NATIONAL COMMISSION ON

FORENSIC SCIENCE

Root Cause Analysis (RCA) in Forensic Science

Type of Work Product

Directive Recommendation developed by the Interim Solutions Subcommittee

Recommendation

It is recommended that appropriate root cause analysis protocols for all forensic science service 

providers (FSSPs) or forensic science medical providers (FSMPs) be adopted.

Statement of the Issue

The US Attorney General should direct the adoption of appropriate root cause analysis protocols 

for all forensic science service providers (FSSPs) or forensic science medical providers (FSMPs) 

that are part of the federal government or are receiving federal funds, and to establish policy for 

restoration procedures, that comply with the recommended root cause analysis process. 

Background

Forensic laboratories accredited under programs that adhere to the ISO/IEC 17025,

1 General 

requirements for the competence of testing and calibration laboratories, are required to “establish 

a policy and a procedure and shall designate appropriate authorities for implementing corrective 

action when nonconforming work or departures from the policies and procedures in the 

management system or technical operations have been identified.” A problem may be identified 

through a number of different techniques, including internal and external audits, reviews of the 

management system, customer feedback, or staff observations.

“Corrective actions” are potential solutions that eliminate or minimize the risk of repeating the 

nonconforming work or departure from policies and procedures. Corrective action is a requirement 

when any error or nonconformity is identified. To establish the best corrective actions, and as 

required by ISO 17025, an investigation is initiated to determine the root cause(s) of the situation 

or condition. Root Cause Analysis (RCA) is a critical step of determining corrective actions and 

may be the most important part of establishing proper corrective actions. 

Implementation Recommendations

Understanding that all human systems are fallible, and that hazards in a system can be minimized, 

the Department of Justice should encourage federal Forensic Science Service Providers (FSSPs) 

and Forensic Science Medical Providers (FSMPs) to consistently strive to be “high reliability 

organizations” and ensure a culture of constant self-monitoring and self-improvement by 

incorporating established practices of “just culture” and learning from error. To this end, the 

Department of Justice shall require its FSSPs and FSMPs to create and maintain protocols around 

 

1

ISO/IEC 17025:2005(E) (hereafter, ISO 17025), General requirements for the competence of testing and 

calibration laboratories, Section 4.11.2 Cause Analysis. “The procedure for corrective action shall start with an 

investigation to determine the root cause(s) of the problem.”
the conduct of Root Cause Analysis (RCA) to reduce adverse events.2 The Department or its 

designee will periodically review those RCA policies to ensure they include the following:

 Objective guidance as to when a RCA should be conducted;

 The regular provision of appropriate training to key personnel on how a RCA should be conducted;

 Training to all employees within the FSSP on RCA principles and processes, to enhance the quality 

of the RCA and its acceptance within the laboratory environment;

 Proper construction of the investigative team conducting a RCA;

 Definition of and procedures for an investigation that identifies the extent of adverse events and 

their causal factors in a blame-free environment, prioritizing continuous improvement of 

laboratory quality, safety and reliability by learning from adverse events;

 Recommendations that identify proactive action to minimize the chance of future recurrence of 

adverse events identified in the RCA; 

 Guidelines that define when and how to identify other cases that may have also been affected by 

an identical or similar adverse event, and the obligation to conduct a retrospective re-analysis of 

and address such cases;

 Communication of the existence of the adverse event to individuals impacted by the adverse event; 

 Provision of Safe Harbor to employees who report adverse events or near misses, including use 

immunity for participation in an RCA and limitations on the disclosure of materials generated in 

the course of an RCA;

 Implementation of interventions designed to minimize the chance of future similar adverse events 

and to appropriately redress injury caused by the adverse event; and 

 Documentation of both the adverse event(s) and the proposed interventions in a manner that does 

not reveal specific individuals or case information, and makes the learnings from the RCA publicly 

available for the review and benefit of other FSSPs and FSMPs.

Implementation Strategy 

The US Attorney General should collaborate with accepted accreditation and standards bodies for 

federal FSSPs and FSMPs to establish guidelines in compliance with the above for the design, 

implementation, and review of RCAs, and for the periodic review of protocols and procedures 

regarding RCAs that may be updated over time. In addition, the Human Factors Committee of the 

Forensic Science Standards Board within the Organization of Scientific Area Committees (OSAC) 

should be tasked with further exploration and periodic definition of best practices in RCA as 

applied to FSSPs and FSMPs. 

 

2 Different terms may be used for unplanned and/or unintended occurrences in human systems, including adverse 

events, adverse events/omissions, mistakes, nonconformities, etc. We have selected the term “adverse events,” 

which may include good faith or malfeasant behavior, for use in this document in the belief that it is the most 

objective and least judgmental of the various options. Our use of the term also includes “near misses,” or unplanned 

events that had the potential to result in injury or damage but did not do so due to a fortunate turn of events, as 

opposed to a deliberate system design.
Appendix A

Supporting Information and Examples of Root Cause Analysis

Despite the best intentions and best efforts of forensic science professionals, supervisors, and 

managers, adverse events will occur in forensic laboratories, as in any complex organization. It is 

the position of the National Commission on Forensic Science that all responsible forensic science 

providers should embrace and implement a just culture3of “learning from error” and continuous 

improvement to minimize the occurrence of adverse events and/or misconduct in the performance 

of forensic science services over time. This is true regardless of an organization’s history of error, 

since “[a]dverse events, like the number of adverse events, are poor indicators of the general safety 

of a system. . . . Safe organizations can still have bad adverse events, whereas unsafe systems can 

escape them for long periods. Furthermore, progress creates new risk that is difficult to anticipate 

but is a feature of new procedures and technologies.”4

Forensic laboratories accredited under programs that adhere to the ISO/IEC 17025 General 

requirements for the competence of testing and calibration laboratories are required to “establish 

a policy and a procedure and shall designate appropriate authorities for implementing corrective 

action when nonconforming work or departures from the policies and procedures in the 

management system or technical operations have been identified.” A problem may be identified 

through a number of different techniques, including internal and external audits, reviews of the 

management system, customer feedback, or staff observations.

“Corrective actions” are potential solutions that eliminate or minimize the risk of repeating the 

nonconforming work or departure from policies and procedures. Corrective action is a requirement 

when any error or nonconformity is identified. To establish the best corrective actions, and as 

required by ISO 17025,5an investigation is initiated to determine the root cause(s) of the situation 

or condition. Root Cause Analysis (RCA) is a critical step of determining corrective actions and 

may be the most important part of establishing proper corrective actions. 

ISO/IEC 17025 also requires laboratories to establish procedures to identify needed improvements 

and potential sources of nonconformities.

6

 This proactive process is termed “preventative action” 

and follows a similar process of Root Cause Analysis to identify the best solutions to prevent or 

minimize the chance of nonconformity from occurring.

 

3 A “just culture” can be defined as “a culture that recognizes that competent professionals make mistakes and 

acknowledges that even competent professionals will develop unhealthy norms (shortcuts, "routine rule violations"), 

but has zero tolerance for reckless behavior.” Agency for Healthcare Research & Quality Glossary, available at 

http://psnet.ahrq.gov/popup_glossary.aspx?name=justculture. 

4 Barach P, Berwick DM. Patient Safety and the reliability of health care systems. Ann Intern Med 2003, 

138(12):997-8. 

5

ISO/IEC 17025:2005(E) (hereafter, ISO 17025), General requirements for the competence of testing and 

calibration laboratories, Section 4.11.2 Cause Analysis. “The procedure for corrective action shall start with an 

investigation to determine the root cause(s) of the problem.”

6

ISO 17025, Section 4.11.3 Selection and implementation of corrective actions, “Where corrective action is needed, 

the laboratory shall identify potential corrective actions. It shall select and implement the action(s) most likely to 

eliminate the problem and to prevent recurrence.”
RCA has been used productively not only throughout the healthcare industry (including in clinical

and toxicology laboratories as well as other settings), but also in aviation, manufacturing and other 

quality-minded industries to conduct event reviews that lead to actionable change of policies and 

procedures to reduce the occurrence of adverse events or adverse events. The goal of RCA is to 

learn from adverse events and “near misses,”7and to implement proactive change in order to 

reduce further similar events that might compromise lab report or opinion integrity. An important 

feature of the RCA is that it is a blame-free analysis: “[b]laming and punishing for adverse events

that are made by well-intentioned people . . . drives the problem of iatrogenic harm underground 

and alienates people who are best placed to prevent such problems from recurring.”8

This document sets forth recommendations for the standardized use of RCA to identify why an 

error has occurred in a crime lab setting and make recommendations for the prevention of the 

future occurrence of similar adverse events.

Types of Adverse Events Susceptible to Root Cause Analysis and A Structure for Analyzing Causes.

One framework for evaluating adverse events has been provided by British researcher Dr. James 

Reasons. Dr. Reasons describes three different types of error: 

1. Decision error: One made because information, knowledge, or experience is lacking

2. Skill-based error: One made while engaged in a familiar task

3. Perceptual error: One made because input to one of the five senses is degraded or incomplete.

These errors typically fall into one of four categories:

1. Unsafe Acts: those performed by the operator

2. Preconditions for Unsafe Acts: environmental factors contributing to the error

3. Supervision: management actions affecting the operator

4. Organizational Influences: culture, policies, or procedures of the organization that affect the 

operator.

Dr. Reasons distinguishes adverse events from “violations,” which are “intentional departure[s]

from accepted practice.” Violations may be:

1. Routine violation: habitual, repeat departures, enabled by “bending of the rules.”

2. Exceptional violation: a willful departure outside norms, not condoned by management.

A structure for categorizing different causes of each of the categories of error follows.

 

7

For purposes of this document, an “adverse event” is defined as any occurrence or worsening of an undesirable 

or unintended consequence, including an abnormal laboratory finding, or outcome caused by or associated with a 

particular action by an FSSP or FSMP. A “near miss” is defined as unplanned event that did not result in injury, 

illness, or damage, but had the potential to do so. Only a fortunate break in the chain of events prevented an 

injury, fatality or damage.

8 Rinciman WB, Merry AF, Error, blame, and the law in health care – an antipodean perspective. Ann Intern Med. 

2003 Jun 17; 138(12):974-9.
Figure 1: Types of Unsafe Acts.

Figure 2. Causes of Preconditions for Unsafe Acts.

Unsafe Act

Errors

Skill-Based 

Error

Decision 

Error

Perceptual 

Error

Violations

Routine

Exceptional

Preconditions for 

Unsafe Acts

Environmental 

Factors

Physical 

Environment

Technological 

Environment

Personnel 

Factors

Communication/ 

Coordination/ 

Planning

Fitness for Duty

Conditions of the 

Operator

Adverse Mental 

State

Adverse 

Physiological 

State

Chronic 

Performance 

Limitation
Figure 3. Causes for Adverse events of Supervision.

Figure 4. Causes of Undue Organizations Influences.

How should an RCA be conducted?

It cannot be emphasized enough that RCAs are event reviews, not performance evaluations, 

and their purpose is learning, not punishment. Accordingly, personnel and discipline issues 

should be handled through a separate process from RCA. In many contexts, including 

transportation and healthcare, the activities and output of an RCA are inadmissible as evidence 

and excluded from discovery in litigation to ensure this purity of purpose. The “just culture” focus 

of the RCA creates shared accountability: the system is responsible for providing an environment 

that is optimally designed for safe care and staff is responsible for their choices of behavior and 

for reporting system vulnerabilities.9

While specific recommendations for the conduct of RCAs may differ, a few themes emerge from 

review of RCAs across industries:

 Construction. RCAs should be performed by a team.

 

9 Agrawal, A, Patient Safety: A Case-based Comprehensive Guide, 2014. 

Supervision

Inadequate 

Supervision

Inappropriate 

Planned 

Operations

Failure to 

Address a 

Known Problem

Supervisory 

Violation

Organizational 

Influences

Resource ManagementOrganizational 

Climate

Organizational 

Process
o RCAs often work best when performed by multidisciplinary teams of 4-10 members, from all 

levels of staff, with fundamental knowledge of the specific area involved.

o The team should have people who were not involved with the specific incident to ensure 

objectivity in the review

o A facilitator should be appointed who was not directly implicated in the incident.

 Investigation. The event should be analyzed for its causal factors.

o Detailed review of the event by the team

o Identify problems – what went wrong

 Is this a one-time adverse event or a recurring error?

o Identify Root Causes/Contributing Factors – why it went wrong

 Focus on objective causes and minimize “bad apple” causation conclusions where possible

o Prioritize the factors that contributed to the harm, evaluating both their severity and the 

probability that these factors will cause harm in the future

o Develop interventions that conform with the prioritization and likelihood of repetition of the 

various factors

 Recommendation. The team should make specific, prioritized recommendations for 

interventions that are intended to prevent occurrences of similar events. These recommendations 

should be made in writing and stored for future review as needed.

 Implementation. Implement those interventions, considering the quality of analysis, the cost of 

the suggested interventions, and their likely real-world impact on safety and reliability

 Evaluation. Evaluate the interventions and take subsequent additional action as needed.

 Professional Standards and a “Just Culture.” A “Just Culture” is one that balances blame-free 

event reviews with the need for professionals, including FSSPs, to be personally accountable for 

adherence to reasonable standards of professional conduct. Typically, this involves the creation 

of a separate disciplinary process, managed outside the RCA process, in the event that the RCA 

uncovers evidence of intentional wrongdoing by any individual. A sample tool to assess the 

necessity of such a parallel disciplinary process used in a hospital setting is attached. 

To preserve the integrity of the RCA as a blame-free event review, it is important that any 

disciplinary process be additional to, and separate from, the RCA, and that the individual in charge 

of making determinations about disciplinary action be informed by, but not reporting to or involved 

in, the RCA itself. 

Three Examples of Root Cause Analysis Deployed in Laboratory Environments. For purposes 

of illustration and discussion, three separate implementations of RCAs used today are described 
briefly below. This document does not express any opinion or judgment on the completeness or 

utility of any of the approaches.

1. Veterans Health Administration. An example of the RCA process implemented at the Veterans’ 

Health Administration (VHA) is shown in Figure 5 below:

Figure 5. Root Cause Analysis at Veterans Health Administration.

2. FBI Laboratory. Another example can be seen in the corrective action process used by the FBI 

Laboratory Quality Assurance and Training Unit (QATU):

1. Chief of QATU receives a Corrective Action Request or Follow-Up Request

2. Determine if “nonconformity” is “significant condition adverse to quality”

3. Assign someone to manage the corrective action

4. Determine adequacy of corrective action plan

5. Verify effectiveness of corrective action

6. Track progress of corrective action

7. Perform verification and certify

8. Nonconformities might include Analytical/interpretive adverse events in:

a. Casework

b. DNA databasing

c. Proficiency Tests

9. Managing a nonconformity means:

a. Determine root cause of nonconformity

b. Plan and implement corrective actions to remediate and prevent recurrence of nonconformity

c. Provide objective evidence of corrective action completion to QATU

10. Corrective Actions include:

a. Remedial training

b. Supplemental proficiency test

c. Notifying casework lab or contributors

Adverse Event 

Occurs

Implement Actions 

and Examine 

Outcomes for 

Effectiveness

Safety Manager 

Notified

Safety Manager 

Assigns SAC Score 

to Event

Safety Manager 

Charters 

Interdisciplinary 

Team

Gather and 

Analyze Info 

Leading to AE

Determine Root 

Cause and 

Contributing 

Factors

Determine 

Actions to 

Address Root 

Cause

Determine How to 

Measure 

Outcomes

Present Analysis 

and Proposed 

Actions to 

Leadership
d. Issuing amended or supplemental reports or DNA match confirmation letters

e. Removing individual from casework, etc.

3. Washington, DC Department of Forensic Science. A third example of a RCA has been adopted 

by the Washington, DC Department of Forensic Science.10 It blends a number of quality initiatives 

borrowed from other industries. 

Figure 6. RCA Process Used in Washington DC Dept. of Forensic Science

In Step 1, the RCA team agrees on a Problem Statement, a concise, complete, and accurate single 

sentence describing what the problem (nonconformity) is. Examples may include:

• The proficiency test was not passed.

• The case jacket is missing documentation.

• The wrong individual was identified.

• The sample was contaminated.

• The wrong results were reported.

The problem statement is central to the RCA: it acts as the reference point and compass for the 

analysis. It should be understood and agreed upon by all members of the RCA team. Solutions 

should not be offered at this stage of the process. 

In Step 2, the RCA team engages in a simple exercise known as the “5 Whys” approach. Starting 

with the problem statement, the team asks “Why (did this process fail)?” repeatedly until the root 

cause is identified. For example:

Problem statement: The analysis of a sample/specimen was not completed by the deadline. 

 

10 The graphic in Figure 6 and much of the following section were originally presented by Dr. Max Houck, Director, 

Washington DC Department of Forensic Science, at the 2015 American Academy of Forensic Science.

1

2

3

4

5

6

7
1. Why? The instrument failed to complete the run.

2. Why? The instrument ran out of carrier gas. 

3. Why? The tank of carrier gas emptied mid-run.

4. Why? More gas was not ordered.

5. Why? An employee forgot to order more gas.

Note that these questions generate a recommendation for a new process that will help avoid an 

undesired situation in the future, rather than simply blaming a forgetful employee.

The ability of the “5 Whys” to lead to a clear solution to the problem is affected by the complexity 

of the problem and its causative factors. Step 3 of the RCA decision framework sorts a root cause 

into one of four contexts defined by the nature of the cause and effect:

• Simple: Stability, clear cause-and-effect relationships; the “right” answer is often obvious. 

• Complicated: Clear cause-and-effect relationship but not immediately obvious; at least one “right” 

answer exists; requires expertise; testing may be required to obtain necessary information; better 

practices, rather than best, may be appropriate.

• Complex: Unpredictable; no one “right” answer may exist; “adequate” may be the best answer; 

answers reveal themselves upon exploration.

• Chaotic: Searching for the right answer is pointless; turbulence predominates; cause-and-effect 

relationships are impossible to determine due to constant change and flux.

Once proposed resolutions or modifications to the system have been generated, the RCA team 

moves to Step 4, the Remediation stage. Also known as a corrective or preventative action, 

remediation sets in place actions and processes intended to stop and prevent the root cause that 

lead to the problem. 

• Corrective actions are responsive to an event

• Preventative actions are predictive and are meant to stop a problem before it occurs. 

Remediations can take many forms. Often, there are more remediations than nonconformities –

or, put differently, the team may generate more solutions than problems. In the proficiency test 

example, there might be several remediations suggested, such as: 

• Request more gas with each order placed,

• Create a calendar reminder to send a message to an employee to order more gas,

• Work with the vendor to schedule deliveries

Once the remediations are in place, the RCA team moves to Step 5, in which it solicits feedback

on the effects of the remediation. Feedback is necessary to inform the system about the results of 

the solution attempted, the remediation. The results of a remediation attempt will inform whether 

it was successful or not and, if so, to what degree. 

If the remediation is appropriately successful and the team is satisfied with the results, in Step 6 

the original process can resume with the remediated changes in place. Clear criteria for resuming 

the process must be established and agreed upon by the team prior to the remediation. In Step 7, 

periodic checks should be made to provide feedback on the continual prevention of the 

nonconformity to ensure that the remediation continues to prevent the nonconformity. The 

periodicity should be relevant and meaningful to the remediation and the timing of the new process. 
Documentation/Implementation of Improvement. 

ISO/IEC 17025 requires all selected changes resulting from corrective action investigations be 

documented and implemented. In addition, laboratories are required to monitor the results of the 

corrective actions to ensure the effectiveness of the solutions; this monitoring should similarly be

documented. 

In the criminal justice context, documentation and implementation of corrective action should 

include the obligation on the part of the panel conducting the RCA to communicate the adverse 

event to individuals or agencies involved in casework that may have been affected by the adverse 

event.

11 This duty extends to other individuals who may be similarly situated to those directly 

affected by the adverse event that has been discovered. For example, an RCA could be performed 

on an adverse error regarding the miscalibration of an instrument used to assess blood tests in a 

single DUI case. If an error is discovered, it would lead to an obligation to identify all others who 

might be affected by the miscalibration and inform them about the re-evaluation of their cases.

Not all adverse events affect casework, but when they do, it is important to note that the life and 

liberty of a human being may be (or may not be) affected. For this reason, forensic science service 

providers have a duty to correct the impact of the adverse event, which should include a new, 

amended, or supplemental report with the correct results and an explanation of the initiating 

adverse event distributed to the various parties in a case. The FSSP must work with the proper 

legal authority to identify and notify all individuals whose cases were affected by the adverse 

event/error, and should participate in the suitable remedy as appropriate.

Training of Personnel to Conduct RCAs. 

Root cause analysis may be the most difficult part of establishing proper corrective actions 

following a nonconformity. By becoming proficient at investigating and solving problems of 

nonconformity in their work, a laboratory will ultimately need to conduct fewer investigations. 

But if done inappropriately, a root cause analysis investigation may lead to the inadvertent blame 

of individuals instead of identifying where a work process has broken down. Such blame will be 

detrimental to encouraging participation in the root cause analysis process.

A study that evaluated an aggregated group of RCAs in the healthcare setting identified lack of 

time (55%), unwilling colleagues (34%) and inter-professional differences (31%) as the top three 

barriers to RCAs.12 Each of these barriers can be addressed, at least in part, by experienced 

facilitation and support from senior management within the organization.

Accordingly, a recommendation is made to establish key individuals within a forensic laboratory 

to serve as facilitators of root cause panels. Characteristics of successful RCA facilitators will 

likely include, but may not be limited to: 

 Must be interested in facilitating and documenting problems

 Must have excellent listening skills

 Must be naturally inquisitive

 

11 Note that corrective tests may correct errors from which inferences of guilt or innocence may be drawn.

12 Bowie, Paul, Skinner, J. and de Wet, C. Training health care professionals in root cause analysis: a crosssectional study of post-training experiences, benefits, and attitudes. BMC Health Services Research 2013, 13:50. 
 Must be comfortable speaking in front of a group

 Must be detailed oriented

 Must have a relatively calm disposition

 Must have a good rapport with front-line personnel and management

Once selected, these individuals should be required to receive annual specialized training on the 

topic of root cause analysis to include practice in running group facilitations.

When Should an RCA Be Conducted?

Properly done, RCAs can be time-consuming team activities that include: investigation of facts 

and circumstances that caused or contributed to the adverse event; development of interventions 

that should minimize the chance of future similar adverse events, implementation of those 

interventions, and evaluation of the impact of the interventions. As such, they should be deployed 

with an eye towards the severity and risk of the problem. 

Some laboratories, including the FBI Laboratory, categorize nonconformities in their work product 

as Level 1 or Level 2. Level 1 nonconformities are situations or conditions that directly affect and 

have a fundamental impact on the quality of the work product or the integrity of evidence. Level 

2 nonconformities are situations or conditions that may affect the quality of the work, but does not, 

to any significant degree, affect the fundamental reliability of the work product or the integrity of 

the evidence.

The Veterans’ Health Administration (VHA) uses a somewhat different approach, evaluating 

whether a RCA is needed every time a “Serious Adverse Event” has occurred.13 This is done 

through a Safety Assessment Code (SAC) Matrix that balances the severity of an error (measured 

by its impact on the patient and levels of patient care) with the frequency of the error occurring:

 

13 A “near miss” should be included for RCA review if its score qualifies when viewed as if the event had actually 

occurred.
Table 1. Veterans’ Health Administration Safety Assessment Code (SAC) Matrix.

RCAs should be conducted both on actual adverse events and on adverse events that could have 

occurred but for a fortuitous intervention or timely discovery. Such interventions are called “near 

misses,” and they should be scored in the SAC Matrix as if they were an event that actually 

occurred. Such reviews of near misses or “close calls” are valuable “because they occur much

more frequently than adverse or reviewable sentinel events and do not require harm to a patient 

before learning can occur.”14 Indeed, “the absence of safety, like poor health, is clearly signaled 

by near misses, injuries, and fatalities, which lend themselves to close analysis and 

quantification.”15

It is also important that the RCA process include steps designed to understand whether or not the 

error has been repeated, and if so, the extent of the adverse events. An example would be the use 

of an improper reagent in a chemical test – appropriate auditing should be conducted to ensure 

what other tests, if any, might have been similarly compromised by the improper reagent. Another 

example might be the calibration of lab equipment, which would require a review of all tests 

conducted between the dates of the last calibration and the discovery of the error.

Creating a “Safe Harbor” to Encourage Transparency and Reporting of Error

It has been shown in numerous settings that providing a “safe” environment – that is, an 

environment that encourages and prevents negative use of important quality and/or reliability 

information – enhances participation in RCAs, and thus improves both their frequency and their 

substance.

 

14 Bagian, James et al., The Veterans Affairs Root Cause Analysis System in Action. Journal on Quality 

Improvement, 2002, Vol. 28 No. 10, 531 – 545, at 531.

15 Making Sense of Root Cause Analysis Investigations of Surgery-Related Adverse Events, Cassin, Bryce R., 

Barach, Paul R., Surg Clin N Am. 92 (2012) 101-115.

Severity Probability

Catastrophic:

Death/Permanent 

loss of function

Major: 

Permanent 

lessening of 

functions unrelated 

to course of illness

Moderate: 

Increased LOS or 

level of patient care

Minor: No 

injury, no increased 

LOS or level of 

patient care

Frequent: Likely to reoccur 

multiple times in 1 yr

3 3 2 1

Occasional: May occur 

several times in 1-2 yrs

3 2 1 1

Uncommon: May happen 

once in 2-5 yrs

3 2 1 1

Remote: May happen once 

in 5+ yrs

3 2 1 1

Must Conduct a RCA for a 3, May Conduct a RCA for a 2, Unlikely to Conduct for a 1
The key characteristics of such a Safe Harbor include:

(1) Qualified Immunity for Participants.

a. An individual should not be disciplined in any way for participating in a RCA, or offering a candid 

and good faith assessment of the role of others in an incident under review.

b. In addition, an individual who reports an error should receive positive consideration from any 

disciplinary body if the individual self-reports an error within a reasonable time after the incident 

(e.g., 10 days). Note that this does not protect the individual from any liability that may accrue for 

the individual’s role in the error, though the FSSP should consider the positive impact of the selfreported information in its assessment of any necessary punishment.

(2) Protection from discovery for Notes, Minutes, Correspondence, and/or Reports generated as part 

of an RCA. In order to ensure that the RCA is an event review only, designed to learn from error 

and improve upstream processes, materials generated as part of an RCA should not, generally 

speaking, be discoverable in civil or criminal litigation related to the incident. This is in keeping 

with Peer Review Protection Acts that hold healthcare event reviews as undiscoverable in 46 states 

throughout the United States.16

(3) Nothing in this safe harbor should be viewed as limiting the discovery rights of individuals to 

information about the underlying facts related to an adverse event. The purpose of the safe harbor 

is merely to ensure that no one is penalized as a result of his or her participation in a valuable event 

review designed to improve the fair administration of justice.

 

16 To the extent an error justifying a RCA occurs in a criminal case, the defendant may have enhanced rights to learn 

about the results of the RCA as part of his/her criminal defense. Such an issue can be managed by the court of 

relevant jurisdiction on a case-by-case basis, with the information that the Attorney General views the protection of 

RCA work product to be an important public interest that does not preclude any discovery sought by the defendant 

on the underlying facts at issue.