ensure that a single benign event does

not become the failure mode for too many mistakeproofing devices. For example, Causes 1 through 4 should

not all be moved to the same benign failure. When

multiple causes can stop the process in the same way, the

process can become difficult to troubleshoot. The result is

that team members may become uncertain about how to

re-start the process after a failure. 

Effective mistake-proofing should involve a diverse set of fault

trees that result in a variety of benign failures.

While designing a mistake-proofed cooktop (Figure 3.10),

the designer could consider that the presence of a cooking

pan could be detected by the mass or the weight of the

pan. The burner could be deactivated if there is no pan

sitting on it. Additonal features could include a small light

near each burner to indicate that the burner is on, and

arranging the burner control knobs to correspond to the

physical arrangement of the burners. This is a natural

mapping.

Although fault trees are central to this discussion, other

failure analysis tools can be employed and will yield

similar insights (relatively detailed FMEA,4,5 anticipatory

failure determination,12 current reality trees,13 and causal

trees,14 for example). 

Fault trees have two advantages: 

1. The application of the method to a situation is

straightforward. 

2. The failure is displayed simply and in substantial

detail. 

In addition to understanding fault trees, team members

need information, resources, and creativity:

1. Team members must be privy to all information

normally generated by the enabling tools. 

2. Team members must have access to detailed

knowledge of the medical processes involved.

Only then will the team be able to link the causes of

undesirable failures to the outcomes of benign failures in

ways that:

1. Are inexpensive.

2. Have minimal impact on the existing process.

Chapter 3: How To Mistake-Proof the Design

46

Figure 3.10. Natural mapping.
Designing Mistake-Proofing Devices that Cause Benign

Failures

There are eight primary steps involved in designing mistake-proofing devices. 

Step 1. Select an undesirable failure mode for further analysis. In order to make an informed decision about which

failure mode to analyze, the RPN or the criticality number of the failure mode must have been determined in the course

of performing FMEA or FMECA. 

Step 2. Review FMEA findings and brainstorm solutions (Figure 3.11). Most existing mistake-proofing has been done

without the aid of a formal process. This is also where designers should search for existing solutions in medicine or

elsewhere. The examples in Chapter 6 include comparisons of solutions from medical, industrial, and everyday life. Many

exploit the same ideas (see Chapter 6, examples 6.7 and 6.13). Common sense, creativity, and adapting existing examples

are often enough to solve the problem. If not, continue to Step 3. 

Chapter 3: How To Mistake-Proof the Design

47

Process mapping

Just culture

Event and near-miss

reporting

Root cause analysis

Visual systems (5S)

Enabling tools

Failure Modes and

Effects Analysis (FMEA)

Fault tree analysis

Multiple fault

tree analysis

TRIZ**

Weaker cues

Change focus or

give up

Design tools

Brainstorm

Brainstorm

Brainstorm

Brainstorm

Brainstorm

0 Solutions

Solution set

Lots of tools,

but beyond

the scope of

this book

Implementation

tools

>n*

>n

>n

>n

>1

* The variable n equals the number of solutions you would like to generate before selecting the best one.

** TRIZ is the acronym for the “Theory of Inventive Problem Solving” translated from Russian.

<n*

<n

<n

<n

Figure 3.11. Review FMEA findings and brainstorm solutions. 
Step 3. Create a detailed fault tree of the undesirable failure mode (Figure 3.12). This step involves the traditional use

of fault tree analysis. Detailed knowledge regarding the process and its cause-and-effect relationships discovered during

root cause analysis and FMEA provide a thorough understanding of how and why the failure mode occurs. The result of

this step is a list and contents of minimal cut sets. Since severity and detectibility of the failure mode could be the same

for all of the minimal cut sets, the probability of occurrence will most likely be the deciding factor in a determination of

which causes to focus on initially. 

Chapter 3: How To Mistake-Proof the Design

48

Process mapping

Just culture

Event and near-miss

reporting

Root cause analysis

Visual systems (5S)

Enabling tools

FMEA

Fault tree

analysis

Multiple fault tree

analysis

TRIZ**

Weaker cues

Change focus

or give up

Design tools

Brainstorm

Brainstorm

Brainstorm

Brainstorm

Brainstorm

0 Solutions

Solution set

Lots of tools,

but beyond

the scope of

this book

Implementation

tools

>n*

>n

>n

>n

>1

<n*

<n

<n

<n

* The variable n equals the number of solutions you would like to generate before selecting the best one.

** TRIZ is the acronym for the “Theory of Inventive Problem Solving” translated from Russian.

Figure 3.12. Create a detailed fault tree of the undesirable failure mode.
Step 4. Select a benign failure mode(s) that would be preferred to the undesirable failure. The tools that precede

multiple fault trees in Figure 2.7 once again provide information about other failure modes and their severity. Ideally, the

benign failure alone should be sufficient to stop the process; the failure, which would normally lead to the undesirable

event, causes the benign failure instead. 

Step 5. Using a detailed fault tree, identify “resources” available to create the benign failure (Figure 3.13). These

resources, basic events at the bottom of the benign fault tree, can be employed deliberately to cause the benign failure to

occur. 

Chapter 3: How To Mistake-Proof the Design

49

Process mapping

Just culture

Event and near-miss

reporting

Root cause analysis

Visual systems (5S)

Enabling tools

FMEA

Fault tree analysis

Multiple fault tree

analysis

TRIZ**

Weaker cues

Change focus

or give up

Design tools

Brainstorm

Brainstorm

Brainstorm

Brainstorm

Brainstorm

0 Solutions

Solution set

Lots of tools,

but beyond

the scope of

this book

Implementation

tools

>n*

>n

>n

>n

>1

<n*

<n

<n

<n

* The variable n equals the number of solutions you would like to generate before selecting the best one.

** TRIZ is the acronym for the “Theory of Inventive Problem Solving” translated from Russian.

Figure 3.13. Identifying resources available to create the benign failure.
Step 6. Generate alternative mistake-proofing device designs that will create the benign failure (Figure 3.14). This

step requires individual creativity and problem-solving skills. Creativity is not always valued by organizations and may be

scarce. If necessary, employ creativity training, methodologies, and facilitation tools like TRIZ (described in Chapter 2) if

brainstorming alone does not result in solutions. 

Chapter 3: How To Mistake-Proof the Design

50

Process mapping

Just culture

Event and near-miss

Reporting

Root cause analysis

Visual systems (5S)

Enabling tools

FMEA

Fault tree analysis

Multiple fault tree

Analysis

TRIZ **

Weaker cues

Change focus

or give up

Design tools

Brainstorm

Brainstorm

Brainstorm

Brainstorm

Brainstorm

0 Solutions

Solution set

Implementation

tools

>n*

>n

>n

>n

>1

<n*

<n

<n

<n

Lots of tools,

but beyond

the scope of

this book

* The variable n equals the number of solutions you would like to generate before selecting the best one.

** TRIZ is the acronym for the “Theory of Inventive Problem Solving” translated from Russian.

Figure 3.14. Generate alternative mistake-proofing device designs that will create the benign failure.
Step 7. Consider alternative approaches to designed failures (Figure 3.14). Some processes have very few resources. If

creativity tools do not provide adequate options for causing benign process failures, consider using cues to increase the

likelihood of correct process execution. Changing focus is another option to consider when benign failures are not

available. 

Chapter 3: How To Mistake-Proof the Design

51

Process mapping

Just culture

Event and near-miss

reporting

Root cause analysis

Visual systems (5S)

Enabling tools

FMEA

Fault tree analysis

Multiple fault tree

analysis

TRIZ**

Weaker cues

Change focus

or give up

Design tools

Brainstorm

Brainstorm

Brainstorm

Brainstorm

Brainstorm

0 Solutions

Solution set

Lots of tools,

but beyond

the scope of

this book

Implementation

tools

>n*

>n

>n

>n

>1

<n*

<n

<n

<n

* The variable n equals the number of solutions you would like to generate before selecting the best one.

** TRIZ is the acronym for the “Theory of Inventive Problem Solving” translated from Russian.

Figure 3.15. Consider using weaker cues or change focus when other tools do not lead to solutions.
If you cannot solve the problem, change it into one that is

solvable. Changing focus means, essentially, exploring the

changes to the larger system or smaller subsystem that

change the nature of the problem so that it is more easily

solved. For example, change to a computerized physician

order entry (CPOE) system instead of trying to mistakeproof handwritten prescriptions. There are very few

resources available to stop the processes associated with

handwritten paper documents. Software, on the other

hand, can thoroughly check inputs and easily stop the

process. 

Often, responses to events appropriately include multiple

actions, thereby creating their own redundancy. 

Of course, there are no guarantees that a failure mode will

be solved. If little or no progress is made after completing

Steps 1 through 7, it may be prudent to just give up.

Some inventions needed to solve patient safety concerns

are not, at present, technically or financially feasible.

Although it may be necessary to give up, the worst-case

scenario is the continuation of the current process with no

change at all.

Step 8. Implement a solution. A full discussion of

solution implementation is beyond the scope of this book.

A rigorous look at implementation issues is available in

the change management literature. Some basic tasks

usually required as part of the implementation are listed

below:

• Select a design from among the solution alternatives: 

• Forecast or model the device’s effectiveness.

• Estimate implementation costs.

• Assess the training needs and possible cultural

resistance.

• Calculate the solution priority number (SPN) as

described in Chapter 2.

• Assess any negative impact on the process.

• Explore and identify secondary problems (side

effects or new concerns raised by the device).

• Assess device reliability.

• Create and test the prototype design: 

• Find sources who can fabricate, assemble, and

install custom devices, or find manufacturers

willing to make design changes (more in

Chapter 9).

• Resolve technical issues of implementation.

• Undertake clinical trials (because of the stakes

involved, medical implementations will need to

be much more deliberate than those in other

industries).

• Trial implementation:

• Resolve non-technical and organizational issues

of implementation. 

• Draft a maintenance plan. 

• Draft process documentation.

• Broad implementation leads to:

• Consensus building. 

• Organizational change.

The eight steps to creating mistake-proofing devices can

be initiated by a root cause analysis or FMEA team, an

organization executive, a quality manager, or a risk

manager. An interdisciplinary team of 6 to 10 individuals

should execute the process steps. An existing FMEA or

root cause analysis team is ideal because its members

would already be familiar with the failure mode. Help and

support from others with creative, inventive, or technical

abilities may be required during the later stages of the

process. A mistake-proofing device is designed using the

eight steps just discussed in the application example that

follows.

Chapter 3: How To Mistake-Proof the Design

52
An Application Example

Step 1. Determine the undesirable failure mode. For this

example, consider the undesirable event of a patient

injured by a fall during a transfer to or from a standard

(non-powered) wheelchair. Berg, Hines, and Allen.15 report

that 37.9 percent of wheelchair users fell at least once in

the past 12 months. Of those who fell, 46.7 percent were

injured as a result of their fall. Tideiksaar,16 Calder and

Kirby,17 and Ummat and Kirby,18 confirm that transfers to

and from wheelchairs are common causes of injuries.

Step 2. FMEA is well-known in health care, and detailed

instruction on its implementation is available.19 It may be

that a well-done FMEA would be enough to generate

ideas for how to change the process design so that falls are

prevented during transfers to or from wheelchairs. In order

to demonstrate subsequent steps, though, assume that

FMEA and brainstorming did not generate an adequate

number of possible solutions, so the process continues to

Step 3.

Step 3. This step calls for the creation of a detailed fault

tree used to understand and make sense of how failures

occur. In this case, the information from the literature on

wheelchair injuries (cited in Step 1) and information from

previously created FMEAs would inform the creation of

the fault tree. The fault tree in Figure 3.16 shows the

undesirable event—patient falls during transfer to or from

a standard wheelchair. Each level of the tree provides

additional detail into why the event occurred. The fault

trees in this example have purposely been kept small and

simplified. They are intended only to illustrate how using

fault trees can assist in making sense of the causes of

undesirable failures and how more benign failures can be

designed into the process instead. 

Given the fault tree for the undesirable event in Figure

3.16, there are several possible alternative approaches to

preventing the failure. One or more of the causes (often

called basic failures) shown in the bold-lined boxes in

Figure 3.16 need to be addressed. To avoid “hand brake

not engaged,” for example, it is necessary to find ways to

ensure that the patient does not forget (Box A) and to

provide training (Box B). To avoid “footplate present when

it should not be,” requires actions to prevent patients from

failing to move the footplate and to prevent the footplate

from moving back into position for use (caused by Boxes

2 and 3). To prevent “Patient falls during transfer...” (the

top event), preventive actions must be taken on both the

left and right branches of the fault tree, “failure to land on

seat...” and “trip on footplate,” respectively. The next

several paragraphs show how benign failures might be used

to think through design changes that will prevent either

branch from resulting in patient falls.

Step 4. Selecting a benign failure mode in Step 4 requires

asking, “What failure would be preferable to having a

patient fall”? Separating this question into sections, we

arrive at:

1. What failure would be more benign than failing to

land on the wheelchair’s seat? 

2. What failure would be more benign than tripping on

the footplate? 

The answer to the first of these questions might be to

prevent the wheelchair from rolling (Figure 3.17).

Although assuring that the wheelchair does not roll is a

failure that completely defeats the purpose of having a

wheelchair, this outcome could be better than that of

wheelchair users injuring themselves, especially if the

failure is temporary. The white box in Figure 3.17 shows

one of the causes of the wheelchair rolling away, “armrest

used for support, seat vacant,” being moved into the fault

tree for “wheelchair will not roll.” This move generates

creative or inventive questions. Can a mechanism be

invented in which the brake is always engaged when the

seat is vacant? Alternatively, is it possible to develop a

brake that is activated when most of a patient’s weight is

on the armrests instead of on the seat? These creative or

inventive questions are the starting places for changing the

design of the process. It might be necessary to explore

several, perhaps many, possible solutions to find the best

one.

Proposing a benign failure converts a problem into a

question of creativity: Can we invent a mechanism so

that the brake is always engaged when the seat is vacant? 

Chapter 3: How To Mistake-Proof the Design

53
Chapter 3: How To Mistake-Proof the Design

54

OR

AND

Patient falls duringtransfer to or from

standard wheelchair

Failure to land on

seat during entry

or aborted exit

Trip on footplate

Patient unable to

hold wheelchair

in position

Wheelchair

rolls away

AND

Armrest used

for support,

seat vacant

OR

A. Patient

forgets

OR

Patient inadvertently

steps on footplate

instead of floor

Patient trailing

foot trapped behind

footplate

AND AND

Feet placed near

edge of seat (behind

location of footplate)

Footplate

present when it

should not be

Small

initial step

Feet placed near

edge of seat (behind

location of footplate)

Footplate

present when it

should not be

Trailing foot moved

below height of

footplate

Hand brake

not engaged

B. Patient

untrained

OR

Footplate moves

back into position

for use

1. Patient omits

moving footplate

OR

Footplate moves

back into position

for use

1. Patient omits

moving footplate

AND AND

3. Patient lifts

footplate

2. Footplate

loose

3. Patient lifts

footplate

2. Footplate

loose

Figure 3.16. Fault tree of an undesirable event: “Patient falls during transfer.”
Figure 3.17 also provides the information required by Step

5. This tree identifies the resources necessary for creating

the benign failure. In many cases, the basic failure (cause)

of the undesirable fault tree can be moved directly onto an

existing branch of the benign fault tree, thereby employing

an already-existing basic failure as a starting point for

creating the benign failure. In this case, the existing basic

failure “hand brake engaged” is suggestive of a device that

solves the problem: an automatically engaged brake.

It turns out that Steps 6 and 7 are unneeded since an

automatic locking device that creates the benign failure

suggested in Figure 3.17 is already commercially available.

It is a braking system that uses a spring to engage the

brake whenever the wheelchair is vacant (Figure 3.18).

The brake is disengaged by the weight of the wheelchair

occupant, which depresses a lever beneath the seat. The

device moves the basic failure, “armrest used for support,

seat vacant,” from the undesirable fault tree to the benign

fault tree. Now, the brakes are automatically engaged when

the armrest is used for support (Figure 3.19). 

This device comes with a significant secondary problem: it

is much more difficult to move empty wheelchairs around

because their brakes are always engaged. However, this

problem is not difficult to resolve. A hand-activated brake

release enables attendants to override the automatic brake

system. 

Is this a “good” solution (part of Step 8)? The locking

device is a very effective solution. The probability of falls is

reduced dramatically. The device provides a control

measure capable of preventing the error of not engaging

the hand brake. The cost of the product is moderate.

While not affordable out of daily operating funds, funds

allocated from a unit-level budget would probably be

adequate. The implementation would most likely be

considered easy, depending on the culture of the

Chapter 3: How To Mistake-Proof the Design

55

OR

AND

Wheelchair

will not roll

Excessive

friction

Obstruction in

front of wheel

OR

Bearings not

functional Inadequate

lubrication

OR

Corrosion Worn out

OR

No preventive

maintenance

Adverse

environment

Patient engages

brake

Patient forgets

to disengage

brake

Handbrake

engaged

Armrest used

for support,

seat vacant

Brake

engaged

OR

Figure 3.17. Benign failure: Wheelchair will not roll.
organization. The only training required would be to

point out the brake release to the staff. If more than

minimal resistance is expected, the organization’s problems

go well beyond those that mistake-proofing is likely to

help. Consequently, the SPN equals 18, the second

highest possible score. 

Calculating the SPN indicates that this device is a

promising direction for improvement. It does not provide

a definitive answer to the question of whether this device

should or should not be implemented. The remaining

tasks in Step 8 must be performed, including an

assessment of device reliability, device trials, maintenance

planning, drafting process documentation, etc. 

Will the automatic brake eliminate the possibility of the

top event, “patient falls during transfers?” No. The other

branch of the tree, “trip on footplate,” must also be

addressed. Returning to Step 4, the second question is:

What failure would be preferable to having a patient trip

on a footplate? One possible response would be the failure

of having the footplate absent or completely unavailable. 

Step 5. What would cause the footplate of a wheelchair

(Figure 3.20) to be absent or unavailable? Figure 3.21

indicates a few possibilities. It could have broken off due

to an impact or other excessive force. This failure suggests

solutions involving parts that break away, like the

attachment of ski bindings to a boot. Under the correct

amount and direction of forces, the ski breaks away from

the boot and prevents injuries to the skier’s legs. Perhaps

the footplate should be designed so that it snaps off when

the patient’s entire weight is put on it; or, if the footplate

is bumped from the rear, it could easily detach from the

chair frame. The footplate might also be absent or

unavailable because it has been disassembled and removed

intentionally. 

This failure suggests that the footplate should be present

to hold the patient’s feet while the chair is in use, but the

footplate would, ideally, be absent at the time of entry or

exit from the wheelchair. A situation in which the

footplate is ideally both present and absent is an example

of what TRIZ users call “an inherent contradiction,” or a

“physical contradiction.” 

Chapter 3: How To Mistake-Proof the Design

56

Figure 3.18. A commercially available, automatic

wheelchair locking device.

Figure 3.19. Wheelchair does not move, locking

device engaged.

Figure 3.20. A wheelchair with footplates.
Step 6. Step 6 recommends using creative or inventive

tools to find directions for further exploration. TRIZ

offers ready approaches for resolving contradictions.

A contradiction is defined as: 

Opposition between things or properties of things. There

are two kinds of contradictions: 

1. Tradeoffs—a situation in which if something good

happens, something bad also happens; or, if something

good gets better, something undesirable gets worse. 

2. Inherent contradictions—a situation in which one

thing has two opposite properties.20

Once a contradiction is identified in the language of

TRIZ, approaches used by other inventors to solve that

contradiction can be looked up on a large matrix. 

TRIZ approaches for resolving the contradiction of

incompatible requirements at different times include the

following eight approaches. The number following each

approach is the TRIZ “principle number.” These numbers

are consistent throughout the TRIZ literature, although

their descriptive label will vary among authors (as shown

in parentheses below). A brief description of each follows.

More detailed information is available from other

sources.21

1. Segmentation (fragmentation) (1): “Divide an object

into independent parts.”21 “Make an object easy to

disassemble.”20 Example: flexible poles of dome-shaped

tents can be folded compactly when not in use (see Figure

3.22).

2. Preliminary counteraction (9): “Preload countertension to an object to compensate excessive and

undesirable stress.”21

3. Preliminary action (10): “Perform required changes to

an object completely or partially in advance.”21 For

example (Figure 3.23): Glue a strong cord inside a

shipping box and connect a “pull here” tab before use to

make it easier to open the box later.

Chapter 3: How To Mistake-Proof the Design

57

OR

AND

Footplate

absent or

unavailable

Removed

Disassembled Forgot/

failed to

reassemble

Impact Other excessive

force

Broken off

OR

Figure 3.21. Benign failure: footplate is absent or

unavailable.

Figure 3.22. Tent poles fold compactly.

Figure 3.23. Connecting the pull tab before use

makes the box easier to open later.
4. Beforehand compensation (cushion in advance) (11):

“Compensate for relatively low reliability of an object with

emergency measures prepared in advance.” For example:

Automotive airbags or guard rails, especially the ends that

are designed to attenuate impact (Figure 3.24).

5. Dynamic parts (dynamicity) (15): Allow (or design) the

characteristics of an object ...to change to be optimal...”20

“Divide an object into elements capable of changing their

position relative to each other.”21 For example: Flaps on

airplane wings (Figure 3.25). 

6. Periodic action (19): “Instead of continuous actions,

use periodic or pulsating actions.”20 For example: Sprinkler

does not damage soil by applying water in droplets instead

of a steady stream (Figure 3.26). 

7. Hurrying (rushing through) (21): “Perform harmful and

hazardous operations at very high speed” (Figure 3.27). For

example: For a given surgical procedure, the more rapidly it

can be done, the better.21 

Chapter 3: How To Mistake-Proof the Design

58

Figure 3.24. Cushion in advance.

Figure 3.26. Pulsating action prevents damage to the

soil.

Figure 3.27. Rushing through. Photo courtesy of Kelly

Moore Connors and www.travelblog.org. Used with

Figure 3.25. On these airplane wings, each element is permission.

capable of changing its position relative to the other

element.
8. Discarding and recovery (Rejecting and regenerating

parts) (34): “Make portions of an object that have fulfilled

their functions go away (discard by dissolving,

evaporating, etc.), or modify them directly during the

operation. Conversely, restore consumable parts of an

object directly in operation.”20 For example (Figure 3.28):

Dissolvable polylactides screws and pins are used in

surgery to mend broken bones, which makes the second

operation for their removal unnecessary.20

Clearly, not all of these approaches seem promising for the

solution to this particular problem of having the footplate

present some of the time but not at others. However,

preliminary counteraction, preliminary action, and the

related approaches of segmentation, dynamic parts, and

discarding and recovery seem promising. 

The eight approaches suggested using multiple fault trees

fit nicely into these TRIZ recommendations. Having

breakaway parts is an example of discarding and recovery.

Approaches suggested by the TRIZ principle of

“preliminary counteraction” involve putting a barrier in

place that will keep the foot from getting behind the

footplate, and creating a spring-loaded footplate assembly

that is raised whenever the foot is not resting on it. The

barrier could take the form of a heel strap or leg strap

(Figures 3.29 and 3.30). Another approach that TRIZ

suggests is dynamic parts. Figure 3.31 shows that the use

of dynamic parts is already available. Some wheelchairs

have footplates that can be released and swung to the side. 

What this solution lacks is a system for causing it to

happen automatically, a simple means of detecting

whether the footplates should swing out of the way.

Because patients could conceivably reposition themselves

by putting most of their weight on the armrests,

footplates, and chair back, having a seat lever mechanism

similar to the previous example could be problematic.

Perhaps in this case the setting function (or detection

system) would need to test for total weight exerted on the

wheels instead of on the seat itself. What should the final

solution be? That remains an open question; but the

engineering task does not appear so daunting that it would

be difficult to develop if someone were so inclined. 

Conclusion

Changing the design of processes is a critical task in

reducing the human errors that plague health care. Of

course, the term design can mean different things in

different contexts. In the contexts of mistake-proofing and

FMEA, it means physical changes in the design of

processes. Only these design changes are adequate to

escape the repetitive revisiting, followup, and preventive

actions that FMEA otherwise requires. 

The goal is to rapidly find inexpensive, effective solutions

that are easy to implement. The process is only an aid in

accomplishing this objective.

Adequate design changes will remove a single point of

weakness, create one or more effective control measures, or

make the hazard so obvious that control measures are not

needed. All of these required actions suggest forms of

mistake-proofing. Moreover, experts from the disciplines

of engineering, cognitive psychology, quality management,

and medicine all agree that these process design changes

should not bring processes to a stop. They should

introduce benign failures into a process. 

A series of tools and some novel applications of those tools

were presented in an eight-step process designed to

generate and evaluate several potential solutions. An

application example was presented. While it was presented

Chapter 3: How To Mistake-Proof the Design

59

Figure 3.28. Rocket parts are discarded when they

are no longer useful.
in a relatively linear step-by-step fashion, real life

circumstances will occasionally prove to be less linear. While

all the steps need to be considered eventually, the designer of

mistake-proofing devices can opportunistically skip a step. 

At other times, the designer may repeatedly return to some

steps on an iterative basis. The goal is not to complete the

eight steps. The goal is to rapidly find inexpensive, effective

solutions that are easy to implement. The process is only an

aid in accomplishing this objective. 

The approach presented here represents an incremental step

in thinking about mistake-proofing medical processes.

Future research and experience will provide additional tools,

techniques, and enhanced approaches for designing effective

medical processes that will have the ability to prevent

specific, undesirable failure modes. Some of the limitations,

drawbacks, and design issues of mistake-proofing are

presented in the next chapter. 

Chapter 3: How To Mistake-Proof the Design

60

Figure 3.29. Wheelchair with heel strap.

Figure 3.30. Wheelchair with leg strap.

Figure 3.31. The footplate can be released and moved to

the side.
References

1. Berwick DM. Not again! BMJ 2001;22:247-248. 

2. Department of Health, The Design Council. Design for

patient safety. London: Department of Health and The

Design Council; 2003.

3. Joint Commission on Accreditation of Healthcare

Organizations. Patient safety: essentials for health care, 2nd

ed. Oakbrook Terrace, IL: Joint Commission Resources;

2004.

4. Automotive Industry Action Group. Process failure mode

effect analysis. Southfield, MI: Automotive Industry Action

Group; 1995.

5. DeRosier J, et al. Using health care failure mode and effect

analysis: The VA National Center for Patient Safety’s

prospective risk analysis system. Jt Comm J Qual Improv

2002; 28:248-267.

6. Norman DA. The design of everyday things. New York:

Doubleday; 1989.

7. Petroski H. Designed to fail. American Scientist. 1997;

85:412-446.

8. Shingo S. Zero quality control: Source inspection and the

poka-yoke system. New York: Productivity Press; 1986.

9. Croteau RJ, Schyve PM. Proactively error-proofing health

care processes, in Spath PL, ed. Error reduction in health

care. Chicago: AHA Press; 2000. 

10. Webster’s new universal unabridged dictionary. Definition

3. New York: Barnes and Noble Books; 1996.

11. Goodwin O. Giving rise to the modern city. Chicago: Ivan

R. Dee; 2001.

12. Kaplan S. New tools for failure and risk

analysis/anticipatory failure determinationTM (AFDTM ) and

the theory of scenario structuring. Southfield, MI: Ideation

International Inc; 1999.

13. Goldratt EM. It’s not luck. Great Barrington, MA: North

River Press; 1994. 

14. Gano DL. Apollo root cause analysis: a new way of

thinking. Yakima, WA: Apollonian Publications; 1999.

15 Berg K, Hines M, Allen S. Wheelchair users at home: few

home modifications and many injurious falls. Am J Public

Health 2002; 92(1):48. 

16 Tideiksaar R. Risk management: Falls and wheelchair safety.

RN+ Fall Prevention and Restraint Reduction Newsletter.

http://www.rnplus.com/pdf.newsletter.1/april.04.pdf.

Accessed July 2005.

17. Calder C, Kirby R. Fatal wheelchair-related accidents in the

United States. Am J Phys Med Rehab 1990;69:184-190.

18. Ummat S, Kirby R. Nonfatal wheelchair-related accidents

reported to the national electronic injury surveillance

system. Am J Physical Medicine & Rehabilitation 1994;

73:163-167.

19. Waiting for citiation

20. Rantanen K, Domb E. Simplified TRIZ: New problemsolving applications for engineers and manufacturing

professionals. Boca Raton, FL: CRC Press; 2002. 

21. Altshuller GS, Shulyak L. 40 Principles: TRIZ keys to

technical innovation. Trans. Rodmans, Shulyak L.

Worcester, MA: Technical Innovation Center; 2001.

Chapter 3: How To Mistake-Proof the Design

61

Chapter 4. Design Issues,

Caveats, and Limitations

Introduction

Mistake-proofing is not without its pitfalls. In the 15th

century, knights and men-at-arms wore heavy armor to

protect themselves from their enemies’ weaponry. In the

context of mistake-proofing, this can be thought of as a

strategy to reduce the influence of the “mistake” of being

injured by enemy weapons. The French’s heavy armor

worked against them, however, when they fought the

British in the Battle of Agincourt on October 25, 1415.

Instead of saving lives, it contributed to their defeat.

Heavy rains on the recently-plowed battlefield created

deep mud. Soldiers wearing heavy armor were unable to

maneuver in the mud when they became even slightly

injured or were pushed to the ground. Some even

drowned in it. Lightly-armored or unarmored English

archers, on the other hand, were able to move more

nimbly and inflict severe damage on the French. 

One lesson to be learned from the Battle of Agincourt is

that it is important to take design issues into account as

part of an effective implementation. Otherwise, mistakeproofing efforts intended to reduce errors or their impact

could cause significant problems themselves.

Implementation problems can be avoided by managing

design issues and, at the same time, recognizing the

limitations or liabilities of mistake-proofing. In the TRIZ

methodology,1 problems associated with a solution are

referred to as secondary problems. It is no surprise that

most mistake-proofing devices contain secondary

problems. Almost every solution does. There are several

recurring mistake-proofing design issues that must be

taken into consideration. These include the need to:

• Mistake proof the mistake-proofing.

• Move errors to another location.

• Prevent devices from becoming too cumbersome.

• Commit the appropriate resources.

• Avoid Type I error problems.

• Avoid unintended utilization of benefits.

• Prevent worker detachment from the process.

• Prevent workers from losing skills.

Each of these issues is discussed in this chapter.

Mistake Proof the MistakeProofing

Mistake-proofing devices should be mistake-proofed

themselves. They should be designed with the same rigor

as the processes the devices protect. The reliability of

mistake-proofing devices should be analyzed, and if

possible, the device should be designed to fail in benign

ways. 

Reliability of Devices

Reason2 warns that systems with extensive automatic error

detection and correction mechanisms are more prone to a

devious form of failure called a latent error.3 Latent errors

remain hidden until events reveal them and are very hard

to predict, prevent, or correct. They often “hide” inside

automatic error detection and correction devices. An error

that compromises an inactive detection and recovery

system is generally not noticed, but when the system is

activated to prevent an error, it is unable to respond,

leaving a hole in the system’s security. This is an important

design issue, although it is quite likely that the errors

prevented by the automatic error detection and correction

systems would have caused more damage than the latent

errors induced by the systems.

Devices Sometime Fail

The following scenario, in which a mistake-proofing

device failed, is a tragic example of the type of latent error

Reason identified. In Chapter 3, devices were modeled as

if they were perfectly reliable. Devices are not perfectly

reliable. The analysis below suggests how device reliability

can be modeled to assess the benefits and risks presented

by the latent error. 

In January 2002, two women died during the same

routine heart procedure in the same room.4 They were

both mistakenly given nitrous oxide instead of oxygen

because a device that regulates oxygen flow was plugged

Chapter 4: Design Issues, Caveats, and Limitations

63
into a receptacle that dispenses nitrous oxide (Figure 4.1).

The flow regulator was missing one of the index pins

designed to prevent such mix-ups. The mistake-proofing

depended on pins connecting the oxygen regulator at 12

and 6 o’clock and the nitrous oxide regulator at 12 and 7

o’clock. The missing pin broke off. A mistake-proofing

device failed.

The fact that devices fail, while sometimes tragic, does not

mean that mistake-proofing is an unsound prevention

strategy. Consider the fault trees in Figures 4.2 and 4.3.

They correspond to the harmful event and benign failure

shown in Chapter 3, Figure 3.9, except that the mistakeproofing device is not perfectly reliable. In Chapter 3,

Cause 4 was completely removed from the harmful event

fault tree. Here, the mistake-proofing device is not very

reliable, failing 1 percent of the time. Cause 4 remains in

the tree because it can cause the harmful event any time it

occurs and the mistake-proofing device also fails. The

probability that both of these events will occur is 0.0005,

two orders of magnitude smaller than without the device.

Device failures should be a catalyst for further exploration

of improvements that could be incorporated into the

device’s design to improve reliability. 

Devices should fail benignly, too. An approach to

improving the reliability of devices is to design them so

that they fail in benign ways. The air brakes on tractortrailer trucks engage if air pressure is lost. When scuba

regulators fail, they are designed to deliver a constant flow

of air instead of no flow at all. A different design for the

pin indexing system that failed would be one that uses

pressure on the index pins to open the flow of gases. If a

pin is broken off, the gas would not flow. If devices

cannot be designed to fail benignly, improve the reliability

of the device by creating more system redundancy.

Alternately, a system of careful maintenance, calibration,

and inspection should be put in place.

Chapter 4: Design Issues, Caveats, and Limitations

64

Harmful event

P(harmful event)=.0605

OR

P(F1)=0.1

Cause

#1

Cause

#2

P(F2)=0.1

P(C1C2)=0.01

P(F3)=0.05

Cause

#3

AND AND

P(F4)=0.05

Cause

#4

MP

device

fails

P(MP)=0.01

P(C4MPW)=0.0005

Figure 4.1. Receptacles dispense oxygen and nitrous

oxide.

Figure 4.3. Fault tree showing reliability of a mistakeproofing device.

Benign failure

P(Benign failure)=.0505

OR

P(F4)=0.05

Cause

#4

Cause

#2

P(F3)=.1

P(C4MPW)=0.0495

P(F2)=.1

Cause

#3

AND AND

P(F1)=.1

Cause

#4

MP

device

fails

1-P(MP)=0.99

P(C4C2C3)=0.001

Figure 4.2. Fault tree showing the effect of less reliable

mistake-proofing device.
Avoid Moving Errors to

Another Location

When designing mistake-proofing devices, it is important

to avoid the common problem of moving errors instead of

eliminating or reducing them. For example, in jet engine

maintenance, placing the fan blades in the correct position

is very important. The hub where the blade is mounted

has a set screw that is slightly different in size for each

blade so that only the correct blade will fit. This solves

numerous problems in assembly and maintenance

throughout the life of the engine. It also produces real

problems for the machine shop that produces the hubs; it

must ensure that each set screw hole is machined properly. 

Moving the error to another location can provide a benefit

in the following circumstances:

1. If the error is moved to a location in the process where

interruptions are more controllable or less likely. 

2. If the means of detection are better. 

3. If the consequences are less severe or reversible. 

Prevent Devices from

Becoming Too Cumbersome

How mistake-proofing devices affect processes is another

design issue that must be considered. The device could be

cumbersome because it slows down a process while in use

or because the process, once stopped, is difficult to restart.

Slow Down the Process

If a mistake-proofing device slows down the process,

workers will find coping strategies (also known as “workarounds”) to enable them to get their work done. Consider

the table saw. It is a common woodworking power tool.

Each saw is equipped with a blade guard in the factory

(Figure 4.4A and 4.4B). The guard covers the spinning

blade as the wood is passed through the saw. In an

unscientific survey of manufacturing workers who own

table saws at home, the majority report removing the

guard from their table saws. When asked why they

removed the guard, most responded that it “got in the

way” or “did not operate smoothly.” The lesson is that

workers will circumvent cumbersome devices that make

work more difficult.

Ideally, mistake-proofing should be designed so that the

device is transparent to the process, like the orientation

check of the 3.5-inch diskette drive. It does not slow down

the process until an error occurs. 

In some cases, mistake-proofing devices can actually make

the correct execution of the process easier and faster. The

pick-to-light bin system (Figure 4.5) is one such device.

Workers select items from the bin to fill customer’s orders.

Each order is different. The bin system is linked to a

computer that downloads each customer’s order. Each bin

Chapter 4: Design Issues, Caveats, and Limitations

65

Figure 4.4A. A table saw without SawStop.

Figure 4.4B. Close up photo of a blade guard. SawStop is

an intriguing, alternative safety device for table saws that

is very effective. Workers may not even know about it until

it saves their fingers. (Video of SawStop’s function can be seen

at www.mistakeproofing.com.)
has a light above it, and an infrared beam detects the

insertion of the worker’s hand. Workers fill the order by

picking an item from each lighted bin. The light goes off

automatically as the item is picked. An alarm sounds if

workers insert a hand into the wrong bin. The subsequent

operation, order packaging, will not operate until all the

lights on the bin system are off. The pick-to-light system

improved worker productivity dramatically compared with

paper orders. Omitted parts defects were reduced from 400

per million to 2 per mllion.5

Difficulty Trouble-Shooting

If too many mistake-proofing devices stop the process in the

same way, it can become difficult to determine which error

is responsible and how to resume normal process operation. 

During the Christmas season of 1997, Toymax sold a very

popular toy called “Metal Molder” (Figure 4.6). This toy

enabled children to mold molten metal into small charms

and trinkets. The toy was thoroughly mistake-proofed to

keep children’s fingers separate from the molten metal.

Various locking mechanisms prevented the process from

proceeding until all the required conditions had been met,

and all the previous steps had been completed. There were

so many reasons that the process could be stopped that the

children for whom it was intended (8-year-olds and older)

were mystified about how to get it to work. Something was

obviously wrong; they just could not figure out what it was. 

Similar outcomes occurred with early computer software,

when the descriptor “user-friendly” differentiated new

versions from older ones. Some of these programs checked

user inputs so carefully that it became difficult to know what

was wrong or how to fix it. 

Effective implementations of mistake-proofing must have

enough different manifestations of process stoppages to

make troubleshooting the error obvious and rapid. 

Commit the Appropriate

Resources

Because many mistake-proofing devices are simple and

inexpensive, they pay for themselves very rapidly. In safetycritical industries where error costs are high, they could pay

for themselves the first time an error is detected. 

Under other circumstances, ensuring that a device is costjustified requires careful cost-benefit analysis. Multi-million

dollar investments in high-technology solutions like

computerized physician order entry, widespread bar-coding,

and robotic pharmacies certainly require careful financial

deliberations. Consumable devices that have small per unit

costs but are used in large quantities per error detected (i.e.,

errors are relatively rare) may also require careful cost

justification (see the BloodlocTM in Chapter 7, Example

7.8). In addition to the traditional cost-benefit analysis,

models based on the economic design of statistical process

control charts are available.6

Chapter 4: Design Issues, Caveats, and Limitations

66

Figure 4.5. A pick-to-light bin system. Figure 4.6. This toy enabled children to mold molten

metal into small charms and bracelets.
An unwillingness to invest enough in error reduction

projects is common. Repenning and Sternman7 wrote an

article with a particularly salient title: “No One Ever Gets

Credit For Fixing Problems That Never Happened.” It

seems to be easier for managers to pay for a lawsuit after

the incident than it is to justify investing in prevention

before the fact. Repenning and Sternman7 describe how

difficult situations that managers confront contribute to

this bias against investing in prevention. They assume that

productive capabilities deteriorate over time and that

ongoing investments in capabilities are needed to ward off

entropy. These capabilities lead to actual performance,

which is assessed against the desired performance.

Managers typically feel pressure to resolve performance

gaps between actual and desired performance.

Applied behavior analysis suggests that people respond

best to outcomes and rewards that are “soon,” “certain,”

and “positive.” As a result, managers are biased. They

would rather not reallocate worker time to “improvement

work” but instead concentrate on doing the core

production work of the firm. Managers are biased toward

production work because its impact is immediate (soon), it

is completely within their control (certain), and it will

likely reduce the performance gap in the short term

(positive). Improvement work tends not to offer the same

rewards. Outcomes, though promising (positive), will be

delayed as teams organize, define, measure, improve, and

control (not soon), and if the performance problem is not

solved, the effort will have been in vain (not certain). 

It seems to be easier for managers to justify paying for

the lawsuit after an incident than it is to justify

investing in prevention before the fact. 

Faced with these alternatives, managers decide to

concentrate on core production work that improves

performance in the short term, but that allows capabilities

to deteriorate in the long term. These deteriorating

capabilities give rise to performance gaps that generate

more pressure on managers to focus on production work

instead of improvement work, and a vicious downward

spiral of capabilities ensues. Consequently, improvements,

including the implementation of mistake-proofing, will

require managers to subordinate short-term pressures to

the long-term goals of the organization. The performance

gap will need to widen initially if it is to narrow in the

long term (Figure 4.7). 

Avoid Type I Error Problems

If mistake-proofing is used for a mistake detection

application and replaces an inspection or audit process in

which sampling was used, changing to the 100 percent

inspection provided by a mistake-proofing device may

have unintended consequences. Specifically, there will be

significantly more information collected about the process

than there would be when only sampling is used. 

Suppose the error of inferring that something about the

process is not correct when, in fact, the process is normal

(Type I error) occurs only a small percentage of the time.

The number of opportunities for a Type I error increases

dramatically. The relative frequency of Type I errors is

unchanged. The frequency of Type I errors per hour or

day increases. It is possible that too many instances

requiring investigation and corrective action will occur.

Properly investigating and responding to each may not be

feasible. Papadakis8 discusses this problem and a possible

remedy.

Avoid Unintended Utilization

of Benefits

The benefits of mistake-proofing can include lower

cognitive workload, reduced chances of error, and faster

and more easily learned processes. Whether these benefits

are used to generate patient safety or some other benefit is

an important and open question. The strength of the

organization’s safety culture will dictate the answer. 

Chapter 4: Design Issues, Caveats, and Limitations

67
Risk Homeostasis

Risk homeostasis, as presented by Wilde,9 maintains that: 

In any activity, people accept a certain level of

subjectively estimated risk to their health, safety, and

other things they value in exchange for the benefits

they hope to receive from that activity... people

continuously check the amount of risk they feel they

are exposed to. They compare this with the amount of

risk they are willing to accept, and try to reduce any

difference between the two to zero.9

In the context of mistake-proofing, risk homeostasis

means that design changes intended to improve patient

safety might actually result in changes of behavior that

provide other benefits instead. Wilde9 points out that antilock brakes do not result in fewer or less severe accidents.

Drivers choose to go faster in inclement weather because

they know they have anti-lock brakes. They use the brakes

to facilitate risky behavior while maintaining a constant

overall risk level. All other things being equal, drivers

essentially trade safety enhancements for additional speed.

Consider the case of the oxygen flow meter with a missing

index pin.4 The flow meter was inserted in a nitrous oxide

outlet where the view of the outlet was obstructed. The

worker had a legitimate expectation that the flow meter

could not be inserted into an incorrect outlet. One might

speculate that the obstructed view was tolerated and the

labeling, color-coding, and other cues about what to do

were not used because of a reliance on the pin-indexing

system. If the worker knew that the pin-indexing system

was not in place, he might have looked at the outlets more

carefully. Here, convenience and speed could have been

obtained by a behavioral change facilitated by a mistakeproofing device. 

Such behavioral changes should be an anticipated

secondary problem during the mistake-proofing device

design process. Use of FMEA, fault trees, and other

analyses throughout the design process can help identify

Chapter 4: Design Issues, Caveats, and Limitations

68

Figure 4.7. Doing more productive work at the expense of improvement work is beneficial in the short term but detrimental in

the long term Copyright 2001, by The Regents of the University of California. Reprinted from the California Management Review, Vol. 43,

No. 4. Used with permission.
and resolve these changes. It also highlights how critical

safety culture is in monitoring and managing the risk level

tolerated by individuals in the organization. 

Reduced Cognitive Content

Mistake-proofing can reduce the amount of cognitive

content in work tasks. However, the benefits that accrue to

organizations from this reduction can be perceived very

differently according to the organization’s intent, culture,

and stategy.

Erlandson, Noblett, and Phelps10 studied the performance

of students with cognitive impairments at Northwest

Wayne Skill Center (NWWSC). These students/workers

ranged in age from 15 to 22 years. Their IQ scores ranged

from 45 to 86. Their job was to assemble fuel filter clamps

for the automotive industry (Figures 4.8A and 4.8B). This

task was initially very difficult for the students and led to

low morale among those assigned to the task. Quality

levels were between 35 percent and 70 percent acceptable

production. The rate of production was approximately

62.5 assemblies/student-hour. Mistake-proofing was

employed to create a work fixture that made it difficult to

make mistakes. The mistake-proofed fixtures allowed for

the use of “a much larger worker pool, reflecting a broader

range of cognitive disabilities. The students were able to

produce approximately 167 completed, acceptable

assemblies/student-hour with accuracy rates approaching

100 percent.”10 NWWSC found that worker morale

improved. Workers reported to work early and, at the end

of the day, congratulated each other for their significantly

increased productivity. The purchasing company was also

enthusiastic about the “quality and quantity” of

production. NWWSC reported a zero return rate after

producing 100,000 clamps following the intoduction of

mistake-proofing. 

As was the case at NWWSC, when designing and

implementing mistake-proofing devices, it is important to

ensure that there exists a culture in which patient safety

will be enhanced. This culture should use the benefits of

mistake-proofing to free health care professionals from

attending to the minute details of a process so that they

can attend to more important aspects of patient care.

The methods employed at the NWWSC seem to be much

more ominous when employed by organizations that are

less interested in promoting the well-being of workers.

Social critics have found fault with the dehumanization of

work since the dawn of the industrial revolution. Mistakeproofing has been used to exploit workers. Unfortunately,

lowering the skill level or cognitive content of work tasks

encourages some companies to reduce training costs and

exhibit little concern for treating employees well enough

to retain them over the long term. When processes are

mistake-proofed, workers become interchangeable and can

be treated as a disposable commodity. 

Chapter 4: Design Issues, Caveats, and Limitations

69

Figure 4.8A. An empty work fixture.

Figure 4.8B. A fuel filter clamp loaded in a work fixture.

Photos from Erlandson et al.10 © 1998 IEEE. Used with

permission.
Pursuing such a strategy to simplify the work also enables

employers to employ individuals with fewer economic

options. It could be argued that the human resources

policies of these companies reveal that their intent is not

the same as that of the Northwest Wayne Skill Center.

NWWSC employs the disabled in a meaningful way,

providing them with more options and upholding their

dignity in a culture that encourages respect for workers.

Prevent Worker Detachment

from the Process

Bose,11 a self-proclaimed proponent of mistake-proofing

(poka-yoke), discusses concerns that the use of mistakeproofing devices may estrange workers. Over zealous

mistake-proofing “generates its own cultural attributes, its

own work ethic. It sows the seeds of operator detachment

from the product...” Bose points out that North American

industries have been trying to involve workers in process

management for the past decade. Bose differentiates

between the useful simplification of the process, including

the elimination of the possibility to create defects, and the

detrimental elimination of required skills. Mistakeproofing should “enable the operator to easily oversee the

process.”11

Prevent Workers from Losing

Skills

Bainbridge12 and Parasuraman et al13 assert that reducing

workers’ tasks to monitoring and intervention functions

makes their tasks more difficult. Bainbridge asserts that

workers whose primary tasks involve monitoring will see

their skills degrade from lack of practice, so they will be

less effective when intervention is called for. Workers will

tend not to notice when usually stable process variables

change and an intervention is necessary. Automatic

features, like mistake-proofing devices, will isolate the

workers from the system, concealing knowledge about its

workings, which are necessary during an intervention.

And, finally, automatic systems will usually make decisions

at a faster rate than they can be checked by the

monitoring personnel. Parasuraman, Molloy, and Singh13

looked specifically at the ability of the operator to detect

failures in automated systems. They found that the

detection rate improved when the reliability of the system

varied over time, but only when the operator was

responsible for monitoring multiple tasks. 

Know the Third Boundry

Rasmussen14 and Rasmussen, Pejterson, and Goodstein.15

warn that errors play an important role in learning to

become more efficient. Extensive use of automatic error

detection and correction mechanisms, such as mistakeproofing devices, could have a negative effect on this

learning. Rasmussen and his co-authors argue that the

workers are being constrained by three boundaries:

1. The boundary of unacceptable workload, which

workers will desire to move as far away from as

possible. 

2. The boundary of financial breakdown, from which

management will drive the workers away. 

3. The boundary of functionally acceptable behavior,

beyond which system failures occur. 

Efficiency is gained by learning the exact location of the

third boundary, so that processes can take place as far

from the other two boundaries as possible without

crossing the third. The location of this boundary is

discovered through trial and error testing. Automatic error

detection and correction mechanisms, by concealing the

boundary of control, can prevent learning and skill

development that might otherwise promote efficiency.

Conclusion

This chapter suggests that, concerning mistake-proofing in

health care, lessons can be learned from several diverse

disciplines. Mistake-proofing is not a panacea, and it is

not without its limitations and liabilities. Inattention to

these limitations and liabilities in the design and

implementation of mistake-proofing devices can lead to

problems. Designing and implementing devices effectively

requires careful thought. The design issues identified in

this chapter should not be a deterrent to implementing

mistake-proofing. Rather, they should serve as a basis for

thorough and thoughtful consideration of mistakeproofing designs.

Chapter 4: Design Issues, Caveats, and Limitations

70
References

1. Innovation Workbench Masters Program. Self-sufficiency

in inventive problem solving. South Field, MI: Ideation

International; 2001.

2. Reason JT, Managing the risks of organizational accidents.

Aldershot, UK: Ashgate; 1997.

3. Perrow C. Normal accidents: living with high-risk

technologies. New York: Basic Books; 1984.

4. Collins J. City police investigate St. Raphael’s: Hospital

could face charges for accidental deaths of two women.

New Haven, CT: Yale Daily News; January 21, 2002.

http://www.yaledailynews.com/Article.aspx?ArticleID=17

694. Accessed December 2006.

5. Grout JR. Mistake-proofing: process improvement

through innovative inspection techniques, In Woods, J,

Cortada J, eds, The quality yearbook. New York:

McGraw-Hill; 1998.

6. Downs BT, Grout JR. An economic analysis of inspection

costs for mistake-proofing binomial attributes. J Qual

Technol. 1999; 31(4):417–26.

7. Repenning NP, Sternman JD. Nobody ever gets credit for

things that never happened: creating and sustaining

process improvement. California Management Review.

2001; (43)4:64-88. 

8. Papadakis EP. A computer-automated statistical process

control method with timely response. Engineering Costs

and Production Economics. 18: 301-10.

9. Wilde GJ. Target risk 2: new psychology of safety and

health. Toronto: PDE Publications; 2001.

10. Erlandson RF, Noblett MJ, Phelps JA. Impact of a pokayoke device on job performance of individuals with

cognitive impairments. IEEE Transactions on

Rehabilitation Engineering. 1998; 6(3):269-76.

11. Bose R. Despite fuzzy logic and neural networks, operator

control is still a must. 1995: CMA 69: 7.

12. Bainbridge L. Ironies of automation, in Rasmussen J,

Duncan K, Leplat, J, eds., New technology and human

error. New York: John Wiley & Sons;1987.

13. Parasuraman R, Molloy R, Singh I. Performance

consequences of automation-induced ‘complacency.’ The

International Journal of Aviation Psychology. 1993: 3(1):

1-23.

14. Rasmussen J. The role of error in organizing behavior.

Ergonomics. 1990; 33(10/11):1185-99. 

15. Rasmussen J, Pejterson A, Goodstein, L. Cognitive

systems engineering. New York: John Wiley & Sons;

1994.

Chapter 4: Design Issues, Caveats, and Limitations

71

Chapter 5. Examples of

Alternative Approaches to

Mistake-Proofing

Introduction

As discussed in Chapter 1, mistake-proofing can use a

variety of setting functions, control functions, or

categories. This chapter provides 67 examples of mistakeproofing organized into 21 sets. Each set highlights

alternative approaches to similar problems. Since each

organization’s processes are subtly but distinctly unique,

different organizations can use a variety of related

approaches to address specific situations. 

The inclusion of the examples in this chapter follows the

pattern of books on mistake-proofing in

manufacturing.1,2,3,4 Some of these examples will be directly

applicable to errors that confront organizations. Others

might suggest how to approach a novel problem that is a

source of concern. The following are issues for

consideration as the mistake-proofing examples in this

chapter are discussed:

1. Consider the most appropriate circumstances for each

mistake-proofing example.

2. Consider whether processes have adequately addressed

issues raised by the examples. 

Pella Window engineers develop and test seven solutions

before identifying and implementing the best one. 

Example Set 5.1—One

Exposure Only, Please

Unintentionally exposing x-ray film to light destroys

images that are vital to proper patient care. These images

can usually be recreated, but they cost time and money. 

The entrance to the hospital darkroom door (Figure 5.1)

has only one opening in a revolving drum. Passing

through the vestibule ensures that the contents of the

darkroom are not unintentionally exposed. The door

creates a failure in that you cannot enter the darkroom

under incorrect conditions.

Figure 5.2 shows a film bin equipped with a special

locking mechanism. The mechanism includes a light

sensor that will not allow the bin to be opened when light

is present in the darkroom. 

Chapter 5: Examples of Alternative Approaches to Mistake-Proofing

73

Figure 5.1. A hospital darkroom door.
Example Set 5.2—Variations

in Scald Prevention 

Data from the National Safe Kids Campaign indicate that

4,000-5,000 children are scalded each year, receiving

third-degree burns that cover at least 12 percent of the

body.5 Most of these events do not take place in medical

facilities, although fatalities have occurred in medical

facilities. Listed below is a variety of devices designed to

reduce the chance of scalding.

Figure 5.3 illustrates a device that uses color-changing

plastics to warn when water reaches dangerous

temperatures, and scalds can occur. 

The color of the circular ring changes from purple (left) to

pink (right) when water exceeds 40 0

C, 104 0F. A

triangular ring (not shown) changes at 37 0C. 

The anti-scald plug shown in Figure 5.4 works the same

way as the circular ring, but with one crucial difference:

the anti-scald plug, by requiring the user to place the

device in order to fill the tub, enforces its own use. In

other words, the user must use the device to fill the tub,

and using the device prevents scalding. 

The anti-scald valve in Figure 5.5 is attached to the end of

a faucet. It contains a valve that closes when water reaches 

117 0

F. This device is easy to install. It is simply threaded

on to the end of the faucet, replacing the standard filter or

aerator. It creates a “shutdown” that prevents the

possibility of scalding. This device lacks an override valve

that is available on some models. A valve would allow

hotter water to be obtained, if necessary, without

disassembling part of the faucet.

Chapter 5: Examples of Alternative Approaches to Mistake-Proofing

74

Figure 5.3. These plastic rings change color at 40 °C.

Figure 5.4. An anti-scald plug. 

Courtesy of the VA National Center for Patient Safety.

Used with permission.

Figure 5.2. A film bin with a locking mechanism.
The device in Figure 5.6 is inserted into the end of the

shower pipe and works much like the previous device. It

also contains a valve that closes when water becomes too

hot. This device installs in a few minutes using an Allen

wrench and is completely hidden once installed.

The device in Figure 5.7 is a thermostatic mixing valve. It

provides “forced control” by automatically mixing cold

water with hot water to reduce the water temperature. The

maximum water temperature can be set and adjusted.

Installation of this type of valve is more troublesome than

the other devices mentioned here. In some cases, the

mixing valve is located behind the wall of the shower, and

installation or adjustment requires carpentry and

plumbing. 

The devices in Figures 5.5, 5.6, and 5.7 require regular

maintenance for reliability and calibration.

Example Set 5.3—Medical

Gas Connections 

Figure 5.8 illustrates the extensive mistake-proofing that

medical gas tanks undergo. Here, the fittings that connect

medical gases from the tanks in the back room to the

tubes leading to the patient have undergone extensive

mistake-proofing.

Tanks display the color-coding scheme. The color coding

serves as a “sensory alert” to ensure that the correct

connections are made between the tanks and the valves in

the patients’ rooms. The tanks are also fitted with pinindexed connectors to prevent incorrect connections.

The generic regulator in Figure 5.9 has a dial that

indicates how many liters of oxygen are delivered. The dial

clicks as each liter of oxygen is delivered. Hinckley2 points

out that converting adjustments to settings is a very

powerful type of mistake-proofing because it requires far

less attention to detail and can accelerate the process

dramatically.

Chapter 5: Examples of Alternative Approaches to Mistake-Proofing

75

Figure 5.6. Valve closes when water becomes too hot.

Figure 5.7. Thermostatic mixing valve. Figure 5.5. Anti-scald valve.
In this case, however, the design has a drawback which is

indicated in a warning box in the instructions: “There is

NO FLOW between settings. To obtain the desired

oxygen flow, the indicating pointer must point to a

specific number on the dial.”6 Eliminating the possibility

of one mistake can create an opportunity for another. 

...a physician treating a patient with oxygen set the

control knob to between one and two liters per

minute, not aware that the numbers represented a

discrete rather than a continuous setting. No oxygen

was flowing through, yet the knob rotated smoothly,

giving the suggestion that the intermediate setting of

the machine was possible. The patient became

hypoxic before the error was discovered. A design

solution would have been a rotary control that snaps

into a discrete setting along with some indication of

flow.7

If the probability of the second mistake is lower than the

probability of the first, on average, patients will benefit.

Designing the device so that flow continues at the rate of

the last setting, regardless of whether or not the indicator

sits between settings, might be safer. 

Example Set 5.4—More

Connections

Often, connections are pin-indexed and color-coded. In

Figure 5.10, the holes for the pins for medical air are

located at 12 o’clock and 5 o’clock. Using this system, all

of the gases have a pin at 12 o’clock. The other pin is

different for each gas.

In their new facility in West Bend, WI, St. Joseph’s

Hospital has gone further by standardizing the location of

each gas outlet on the head wall. Each gas outlet is located

in the same place on each head wall in the hospital. 

How much color-coding is too much? In this case (Figure

5.11), the clear nozzle may be the most mistake-proof

choice.

It is not possible to mount the nozzle on the wrong

regulator because it is universal, not color-coded. If you

have to stock yellow, green, and every other colored nozzle

in each location where they may be used, you not only

incur additional inventory costs, you may actually cause

reportable violations of operating policies or procedures

that would be impossible if only clear nozzles were

stocked. 

Chapter 5: Examples of Alternative Approaches to Mistake-Proofing

76

Figure 5.8. Color-coding and pin-indexed connectors

for medical gas tanks.

Figure 5.10. The holes for the pins are located at 12

o’clock and 5 o’clock. Also, the oxygen outlet is

green, and the medical air outlet is yellow.

Figure 5.9. Regulator dial indicates the amount of

oxygen delivered in liters.
Errors occur where things are almost the same but are

subtly different. What can be made identical should be.

What cannot be made identical should be made obviously,

even obtrusively, different (Figure 5.11).

The regulator in Figure 5.12 is attached to the wall with a

vinyl-covered steel cable in order to avoid converting the

regulator into a projectile that flies across the room when

it is disconnected under pressure. This is an example of

what Tsuda8 refers to as “preventing the influence of

mistakes.”

The tubing can attach to a regulator with (Figure 5.13A)

or without (Figure 5.13B) the nozzle attached. If either

option is acceptable, this design is mistake-proof. If one

option is preferred, the design should be avoided. 

The tubing can attach to a regulator with or without a

nozzle attached. 

Example Set 5.5—Variations in

Tube Identification

Ensuring that labels on samples and test tubes are correct

is a very important aspect of reducing medical errors.

Often, printed labels with complete information are not

available at the bedside and must be retrieved from the

nurses’ station. This delay can contribute to the

introduction of errors into the system. The following three

examples represent approaches to accurately identify tubes

and samples. 

When multiple tubes are drawn at the same time, writing

a label for each can be time-consuming. The BloodracTM

is produced by the makers of the BloodlocTM (see Chapter

7, example 7.8). It enables several tubes to be stored

together with one handwritten label. The identification is

Chapter 5: Examples of Alternative Approaches to Mistake-Proofing

77

Figure 5.11. Yellow, clear, and green nozzles. 

Figure 5.12. A regulator attached to the wall with

steel cable.

Figure 5.13A. Tubing attached to a regulator with a

nozzle.

Figure 5.13B. Tubing attached to a regulator without a

nozzle.
usually the patient’s name and the BloodlocTM code on the

patient’s wristband.

Another approach to reducing the effort required to

accurately label multiple tubes is the use of a wristband

with pre-printed, peel-off, self-adhesive labels (Figure

5.15). All the labels have the same unique identification

number. As they are removed, the same number appears

underneath each label. 

These labels temporarily label the tubes until permanent

labels containing complete information can be printed and

affixed. Error rates are reduced because the preliminary

labels are only available at the patient’s bedside. 

Although the tube in Figure 5.16 receives the temporary

label with little chance of error, the possibility of errors

occurring when matching permanent labels with

temporary ones would also need to be addressed in the

process.

Example Set 5.6—Variations

in Esophageal Intubation

Detection

Esophageal intubation is a common error that occurs

when the intubation tube is inserted in the patient’s

esophagus instead of in the trachea. There are several

approaches to detecting this error in hospital settings.

Figures 5.17-5.21 illustrate a variety of low-tech

approaches that could be employed where power

requirements or space prohibit more sophisticated

approaches. 

After the patient is intubated, a staff member squeezes the

bulb (Figure 5.17) and places it over the end of the tube.

If the bulb fails to re-inflate to its original shape, the tube

is in the esophagus. If it re-inflates fully, the tube is placed

correctly.

Chapter 5: Examples of Alternative Approaches to Mistake-Proofing

78

Figure 5.14. One hand-written label identifies several

tubes of samples.

Figure 5.15. A wristband with multiple, peel-off,

adhesive labels.

Figure 5.17. When inflated fully, this bulb indicates

that the intubation tube has been successfully inserted

into the trachea.

Figure 5.16. Errors can occur when matching

temporary labels with permanent ones.
The bag in Figure 5.18 has a detector that changes color

in the presence of carbon dioxide. If the detector fails to

change color, then the tube is in the esophagus. If it

changes color, the tube is in the trachea. If the mistakeproofing device fails, the device will indicate a situation

requiring corrective action. 

The round cylinder at the end of the tube in Figure 5.19

is a whistle. As the patient breathes in and out the whistle

makes an audible, wheezing sound. The staff can hear the

patient’s breath.

The device in Figure 5.20 is essentially a large caliber

syringe, but instead of pushing fluids out, it pulls in

anything available. If the plunger cannot be pulled out

easily, or if stomach contents come out, the tube is in the

esophagus. If the plunger pulls out easily and completely,

the tube is in the trachea as it should be. 

Example Set 5.7—Variations

in “Take Your Medicine,” 

Part I

The following examples illustrate a common problem in

prescribed medications. The instructions from the bottle

shown in Figure 5.21 are:

Take 5 tabs once daily x 3 days, 

then 4 tabs once daily x 3 days, 

then 3 tabs once daily x 3 days, 

then 2 tabs daily x 3 days, 

then 1 tab daily x 3 days.

Complying with these instructions requires the patient to

pay careful attention to detail and have a good memory or

to use some additional mechanism for tracking necessary

changes in dosages.

A typical prescription bottle may not adequately convey

detailed instructions. One approach to managing dosage

changes is to print the dosage for each day on a calendar.

This approach is cumbersome and increases the

probability of making an error in following the prescribed

instructions.

Chapter 5: Examples of Alternative Approaches to Mistake-Proofing

79

Figure 5.18. The CO2 detector in this bag does not

change colors when the tube is incorrectly inserted

into the esophagus.

Figure 5.19. The whistle at the end of the tube

enables staff members to hear the patient’s breath. 

Figure 5.20. If the plunger in this syringe pulls out

easily, the tube has been properly inserted. 
The packaging, however, puts lots of knowledge in the

world (Figure 5.22) because the rows are labeled by day,

and the instructions for each day are printed on the line

below each row of pills. The act of taking a pill creates a

record of where the patient is in the sequence. No

calendar or other aid is needed. 

Example Set 5.8—Variations

in “Take Your Medicine,” 

Part II

For some, taking medications four times daily is not a

problem. For others, determining if they have taken their

medications is more problematic. Several approaches have

been created to help ensure that medications are taken as

prescribed. Clearly, some devices require less attentiveness,

and some approaches are more cost-effective than others.

The effectiveness of each approach depends on the

individual involved. 

Figure 5.23 shows a daily pillbox. It is simple,

straightforward, and easy to use. This mistake-proofing

device is not particularly mysterious or clever. Yet, it is

common enough that it must work for someone. A

weakness of this device is that it provides only a visual cue

to take medications. It provides no mechanism to know

which pills to take at a particular time of day.

Birth control pills are sold packaged for use as a 1-month

supply. The packaging indicates whether or not patient

has been taking their medication consistently and are

current, assuming they know what day it is. 

Chapter 5: Examples of Alternative Approaches to Mistake-Proofing

80

Figure 5.21. A typical prescription bottle.

Figure 5.22. Package, conveys detailed dosing

instructions.

Figure 5.24. Birth control pills are packaged for use

as a 1-month supply.

Figure 5.23. Pillbox provides only visual cues.
If clever packaging is not enough, the wristwatch in Figure

5.25 can remind the user to take medications up to six

times a day. Instead of an audible alarm, the watch

vibrates discreetly. 

The logical extension of the simple pillbox is shown in

Figure 5.26. This system has seven boxes. Each box

contains four compartments and a timer to remind the

patient to take the medicine in the next compartment.

If a timer is not enough, the medication dispenser in

Figure 5.27 dispenses the medications and detects when

they are removed. If the pills are not removed on a timely

basis, the dispenser places a phone call to a family member

or caregiver who can follow up with the appropriate party. 

Example Set 5.9—Variations

in “Take Your Medicine,” 

Part III

The next step in this progression towards more strict

control of medication dosing would be a device to ensure

that medications are actually administered. Even the most

sophisticated dispenser ensures only that the medication is

removed from the dispenser. The mistake-proofing devices

that follow take a different approach. Instead of

controlling the traditional process, new processes are

developed. The time-release capsule (Figure 5.28)

accomplishes the same goal as prescribing multiple doses

of a medicine but in a more mistake-proof way. The

patients need only to take a single pill. 

The need to remember to take even a single pill has been

further reduced. Patches are used to administer

medications over much longer periods of time (Figure

5.29). The design of the medication delivery method

reduces the need to remember to take medications.

Chapter 5: Examples of Alternative Approaches to Mistake-Proofing

81

Figure 5.26. This system represents the logical

extension of the traditional pillbox. 

Courtesy e-pill® Medication Reminders. www.epill.com. Used

with permission.

Figure 5.27. The medication dispenser dispenses

medications and detects when they are removed.

Courtesy e-pill® Medication Reminders. www.epill.com.

Used with permission.

Figure 5.25. This watch vibrates to remind users to

take medication.

Courtesy e-pill® Medication Reminders. www.epill.com.

Used with permission.
Going one step further, the Norplant® system is embedded

in a woman's body for 5 years. This contraceptive is a set

of six small capsules that are placed under the skin of the

upper arm (Figure 5.30). They eliminate the need to

remember to take medication. One drawback is that the

implants must be removed after 5 years.

Example Set 5.10—Examples

from the Built Environment,

Part I

New York Presbyterian Hospital covers a city block with

interconnected buildings featuring addition after addition

(Figure 5.31). The interconnections inside these buildings

can cause navigational problems. Those familiar with the

layout of the hospital know that Building A connects to

Building B on the first and third floors, but not on the

second, or they may know that floor 15 of Pavilion X

connects to floor 16 of Y Building via the skybridge.

Patients who are newcomers to these buildings find it

difficult to navigate the hospital.

Chapter 5: Examples of Alternative Approaches to Mistake-Proofing

82

Figure 5.28. The time-release capsule represented

one instance of the development of a new process

instead of attempting to control the traditional process

of reminding patients to take their medication.

Figure 5.29. Patches administer medications over a

longer period of time.

Figure 5.30. Norplant® contraceptive capsules are

effective for 5 years.

Figure 5.31. New York Presbyterian Hospital.
One way to improve a patient's ability to find their way

around is to mark well-traveled paths throughout the

facility. Paths could be marked using solid tape or painted

lines (Figure 5.32) or, like Hansel and Gretel's bread

crumbs, they could be marked with strategically placed

icons that lead to the desired destination. The colored

shoes (Figure 5.33) are from New York Presbyterian

Hospital.

Magnetic fire doors (Figure 5.34) are widely used in many

types of commercial buildings. They are linked to fire

detection systems so that the doors are released, then close

when the fire detection system is activated. Closing the

door does not prevent fires. It temporarily prevents the

influence of mistakes, the fire, from spreading further.

During a fire or other emergency, many factors make it

easy for those descending to descend too far down the

stairwell and miss the street-level exit. The gate in Figure

5.35 provides a very strong cue that descending past that

point is discouraged. This gate, like the door in Figure

5.34, closes automatically when the fire alarm is tripped.

Chapter 5: Examples of Alternative Approaches to Mistake-Proofing

83

Figure 5.32. Solid lines show the way.

Figure 5.33. The colored shoes mark the path.

Figure 5.34. Magnetic fire doors.

Figure 5.35. The gate discourages further descent.
Example Set 5.11—Examples

From the Built Environment,

Part II

St. Joseph's Hospital has designed every patient room so

that the sink is clearly visible (Figure 5.36). Patients are

encouraged to watch and ensure that staff members wash

their hands before interacting with them. In most rooms,

the doors open toward the sink (Figure 5.37), further

encouraging handwashing.

Each patient room is also provided with a nurse's alcove

that has all of the necessary supplies (see Chapter 7,

example 7.27) and a computer for electronic

documentation of care accomplished before he or she

moves on to another patient. The door to the alcove has a

window so that the nurse can see the patient while

completing the chart (Figures 5.38 and 5.39). 

Chapter 5: Examples of Alternative Approaches to Mistake-Proofing

84

Figure 5.37. Floorplan of a room in St. Joseph's

Hospital, in West Bend, WI.

Figure 5.38. Floorplan of a patient room with nurse's

alcove in St. Joseph's Hospital.

Figure 5.39. Each patient room has a nurse's alcove. 

Figure 5.36. Clearly visible sinks encourage

handwashing.
The concept of being able to see the patient is taken to the

extreme in St. Joseph's intensive care unit (ICU). The

ICU is located along the curved back of the building. It is

engineered so that each patient's face can be seen from the

work area. Being able to see patients is considered so

important that the only exception to room standardization

in the entire hospital occurs here. The last two rooms

(most distant in Figure 5.40) had to be rotated 180

degrees so that the patients could be seen.

Example Set 5.12—Examples

from the Built Environment,

Part III

At St. Joseph's Hospital, the bathroom is placed near the

head of the bed for fall prevention (Figure 5.41). In many

hospitals, however, the room plans for every other room

are rotated 180 degrees so that two rooms share a

common plumbing wall. Often, this requires the patient

to cross the middle of the room where no handrails are

available to support the patient and prevent falls. At St.

Joseph’s hospital, the patient is provided with handrails

from the bedside to every part of the bathroom (Figures

5.42-5.45). 

If human beings are prone to perform automatically, as if

on auto-pilot, perhaps making environments where that

auto-pilot will be correct is worthwhile. That is the

strategy for headwalls. Every room in the hospital has a

standardized arrangement; the Emergency Room (ER),

ICU, and medical/surgical rooms are all identical. 

Subsequently, ER activities can spill over into adjacent

rooms in ICU during extremely busy times (Figures 5.46A

and 5.46B). 

Chapter 5: Examples of Alternative Approaches to Mistake-Proofing

85

Figure 5.40. The St. Joseph's Hospital ICU.

Figure 5.41. Floorplan of a patient room with

bathroom.

*Floorplan images© Joint Commission Resources.

Enhancing the traditional hospital design process: a focus on

patient safety. Jt Comm J Qual Safety 2004;30(3):115-124.

Reprinted with permission.
Chapter 5: Examples of Alternative Approaches to Mistake-Proofing

86

Figure 5.42. Patient bathrooms are near bed. Note the

hand rail.

Figure 5.43. Handrails are present from the bedside to

the bathroom.

Figure 5.44. Another view of a patient bathroom. Figure 5.45. A shower with handrails.

Figure 5.46A. Standardized headwalls allow staff

members to work on 'auto-pilot'.

Figure 5.46B. Another view of a standardized headwall.

Figure 5.46A Figure 5.46B
Example Set 5.13—Getting 

X-Rays Right

The flasher plate (Figure 5.47) is a small window on the 

x-ray film cassette that prevents film from becoming

exposed during the flashing of the patient's name onto the

film. The cassette is inserted into the name flasher, then

the flasher plate is automatically pulled back to expose the

film to a small light that exposes the patient's name on the

film (Figure 5.48). The flasher plate will only move when

it is inserted into the name-flashing device.

The film is marked as 'left' or 'right' for reference to

prevent the radiologist from misinterpreting the results

when reading the film (Figure 5.49). 

In addition to marking the left and right sides, a

technologist's initials, film series, and other information

can be recorded with a blunt writing instrument. 

Figure 5.50 shows a dental x-ray film holder that is

inserted in a patient's mouth. The hoop provides a target

for positioning the x-ray machine so that the dental

technician aligns it correctly each time.

Chapter 5: Examples of Alternative Approaches to Mistake-Proofing

87

Figure 5.47. The flasher plate ensures that only the

patient’s name is exposed on film. 

Figure 5.48. The patient's name is exposed on film. 

Figure 5.49. Beekley R-ID-SPOT® and Beekley L-IDSPOT®. Photo courtesy of Beekley Corporation, Bristol, CT.

Used with permision.

Figure 5.50. The hoop in this dental x-ray film holder

provides a target for the technician.
Example Set 5.14—Exposure

Control

Figure 5.51 illustrates two mistake-proofing techniques to

prevent radiation exposure. The lighted sign over the x-ray

room door alerts personnel that an exposure is in progress.

When the x-ray machine is emitting x-rays, the exposure

light alerts personnel that they should not enter the room.

The door interlock prevents exposure if the x-ray room

door is left open. A small switch in the door frame will

not allow an exposure to occur if the door is left open.

In Figure 5.52, the mistake-proofing takes the form of

personal protective equipment. The apron protects the

technician from overexposure to radiation.

On older x-ray units that have a cord attached to the

exposure button, the relatively short cord length does not

allow the technologist to make an exposure while outside

the protection of the control booth. 

Example Set 5.15—Bed

Alarms and Fall Reduction

A number of mistake-proofing devices have been

developed to protect patients at risk for falls when getting

out of bed. Bed alarms (Figures 5.54 and 5.55) are

designed to notify caregivers when a patient gets out of

bed, come in a variety of sizes and shapes, and perform a

variety of functions. 

Chapter 5: Examples of Alternative Approaches to Mistake-Proofing

88

Figure 5.51. The door interlock prevents unwanted

exposures; the lighted sign provides additional mistakeproofing.

Figure 5.52. Mistake-proofing via personal protective

equipment.

Photo courtesy of Marcy F. Grant. Used with

permission.

Figure 5.53. The short cord prevents an exposure

outside of the control booth.

Figure 5.54. A bed monitor with sensor built into the

bed.
In some cases, the alarm is built into the bed. In other

cases, it is added-on as needed. In one model, a pad is

placed under the bottom sheet and detects the patient's

body weight. See http://www.abledata.com/

abledata.cfm?pageid=113583&top=0&productid=

84241&trail=0). 

Some sensors can be placed under the mattress. The

alarms come with many different sound alert options,

including voice warnings that can be recorded by a loved

one. One version will monitor how long a patient has

been out of bed and telephone a caregiver if the bed

remains unoccupied for too long. See http://www.

bedmonitors.com/bedmonitors_how_works.htm.

The alarm in Figure 5.56 tethers the patient to the bed.

The device is strapped to the patient. The cord is attached

to the bed. The alarm will sound if the patient moves in a

way that pulls the cord, detaching the tether from the

device.

The bed alarm in Figure 5.55 is placed on the floor beside

the bed so that an alarm sounds when a patient's feet

touch the floor. Other approaches considered by

manufacturers include the use of lasers and other

sophisticated sensors to detect when a patient tries to get

up. See http://www.norto.com.au/Norto-EmfitSafebed.htm.

Example Set 5.16—Sharps

Protecting staff, patients, and visitors from the biohazard

of “sharps” (exposed needles) takes many forms. The

syringe in Figure 5.57 is equipped with a cover for the

needle. The cover is inserted into the square base so that it

stands vertically. The needle can be inserted into the cover

using one hand. The other hand can be kept safely out of

the way. When the cover is used as intended, a

misjudgment in the insertion process will not result in a

needle stick. 

The syringe in Figure 5.58 has a hinged cover so that it

can be easily closed with one hand and with a motion that

provides minimal opportunity for a needle stick. The cover

clicks into place and cannot be removed.

Chapter 5: Examples of Alternative Approaches to Mistake-Proofing

89

Figure 5.56. A bed alarm with tether.

Figure 5.55. Sophisticated sensors trigger alarms when

patients attempt to get up from their beds.

Figure 5.57. Syringe with a cover and a square

base.
The needle in Figure 5.59 is nearly self-blunting. It is

inserted normally, but when the needle is withdrawn, a

sleeve containing a steel tip cover is held against the

patient's skin. The tip of the needle catches the cover,

pulling it from the sleeve. Devices that require less effort

and involve a more natural motion will usually be more

effective.

The scalpel in Figure 5.60 has a spring-loaded, retractable

blade. Push a button near the back of the handle and the

blade retracts. 

A workbook on sharps safety by the Centers for Disease

Control and Prevention (CDC)9 states: “A passive safety

feature is one that requires no action by the user.” 

...Few devices with passive safety features are

currently available. Many devices currently marketed

as self-blunting, self-resheathing, or self-retracting

imply that the safety feature is passive. However,

devices that use these strategies generally require that

the user engage the safety feature... Although devices

with passive safety features are intuitively more

desirable, this does not mean that a safety feature that

requires activation is poorly designed or not desirable.9

Example Set 5.17—

Controlling the Controls

The IV pump in Figure 5.61 features a small button on

the back of the machine that can be used to lock the

controls so that others who are unfamiliar with the

equipment cannot tamper with the settings on the control

panel on the front of the machine.

Chapter 5: Examples of Alternative Approaches to Mistake-Proofing

90

Figure 5.58. This syringe can be closed with one hand.

Figure 5.59. When this needle is withdrawn, a sleeve

is held against the patient's skin.

Figure 5.60. Push a button on this scalpel to retract the

blade.

Figure 5.61. This IV pump's controls can be locked by

pushing a button.
The switch on this IV pump has a clear plastic cover that

prevents inadvertent bumping of the switch. Donald

Norman10 recommends making it harder to do what

cannot be reversed. The cover makes the equipment in

Figure 5.62 more difficult to use, but apparently, the

errors prevented more than compensate for the

inconvenience. 

Example Set 5.18—Software

Although most mistake-proofing devices can be

photographed, software applications cannot. A number of

logical checks can be performed, however, after

information has been entered into an application via

computer. The examples in this set show how software

interfaces can be used to mistake-proof some aspects of

medical processes. 

The keypad on the radiology equipment in Figure 5.63

requires patient information to be entered prior to any

exam.

Programmed protocols are pre-programmed instructions

to the machine that control how the exam will be set up

(Figure 5.64). This enables the operator to select the exam

and be confident that all the correct settings are in place.

It also ensures that exams are performed in a consistent

manner, regardless of who is operating the machine. 

The system shown in Figure 5.65 reviews patient histories

and gives an alert if the blood type differs from the type

previously entered or if the patient's blood contained an

antibody. The system will also give a warning if a blood

type different from the patient's is cross-matched for

transfusion. An alert is given if the patient needs special

blood products.

Chapter 5: Examples of Alternative Approaches to Mistake-Proofing

91

Figure 5.62. The switch on the back of this machine

prevents inadvertent bumping.

Figure 5.63. Patient information first, exam second.

Figure 5.64. Programmed protocols ensure that all

exams are performed in a consistent manner.
For stereotactic breast biopsies, this unit (Figure 5.66)

contains protective software that, by calculating the

needle's position, prevents the improper insertion of a

biopsy needle that could result in patient injury.

Example Set 5.19—

Refrigeration Feedback

Blood bank refrigerators are equipped with temperature

monitors that sound an alarm if and when the

temperature is out of the safety range (Figure 5.67). The

alarms also produce continuous chart recordings (Figure

5.68) and visual digital readings (Figure 5.69).

The read-out “Status OK” indicates that the refrigerators

in this blood bank are operating properly. When the

temperature or other operating parameters are not correct,

a message scrolls across the display, indicating which

refrigerator is out of specifications and which specification

is violated.

Chapter 5: Examples of Alternative Approaches to Mistake-Proofing

92

Figure 5.66. Software prevents improper insertion of a

biopsy needle.

Figure 5.68. Blood bank refrigerators monitor

temperature and produce chart recordings and digital

visual readings.

Figure 5.67. An alarm sounds if the refrigerator

temperature becomes too warm or too cold.

Figure 5.65. This system alerts for conflicting

information about a patient's blood and the need for

special blood products.
The alarm system in Figure 5.70 is functional but not as

sophisticated as the other examples in this set. It features an

audible alarm and lights to indicate which zone is down.

This system benefits tremendously from the posted

instructions, a simple job aid that puts knowledge in the

world. It will be very useful when the alarm goes off. The

instructions indicate which refrigerator corresponds to each

zone and provides information about how to silence the

alarm and troubleshoot the problem. Troubleshooting begins

with ensuring that the door is sealed.

Example Set 5.20—MistakeProofing Patient Interactions 

As Chase and Stewart11 indicated almost 15 years ago, the

actions of the “customer” need to be mistake-proofed. These

two examples show how software can reduce variation in

processes for which patients' cooperation and precise

responses are critical to successful outcomes. Both examples

show that mistake-proofing the actions of health care staff

can only partially lead to truly mistake-proofing processes.

The actions and behaviors of patients, family, and loved ones

must also be mistake-proofed. 

It is very important that patients lie as motionless as possible

during a CT exam. Breathing instructions are pre-recorded

and embedded in multimedia software. When the operator

begins the exam, the correct breathing instructions are

automatically played to the patient at the correct time

without further operator intervention, helping ensure

patient cooperation and optimal results (Figure 5.71).

Chapter 5: Examples of Alternative Approaches to Mistake-Proofing

93

Figure 5.70. This system uses an audible alarm; posted

instructions aid in troubleshooting.

Figure 5.69. The display indicates an OK status and,

when necessary, provides other indications of refrigerator

problems.

Figure 5.71. Pre-recorded patient instructions help

ensure cooperation and optimal results from CT scans.
The blood donation software application in Figure 5.72 is

optimized by eliciting donor information through a Webbased survey. The system provides on-screen text with

added privacy via earphone audio and other options, color

pictures to emphasize important aspects of questions, and

touch screens to eliminate "keyboard phobia" and mouse

aversions. The system contains donor self-interview and

staff-review modules. It prevents the production of a

donor record until the survey has been completed and a

staff member has judged the information to be acceptable. 

Example Set 5.21—

Wristbands 

Wristbands (Figures 5.73-5.75) have been used

extensively in medicine to provide sensory alerts for many

different patient conditions. Wristbands provide a physical

space for patient information to reside; efforts are

underway to put as much information onto a wristband as

possible. Color coding is widely employed to indicate

allergies, fall risks, do not resuscitate (DNR) orders, etc.

Improved printer functionality enables the placement of

multiple symbols and photos on the wristband, along with

a patient's name and date of birth. The wristband is also

the locus for more sophisticated patient identification

technologies such as bar coding. There is a magnetic data

storage device (capable of storing medical records)

mounted on the wristband in Figure 5.75. 

Some hospitals place yellow wristbands on DNR patients.

There is some concern that yellow LIVESTRONGTM

bracelets that help support the Lance Armstrong

Chapter 5: Examples of Alternative Approaches to Mistake-Proofing

94

Figure 5.72. Blood donation software elicits donor

information via a Web-based survey. © Talisman

Limited. Used with permission.

Figure 5.73. Wristbands can contain color photos,

symbols, and other patient information Copyright ©

2005 Endor ID. Used with permission.

Figure 5.74. A patient wearing multiple hospital

wristbands.

Figure 5.75. A patient's medical records can be stored

in this wristband.
Foundation's efforts to fund cancer research may be

mistaken for a DNR wristband. While no one has ever

died because of confusion between the two, some hospitals

are reportedly taping over LIVESTRONGTM bracelets

with white adhesive tape to be safe.12

This chapter discussed related sets of mistake-proofing

devices. Chapter 6 is concerned with medical and nonmedical applications of mistake-proofing.

References

1. Shingo S. Zero quality control: source inspection and the

poka-yoke system. trans. A.P. Dillion. New York:

Productivity Press; 1986.

2. Hinckley CM. Make no mistake. New York: Productivity

Press; 2001.

3. Nikkan Kogyo Shimbun/Factory Magazine, ed. PokaYoke: Improving product quality by preventing defects.

Portland, OR: Productivity Press; 1988.

4. Confederation of Indian Industry. Poka-Yoke book on

mistake-proofing. New Delhi: Confederation of Indian

Industry; 2001. 

5. Bynum D. Domestic hot water scald burn lawsuits - The

who, what, when, why, where, how. In Petri VJ, et al.

Annual ASPE Meeting. Indianapolis; October 25-28,

1998. See also http://www.tap-water-burn.com/#4.

Accessed January 2007.

6. Anderson TM. Harry S. Truman VA Hospital. Columbia,

MO: Written communication; March 12, 2004.

7. Department of Health, The Design Council. Design for

patient safety. London: Department of Health and Design

Council; 2003.

8. Tsuda Y. Implications of foolproofing in the

manufacturing process. In Quality through engineering

design. Kuo W, ed. New York: Elsevier; 1993.

9. Centers for Disease Control and Prevention. Workbook

for designing, implementing, and evaluating a sharps

injury prevention program. http://www.cdc.gov/

sharpssafety/appendixB.html. February 12, 2004.

Accessed Sep 2005.

10. Norman DA. The design of everyday things. New York:

Doubleday; 1989.

11. Chase RB, Stewart DM. Make your service fail-safe. Sloan

Management Review. 1994;34-44.

12. Associated press. Hospitals cover LiveStrong bracelets,

fearing fatal mix-up. USA Today.com

http://www.usatoday.com/news/health/2004-12-11-

wristbands_x.htm. Accessed Sep 2005.

Chapter 5: Examples of Alternative Approaches to Mistake-Proofing

95

Chapter 6. Medical and

Non-Medical Examples:

Differences and

Similarities

Introduction

Despite the different domains in which mistake-proofing

is employed, actual devices often are not very different.

This chapter provides 19 pairs of examples. Each medical

example is paired with an example from industry or

everyday life. The examples also suggest that many

solutions for medical mistake-proofing have already been

implemented in other industries and only need to be

adapted, or directly imported, for use in medical

environments. 

Maurer, et al.1 pose the question “Are industry-based safety

initiatives relevant to medicine?” Their article argues for an

affirmative response: 

The fundamental concepts of these quality programs,

[e.g., Six Sigma], although initially designed to

improve manufacturing quality and efficiency, can be

effectively applied to service-based activities such as

medical care. In one case, implementing an industrybased quality program in the medical department of a

large manufacturing concern initiated improvements

and changes to the medical care process.

Example Pair 6.1—Color

Coded Wires

Medical Application

In Figure 6.1, each monitor lead is color-coded so that it

can be correctly placed on the patient and hooked to the

same color-coded outlet on the machine.

Comparable Non-Medical

Application

Color-coding is a weak but widely used mistake-proofing

method shown in Figure 6.2 on the back of a computer.

Depending on the application, color-coding can be very

effective, despite its inability to stop the process.

Chapter 6: Medical and Non-Medical Examples: Differences and Similarities

97

Figure 6.1. Color-coded wiring.

Figure 6.2. Color coding on the back of a computer.
Example Pair 6.2—Automatic

Wheelchair Brakes

Medical Application

Xiang, Chany, and Smith2 reported that in 2003, more

than 100,000 wheelchair-related injuries were seen and

treated in US emergency rooms—twice the number

reported in 1991. The authors also reported that in all

age groups of wheelchair users, tipping over and falling

accounted for 65 percent to 80 percent of injuries.

Brechtelsbauer and Louie3 reported on a study of

incidents involving wheelchair use in long-term care and

found that most injuries were a result of attempts by

residents to self-transfer into or out of the wheelchair.

The wheelchair in Figure 6.3 is equipped with a device

that automatically locks the wheelchair when no one is

sitting in it. When empty, it can only be moved when the

unlocking lever on the handle is used.

Comparable Non-Medical

Application

Some applications of medical mistake-proofing do not

differ from non-medical applications. Many riding

mowers have a “dead-man’s switch” on the seat. When the

rider gets out of the seat for any reason, the engine turns

off. The mower is equipped with an electronic sensor on

the bottom of the seat (Figure 6.4). Of course, employing

electronics would be an added system for non-electric

wheelchairs. The purely mechanical approach could be

preferred because of its simplicity.

Example Pair 6.3—Picking Up

the Right Product, Part I

Medical Application

The Pyxis system controls access to medications. The

drawers are locked and inaccessible unless the proper

verification process is completed. The user enters patient

and order information via the keyboard or the barcode

reader. The information is processed, and only the correct

drawer opens to allow access to the prescribed drug. The

supply cabinet in Figure 6.5 features a pick-to-light

system. Green lights indicate the shelf on which the

selected item resides. 

Chapter 6: Medical and Non-Medical Examples: Differences and Similarities

98

Figure 6.3. Exiting a wheelchair with automatic brakes.

Photo courtesy of Safer Automatic Wheelchair Wheel

Lock, Inc. Used with permission.

Figure 6.4. A riding mower with an electronic sensor

and “dead-man’s switch.”
Comparable Non-Medical

Application 

Comparable systems exist in industry. The bins in Figure

6.6 are equipped with pick-to-light systems. These systems

have a computer-controlled system of lights that indicate

from which bin items are to be removed. Some are

equipped with an infrared sensor that sounds a buzzer if

an item is selected from the wrong bin.

Example Pair 6.4—Picking Up

the Right Product, Part II

Medical Application

Figure 6.7 shows the interior of a robotic pharmacy. The

inventory-picking robot increases the accuracy of picking

and the speed/efficiency of the operation. Comparable

systems, called Automated Storage and Retrieval Systems

(ASRS), are used extensively in industrial settings.

Comparable Non-Medical

Application

The Oviatt Library at California State University at

Northridge features an ASRS in its East Wing (Figure

6.8). The ASRS employs 13,260 steel bins that measure 2

feet by 4 feet. Infrequently used books and older

periodicals are stored in the 8,000 sq. ft wing, which has a

ceiling height of 40 feet. Bar codes attached to books and

periodicals are mapped to their bin locations in the ASRS

system. Materials are retrieved using a computerized lift

that is guided by rails at the top and bottom.

Chapter 6: Medical and Non-Medical Examples: Differences and Similarities

99

Figure 6.5. A pick-to-light auxiliary cabinet linked to

the Pyxis system.

Figure 6.6. The computer-controlled light system lets

users know from which bin to remove items.

Photo of Smart FrameTM courtesy of Speastech, Inc. Used

with permission.

Figure 6.7. The inventory-picking robot increases

accuracy.

Photo courtesy of Redmond Regional Medical Center. Used

with permission.
Example Pair 6.5—Close the Door

to Start

Medical Application

The automatic tissue processor in Figure 6.9 is equipped

with an alarm to verify that the door of the processor has

been properly closed before processing begins. Processing

will be halted if the door is opened for any reason.

Comparable Non-Medical

Application

At times, mistake-proofing for a medical environment is

not very different from existing mistake-proofing

applications in everyday life. For decades, clothes dryers

have been designed to stop operating when the door is

opened (Figure 6.10).

Example Pair 6.6—Push to

Go

Medical Application

The portable x-ray machine in Figure 6.11 is equipped

with a brake that disengages when a user pushes down on

the handle. The mechanism prevents the x-ray machine

from moving unless it is being pushed. 

Successful mistake-proofing requires attention to many

details

Chapter 6: Medical and Non-Medical Examples: Differences and Similarities

100

Figure 6.10. The clothes dryer stops operating when

the door is opened.

Figure 6.8. This ASRS system uses a computerized lift to

retrieve books and periodicals. 

Used with the permission of the Oviatt Library, California State

University, Northridge.

Figure 6.9. This tissue processor stops if the door is

opened.
Comparable Non-Medical

Application

The portable x-ray machine in Figure 6.11 and the

luggage cart in Figure 6.12 employ the same approach to

eliminate errors. The luggage cart requires the user to

depress the bar in order to disengage the cart’s brake. 

The shaved ice machine in Figure 6.13 requires the lid to

the shaving chamber to be closed and depressed in order

for the machine to operate. 

Example Pair 6.7—Collision

Prevention

Medical Application

The bumper switch stops a portable x-ray machine if the

front bumper comes into contact with an object (Figure

6.14). The bumper is easily pushed in so that the slightest

contact causes the portable unit to stop immediately.

Chapter 6: Medical and Non-Medical Examples: Differences and Similarities

101

Figure 6.11. The brake disengages when a user pushes

down on the handle.

Figure 6.12. Depress the bar to disengage the brake

of this luggage cart.

Figure 6.13. This shaved ice machine will not operate

with the lid open.

Figure 6.14. A front bumper switch stops the machine

upon contact.
Comparable Non-Medical

Application

In robotic manufacturing systems, material is moved using

automated guided vehicle systems (Figure 6.14). The

automated guided vehicles are equipped with bumpers

that stop the vehicle if they contact anything in their path.

It is the bumpers, not neural networks, that enable these

special purpose robots to adhere to the first law of

robotics: “A robot may not injure a human being, or,

through inaction, allow a human being to come to

harm.”4

Similar approaches are used on jetways at major airports.

Bumpers stop the jetway if it comes into contact with

anything near the wheels.

Example Pair 6.8—What

Goes In Must Not Come Out

Medical Application

The sharps container in Figure 6.16 ensures that used

sharps (needles) cannot be reached and removed after they

are deposited. The used sharp is placed on the back part of

the lid, which is then lifted to dump the sharp into the

container. The lid’s design makes it impossible to access

the used sharps. This example is similar to the darkroom

door example (Chapter 5, Figure 5.1).

Comparable Non-Medical

Application

The same techniques for preventing individuals from

gaining access to deposited items are used in library book

returns (Figure 6.17) and bank night depositories (Figure

6.18).

Chapter 6: Medical and Non-Medical Examples: Differences and Similarities

102

Figure 6.16. This sharps container prevents injuries.

Figure 6.17. Books and other materials can be

deposited, but access is controlled.

Figure 6.15. A guided vehicle system stops this robot

when contact is made. 

Image from Frog Navigation Systems. www.frog.nl. Used with

permission.
Example Pair 6.9—Two

Hands Required

Medical Application

As a safety mechanism, all defibrillators require the

activation of two separate buttons, held by one operator,

to trigger discharge of an electrical current across the

thorax of patients in ventricular fibrillation (Figure 6.19).

The two button feature reduces the risk of accidental

discharge or misplaced electrical shock.

Comparable Non-Medical

Application

The punch press in Figure 6.20 was made in the United

States and exported to a factory in Asia. The American

manufacturer assumed that one person would operate the

machine. It has two switches, one for each of the worker’s

hands. Multiple switches are very common on

manufacturing machinery. They provide the same

safeguard as the buttons on the defibrillator in Figure

6.19.

In countries with low wages and lax occupational safety

laws, getting the most out of this machine means using six

hands instead of two. 

One bad judgment or lapse of attention can result in the

maiming of a worker and the end of a productive working

life. Medicine is not very different. One bad judgment or

lapse of attention can maim a patient or end the career of

a doctor or nurse. Neither result is acceptable.

Chapter 6: Medical and Non-Medical Examples: Differences and Similarities

103

Figure 6.19. This defibrillator requires two-handed

operation.

Figure 6.20. Punch press made for two-handed

operation, but in some locales six-handed operation

will be seen as more efficient.

Figure 6.18. Only bank employees can access deposits

made after operating hours.
Example Pair 6.10—How

Information Is Presented

Matters

Medical Application

How information is displayed makes all the difference in

its utility. Clipboards filled with papers (Figure 6.21) are

much more effective at providing an audit trail than they

are at communicating the status of the patient or how the

process should proceed. 

The use of electronic medical records enables information

to be reformatted in ways that are more readily

understandable. Powsner and Tufte5 propose medical

charting software that renders years of data more easily

understandable (Figure 6.22). 

See Chapter 7, Example 7.18, for a larger image of the

graphic medical chart.

Comparable Non-Medical

Application

The formatting of information also matters outside of

medicine. Figures 6.23 and 6.24 document the

performance of a complex machine being tested before it

is shipped to a customer. The company found that most

of the critical information on which decisions were based

could be contained on one summary page (Figure 6.24).

Reportedly, the result was that decisions were made more

quickly, and use of the information increased. Managers

also found that the trends on the one-page graph (Figure

6.25) were easier to spot than when presented on a graph

that was “three cubicles long” and folded every 11 inches

(Figure 6.26).

Chapter 6: Medical and Non-Medical Examples: Differences and Similarities

104

Figure 6.22. Medical charting software enables the

display of years of patient data. 

© 1994, Seth Powsner and Graphics Press. Used with

permission.

Figure 6.23. Before; one way to document a

machine’s performance.

Figure 6.21. Clipboards provide an effective audit trail,

but do not indicate how to proceed.
Example Pair 6.11—Tooling:

Jigs and Fixtures

While the idea of using jigs and fixtures in health care may

seem distasteful, there are numerous examples of devices

that allow the body to be positioned in ways that facilitate

good care. In many cases, these devices are used solely to

increase a patient’s comfort. 

Medical Application

The CT scan head holder in Figure 6.27 keeps the

patient’s head in the correct position during a CT scan,

which is critical to an accurate reading. 

The immobilizer (Figure 6.28) has been in use for 40

years. Designed by a technician who had many problems

with positioning infants and children, it securely restrains

infants during imaging. 

Chapter 6: Medical and Non-Medical Examples: Differences and Similarities

105

Figure 6.27. A CT scan head holder.

Figure 6.24. After; most of the critical information was

captured in one page. 

Figure 6.26. Information was hard to find in a graph

that was three cubicles long.

Figure 6.25. A one-page graph accurately depicted

trends.
Beds used in maternity wards are equipped with stirrups

(Figure 6.29) to allow expectant mothers to be positioned

correctly and as comfortably as possible under the

circumstances.

Comparable Non-Medical

Application

Figures 6.30 and 6.31 depict a fixture for holding parts in

the correct orientation during fabrication. 

Example Pair 6.12—LockOuts

Medical Application

An electromechanical door lock system on the lab

centrifuge in Figure 6.32, together with a manual lock,

prevents run initiation unless the door is closed and

latched. When a run is in progress, the door locks

automatically and can be opened only when the power is

on, the rotor is virtually stopped (spinning less than 40

rpm), and the lock is in the unlocked position. An LED

(light emitting diode) on the “open door” key lights up

when the door can be opened.

Chapter 6: Medical and Non-Medical Examples: Differences and Similarities

106

Figure 6.30. A fixture for holding parts during

fabrication.

Photo by Jon Timlin. Used with permission.

Figure 6.31. Closeup of the fixture in Figure 6.30.

Photo by Jon Timlin. Used with permission.

Figure 6.28. The Pigg-O-Stat Infant Immobilizer and

Positioner.

Modern Way Immobilizers, Inc. Used with permission.

Figure 6.29. A maternity bed with stirrups for positioning

and support. 
Comparable Non-Medical

Application

The centrifuge in Figure 6.33 is used to stress test ceramic

semiconductor packages to ensure the integrity of the

hermetic seal. Heavy steel wheels full of parts are loaded

into the machine. The lid is closed and locked before

starting. After the machine has started to spin, the cover is

locked and cannot be opened until the speed of rotation

approaches zero.

Example Pair 6.13—Visual

Indication of Settings

Medical Application

Michael Westley, medical director of critical care and

respiratory therapy at Virginia Mason Hospital in Seattle,

Washington, reported that: 

The hospital was able to reduce cases of ventilatorassociated pneumonia (VAP) from 30 in 2002 to 5 in

2004. Costs associated with each case of VAP ranged

from $5,000 to $40,000. Doctors and nurses reduced

the number of cases by “reliably doing boring things.”

The ‘boring things’ included frequent hand washing

by doctors and nurses and keeping patients’ heads

elevated.6

The Mississippi delegation to the Patient Safety

Improvement Corps (PSIC) also focused on reducing VAP

rates. One action they took was to ensure that patients’

beds were raised to an angle of at least 30°. To facilitate

“reliably doing boring things,” Darla Belt, an RN on the

team, felt that it was important to be able to determine

whether the bed was at the correct angle from outside the

room in the ICU. Her solution was to apply a label to the

bed to indicate the correct angle (Figure 6.34). She reports

that staff members have become accustomed to the label’s

Chapter 6: Medical and Non-Medical Examples: Differences and Similarities

107

Figure 6.32. The door on the centrifuge contains an

electromechanical lock and a manual lock.

Figure 6.33. The cover on this centrifuge cannot be

opened until rotation approaches zero.

Copyright © 2006 Tandex Test Labs, Inc. Used with

permission.

Figure 6.34. In addition to the gauge on the railing,

the label is mounted to indicate to nurses whether or

not the bed is situated at the correct angle.
position. Spotting it from the doorway, they no longer

have to walk into the room to check the bed’s angle,

realizing that a flat or vertical sign is indicative of a less

than ideally positioned bed. Consequently, an out of place

sign is immediately noticeable to the staff. Now, when

they see a bed without a gauge on its railing indicating the

angle of the bed, they can judge the correct angle of the

bed fairly accurately.7

Figure 6.35 could be seen as a slight improvement: staff

mount the label at 30° so that it is level when the bed is at

the correct angle. Staff will quickly become accustomed to

looking at this angle and judging whether or not it is

correct.

Comparable Non-Medical

Application

The label in Figures 6.36 and 6.37 is attached to a

vibrator bowl (Figure 6.38) that is used to prepare steel

tools for chroming. The label helps workers determine if

the bowl is operating correctly. It is difficult to tell from

the photograph, but in Figure 6.37, the lines labeled 60

and 70 appear to be less blurry. This indicates that the

lead angle is between 60° and 70°. The series of circles

running horizontally below the fan shaped figure show

vibration amplitude. At the circle labeled 2, the two circles

created by the vibration do not touch. At 7, the two

circles overlap. At 3.5, the circles just touch. This means

that the amplitude is 3.5 mm. The label enables anyone to

determine how well the bowl is operating. 

Chapter 6: Medical and Non-Medical Examples: Differences and Similarities

108

Figure 6.35. The label on this bed is mounted at 30°

so that it is level when the bed is at the correct angle.

Figure 6.36. A vibrator bowl label with the vibrator

turned off. 

Figure 6.37. A vibrator bowl label with the vibrator

turned on.

Figure 6.38. Vibrator bowl.
Example Pair 6.14—

Knowledge in the World

Equals Knowledge on the Pill

Medical Application

Many phamaceutical companies use color-coding and

information printed on the product (Figure 6.39) to

inform consumers of the medication and dosage.

Comparable Non-Medical

Application

A color-coding scheme is used for electronic resistors to

communicate tolerances and electrical properties from .01

to 10,000,000 ohm (Figure 6.40).

Example Pair 6.15—Don’t

Reinvent the Wheel, Part I

Medical Application

Often, there is no difference between medical and nonmedical applications. In the case of the restaurant pager,

the medical application is an off-the-shelf application

taken directly from the restaurant industry, not a separate

invention.

In St. Joseph’s Hospital in West Bend, IL, pagers are

distributed to patients in the hospital waiting room

(Figure 6.41).

Comparable Non-Medical

Application

Staff members saw restaurant pagers (Figure 6.42) and

bought them, then began using them to improve patient

and health care worker satisfaction.

Chapter 6: Medical and Non-Medical Examples: Differences and Similarities

109

Figure 6.39. Color-coded medications with dosage

information.

Figure 6.40. The color scheme makes differentiation

easily understood.

Figure 6.41. The restaurant pager required no changes

in order to be useful in a medical environment.
Example Pair 6.16—

Coverage Must Be Complete

Medical Application

Chlorhexidine has been shown to be more effective than

iodine for the prevention of intravascular catheter-related

infections.8 Yet, its adoption has not been as rapid as some

might expect. One explanation is that chlorhexidine is

clear (Figure 6.43). It does not leave iodine’s telltale, burnt

orange stain. The stain gives a visual indication of where it

has been applied, and whether or not the coverage is

satisfactory. A solution is to add blue-green tint (Figures

6.40 and 6.41) to chlorhexidine for easier visualization.

Chapter 6: Medical and Non-Medical Examples: Differences and Similarities

110

Figure 6.42. Restaurant pagers have proved useful in

different health care environments.

Figure 6.43. Clear chlorhexidine in an intravascular

catheter is more effective than iodine in preventing

infections.

Figure 6.44. Chlorhexidine with a blue-green tint in an

intravascular catheter makes it easier to see if the

chlorhexidine has been applied and, if so, determine

the thoroughness of the coverage.

Figure 6.45. Tinted chlorhexidine contributes to the

prevention of intravascular cather-related infections.
Comparable Non-Medical

Application

Ceilings are typically white. The application of a fresh coat

of white paint on a surface that is already white makes it

difficult to determine where spots have been missed, and

whether an adequate amount of paint has been applied for

good coverage. A solution is to add pink tint for easier

visualization. The specially formulated ceiling paint in

Figure 6.46 goes on pink but dries white.

Example Pair 6.17—Wheelie

Bars

Medical Application

The anti-tip wheels mounted to the back of a wheelchair

(Figures 6.47 and 6.48) play a very important role. They

keep the chair from tipping backward. They also allow the

rear wheel to be mounted further forward without the feel

of tipping backward. This reduces the weight on the small

front wheels, allowing them to turn and roll up and over

small obstacles more easily.

Comparable Non-Medical

Application

A drag racing motorcycle (Figure 6.49) is equipped with a

wheelie bar that keeps its front wheel from coming up too

high and prevents the driver from losing control.

Chapter 6: Medical and Non-Medical Examples: Differences and Similarities

111

Figure 6.46. This paint is pink when applied, but will

be white when it dries. 

Figure 6.47. Anti-tip wheels prevent the wheelchair

from tipping backward.

Figure 6.48. Anti-tip wheels also contribute to

maneuverability. 
Example Pair 6.18—Don’t

Reinvent the Wheel, Part II

Medical Application

Figure 6.50 illustrates another adaptation of a solution

used in retail stores and libraries. Richard Chole, MD,

PhD, noted that, even with the “sign your site” policy in

place, wrong-site errors (where surgery is performed on a

site other than the intended one) still occur and are

attributed to one primary cause: the surgical site was not

marked. After noting the anti-theft chips attached to items

sold at a large hardware chain store last summer, he

invented a wristband embedded with a miniature,

disposable microchip, and a marker pen with a specialized

sticker that deactivates the chip.9,10 After consulting with

the patient or the patient’s family, a staff member marks

the patient’s surgical site, then removes the sticker from

the pen and places it on the patient’s wristband to

deactivate the chip.

If these steps are not followed, the wristband will set off a

detector placed in the hallway between the preoperative

area and the operating suite. The detector can be set up to

give a visual or auditory signal that alerts hospital

personnel.

Comparable Non-Medical

Application

Libraries have enacted comparable measures to reduce

book thefts. A narrow strip of magnetic material (Figure

6.51) is affixed to each library book. Sensors are placed in

front of the exit door (Figure 6.52). An alarm goes off if

the book has not been desensitized at the checkout

counter.

Chapter 6: Medical and Non-Medical Examples: Differences and Similarities

112

Figure 6.49. The wheelie bar helps the driver maintain

control of the motorcycle. 

Photo by Matt Polito. Used with permission.

Figure 6.50. A pen, a microchip, and a wristband

minimize the chances of wrong-site surgery.

Copyright © CheckSite Medical, Inc. Used by permission.

Figure 6.51. A narrow strip of magnetic material,

accompanied by exit door sensors, helps deter library

thefts.
Figures 6.53 and 6.54 illustrate alternate configurations.

In Figure 6.53, a metallic layer of the sticker desensitizes

the article for removal from a library. In Figure 6.54, a

commercial product has a sensor strip attached to

discourage and catch shoplifters. All three approaches are

similar. The advantage of the magnetic material in Figure

6.51 is that it is much harder to find and, therefore,

harder to remove. 

Example Pair 6.19—ColorCoded Lights

Medical Application

In an effort to make system status obvious even in lowlight situations, the IV pole in Figure 6.55 is equipped

with LEDs that illuminate the bags of fluid. Colored

plastic inserts change the color of the light shining on each

channel so that each bag is uniquely identified.

Correspondingly colored cyalume lights and stickers are

attached to each IV tube (Figure 6.56). This enables the

tubing at one end to be more reliably associated with its

contents in the IV bag at the other end. 

Chapter 6: Medical and Non-Medical Examples: Differences and Similarities

113

Figure 6.52. Exit door sensors in a library.

Figure 6.53. The metallic layer desensitizes books so

they can be removed from the library without setting

off an alarm. 

Figure 6.54. The sensor strip can stop a shoplifter.

Figure 6.55. LEDs, lights, and stickers uniquely

identify each bag of IV fluid.

Image courtesy of Embo-Optics, LLC. Used with permission.
Comparable Non-Medical

Application

The small electronic device on the toilet in Figure 6.57

detects user movement and turns on one of two LED

lights. When the red light turns on, the toilet seat is in the

up position. A green light indicates that the seat is down. 

A Future Mistake-Proofing

Wish List

Medical Application—Rolling Bed

Table

A participant attending the Patient Safety Improvement

Corps, sponsored by the Department of Veterans Affairs

(VA) and AHRQ, suggested the need for an overbed table

that would not roll when patients used it to steady

themselves. No one present knew of such a product. The

technology involved to develop such a product, however,

could be relatively simple.

Comparable Non-Medical

Application

The step stool in Figure 6.58 rolls freely until someone

steps on it. The user’s weight presses the rim of the stool

firmly against the ground so that it will not roll. Perhaps

this technology could be applied to solve the hazard of

rolling overbed tables. Experimentation of this sort—using

creativity to apply existing technology to new problems—

has proven to be worthwhile in several examples discussed

in this chapter.

Chapter 6: Medical and Non-Medical Examples: Differences and Similarities

114

Figure 6.56. Cyalume lights are attached to each IV

tube.

Image courtesy of Embo-Optics, LLC. Used with permission.

Figure 6.57. The lights on this toilet enable efficient

navigation in the dark.

Figure 6.58. The user’s weight on this step stool

prevents it from rolling.
References

1. Maurer KF, Maurer JR, Peltier E, Savo P, et al. Are

industry-based safety initiatives relevant to medicine?

Focus on Patient Safety. 2001;4(4):1-3.

2. Xiang H, Chany AM, Smith GA, Wheelchair-related

injuries treated in US emergency departments. Inj Prev

2006;12(1:)8-11 

3. Brechtelsbauer DA, Louie A. Wheelchair use among longterm care residents. Ann Long-Term Care 1999; 

7(6):213-20. 

4. Asimov I. I, robot. New York: Signet Books; 1956.

5. Powsner SM, Tufte ER. Graphical summary of patient

status. Lancet 1994;344(8919):386-9. 

6. Connolly C. Toyota assembly line inspires improvements

at hospital. Washington Post. June 3, 2005; p. A01.

7. Belt D. Personal communication. June 14, 2005.

8. Chaiyakunapruk N, Veenstra DL, Lipsky BA, et al.

Vascular catheter site care: the clinical and economic

benefits of chlorhexidine compared with povidone iodine.

Clin Infect Dis. 2003; 37(6):764-71. 

9. Pahl K. Physician invents smart wristband to prevent

wrong-site surgery. Barnes Jewish Hospital, Washington

University in St. Louis. BJC Today, 2005 August22.

10. Ericson, G. Smart wristband designed to prevent wrongsite surgery. Washington University in St. Louis, School of

Medicine; press release, 2005; Aug 9.

http://mednews.wustl.edu/news/page/normal/5547.html

Accessed Sep 2005.

Chapter 6: Medical and Non-Medical Examples: Differences and Similarities

115

Chapter 7. Examples of

Mistake-Proofing in

Health Care

Introduction

This chapter contains 30 examples of mistake-proofing

in health care. They range from simple, inexpensive

(even hand-made) devices to sophisticated, expensive

electronic equipment that can be used anywhere. The

creator of one example is a noted expert in graphic

displays of quantitative information. Another example

has been shown in New York’s Museum of Modern Art.

All are possible solutions to daunting problems and

exemplars of design approaches to solving the problem

of human beings making mistakes.a

Example 7.1—The

Broselow® Tape for Pediatric

Trauma

Broselow® Pediatric Emergency Tape is used to reduce

errors and increase the speed of treating pediatric trauma

patients. The tape is laid out next to the child (Figure

7.1). The tape measure is color-coded according to

height. The child is measured along the tape, and the

appropriate treatment color is determined. The caregiver

then knows that appropriately sized medical devices and

appropriate doses of medcations are contained in

packets of the same color and can begin treatment

immediately.

Dosages of commonly used medications are printed on

the Broselow® Tape. Fewer calculations are required,

resulting in fewer errors and less time elapsed before

treatment actually begins. Supplies are stored in a

movable cart or in a satchel (Figure 7.2), each also colorcoded according to the Broselow® Tape.

a Contributors may submit additional ideas to

www.mistakeproofing.com/medical.

Example 7.2—Finding the

Chart in a Patient’s Home

In-House Home Health, Inc. reports that, in the home: 

The patient’s home chart becomes lost among the

patient’s belongings or newspapers and is not

available for documentation or continuity of care.

Environmental conditions of the patient’s home are

beyond the control of the agency staff. 

Chapter 7: Examples of Mistake-Proofing in Health Care

117

Figure 7.1. Use of the Broselow® Tape.

Photo used with permission. 

Figure 7.2. A treatment cart color-coded according

to the Broselow® Tape.
The mistake-proofing device in this case is a sturdy bag

with the agency’s contact information printed on the bag. 

The bag is hung on the bedroom doorknob with the

patient’s home chart inside (Figure 7.3). Any supplies,

equipment, or documentation are placed inside the

bag, ensuring that all agency staff will be able to locate

the patient’s chart when entering the home. The bag

also makes it less likely for the chart to get mixed in

with newspapers or other clutter that might be in the

home.1

Example courtesy of In-House Home Health Inc. Used with

permission.

Example 7.3—Labeling of

Bottled Breast Milk 

A hospital risk manager reported that: 

The father of a neonatal intensive care unit (NICU)

baby suggested that the previously collected and

stored container of breast milk should have some type

of seal that would, when broken, indicate tampering.

The staff agreed and instituted a system whereby the

mother could place a seal on the container after

collecting the milk. The seal consists of a paper band

placed across the top of the container (Figure 7.4). 

The mother is instructed to place the baby’s last name

on the band on top of the container. A second label

designed for breast milk containers, indicating the

baby’s last name and date/time of collection, is placed

around the container covering the ends of the label,

which has been placed over the top of the container. 

With these labels in place, the container cannot be

opened without breaking the seal. The parents and

staff are instructed not to use any container that has a

broken seal.

Example courtesy of Bill Quinlan, Toledo Children’s Hospital.

Used with permission.

Example 7.4—Ensuring that

Time-Outs Occur

The chief medical officer in Figure 7.5 volunteered to

appear on a flyer that is bundled in every sterile surgical

kit. Before a surgery, the scrub nurse puts the flyer over

the tools to be used in the surgery, blocking the surgeon’s

access to the tools until the flyer is removed. When the

flyer is removed, it reminds the surgical team to perform

the required time-out. Although this technique cannot be

considered an example of strong mistake-proofing, it is a

starting point and is likely to be more effective than the

sign usually placed above a door as in Figure 7.6. 

Chapter 7: Examples of Mistake-Proofing in Health Care

118

Figure 7.3. Hanging the chart on the door helps avoid

misplacing it in a home health care situation.

Photo courtesy of In-House Home Health Inc. Used with

permission. 

Figure 7.4. Mothers will not use this container if the seal is

broken.

Photo courtesy of Toledo Children’s Hospital. Used with

permission.
During a time-out, prior to the procedure, the team agrees

that they are in possession of the correct information and

are about to perform the correct procedure on the correct

patient. The sign in Figure 7.6 must be seen to be useful;

placing it over the surgical kit would most likely be more

effective than hanging it on a nearby wall.

Example courtesy of an anonymous contributor. Used with

permission.

Example 7.5—Look-Alike and

Sound-Alike Medications

In the absence of planning a change to a robotic

pharmacy, a simple job aid can help avoid dispensing the

incorrect medication. In Figure 7.7, staff members know

that each red bin in the pharmacy contains a look-alike or

sound-alike medication. The bins shown contain

Celebrex® and Celexa®.

Example courtesy of Elbert Memorial Hospital. Used with

permission.

Example 7.6—“Tall Man”

Labels 

“Tall man” labels also can be used used to distinguish

look-alike or sound-alike medications. This technique

employs capital letters in unusual places in a word to

create larger visual differences between words that are

otherwise visually similar. The Food and Drug

Administration (FDA) began reqesting tall man labeling in

2001.1,2

Chapter 7: Examples of Mistake-Proofing in Health Care

119

Figure 7.5. This chief medical officer emphasizes the

use of time-outs. Photo courtesy of Barnes Jewish Hospital.

Used with permission.

Figure 7.6. The sign reminds surgical personnel in

one hospital to take a time-out.

Figure 7.7. Look-alike or sound-alike medications are

kept in specially designated bins.

First, Do No Harm

Inititate a Time-Out
The effect is more pronounced when the beginning and

ending syllables of the drug name are the same.

Normal Text Tall Man Text

Celebrex CeleBREX

Celexa CeleXA

Vinblastine VinBLAStine

Vincristine VinCRIStine

Example courtesy of an anonymous participant at a

HealthInsight Learning Seminar. Used with permission.

See also: http://www.fda.gov/cder/drug/MedErrors/

nameDiff.htm

Example 7.7—High-Risk

Medicine Cues

A number of deaths were reported to have been caused by

the accidental administration of concentrated solutions.

The National Patient Safety Agency (NPSA) of the United

Kingdom has been working with manufacturers to ensure

the availability of a broader range of diluted products and

to help introduce distinctive packaging so that solutions,

such as potassium chloride, are easily identified and

distinguished from other intravenous products (Figure

7.8). 

The following “cues” were devised for potassium chloride:

1. The official name (U.S. Pharmacopeia) was changed

to “Potassium Chloride for Injection Concentrate.”

The word “concentrate” in the new name indicates

the need to dilute the product prior to use. 

2. A requirement that labels contain a boxed warning

that reads: “Concentrate: Must be Diluted Before

Use.” 

3. A unique requirement that the cap used in the

packaging of this drug be black in color and that it

contain an imprint in a contrasting color with the

words: “Must be Diluted.”3 See Chapter 8, Example

8.27.

Example courtesy of Holly Ann Burt, NPSF. Current Awareness

Literature Alert July #1, 2004 (item #7). Used with permission.

Example 7.8—The BloodlocTM

The BloodlocTM (Figure 7.9) is a plastic, one-time use

padlock that restricts access to a unit of blood. It is

opened by a three-letter code that can only be found on

the patient’s wristband (Figure 7.10). 

Use of the BloodlocTM has been documented in several

studies.4,5,6 Cost is a common concern. AuBuchon7

reported that the cost of the BloodlocTM is “between $3

and $4 dollars per unit.” His calculation of the cost

effectiveness, from the societal perspective (excluding

liability costs), was approximately $200,000 per qualityadjusted life year (QALY). Actual values can vary because

“Traditional quality-adjusted life year (QALY) cost analysis

is complex and assigns arbitrary dollar values to

catastrophic outcomes such as death.”7 Nevertheless, in

terms of proportional cost, AuBuchon’s comments are not

unreasonable.

Chapter 7: Examples of Mistake-Proofing in Health Care

120

Figure 7.8. Potassium chloride’s distinct packaging

helps prevent fatal accidents.
AuBuchon7 stated that at a cost-effectiveness of $200,000

per QALY, the BloodlocTM is not as cost effective as many

medical and surgical interventions, where $50,000 per

QALY is generally considered the upper limit. It is much

more cost effective, however, than many interventions in

transfusion medicine aimed at assuring safe transfusions.

The cost-effectiveness of using nucleic acid testing (NAT -

to screen whole blood donors for the HIV and hepatitis C

viruses), and testing for the p24 protein found in HIV

(the p24 test identifies actual HIV viral particles in blood

1 week or more after infection) is more than $1 million

each. The cost effectiveness of solvent detergent (SD)

plasma is $3 million per QALY.8 The SD process pools up

to 500,000 units of thawed fresh frozen blood plasma and

treats it with solvent and detergent to remove viruses such

as HIV and hepatitis. 

Additionally, factoring in liability payments to a patient’s

family members make the BloodlocTM and similar

expensive interventions much more desirable from the

hospitals’ standpoint.

Regarding the BloodlocTM, AuBuchon stated: 

It’s a barrier. It prevents the transfusionist from getting

to a unit of blood that they are not supposed to get to. 

Because the BloodlocTM may slow the process of

administering units of blood in emergent situations, the

locks are often opened after the patient arrives in the

operating room but before the actual need for transfusion

occurs. Since the plastic bag can be cut open,

circumventing the BloodlocTM, some hospitals began the

practice of putting the BloodlocTM directly on the tubing

that extends out of the unit of blood. 

Example 7.9—Child Scale

Using a flat scale, it was easy for children to roll off the

scale and injure themselves. The scale in Figure 7.11 is

equipped with a seat that provides more security for the

child while being weighed. The contributor of this

example notes that it “would be more secure if it had a

seat belt.” 

Example courtesy of Washoe County District Health

Department. Used with permission.

Chapter 7: Examples of Mistake-Proofing in Health Care

121

Figure 7.9. The cost effectiveness of the BloodlocTM is

estimated to be very favorable when compared to

most transfusion interventions.

Figure 7.10. A patient’s wristband contains the unique

combination to his BloodlocTM.

Figure 7.11. This scale with a child’s seat prevents

injuries during weighing.
Example 7.10—A Safer Blood

Pressure Cuff

In the past, blood pressure cuffs containing mercury posed

a risk to patients when they were broken. New blood

pressure cuffs containing no mercury (Figure 7.12) are

safer.

Example courtesy of Washoe County District Health

Department. Used with permission.

In a related remark, Trevor Kletz,9 when listing10

characteristics of user-friendly chemical factories, pointed

out that “What you don’t have can’t leak.” 

Example 7.11—Sign Your Site

On July 1, 2004, JCAHO made “sign your site” (Figure

7.13 and 7.14)—the practice of marking the correct site

on which a procedure is scheduled to take place—

mandatory. Prior to this policy, data suggested that one in

four orthopedic surgeons would perform a wrong-site

surgery during a 35-year career.b

b

More information on JCAHO’s patient safety practices is

available at: http://www.jcipatientsafety.org/22782/

Example 7.12—Templates 

A mistake or omission on the form in Figure 7.15 will

take longer to find than one on the template in Figure

7.16.

A template similar to the one in Figure 7.16 was used in a

blood center to ensure that incoming forms were

completed. Additional information could be added to the

template to indicate valid ranges for numeric entries,

further adding to the effectiveness of the job aid.11

Chapter 7: Examples of Mistake-Proofing in Health Care

122

Figure 7.12. A non-mercury blood pressure cuff poses

much less of a risk to patients if broken.

Figure 7.14. The site of the procedure is clearly

marked.

Figure 7.13. An advertisement urging health care

workers to “sign your site.”

Photo courtesy of AOFAS (American Orthopaedic Foot and

Ankle Society) and AAOS (American Academy of

Orthopaedic Surgeons). Used with permission.
The template in Figure 7.16, pre-developed to highlight

key words and terms, is made using ingredients found at

any office supply store: colored plastic pocket dividers and

a knife. 

Instructions to make the template are simple:

1. Insert the form. 

2. Mark the areas to highlight.

3. Remove the form and insert a sheet of cardboard or

card stock.

4. Cut out the marked portions. 

Cost: $.60.

Time to Completion: 2 minutes. 

Example courtesy of Harold S. Kaplan, Columbia University.

Used with permission.

Example 7.13—High Risk

Medications

The red boxes designate the medication, Retavase®, as a

high-risk medication. Administered to cardiac patients

who have just had a myocardial infarction, the medication

dissolves clots that have blocked arteries. The boxes also

contain all items needed for administration of the

medication. 

JCAHO defines high-risk and high-alert medications

as medications involved in a high percentage of

medication errors or sentinel events and medications

that carry a high risk for abuse, error, or other adverse

outcomes. Examples include medications with a low

therapeutic index, controlled substances, medications

not approved or recently approved by FDA,

psychotherapeutic medications, and look-alike and

sound-alike medications. JCAHO requires

organizations to identify high-risk and high-alert

medications used within the organization.c

Example courtesy of Elbert Memorial Hospital. Used with

permission.

c

Available at http://www.medscape.com/viewarticle/

482368_11.

Chapter 7: Examples of Mistake-Proofing in Health Care

123

Figure 7.15. A typical form is inefficient.

Figure 7.16. A template is more effective than a form.

Figure 7.17. High-risk medications are stored in red

boxes.
Example 7.14—Emergency

Defibrillator

The emergency defibrillator in Figure 7.18 is one of many

installed in airports, airplanes, and other public places

throughout the United States. It has been designed so that

anyone can operate it. The device gives its operator verbal

instructions during the process. It also employs sensors to

deliver a shock, but only when one is necessary.

Example 7.15—The 5 Gauss

Line

The European Magnetic Resonance Forum (EMRF) Web

site10 states that:

The national regulatory boards decided to limit the

threshold for access to MRI areas to 5 Gauss [a

measure of the strength of magnetic attraction]. It

seems advisable to mark this area by signs or lines on

the floor.

Using a line on the floor as a sensory alert (Figure 7.19), a

mistake-proofing device in the magnetic resonance

imaging (MRI) suite is a start, but its effectiveness is

dependent on the constant attention of technicians and

patients. Adult patients are required to try to remember

relevant events in their medical history, such as the metal

plates and screws they received after a skateboarding

accident as a 13-year-old. Expecting patients to remember

these details is an unreliable safety mechanism. Patients are

often unsure of even more recent events. Processes have

been redesigned out of concern that patients will forget

recent information (see Chapter 5, Example Set 5.20).

The EMRF Web site also states: 

To prevent such accidents, the installation of a metal

detector through which everybody has to pass before

entering the MRI suite has been recommended, but is

rather cumbersome. 

Every person working or entering the magnet room or

adjacent rooms with a magnetic field has to be

instructed about the dangers. This should include the

intensive-care staff, and maintenance, service and

cleaning personnel, as well as the crew at the local fire

station.

It is not clear that a metal detector in its current

configuration is the best and final answer to MRI safety.

However, it is also not clear that installing a metal detector

is a less “cumbersome” solution than the marginal increase

in training needed for a large and diverse group of workers

that spans organizational boundaries. 

Chapter 7: Examples of Mistake-Proofing in Health Care

124

Figure 7.18. Emergency defibrillators are available in

many public places.

Figure 7.19. The lines on the floor indicate the area of

magnetic attraction.
Example 7.16—More ColorCoding

The white form on the left in Figure 7.20 is used for a

heparind infusion order. The pale blue form on the right is

used for a heparin cardiology dosing protocol order.

Standard and cardiology protocols differ, so the forms are

in different colors. For heparin administration, the

mistake-proofing is a subtle sensory alert. The distinction

between the white and the pale blue forms could be

missed if they are presented to users in close proximity.

This is very weak mistake-proofing. Yet, it is better than

the confusion generated by two white forms.

Example courtesy of an anonymous Web site contributor. Used

by permission.

Example 7.17—Leave Me

Alone, I Have to Concentrate

The line around the medication dispensing station in

Figure 7.21 provides a visual cue that co-workers should

not interrupt the process of retrieving medications. The

organization that implemented this sensory alert expects

nurses who are in the zone to be allowed to attend to the

details of selecting the correct medication and selfchecking their work without distractions by others. 

d Heparin is an anticoagulant, referred to as a blood thinner. 

In another example utilizing visual cues to reduce

interruptions,12 a nurse wore a vest prominently labeled

“do not disturb.” Interruption rates fell approximately 64

percent.

Example courtesy of Sentara Leigh Hospital, Norfolk, VA. Used

by permission.

Example 7.18—What is

Normal? 

The square in Figure 7.22 measures 1 inch on each side.

The figure provides patient data for more than a period of

1 year. It uses the hash marks to indicate the normal

range. This figure appears on the first row, third from the

left, in Figure 7.23. A large amount of information can be

conveyed in a very small amount of space. Comments on

the patient’s condition and treatment are in the right

column of Figure 7.23. 

Chapter 7: Examples of Mistake-Proofing in Health Care

125

Figure 7.20. These forms are used for different

protocols but vary only subtly in color.

Figure 7.21. Inside the red line is a quiet, no

interruption zone.
Example courtesy of Seth Powsner and Graphics Press. Used

with permission. 

Example 7.19—Automatically

Terminated

In 1993, Leveson and Turner14 wrote about their analysis

of accidents that occurred in 1976 with the Therac-25 (a

computerized radiation therapy machine):

Between June 1985 and January 1987, six known

accidents involved massive overdoses by the Therac25, with resultant deaths and serious injuries. They

have been described as the worst series of radiation

accidents in the 35-year history of medical

accelerators.

Patients died from overexposure to radiation as a result of

poor software design and ineffective controls. This failure

may have acted as a catalyst for radiology equipment

manufacturers to design new equipment. New designs

were introduced.15 The machine in Figure 7.24 detects the

amount of radiation that has penetrated a patient and

automatically terminates exposure when a predetermined

level has been reached. The treatment is optimized by

factoring in the variables of patient size and density.

Example courtesy of Elbert Memorial Hospital and an

Anonymous contributor. Used with permission.

Chapter 7: Examples of Mistake-Proofing in Health Care

126

Figure 7.22. A detailed graph of a patient’s condition

presented in compact form. 

From Powsner and Tufte.13 Used with permission.

Figure 7.24. One of a new breed of machines that

limit patients’ exposure to radiation.

Figure 7.23. More than 1 year’s worth of patient

information is presented on one page. 

From Powsner and Tufte.13 Used with permission.
Example 7.20—Blood Sample

Traceability

The cassette in Figure 7.25, the complete blood count

(CBC) analyzer, and a printout match the cassette number

and the patient number. 

Example courtesy of Elbert Memorial Hospital. Used with

permission.

Example 7.21—Leave that

Stopper in Place 

The blood analyzer in Figure 7.26 accepts tubes without

requiring technicians to remove the rubber stopper so that

employees are not contaminated with blood. It is also

labeled with patient information that matches the printout

in Example 7.20, above.

Example courtesy of Elbert Memorial Hospital. Used with

permission.

Example 7.22—Oral

Syringes: Two for One

The oral syringes in Figures 7.27 and 7.28 are designed so

that they will not fit onto any IV tubing. Oral medication

cannot be accidentally administered intravenously. The

orange color of the oral syringes in Figure 7.27 provides

an additional visual sensory alert, indicating that the

syringe is not to be fitted to an IV. 

Example courtesy of Elbert Memorial Hospital. Used with

permission.

Chapter 7: Examples of Mistake-Proofing in Health Care

127

Figure 7.25. Matching the cassette number and

patient number ensures accuracy.

Figure 7.26. The rubber stopper on this blood analyzer

is mistake-proofed to prevent contamination of

employees.

Figure 7.27. These oral syringes will not fit into IV

tubing.

Figure 7.28. This syringe prevents the accidental

intravenous administration of oral medication.
Example 7.23—Newborn

Resuscitation

Two photos of a neonatal resuscitation device are shown in

Figures 7.29 and 7.30. The device has two important

mistake-proofing features:

1. A pressure relief valve that prevents excessive gas

pressure delivery to the lung. 

2. A pressure gauge to measure the actual pressure

delivered by squeezing the deflatable portion of the

bag. 

This device protect infants’ airways from errors in

providing augmented ventilation during resuscitative

efforts.

Example courtesy of Elbert Memorial Hospital and an

anonymous contributor. Used with permission.

Example 7.24—X-RayDetectable Sponges

X-ray detectable sponges (Figure 7.31) contain a radioopaque (impenetrable by x-rays) substance, such as a small

embedded flexible strip, or barium sulfate. These sponges

are an improvement, but not a perfect solution.16 X-rays

can easily detect the presence of sponges when they are

large and “left out in the open” in muscle or fat tissue.

When they are small and left near bone, however, they

become much more difficult to find in the image. See also

Chapter 8, Example 8.10.

Example courtesy of an anonymous contributor. Used with

permission.

Example 7.25—Anti-Reflux

Valves

A reflux is a backward or return flow. Anti-reflux valves are

designed to prevent fluids that have been expelled from

returning to the body and leading to varied complications.

Anti-reflux valves ensure that there is no return flow after

fluids have been expelled, thereby avoiding the “mistake”

of a return flow (Figure 7.32).

Chapter 7: Examples of Mistake-Proofing in Health Care

128

Figure 7.29. A manual neonatal resuscitation device.

Figure 7.31. Sponges containing radio-opaque

substances are more easily found after surgery.

Figure 7.30. This neonatal resuscitation device contains

a pressure relief valve and a pressure gauge.
Example courtesy of an anonymous contributor. Used with

permission.

Example 7.26—Wristband

Checklist 

Robert S. Mecklenburg, chief of the Department of

Medicine at Virginia Mason Medical Center in Seattle,

WA, is designing a bracelet for heart attack patients that

uses symbols to track whether they have received the full,

universally accepted treatment regimen. The regimen

includes receiving beta-blockers within 1 hour of arrival at

the emergency department, monitoring cholesterol levels,

and counseling on diet and smoking. Patients are not

discharged until each item on the wristband medical

record is checked off.17

Mecklenburg adds:

The wristband medical record is being tested as part

of our work bundles (Institute for Healthcare

Improvement) on cardiac care. It is an example of

“visual control” that alerts all in the area that the

patient is on the bundle pathway and allows the

patient and family to follow and audit execution of

the components of the bundle. The response of

patients, providers and support staff has been positive.

We’ve moved through several versions to maximize its

utility.18

According to service management theory, this simple

mistake-proofing device (Figure 7.33) is very powerful. As

a customer mistake-proofing device, it lets the patient and

family and other caregivers know the status of the health

care process.19

Example 7.27—Time to ReStock

In Japanese, a “kanban” is a “sign” or visual signal. In

Japanese manufacturing, a kanban is used to indicate

when work needs to be done.20 St. Joseph’s Hospital

employs a large sticker to indicate when cabinets are fully

stocked (Figure 7.34). This enables the employees who

stock the cabinets to know where their attention is needed.

When supplies have been used to treat patients, the sticker

is torn and employees know that the cabinet needs to be

re-stocked. 

Chapter 7: Examples of Mistake-Proofing in Health Care

129

Figure 7.32. The urine bag and catheter have valves

designed to allow fluids to flow only one way.

Figure 7.33. The author’s interpretation of

Mecklenburg’s design concept.
What Schonberger20 called “Japanese manufacturing

techniques” also has many other names:

• Toyota Production System. 

• Just-in-Time. 

• Stockless Production. 

• Zero Inventories. 

• and, most recently, Lean Production.

There is a standardized supply cabinet in each room. The

presence of the stickers enables the staff to rapidly bypass

unoccupied rooms as they re-stock the facility.

Example 7.28—Knowledge

on the Bottle 

The standard medicine bottle reveals some design

problems: the bottle must be rotated in order to see the

entire label. Recently, Target pharmacies began using a

new medicine bottle design.e

Good ideas come from many sources. In this case, Target’s

medication bottle originated when the grandmother of

graphic designer Deborah Adler accidentally took another

family member’s medication. Mistake-proofing features are

all over the bottle: 

e

See http://sites.target.com/site/en/health/

page.jsp?contentId=PRD03-004033.

• The bottle is designed to stand on its lid. 

• A colored band surrounds the neck.

• The band is color-coded to personalize family

members’ medications. Each family member can use a

different color (yellow, green, blue, purple, or red). 

• The bottle has a rounded, rectangular cross section. 

• The sides taper toward the top. 

• The panels are flat so that all the text on the label is

visible at once. 

• The typography is larger and more distinct than usual.

• The name of the drug is clearly shown on the front

and on the top. 

• A patient information card is tucked in the back.21

Deborah Adler’s bottle was featured at the New York

Museum of Modern Art exhibit, SAFE: Design Takes On

Risk, October 2005–January 2006.

Example 7.29—Weaving

Tangled Webs

The intravenous (IV) pole and infusion pump in Figure

7.35 provide graphic evidence of how IV tubes can

become very tangled. This problem can be mitigated

through the use of Donald Norman’s concept of natural

Chapter 7: Examples of Mistake-Proofing in Health Care

130

Figure 7.35. In this configuration it is difficult to tell

what is connected to what.

Figure 7.34. The sticker provides a visual signal that

the cabinet has been fully stocked.
mappings. One possible solution is the use of in-line IV

hooks that provide a one-to-one correlation between the

IV bags and the infusion pump channels controlling their

flow (Figure 7.36). 

Example 7.30—What’s the

Status?

The flat screen panel in Figure 7.37 provides information

to families without violating Federal privacy laws. The

locator number (indicated by “locator #” on the screen) is

the pager number assigned to each family while they wait. 

Chase and Stewart,22 discussed in Chapter 1, would most

likely categorize the flat screen display in Figure 7.37 in

the following way:

Category: server mistake-proofing device 

Subcategory: treatment

Setting function: Information enhancement

Norman,23 also discussed in Chapter 1, might describe it

as providing visibility.

Chapter 7: Examples of Mistake-Proofing in Health Care

131

Figure 7.36. It is easy to distinguish a one-to-one

correlation between IV tubes and solution bags.

Figure 7.37. The flat screen provides anonymous

information to families with pagers.
References

1. Wachter RM, Shojania KG. Internal bleeding. New York:

Rugged Land; 2004.

2. U.S. Food and Drug Administration Center for Drug

Evaluation and Research. Medication errors. Name

Differentiation Project.

http://www.fda.gov/cder/drug/MedErrors/nameDiff.htm.

Accessed Sep 2005.

3. Subcommittee on Health of the Committee on Energy and

Commerce, House of Representatives Hearing Transcript.

Reducing medical errors: A review of innovative strategies to

improve patient safety. 107th Congress, Second Session.

May 8, 2002. No. 107–12.

4. Mercuriali F et al. Bedside transfusion errors: analysis of 2

years’ use of a system to monitor and prevent transfusion

errors. Vox Sanguinis. 1996;70:16-20. 

5. Mercuriali F et al. One-year use of the BloodlocTM system

in an orthopedic institute. Centro Transfusionale.

1994;3:227-230.

6. Wenz B, Burns ER. Improvement in transfusion safety

using a new blood unit and patient identification system as

part of safe transfusion practice. Transfusion 1991;31(5):

401-403.

7. AuBuchon J. Practical considerations in the implementation

of measures to reduce mistransfusion, transcript of

workshop on best practices for reducing transfusion errors.

Food and Drug Administration and the Agency for

Healthcare Research and Quality. Bethesda, MD. February

15, 2002. http://www.fda.gov/cber/minutes/0215bloo.pdf.

Accessed Sep 2005. 

8. Zoon KC. Blood plasma pool facts and a list about blood

plasma pooling, the practice of mixing together the plasma

of thousands of anonymous blood plasma donors.

Testimony before the Subcommittee on Human Resources 

and Intergovernmental Relations Committee 

on Government Reform and Oversight, U.S. House of

Representatives. July 31, 1997. http://www.bloodbank.com/

plasma-pool.html. Accessed March 2007.

9. Kletz T. Plant design for safety. Bristol, PA: Taylor and

Francis; 1991.

10. European Magnetic Resonance Forum. Frequently asked

questions: Is MR imaging a safe technology?

http://www.emrf.org/FAQs Safety.html Accessed Aug 05.

11. Rossett A, Gautier-Downes JA. Handbook of job aids. San

Francisco: Jossey-Bass/Pfeiffer; 1991.

12. Pape TM. Applying airline safety practices to medication

administration. Medsurg Nursing 2003;12(2):77-93.

13. Powsner SM, Tufte ER. Graphical summary of patient

status. Lancet1994;344:386-89. 

14. Leveson NG, Turner CS. An investigation of the therac-25

accidents. http://doi.ieeecomputersociety.org/

10.1109/MC.1993.274940. Accessed March 2007.

15. Casey SM. Set phasers on stun and other true tales of

design, technology and human error. Santa Barbara, CA:

Aegean Publishing Company; 1993.

16. ECRI. X-Ray detectable surgical sponges. Medical device

safety reports. http://www.mdsr.ecri.org/summary/

detail.aspx?doc_id=8181 Accessed Sep 2005.

17. Connolly C. Toyota assembly line inspires improvements at

hospital. Washington Post: Friday, June 3, 2005. p. A01

http://www.washingtonpost.com/wpdyn/content/article/2005/06/02/AR2005060201944_pf.ht

ml 

18. Grout J. Personal communication with Robert

Mecklenburg. June 2005

19. Metters R, King-Metters K, Pullman M. Successful service

operations management. Mason, Ohio: South-Western;

2003. p. 218.

20. Schonberger RJ. Japanese manufacturing techniques: nine

hidden lessons in simplicity. New York: The Free Press;

1982. 

21. Lukas P. Lightning in a bottle. Fast Company. 2005;98:32.

22. Chase RB, Stewart DM. Mistake-proofing: Designing errors

out. Portland, Oregon: Productivity Press; 1995.

23. Norman DA. The design of everyday things. New York:

Doubleday; 1989.

Chapter 7: Examples of Mistake-Proofing in Health Care

132
Chapter 8: More Examples of Mistake-Proofing in Health Care

133

Chapter 8. More

Examples of MistakeProofing in Health Care

Introduction

This chapter features 34 additional examples of mistakeproofing in health care. The examples in this chapter are

more expensive and technology-based than those described

in Chapters 5-7, although some very simple examples are

also included. They are provided as both a catalog and a

catalyst for reducing human errors in health care.

Example 8.1-Infant Abduction

Prevention

Mistake-proofing often involves electronic sensors to

ensure high-quality industrial production. Electronic

sensors are also used in health care applications. In this

example (Figure 8.1), an electronic device, or “tag,” is

designed to be clamped to the infant’s umbilical cord. The

arrow in the photo points to the cord clamp, which

secures the tag to the infant. The tag ensures that the

infant is not removed from the nursery. If the infant is

removed without authorization, alarms sound, specified

doors lock, and the elevators automatically return to the

secured maternity floor; the elevator doors remain open. 

Example courtesy of Barnes Jewish Hospital and an anonymous

contributor. Used with permission.

Example 8.2—Bar Coding

Bar coding is one of the more common and effective

information enhancement and mistake-proofing devices. It

is particularly useful in ensuring a match between a

patient and their treatment, medicines, and supplies

(Figures 8.2 and 8.3). 

One of the contributors to this example emphasized the

importance of radiologists matching the film they are

reading to the right patient:

Bar codes are attached to every order so that the

radiologist can electronically identify the patient and

Figure 8.2. Laboratory instruments in the lab read the

bar coding on specimen tubes to ensure positive

identification of people and procedures.

Figure 8.1. An electronic sensor provides robust

security to prevent infant abductions.

Figure 8.3. The bar codes are laid out on the wall in

close proximity, a design that is inattentive to human

factors considerations. 
be sure that the correct patient [information] has been

entered into the digital dictation system.

Another contributor stated: 

Each specimen is labeled with a bar code that is

specific to that patient and the test that has been

ordered. The instruments in the laboratory are

programmed to identify the bar code that ensures

positive patient identification and to verify that the

correct test is performed. 

Bar coding, however, is a setting function. Therefore, it is

only as effective as the regulatory function to which it is

linked. Many of the control methods used with bar coding

are warnings or sensory alerts. The control methods of

shutdown and forced control are infrequently used.

AuBuchon discussed this shortcoming of bar coding

systems for patient identification: 

A disadvantage that we ran into when we began using

the system on a trial basis is that the system doesn’t

have to be used ... ultimately, our anesthesiologist

said, ‘You know, this is a really neat system, but I

won’t use it. He said [that with] the BloodlocTM, I

have got to use it, I have got to do something, we

have got to take it off, and that’s the whole idea. It’s a

barrier. It prevents the transfusionist from getting to a

unit of blood that they are not supposed to get to.’ So

we have continued using that older system rather than

the new, fancy system.1

The use of bar codes does not automatically prevent errors

from occurring. Staff should check that assigned bar codes

match. In Figure 8.3, a line of red laser light is hovering in

the gap between two bar codes, increasing the odds of

reading the wrong bar code by mistake.

Given the prevalence of patient identification errors, bar

coding is a very promising direction in mistake-proofing.

Example 8.3—ComputerAided Nutrition and Mixing

Software is used to profile total parenteral nutrition

(TPN) solutions (Figure 8.4). A patient’s nutritional needs

(protein, sugar, fat, vitamins, and electrolytes) are entered

into the software application. The software sends a

message to an automixer that compounds the ingredients

to create the base solution. The software issues a warning

if certain concentrations of ingredients are exceeded based

on literature values.

Example courtesy of an anonymous contributor and participants

of a learning session sponsored by Health Insight.

Example 8.4—Equipment

Collisions

In hospital operating suites full of large, expensive

equipment, there is always the danger that units of

equipment will collide with each other. Equipment

requires a wide range of motion while in operation.

Collision detection systems warn and, in some cases, can

lock if they sense an impending collision. The equipment

in Figure 8.5 is situated in an angiographic suite and

outfitted with electronic and manual locks to prevent

collisions.

Chapter 8: More Examples of Mistake-Proofing in Health Care

134

Figure 8.4. Software ensures that this automixer

optimizes proportions of ingredients for TPN solutions.
Example 8.5—Flawless

Equipment Setup

When creating x-ray film, it is very important that the

tube is centered to the film and is situated the correct

distance from the film. The position locks (Figure 8.6)

enable the tube to be centered quickly and correctly by

only locking at the correct positions.

Example 8.6—Mistake-Proof

Mistake-Proofing 

Transport monitors, which employ flashing and audible

alarms, warn all health care workers of high/low heart or

breathing rates. A misplaced blood pressure cuff on the

lower arm below the elbow, as in Figure 8.7, would result

in inaccurate blood pressure readings and trigger flashing

and audible misplacement alarms.

Example 8.7—Private Files

Often, mistake-proofing is accomplished by providing

barriers that prevent people from taking the wrong action.

In Figure 8.8, a portion of the file cabinet drawer can be

locked. This mistake-proofing is neither mysterious nor

subtle.

Chapter 8: More Examples of Mistake-Proofing in Health Care

135

Figure 8.5. Equipment with electronic and manual

locks. 

Figure 8.7. A misplaced blood pressure cuff gives an

inaccurate reading and triggers alarms.

Figure 8.6. Position locks on x-ray film ensure correct

positioning of the tube. Figure 8.8. A locked portion of this drawer protects

against filing mistakes. 
Example 8.8—Computer Drug

Interaction Checker

Software that checks for drug interactions (Figure 8.9) falls

under Shingo’s concept of a successive-check.2 A

successive-check is a mistake-proofing device that

facilitates checking work previously performed by others

and that, in a low-cost, relatively automatic way, notifies

the user that something is wrong. Shingo was of the

opinion that defect detection and rapid feedback following

a mistake are nearly as effective as not making the mistake

at all. Even after an initial mistake, staff can recover before

substantial harm occurrs. In this case, the pharmacist

double-checks the prescriptions submitted by doctors. It is

clear that there is no resultant harm if an error can be

caught by the pharmacist before the patient receives the

medicine, thereby avoiding, at the very least, significant

difficulties for the pharmacist, doctor, and patient. 

Example 8.9—Computerized

Physician Order Entry 

According to Poon, Blumenthal, Jaggi, et al;3

Medication errors are the most common cause of

preventable injuries in hospitals. Computerized

physician order entry (CPOE) systems can reduce the

incidence of serious medication errors by 55 percent,

but only 10 percent to 15 percent of hospitals use

them. 

CPOE is computer software that physicians and other

health care providers use to issue and record patient orders

for diagnostic and treatment services such as medications,

laboratory tests, and diagnostic tests. Computers on

wheels (COWs) are available throughout hospitals so that

staff can enter information without having to go to a

central location (Figure 8.10). CPOE provides several

mistake-proofing features:

1. Informs providers of common dosages and overdose

warnings via drop-down menus.

2. Eliminates the issue of legible handwriting. 

3. Conducts drug interaction and allergy checking

routines.

4. Employs sophisticated systems that function as a

clinical decision support system (CDSS).a CDSSs are

“active knowledge systems that use two or more items

of patient data to generate case-specific advice.”4

a See http://www.openclinical.org/dss.html#wyatt1991.

Example 8.10—SpongeCounter Bag

In aviation, significant effort is exerted to ensure that no

foreign objects are left inside fighter planes. This is done

to prevent foreign object damage (FOD). Changing G

forces can make objects weightless. Subsequently, they

Chapter 8: More Examples of Mistake-Proofing in Health Care

136

Figure 8.9. Drug interaction software notifies the

pharmacist of an incorrect prescription.

Photo: DIT Drug Risk NavigatorTM, Copyright by DIT Drug

Information Technologies, Rockville, MD. Used with

permission.

Figure 8.10. CPOE often means doctors must use

computers on wheels (COWs).
could fly through the cockpit and cause serious damage to

people and equipment. FOD is also a problem in surgery.

Failing to remove foreign objects (tools or supplies) from

inside a patient can cause serious harm. 

The sponge-counter bag (Figure 8.11) assists in keeping

track of sponges removed from a patient. Accounting for

the sponges put into the patient is easier because the

sponges are not discarded immediately or put in a random

pile. 

Example 8.11—Notebook

Switches 

Galsworth5 endorses the mantra that workers should be

able to “know by looking.” The notebooks in Figures 8.12

and 8.13 enable users to do that. The dial on the

notebook in Figure 8.12 and the switches on the notebook

in Figure 8.13 enable everyone to know the status of the

paperwork inside. 

Colors indicate when medical staff have made entries that

need to be processed by administrative staff. A different

color notifies the nurse when the work is finished. No

color is displayed when the work is completed, and no

further action is needed.

Example 8.12—Plug

Protection

In May 2004, a National Patient Safety Foundation

(NPSF) LISTSERV® participant inquired about the safest

height for electrical wall outlets in pediatric rooms. In his

response, Matthew Rosenblum stated that he believes that

other matters are probably more important: 

For example, how the cord is secured to the outlet and

to the wall and how the outlet is covered when no

devices are plugged in. In this regard, there are

numerous products on the market for securing

electrical cords to the outlets and to walls. Also, many

secure socket covers are available.6

Chapter 8: More Examples of Mistake-Proofing in Health Care

137

Figure 8.11. A sponge-counter bag.

Figure 8.12. The dial on the notebook indicates the

status of the paperwork inside.

Figure 8.13. This notebook employs switches to let

workers know the status of the paperwork inside. 
When an outlet is used properly, the plug fits without

slowing the process. The process is slowed only when an

error occurs; then the mistake-proofing device brings the

process to a halt. Figures 8.14-8.18 illustrate various

mistake-proofing methods employed to make wall sockets

safer.

Photos courtesy © Koncept Technologies Inc. Used with

permission.

Chapter 8: More Examples of Mistake-Proofing in Health Care

138

Figure 8.14. Insertion in the outlet of this surge

protector is blocked to plugs with less than two prongs.

Figure 8.15A. A screwdriver cannot penetrate the

outlet slot because of the shutter.

Figure 8.17. Secure socket covers prevent accidents.

Figure 8.18. Outlets should be effectively secured to

the wall. Figure 8.15B. The shutter is designed to prohibit

insertion in either slot.

Figure 8.16. Outlet with correct plug inserted.
Example 8.13—Instructions

Getting in the Way

The card shown in Figure 8.19 is not the strongest

example of mistake-proofing. It does, however, put

knowledge in the world. Also, it is designed to stand out

against a noisy background. At a minimum, someone (a

patient or family member, perhaps) will have to move it

out of the way in order to use the table space.

A card on the overbed table (Figure 8.20) provides

information to patients about what patient safety

behaviors to expect from staff and encourages them to

hold staff accountable for complying with those behaviors. 

This example is similar to the time-out example (Chapter

7, Example 7.4). It also has some common features with a

proxy ballot that was mailed to a retirement fund (Figure

8.21). The ballot was designed so that it would not fit in

the envelope until a small portion of the page containing

the mailing instructions/checklist was torn off. 

Example courtesy of Linda Bontrager and the Nebraska State

delegation to the VA/AHRQ Patient Safety Improvement Corps,

2005. Used with permission.

Example 8.14—Monitoring

Glucose

In the past, glucose monitoring required that patients

follow strict clinical procedures to determine their blood

glucose levels. Today, most of the precise actions and

calculations are designed into a portable glucose monitor

that is user-friendly and more mistake-proof. 

Example 8.15—Unit Dosing

Robotics, bar coding, and packaging medicines in plastic

bags containing a single dose, or “unit dose,” form a

powerful combination of mistake-proofing devices.

Individually, none of them would be very effective. The

unit dose package enables the machine to select a single

dose to be delivered to a patient. The unit dose package

also provides a convenient way to associate bar codes to a

specific pill for use in the pharmacy and throughout the

medication delivery system. Bar codes make the packages

Chapter 8: More Examples of Mistake-Proofing in Health Care

139

Figure 8.19. For each admission, a new copy of this

piece of folded card stock is placed on the patient’s

overbed table. 

Figure 8.20. St. Joseph’s Hospital says “It’s OK to ask

‘Did you wash your hands?’”

Figure 8.21. This proxy ballot will not fit into the

envelope until the mailing instructions are torn off. 
containing the pills machine readable (Figure 8.22). The

machine in Figure 8.23 provides the automation that

makes converting bottled medicines into unit doses less

expensive, less labor intensive, and more reliable.

Example 8.16—Kits

The Massachusetts team from the Patient Safety

Improvement Corps (PSIC) reported their efforts in

reducing central line infections.7 They recommended a

variety of changes to the central line insertion process.

Included in their recommendations is a customized kit

(Figure 8.24) that standardizes available supplies,

including drapes and other site preparation materials. 

The cost of the custom central line kits is more than

twice that of the old methods. Regardless of which

method is used, each infection episode has an associated

cost of $45,000. Savings will be realized after adoption

of the custom kits because the number of infection

episodes is expected to decrease by almost 50 percent

due to the mistake-proofing built into the kits,

effectively more than nullifying the additional cost of

each kit. Without the custom kits, the number of

expected infection episodes is 145 annually. With the

kits, however, the expected annual number of episodes is

less than half at 72. Table 8.1 shows the annual savings

calculations.

Chapter 8: More Examples of Mistake-Proofing in Health Care

140

Figure 8.22. Unit dose packages associate bar

codes to specific pills in a pharmacy. 

Figure 8.23. This machine automates the conversion

of bottled medicine into unit doses. 

Table 8.1. Cost comparison between two methods

of reducing central line infections

Savings will equal the difference in total episodic costs

of the two methods:

([B]$6,525,000- [A]$3,240,000

minus the difference in equipment costs 

([A]$147,840-[B]$55,552=$92,288)

Method A: Previous Method

Annual equipment cost 

2,240 cases x $24.80/kit =$55,552.

Annual infection cost

$45,000/episode x 145 expected episodes =

$6,525,000

Total Cost = $6,580,552 

Method B: Using Custom Kit

Annual equipment cost

2,240 cases x $66/kit =$147,840

Annual infection cost 

$45,000/episode x 72 expected episodes =

$3,240,000

Total Cost = $3,387,840

Net Savings = $3,192,712
According to the calculations in Table 8.1, the annual

cost increase is substantial: $92,288. Yet, if the number

of infections can be reduced by only 3 episodes out of

145 (a 2 percent decrease), the change will be costjustified. The team forecasted infection rates would be

cut in half, a result that was supported in their

preliminary findings. The net savings appeared to be far

more substantial than the cost increase. 

Example and photos courtesy of an anonymous contributor.

Used with permission.

Example 8.17—BacteriaDetecting Bandages

Benjamin Miller8 developed the technology to produce

“smart bandages” that indicate an infection by changing

color (Figure 8.25). The “smart bandage” is in the early

stages of development, so actual commercial products

may still be years away. In its current form, the

technology is in a chip that reveals the existence of

different bacteria by changing colors. As a consumer

product, a small chip would be embedded in a regular

bandage. Computer connectivity is another future

posibility.

Example 8.18—Urinalysis

Test Strips

The old method of reading urinalysis test strips required

health care workers to make subjective decisions. Timing

and color perception were critical to error-free results.

The machine in Figure 8.26 analyzes urine test strips

and prints out the results. In addition to the obvious

mistake-proofing associated with the automatic nature

of the machine, the strip can be inserted in only one

direction, and the results can be printed out and placed

in the patient’s medical chart. A transcription of the

results is not necessary.

Improperly handled or inadequately maintained samples

can result in inaccurate diagnosis and treatment. The

sample transport kit in Figure 8.27 maintains urine

specimen integrity without refrigeration for up to 72

hours at room temperature.

Chapter 8: More Examples of Mistake-Proofing in Health Care

141

Figure 8.24. Customized central line kits can

significantly reduce the occurrence of central line

infections.

Figure 8.25. Smart bandages may soon be able to

reveal the existence of different forms of bacteria.

Photo courtesy of Benjamin L. Miller, University of Rochester

Medical Center.
Example 8.19—Controlled by

Connections

In Figure 8.28, a benign failure protects patients. Only

rubberized specula will fit as attachments to this loop

electrosurgical excision procedure (LEEP)b machine.

Standard metal specula cannot be attached. If a metal

speculum could be inadvertently attached to the machine

and used, it would result in burns or electrocution.

Example courtesy of Washoe County District Health

Department. Used by permission.

b LEEP is “a way to test and treat abnormal cell growth on the

surface tissue of the cervix. LEEP is prescribed after abnormal

changes in the cervix are confirmed by Pap tests and

colposcopy.” See http://www.clevelandclinic.org/health/healthinfo/docs/0600/0642.asp?index=4711.

Example 8.20—ChildProofing 

Child-proofing is mistake-proofing. Since the bottle in the

foreground of Figure 8.29 is not child-proofed, it is kept

inside a child-proofed medication container when not in

use to prevent accidents. In this example, an entire

demographic group is unable to open a container, the

exact benign failure for which it was designed. 

Example courtesy of Washoe County District Health

Department. Used with permission.

Chapter 8: More Examples of Mistake-Proofing in Health Care

142

Figure 8.28. Standard metal specula cannot be

attached to this LEEP machine.

Figure 8.29. The medication container in the

background was designed to be unavailable to

children.

Figure 8.27. The integrity of urine samples can be

maintained for 72 hours in this transport kit. 

Figure 8.26. This urinalysis machine can print its results.
Example 8.21—Hemoglobin

Testing 

Precision in hemoglobin testing is important. Appropriate

diagnosis and treatment are based on the results.

Automatic hemoglobin testing devices (Figure 8.30),

which perform the analyses in under 1 minute, have

replaced analyses that relied on visual judgment or timeconsuming, complicated methods for their precision.

Example courtesy of Washoe County District Health

Department. Used with permission.

Example 8.22—Auto Shut-Off

Treadmills 

The treadmill in Figures 8.31 is used in rehabilitative

therapy. It is equipped with an emergency stop button and

automatically slows to a stop if the patient trips or falls.

Example courtesy of Jackie Buttacio of HealthInsight and

participants in a HealthInsight-sponsored learning session. Used

with permission.

Example 8.23—Visual

Systems 

Figures 8.32 and 8.33 are more examples of how to “know

by looking.”5 Visual systems make a system’s status visible

to all. Norman9 encourages visibility to reduce errors:

“make relevant parts visible.” In Figure 8.32, the goal was

to encourage employee donations in a workplace. The

visibility of the status of the blood supply made a dramatic

difference. Employee donations grew 300 percent. The

sign served as a simple gauge to indicate inventory levels

and mitigated the human perception, or error, of believing

that the blood supply was more than adequate. The gas

gauge depicted in Figure 8.33 is another visual cue to the

status of a machine. 

Chapter 8: More Examples of Mistake-Proofing in Health Care

143

Figure 8.30. Automatic hemoglobin testing devices do

not rely on visual judgments or complicated methods.

Figure 8.31. This treadmill, used in rehabilitative

therapy, is equipped with an emergency stop button.
Example courtesy of Duke Rohe, MD Anderson Cancer Center.

Used with permission.

Example 8.24—Needleless

Systems

Needleless systems are used throughout the hospital to

prevent needle sticks. The display panel in Figure 8.34

informs the nurse if there is air in the system.

Safety-engineered products for intravenous (IV) therapy

have proven effective in protecting health care workers

from exposure to bloodborne pathogens (Figure 8.35). In

a retrospective review, the Exposure Prevention

Information Network (EPINet) at the International

Health Care Worker Safety Center at the University of

Virginia in Charlottesville showed that the rate of

percutaneous injuries among nurses declined from 19.5

per 100 occupied beds in 1993 to 9.6 per 100 occupied

beds in 2001, a decrease of nearly 51 percent.10

Because these figures only include the first few months of

legally mandated safety device use, they don’t fully reflect

the effect of the Needlestick Safety and Prevention Act,11

which mandated the use of needleless IV systems in all

health care settings.

Safety-engineered devices prevent accidental needle sticks

in two ways: primary prevention and secondary

prevention. The most direct method of preventing needle

stick injuries is through primary prevention techniques

that eliminate the need to introduce sharps into the

workplace, reducing the total number of sharps used.

Example courtesy of Jackie Buttacio of HealthInsight.

Chapter 8: More Examples of Mistake-Proofing in Health Care

144

Figure 8.32. A visual cue.

Figure 8.33. The gas gauge is another visual cue.

Figure 8.34. A needleless system.

Figure 8.35. Safety-engineered IV therapy products

help reduce percutaneous injuries.
Example 8.25—Dress Code

Cued by Floor Tile 

The patterned tile in the hallway (Figure 8.36) is a sensory

alert that surgical attire must be worn past this point. The

tile adds a visual cue about what to do, but it only works

for those who have been taught what the tiles mean.

Patients, visitors, or new staff members will not be aware

of this convention, thereby limiting its effectiveness.

Fortunately, patients are usually sedated and recumbent in

this hall, and visitors are prohibited. 

Examples courtesy of Duke Rohe of MD Anderson Cancer

Center. Used with permission.

Example 8.26—

Internet–Aware Refrigerator

Undergraduate engineering students at Virginia Military

Institute (VMI)—advised by a biomedical engineer, a

computer engineer, and a physician—designed a medical,

Internet-aware, insulin refrigerator for patients living

alone. The small refrigerator (Figure 8.37) is monitored by

a microcontroller that is connected to a standard

telephone outlet. If the refrigerator door is not opened in a

16-hour period, the microcontroller sends an e-mail or a

pager alert to a designated caregiver. The system has

battery backup in case of a power outage. The system can

be retrofitted to standard refrigerators.

Example 8.27-Resources with

Which to Err

Sometimes, mistake-proofing can be thought of as the

removal of the materials required to make errors. In the

United Kingdom, the National Patient Safety Agency, in

its first patient safety alert, warned that potassium chloride

solution in its concentrated form should be removed from

all general wards and replaced by diluted products. See

also Chapter 7, example 7.7.

Example 8.28—Keeping Time

Mistake prevention in the work environment involves

reducing ambiguity. As far as time is concerned, variation

is ambiguity. Clock systems (Figure 8.38) eliminate

variation. A receiver takes signals from global positioning

system (GPS) satellites and communicates the signals to

other clocks in the system, including those in computers. 

Chapter 8: More Examples of Mistake-Proofing in Health Care

145

Figure 8.36. Floor tiles provide visual cues.

Figure 8.37. This insulin refrigerator sends an e-mail

or pager alert if it is not opened during a 16-hour

period.

Photo courtesy of Jim Squire, VMI. Example courtesy of

Advisors: Jim Squire, Dave Livingston, Joseph Troise, M.D.,

VMI Department of Electrical and Computer Engineering.

Used with permission.
The clocks in Figures 8.39, produced by different

manufacturers, set themselves accurately. When observed,

the variation between them was approximately one-half

second.

Example courtesy of John Reiling and St. Joseph’s Hospital.

Used with permission.

c Information design for patient safety. A guide to the graphic design

of medication packaging is available from the UK’s National

Patient Safety Agency at http://www.npsa.nhs.uk/

site/media/documents/1539_Information_Design.pdf.

Example 8.29—Distinct

Labeling

Businesses try to build an image for their product lines by

using similar packaging. Figure 8.40 illustrates a consistent

image that leads to brand awareness but may also lead to

packaging that offers minimal distinctions between

products. Figure 8.41 shows that, while patterns and

graphics can unify a company’s product line, individual

product packaging can be visually distinct. Even within

the same product line, different dosages can be made

distinct.c

Chapter 8: More Examples of Mistake-Proofing in Health Care

146

Figure 8.40. The labeling of different dosages of the

same medication can be confusing.

Photos © 2006 and example courtesy of the National

Patient Safety Agency, UK. Used with permission.

Figure 8.41. Packaging unifies this product line, but

dosages are distinctly labeled.

Figure 8.39. The variation in these clocks by different

manufacturers is insignificant.

Figure 8.38. This clock is part of a system. One receiver

communicates wirelessly with each clock in the facility.
Example 8.30—FreeFlow/No-Flow Protection

Infusing too much or too little fluid can lead to problems.

The free-flow protection on the IV pump in Figure 8.42

causes a benign failure. It is a simple V-shaped piece of

plastic (Figure 8.43) loaded on the machine. The flow of

medication to the patient stops if a tube is removed from

the machine.

Some infusion pumps also offer downstream occlusion

alarms that alert staff that the tubes are blocked or that the

clamp has not been opened, preventing the fluid from

infusing.

Example courtesy of Elbert Memorial. Used with permission.

References

1. AuBuchon J. Practical considerations in the

implementation of measures to reduce mistransfusion.

Best practices for reducing transfusion errors -

OBRR/CBER/FDA Workshop. Food and Drug

Administration, Center for Biologics Evaluation and

Research and Office of Blood Research and Review.

Bethesda, MD; 2002 Feb 15. http://www.fda.gov/

cber/minutes/0215bloo.htm. Accessed: Sep 2005.

2. Shingo S. Zero quality contol: source inspection and the

poka-yoke system. New York: Productivity Press; 1985.

3. Poon EG, Blumenthal D, Jaggi T, et al. Overcoming

barriers to adopting and implementing computerized

physician order entry systems in U.S. hospitals. Health

Affairs 2004 July;23(4):184–90.

4. Wyatt J, Spiegelhalter D. Field trials of medical decisionaids: Potential problems and solutions. In: Clayton P, ed.

Proceedings of the 15th symposium on computer

applications in medical care, Washington, 1991. New

York: McGraw Hill; 1991.

5. Galsworth GD. Visual workplace: visual thinking.

Presentation at 16th annual Shingo Prize Conference.

Lexington, KY: May 2004. 

6. Rosenblum M. Written correspondence. NPSF

LISTSERV®; 2004 27 May. 

7. Alper E, Brush K, McHale E, et al. Prevention of central

line infections. Public-private collaboration,

www.patientsafety.gov/psic/StatePresentations/2004-

2005/Massachusetts.ppt.

8. Smart bandages. Popular Mechanics 2002 May;

179(5):30.

9. Norman DA. The design of everyday things. New York:

Doubleday; 1989.

10. Jagger J, Perry J. Comparison of EPINet data for 1993

and 2001 shows marrked decline in needlestick injury

rates. Adv Exposure Prev. 2003;6(3):25-27.

11. Neddlestick Safety and Prevention Act. Public Law 106-

430, 106th Congress; 2000 Jan 24.

Chapter 8: More Examples of Mistake-Proofing in Health Care

147

Figure 8.42. Infusion pumps regulate the flow of fluids.

Figure 8.43. Close-up of V-shaped plastic tube clamp. 

Chapter 9. Summary

Introduction

The examples in this book represent only a fraction of the

current mistake-proofing methods and devices in the

health care industry and only hint at the possibilities 

of how mistake-proofing could be applied. The

implementation of mistake-proofing does not require

starting from a standstill. Instead, existing solutions should

be implemented wherever appropriate throughout each

health care organization. Where ready-made solutions do

not exist, designing, fabricating and installing new devices

will be required. 

Mistake-proofing is a change of focus, requiring more

attention to the detailed design of processes, so that the

easy way (or, ideally, the only way) to perform a task is the

correct, efficient, and safe way. Mistake-proofing involves

changing the physical attributes of a process.

Consequently, mistake-proofing devices usually can be

photographed. 

Implementation of mistake-proofing in health care settings

will be accomplished by putting knowledge in the world,

designing benign failures, preventing failures in the work

environment, detecting errors, preventing errors, and

preventing the influence of errors. It will require the

employment of devices that mistake-proof the actions of

care providers, patients, and patients’ family members.

Example Summary

Tables 9.1-9.5 recap the composition of the mistakeproofing examples presented in this book as they were

categorized in Chapter 1. Although the selection of these

examples was not intentionally biased, a distinct and

restrictive definition of what does and does not constitute

a mistake-proofing device affects these findings. Mistakeproofing is relatively narrowly defined here when

compared with other authors’ definitions.1,2 For example,

Godfrey, Clapp, Nakajo, et al, include actions such as

“train laboratory technicians to... empower all employees

to... encourage patients to... clarify with physicians...”1

You cannot take a picture of these actions, so, while they

may be worthwhile and effective actions, they would not

be included here. Therefore, the proportions of examples

reported in the tables do not provide a carefully

constructed statistical sample that warrants populationwide conclusions. These tables suggest areas that lack

medical mistake-proofing examples and call for new

contributions to the body of knowledge. 

Preliminary data from the example collection process

suggest that many of the mistake-proofing examples

included here have been broadly implemented in health

care. Many device examples were submitted by people

from differing organizations and geographical regions, and

several were featured on commercial equipment or

supplies. No locally developed devices were reported more

than once. Further research is necessary to definitively

determine if the implementation of certain commercially

available mistake-proofing devices is widespread, as the

preliminary data suggest. Findings of widespread

implementation would be encouraging, suggesting that the

health care industry is amenable to these devices. 

Table 9.1 shows how the devices from this book are

distributed among Tsuda’s3 four approaches to mistakeproofing. One-half of the devices are designed to directly

prevent mistakes by prohibiting them from taking place.

Another 28 percent represent changes to the work

environment intended to prevent mistakes in indirect

ways, by removing ambiguity and making correct actions

more obvious. Twenty percent of the devices rapidly detect

errors, enabling staff to respond quickly and prevent more

serious errors. Among those collected, only a few examples

of preventing the influence of mistakes were identified.

Table 9.2 shows the distribution of devices that utilize the

different setting functions identified by Shingo4 and Chase

and Stewart.5 More than one-third of the devices, 35.3

percent, are physical setting functions. This percentage

would not be unusual for any mistake-proofing

application or, for that matter, any industry. The more

interesting number is the 36.0 percent of information

enhancement setting functions.

Chapter 9: Summary

149
Chase and Stewart wrote about this type of device over a

decade ago.5 They added information enhancement devices

to those proposed by Shingo4 in the belief that this type of

mistake-proofing would be needed in services. The fact that

over one-third of the devices are in this category supports

their belief.

Table 9.3 indicates the distribution of the collected mistakeproofing devices when categorized by control function.

Shutdown and sensory alert devices are the most common

control functions. The overall distribution of devices is

somewhat evenly distributed among the control functions. 

(Note: Numbers may not total 100 due to rounding.)

Chapter 9: Summary

150

Table 9.1. Mistake-proofing devices categorized by

Tsuda’s3 four approaches to mistake-proofing

Percent 

Approach Count of total

Mistake prevention in 

the environment 42 28.0

Mistake detection 30 20.0

Mistake prevention 73 48.7

Preventing the influence 

of mistakes 5 3.3

Total 150 100.0

Table 9.2. Mistake-proofing devices categorized as

setting function

Percent 

Setting Function Count of total

Physical 53 35.3

Sequencing 19 12.5

Grouping and counting 24 16.0

Information enhancement 54 36.0

Total 150 100.0

Table 9.3. Mistake-proofing devices categorized by

control (or regulatory) function

Percent 

Control function Count of total

Forced control 29 19.3

Shutdown 42 28.0

Warning 29 19.3

Sensory alert 50 32.3

Total 150 100.0

Table 9.4 divides the mistake-proofing devices discussed

in this book into the six categories defined by Chase and

Stewart.5 These categories are divided into those

concerning errors committed by customers (non-health

care personnel) and errors committed by service

providers (health care personnel). Of the collected

examples, 24.66 percent address errors that would be

committed by customers. Of these, almost 90 percent

are mistake-proof aspects of the service encounter. 

Few examples exist in the areas of preparation and

resolution. The remaining 75.33 percent focus on the

errors of health care personnel. Not surprisingly, the vast

majority of provider devices, 62.50 percent of the total

and 84.07 percent of the provider devices, address task

performance errors, and 14.16 percent address errors

associated with the tangibles delivered to patients. Only

two (1.77 percent) devices collected ensure that patients

were treated in a respectful and professional manner.

This does not mean that patients were treated badly,

only that few physical devices aided in providing proper

treatment. 

This analysis suggests the existence of a broad area of

opportunity to identify or create additional mistakeproofing devices that address customer preparation,

customer resolution, and provider treatment. The

realization of these opportunities will result in a

perception of more patient-centered care by everyone

involved.
One of the more surprising findings of this project has

been the scarcity of locally developed or “do-it-yourself”

examples (Table 9.5). Locally developed devices custommade by process users are pervasive in industrial

companies that have implemented mistake-proofing. The

relatively few examples in health care may be partially

explained by the fact that most industrial companies have

a machine shop and tool and die makers readily available

to fabricate any mistake-proofing device they need. To

compensate, health care providers will need to develop

external sources of expertise.

Chapter 9: Summary

151

Table 9.4. Devices categorized by areas of focus for service provider and customer mistake-proofing

Percent of devices segregated Percent of

Type of device Device count by customer or provider total devices

Preparation 2 5.41 1.33

Encounter 33 89.19 22.00

Resolution 2 5.41 1.33

Customer total 37 100.00 24.66

Provider

Task 95 84.07 62.50

Treatment 2 1.77 1.33

Tangibles 16 14.16 10.50

Provider total 113 100.00 75.33

Total 150 100.00
Sources of Supply

Although some mistake-proofing devices that will be

needed in medicine will be created in-house or in an

individual’s garage or workshop, others will require more

sophisticated design and production help. Competencies in

inventive processes, design, fabrication, and assembly will

be needed in some cases, and not all medical organizations

will have these capabilities. These competencies usually will

be found in engineering, maintenance, or biomedical

engineering departments. In the absence of these

departments, organizations must find other sources of

supply.

One place to begin the search for help in developing a

prototype for minimal cost is the engineering school at

local colleges. Occasionally, engineering students may

undertake projects as part of a class. Engineering programs

will typically have two types of classes where devices could

be designed and fabricated: “senior capstone design” courses

and independent research courses. Organizations should

expect to provide funding for required materials, but they

may be able to avoid labor costs and profit margins.

Squire6 suggests that: 

Chapter 9: Summary

152

Table 9.5. Proportion of purchased mistake-proofing

devices

Percent 

Source of device Count of total

Locally developed 31 20.7

Off-the-shelf 119 79.3

Total 150 100.0

... the school be physically close ... you want to be

able to go there and explain the idea...undergraduate

engineers have a tendency to go off on their own,

and without being available to see the development,

you may end up with something very different than

you envisioned.

Convincing an engineering school to adopt the project

will also depend on the level of difficulty and whether the

project requires a combination of competencies that

would be beneficial to the students. This approach

requires diplomatic treatment of intellectual property

issues and commercial contingencies. 

Karen Cox, a Patient Safety Improvement Corps (PSIC)

2004 participant, spoke of needing a farmer to weld a

piece of equipment to solve a problem in the area of

human factors and forcing functions. 

The hooks that hold the containers in the infusion pump

in Figure 9.1 are randomly arranged. One hook is

occupied by a container that is connected to the smaller

pump at left. The tubes are thoroughly tangled.

Figure 9.1. This infusion pump can hold and pump

up to four medications at once. 
Karen Cox wanted a hook immediately above each of the

infusion pumps so that it would be clear which

medications were running through each of the four pumps

(Figure 9.2).

If a device is not appropriate for an engineering class

project, an organization should continue to explore its

options. One possibility is to consider networking with

local chambers of commerce or with members of civic

organizations such as the Rotary Club or Optimist Club

in order to develop contacts with local factory engineering

managers. Engineering managers are likely to have

experience obtaining custom tool design, fabrication,

assembly, and installation in the local area. Local machine

shops (sometimes listed under “Machinery-custom” in the

phone book), metal fabricators, and systems integrators

also can help. 

Industrial Glossary

Fabrication is an industrial term generally applied to the

building of metal machines and structures. Fabrication

shops and machine shops have overlapping capabilities,

with fabrication shops concentrating on metal forming

and welding. See http://en.wikipedia.org/wiki/

Fabrication_(metal).

Assembly is the stage of production in which components

are put together into an end-product appropriate to the

process concerned. See http://www.eyefortransport.com/

glossary/ab.shtml. 

A machine shop is a workshop where metal is cut and

shaped by machine tools. 

A systems integrator is an individual or company capable

of making diverse components work together as a system.

The word system usually implies the inclusion of a

computer or microprocessor component to the project.

Sources for more information include:

• A Directory of System Integrators in the Medical

Industry for Factory Automation, Process Control,

and Instrumentation is available at

http://www.automation.com/sitepages/pid121.php.

• Medical DeviceLink - a Web site associated with the

medical device industry provides a directory of North

American Suppliers of Automation and Custom

equipment and Software. See

http://www.devicelink.com/company98/category/Man

ufacturing_Equipment_and_Software/AutomationCus

tom_equipment.html.

• Automation Resources Inc. offers “online resources for

industrial automation, process control &

instrumentation” at www.automationtechies.com

• The Control and Information System Integrators

Association (CSIA) provides a search feature that

enables users to search for experienced CSIA member

integrators according to industry, application,

location, and service. See http://www.controlsys.org/

about/member_directory.htm.

Chapter 9: Summary

153

Figure 9.2. The solution. An infusion pump that

eliminates confusion.
The CSIA also provides a free, two-volume guide to

selecting and working with a systems integrator that covers

most aspects of finding the right systems integrators, and

highlights the nuances of navigating a project that

otherwise might be initially overlooked. These are

available at: http://www.controlsys.org/find/howto_guides.

C. Martin Hinckley’s book, Make No Mistake! An

Outcome Based Approach to Mistakee-Proofing,

7 contains

extensive descriptions of, and supplier information about,

sensors and other technologies that are useful in mistakeproofing.

A Path Forward

The discussion in these nine chapter has intoduced the

concept of mistake-proofing and provided a rationale for

using mistake-proofing to reduce errors in health care. It

has also delineated a set of concepts, a vocabulary, and

tools to assist organizations in taking action. This book

contains 150 examples provided by the health care

industry, as well as examples provided by manufacturing

industries and people in everyday life. Anecdotal evidence

indicates that, after they learn about mistake-proofing,

readers are more likely to start noticing mistake-proofing

examples around them and employ mistake-proofing to

develop solutions. Gosbee and Anderson8 found that root

cause analysis (RCA) teams who have been exposed to

human factors engineering case studies often change their

focus to “underlying design-related factors,” such as

mistake-proofing, as remedial actions. Initiating this

change in focus is the goal of this publication.

As you complete FMEAs and RCAs or witness errors, you

will envision new ways to solve problems and create novel

mistake-proofing devices. As these ideas are implemented

as locally developed mistake-proofing devices, please

spread the news of their existence. Submit them as

indicated below or publish them in some other venue so

that others can benefit from the solution. Modesty,

minimizing contributions, or assuming that others have

thought of a locally developed solution does not serve the

greater good. Some of the best mistake-proofing will be

exceptionally simple and inexpensive. All solutions will be

developed locally by someone before they become off-theshelf solutions. Be that someone.

Example Contributions

The examples presented here do not by any means

represent an exhaustive listing of devices currently in use.

Example contributions are welcome. Contribute mistakeproofing examples by visiting www.mistake-proofing.com

and clicking on “Submit Example.” Select the preferred

submission method and add to the database of mistakeproofing examples. Comments on the devices featured in

this book are also welcome.

References

1. Godfrey AB, Clapp TG, Nakajo T, et al. Error proofing

database. http://www.tx.ncsu.edu/errorproofing/. Accessed

September 2005.

2. Stewart DM, Melnyk SA. Effective process improvement:

developing poka-yoke processes. Production and

Inventory Management Journal. 2000;41(4):48-55.

3. Tsuda Y. Implications of fool proofing in the

manufacturing process. In: Kuo W, ed. Quality through

engineering design. New York: Elsevier; 1993.

4. Shingo S. Zero quality control: Source inspection and the

poka-yoke system. New York: Productivity Press; 1985.

5. Chase RB, Stewart DM. Mistake-proofing: designing

errors out. Portland, OR: Productivity Press; 1995.

6. Squire JC. Written communication. Virginia Military

Institute: July 2005.

7. Hinckley CM. Make no mistake. Portland, OR:

Productivity Press: 2001.

8. Gosbee J, Anderson T. Human factors engineering design

demonstrations can enlighten your RCA team. Qual Saf

Health Care 2003;(12):119-121.

Chapter 9: Summary

154
Acronyms

AAOS – American Academy of Orthopaedic Surgeons

AFDTM — Anticipatory failure determination

AHRQ – Agency for Healthcare Research and Quality

AOFAS – American Association of Foot and Ankle

Surgeons

CBC – Complete blood count

CDSS – Clinical decision support system

CFIT – Controlled flight into terrain

COW – Computer on wheels

CPOE – Computerized physician order entry

CRM – Crew resource management

CSIA – Control and Information System Integrators

DNR – Do not resuscitate

EMRF –European Magnetic Resonance Forum

EPINet – Exposure Prevention Information Network

FDA – Food and Drug Administration

FMEA – Failure Modes and Effects Analysis

FMECA – Failure Modes, Effects, and Criticality Analysis

FOD – Foreign object damage

GPS – Global positioning system

HFMEA – Healthcare Failure Modes and Effects Analysis 

IOM – Institute of Medicine

IV – Intravenous

JCAHO – The Joint Commission

LED – Light emitting diode

LEEP – Loop electrosurgical excision procedure

M&M – Morbidity and mortality

MRI – Magnetic resonance imaging

NAT – Nucleic acid test

NPSF – National Patient Safety Foundation

NWWSC – Northwest Wayne Skill Center

PMI – Pulse medical instrument

PSIC – Patient Safety Improvement Corps

QALY – Quality-adjusted life year

RCA – Root cause analysis

RPN – Risk priority number

SD – Solvent detergent

SOP – Standard operating procedure

SPC – Statistical process control

155



U.S. Department of Health and Human Services

Public Health Service 

Agency for Healthcare Research and Quality

540 Gaither Road

Rockville, MD 20850

AHRQ Publication No. 07-0020

May 2007

ISBN: 978-1-58763-247-1