ECRI Milbank Memorial Fund

Proactive Hazard Analysis and Health Care Policy

John E. McDonough

September 2002

(To request a bound copy of this report, click here.
To print this report click here for the pdf version.
To see a complete list of Milbank reports, click here).

Table of Contents

Executive Summary
Failure Mode and Effect Analysis (FMEA) and Healthcare Failure Mode and Effect Analysis (HFMEA)
Hazard Analysis and Critical Control Points (HACCP)
Toward Broader Health Care Use of Hazard Analysis
Summary of ECRI/Milbank Policy Conversation, February 26–27, 2002
Appendix: Participants in Policy Conversation, February 26–27, 2002


Organizations in the private and public sectors have in recent decades devised effective methods to eliminate or minimize hazards in such risk-laden activities as maintaining the health of astronauts in space, manufacturing automobiles, and preventing the transmission of food-borne disease. These methods, called proactive hazard analysis (or proactive risk assessment), could also protect the health and safety of patients and the health care workforce. The Veterans Health Administration (VHA) and the Joint Commission on the Accreditation of Healthcare Organizations (JCAHO) have begun to adapt proactive hazard analysis to hospital care.

ECRI and the Milbank Memorial Fund are collaborating to promote discussion about the use of proactive hazard analysis in health care settings. ECRI, a Collaborating Center of the World Health Organization, is a nonprofit medical technology assessment and risk management organization. Its work in proactive hazard analysis, building on more than three decades of analogous experience, is being applied in a variety of patient care settings in the United States and abroad. The Fund is an endowed philanthropic foundation, established in 1905, that works with decision makers in the public and private sectors on significant issues in policy for health care and public health. Fund staff learned about proactive hazard analysis in 2000, when senior policymakers in the U.S. Department of Agriculture requested their assistance in resolving issues that had arisen in the final stages of implementing its use to prevent food-borne illness as a result of the processing of meat, poultry, and eggs.

We convened clinicians, hospital leaders and health researchers, persons experienced in proactive hazard analysis, and representatives of four federal agencies, of state government, and of JCAHO. An earlier draft of this report was a background paper for this meeting. The author, John McDonough, a former legislative leader in Massachusetts, is currently a faculty member at Brandeis University and a program officer of the Fund. He has published books and articles on regulation in the health sector and on politics.

Participants in the meeting addressed the potential value of proactive hazard analysis to prevent pain and suffering among patients and persons who take care of them in hospital and ambulatory settings. We organized the agenda around three compelling issues: the safety of patients experiencing invasive procedures; preventing errors in ambulatory and home care; and reducing illness among patients with sensitive organs and immune systems.

These questions received the most attention at the meeting:

This report summarizes the results of the meeting as well as the history of two approaches to proactive hazard analysis. During the meeting, we heard a consensus develop that either approach could improve the care of patients (though there were advocates of each of them), that it is not yet clear how best to introduce proactive hazard analysis into the health sector, and that because successful use of either approach should reduce reimbursement to treat the results of treatment errors, payers should offer providers financial incentives to introduce it.

We are grateful to the persons who reviewed the report, before and after the meeting. Reviewers who also attended the meeting are listed in the Appendix, other reviewers in the Acknowledgments.

Daniel M. Fox
Milbank Memorial Fund

Jeffrey C. Lerner
President and CEO


The following persons reviewed a first draft of this report in June of 2001. They are listed in the positions they held at the time of their participation.

Robert Crane, Senior Vice President and Director, Kaiser Permanente, Oakland, Calif.; Philip S. Derfler, Deputy Administrator, Policy and Development, Food Safety and Inspection Service, U.S. Department of Agriculture, Washington, D.C.; Robert A. Derzon, Senior Vice President, Lewin Associates, Mill Valley, Calif.; Lynn Etheredge, Consultant, Health Insurance Reform Project, George Washington University, Washington, D.C.; Carol Tucker Foreman, Distinguished Fellow and Director, Food Policy Institute, Consumer Federation of America, Washington, D.C.; Velvet Miller, President and CEO, Horizon Mercy, Trenton, N.J.; Joan Mondschein, Tucson, Ariz.; Elaine Power, Vice President of Programs, The National Quality Forum, Washington, D.C.; Carl Schramm, President, Greenspring Advisors, Inc., Baltimore, Md.

Participants in the meeting of February 2002 referred to in this report reviewed a revised draft of the manuscript. They are listed in the appendix. Robert M. Dickler, Senior Vice President for Health Affairs, Association of American Medical Colleges, Ann Arbor, Mich., and Catherine E. Woteki, Dean, College of Agriculture, Iowa State University, Ames, also reviewed this revised draft.

Executive Summary

Proactive hazard analysis (also called proactive risk assessment) is an approach to identifying and eliminating or minimizing hazards that has proven useful in manufacturing and food sectors, and is beginning to be used in medical care. The Veterans Health Administration (VHA) and the Joint Commission on the Accreditation of Healthcare Organizations (JCAHO) have pioneered adaptations of this approach to hospital care. Proactive hazard analysis (PHA) takes many forms and has the potential to enhance patient safety. Different forms of proactive hazard analysis are employed in industries outside health care, most of which are voluntary; one such program, Hazard Analysis and Critical Control Points (HACCP), has a regulatory stimulus. It is useful for policymakers to become familiar with some history and types of this approach. This paper describes two of the more prominent forms, Failure Mode and Effect Analysis (FMEA) and HACCP, and presents results from a policy conversation on proactive hazard analysis held in Philadelphia, Pennsylvania, in February 2002.


Medical error prevention and patient safety have been important topics in U.S. health care policy for professionals and policymakers at least since the publication of the Harvard Medical Malpractice study in 1990.1 Interest in error prevention and patient safety became significant concerns for the public as well with the publication in 1999 of a report by the Institute of Medicine (IOM) titled To Err Is Human: Building a Safer Health System.2

The broader field of health care quality underwent a transformation in the early 1990s. Prior to that decade, the prevailing paradigm was known as quality assurance, based on an assumption that quality already exists and that government, institutions, and professionals simply needed to police their turfs effectively to weed out "bad apples," an approach bolstered by an aggressive trial bar and medical malpractice system. In 1989, a seminal article published in the New England Journal of Medicine proposed a new paradigm for health care quality, borrowed from the manufacturing sector and embodied in the term total quality management (TQM).3 Applied to health and medical care, TQM is most familiarly known as continuous quality improvement (CQI) and suggests that all organizations, no matter how good or bad, have multiple opportunities to improve quality by adopting a proactive, data-driven, and preventive approach rooted in customer satisfaction.4 Thus the paradigm assurance was replaced by a new paradigm, improvement.

TQM/CQI approaches can be applied to any aspect of any health care organization, from scheduling appointments to improving billing procedures or enhancing operating-room efficiency. Professionals concerned with patient safety have found that more prescriptive and rigorous approaches are needed to establish systems to prevent life- and injury-threatening errors in medical care. Thus, patient safety may be regarded as a subset of the broader issues involved in the delivery of "quality" health care. As noted in the Institute of Medicine's 2001 report Crossing the Quality Chasm, safety is just one of six vital attributes of quality; the other five are patient centeredness, timeliness, efficacy, equity, and efficiency. 5

To address hazard and safety concerns, some health leaders have looked to nonhealth industries for models that can be applied successfully to medical systems. Aviation, manufacturing, food service, nuclear power plants, aircraft carriers—all have provided ideas and lessons.6 From these sources, health professionals have discovered frameworks that offer strategies and tools consistent with the needs of large clinical institutions. One prominent approach, called Failure Mode and Effect Analysis (FMEA), has been used in manufacturing for more than 30 years. An adaptation of FMEA specifically designed for health care organizations, Healthcare Failure Mode and Effect Analysis (HFMEA), is now being introduced to medical care through the leadership of the Veterans Administration's National Center for Patient Safety (NCPS), which is applying this model throughout its system.7 Also, in 2000 the Joint Commission on Accreditation of Healthcare Organizations (JCAHO) issued a new standard for all accredited hospitals to complete at least one "proactive risk assessment" of a high-risk process per year. While JCAHO did not specify FMEA or HFMEA, its own approach to fulfilling this requirement is built on the terminology and structure of these two existing models. The first such survey was to be completed by July 1, 2002. As a result, many U.S. hospital personnel are now taking crash courses in FMEA or HFMEA.

Another form of proactive hazard analysis, Hazard Analysis and Critical Control Points (HACCP), also provides a useful framework for improving safety. HACCP is used widely in food production and food services worldwide, and is now being used in medical-device manufacturing. HACCP differs from FMEA-based approaches in a number of details, but is significant in this report because of its long and extensive relationship with public-sector regulation, a relationship that has included both successes and challenges. As such, it provides insight in addressing a key question: Should a process to improve patient safety be incorporated into the oversight of health care, and if so, how should that be accomplished?

While both FMEA and HACCP developed independently of each other and within different sectors, they share a common purpose: to identify and analyze hazards and potential risks in products, processes, or services, and to prevent or mitigate their occurrence. In February 2002, the Milbank Memorial Fund and ECRI (formerly the Emergency Care Research Institute), a nonprofit organization with expertise in health care risk management and patient safety, convened a policy conversation in Philadelphia, Pennsylvania, with experts in risk management, HFMEA, and HACCP, along with others in relevant fields, to discuss the potential for broader application of proactive hazard analysis to medical care, as well as related issues of health care regulation. A summary of the conversation is included toward the end of this report. Quotes cited in this report were made by participants in the sessions.

Failure Mode and Effect Analysis (FMEA) and Healthcare Failure Mode and Effect Analysis (HFMEA)

FMEA is a tool to evaluate potential failures and their causes. The tool is then used to prioritize potential failures according to their risk, pointing to actions to eliminate or reduce the likelihood of occurrence. FMEA provides a methodology to document the analysis for future use and for continuous process improvement. By itself, FMEA is not a solution; rather, it is used in combination with other problem-solving tools to eliminate or reduce risk.

The principal steps in the FMEA process are:

The FMEA process was developed in the U.S. military in 1949 (MIL–P–1629) as a reliability evaluation technique to determine the effect of system and equipment failures. Failures were classified according to their impact on mission success and personnel/equipment safety.9 FMEA was adapted for the National Aeronautics and Space Administration (NASA) in the 1960s for the Apollo space program to facilitate the process of predicting failures, planning preventive measures, estimating the cost of failures, and planning redundant systems or system responses to failures. In the 1960s and 1970s, the tool was noticed and tested by reliability engineers in U.S. manufacturing plants. The Automotive Industry Action Group, including General Motors, Ford, and Chrysler, copyrighted industrywide FMEA standards in 1993—including design and process FMEAs—and imposed these requirements on themselves and their suppliers.10 The FMEA tool is now used widely in industries such as aviation, chemicals, nuclear power, and aerospace.

The Veterans Health Administration pioneered the adaptation of FMEA and other industrial process control tools to patient safety. In 1998, the VHA established the National Center for Patient Safety (NCPS) to coordinate and lead the development and implementation of a patient safety program intended to create a culture of safety in its hospital system. In 1999, four Patient Safety Centers of Inquiry were funded, each with a primary focus on a different research aspect to investigate vulnerabilities in patient care processes and explore improvements. NCPS, in collaboration with quality and risk managers as well as others, developed a patient safety handbook to provide direct, didactic, problem-based learning to front-line personnel of all VHA facilities.11 The handbook includes definitions, instruction on a systematized method of prioritizing patient safety issues, and education on root-cause analysis (RCA) and FMEA.12 The VHA, with assistance from the director of risk assessment and loss prevention at Tenet HealthSystem, developed Healthcare Failure Mode and Effect Analysis (HFMEA) as "a systematic approach to identify and prevent product and process problems before they occur."13

Five key steps are involved in conducting an HFMEA analysis (see also table 1):

  1. Define the HFMEA topic. This should include a clear definition of the process to be studied.
  2. Assemble the HFMEA team. The personnel should be multidisciplinary and include subject matter experts and an adviser.
  3. Graphically describe the process. Develop a flow diagram; number each process step; identify the area of the process to focus on; identify all sub-processes; create a flow diagram of the sub-process.
  4. Conduct a failure analysis. List all possible failure modes under the key sub-process; determine the severity and probability of each potential failure mode; use a Decision Tree to determine if the failure mode warrants further action; list all failure mode causes where the decision has been made to proceed.
  5. Evaluate actions and outcome measures. Determine if you want to eliminate, control, or accept each failure mode cause; identify a description of action for each failure mode to be controlled or eliminated; identify outcome measures to test the redesigned process; identify an individual responsible for completing the action; indicate whether top management concurs with the recommended action.14

In November 2000, the Joint Commission on Accreditation of Healthcare Organizations announced new standards, which became effective on July 1, 2001, requiring all accredited hospitals to complete at least one "proactive risk assessment" of a high-risk process per year. While JCAHO's standard does not require a hospital to use FMEA or HFMEA, much FMEA/HFMEA terminology is built into the intent of the JCAHO standard.15 As a result, U.S. hospitals are moving to grasp the fundamentals of FMEA/HFMEA, root-cause analysis, and other risk assessment tools. Unlike root-cause analysis, which is also required by JCAHO in connection with the occurrence of sentinel events,a a proactive risk assessment is conducted before an adverse event occurs. The new JCAHO standard (LD.5.2) requires hospitals to take the following set of eight actions:

  • Select at least one high-risk process for proactive risk assessment annually, based in part on JCAHO information identifying most frequently occurring types of sentinel events and risk factors.
  • Identify steps within the process where potential problems or failure modes may occur.
  • For each failure mode, identify possible effects on patients and how serious each effect could be.
  • For most critical effects, conduct a root-cause analysis to determine why failure modes may occur.b
  • Redesign the process to minimize risks of the failure modes or to protect patients from their effects.
  • Test and implement the redesigned process.
  • Identify and implement measures to monitor the effectiveness of the redesigned process.
  • Implement a strategy to maintain process effectiveness over time.16

Hazard Analysis and Critical Control Points (HACCP)

HACCP is a "systematic approach to the identification, assessment, and control of hazards."17 Some definitions directly reference food safety, reflecting the predominant use to date of the HACCP approach in the food sector; other definitions are more generic: "a step-by-step approach to the identification and assessment of hazards and risks associated with the manufacture, distribution, and use of products."18 Hazard refers to any part of a production chain or a product that has the potential to cause a safety problem. Analysis is the identification and assessment of the seriousness and likelihood of occurrence of a hazard. A Critical Control Point is a point, step, or procedure at which control can be exercised to prevent, eliminate, or minimize a hazard.

Seven steps form the core of the HACCP approach (see also the preliminary steps of forming a team, etc., listed in table 1):

  1. Conduct a hazard analysis, preparing a list of steps in a process where significant hazards occur and identifying preventive measures.
  2. Identify critical control points—steps at which controls can be applied to prevent, eliminate, or reduce to acceptable levels a safety hazard.
  3. Establish critical limits for preventive measures associated with each identified critical control point.
  4. Establish monitoring requirements for each critical control point, and procedures to monitor results to adjust the process and maintain control.
  5. Establish corrective actions to be taken when a critical limit deviation occurs.
  6. Establish procedures to verify on an ongoing basis that the HACCP system is working correctly.
  7. Establish record-keeping procedures to document the HACCP system.19

Figure 1 provides a simple illustration of the HACCP method applied to preparing infant formula for feeding.

As with FMEA, HACCP has roots in the U.S. aerospace industry, and was developed by the Pillsbury Company in 1959 to ensure the safety of food in the new U.S. space program. Because the lives of astronauts who developed food poisoning in space would be in serious danger, NASA requested the creation of a preventive process to guarantee the quality and purity of food. HACCP was the result.

HACCP was first described publicly in 1971 at the National Conference on Food Protection.20 After a public outcry following a botulism outbreak involving canned soups, the U.S. Food and Drug Administration (FDA) mandated the first use of HACCP by regulation in 1973 for all low-acid canned foods. Reviewing the successful implementation of this regulation, the National Research Council (NRC) in a 1985 report reached four conclusions:

  1. Industry and government worked cooperatively to develop effective monitoring procedures for Critical Control Points.
  2. FDA required that supervision be conducted only by persons who had completed FDA-approved courses.
  3. FDA inspectors were trained in the elements of HACCP.
  4. Use of HACCP was mandated by federal regulation.

The NRC report broke new ground by recommending widespread use of HACCP in all food groups, including meat and poultry, seafood, dairy products, fruits and vegetables, beverages, and more. The Council also called for extending HACCP to the food-service industry.21

Growing public awareness of the threat of microbiological pathogens in foods and deaths from outbreaks of food-borne illness, such as one involving hamburgers tainted with E. coli O157:H7 at restaurants in the Pacific Northwest in late 1992, prompted additional federal action. The U.S. Department of Agriculture (USDA) embraced HACCP as a science-based alternative to nine decades during which federal inspectors, in the industry phrase, "poked and sniffed"; that is, they conducted only visual evaluation of each slaughtered carcass. In 1994, the FDA announced plans to require use of HACCP in the seafood industry beginning in 1997. In 1995, the USDA announced plans to require HACCP in all meat and poultry plants under its jurisdiction beginning in 1998 to replace the "poke and sniff" method. In 1998, FDA announced plans for HACCP implementation for all fruit and vegetable beverages, and is now considering establishing HACCP as the food safety process standard throughout all segments of the food industry under its authority. Beginning in 1999, FDA incorporated HACCP into the Food Code, the biennially published reference for the prevention of food-borne illness in restaurants, grocery stores, and institutions such as nursing homes and hospitals. Since the Food Code serves as model legislation for all states and territories, many state governments now require evidence of HACCP processes for establishments under their purview.

No scientifically controlled studies have been performed comparing foods managed under HACCP processes versus control groups. Nonetheless, use of HACCP to improve food safety appears to produce measurable and positive results across a spectrum of differing work situations and environments. Both the U.S. Centers for Disease Control and Prevention (CDC) and the USDA have released data showing progress in reducing food-borne pathogens, which are estimated to cause 76 million illnesses and 5,000 deaths per year.22 Since 1996 the CDC has collected data on incidence of food-borne illnesses, now covering nine sites and 37.8 million persons; their 2001 FoodNet data show that the estimated incidence of infections caused by four key pathogens (Campylobacter, E. coli O157:H7, Listeria, and Salmonella) was 21 percent lower than in 1996.23 The USDA program, prior to 1996 HACCP implementation, established baseline prevalence levels for the presence of microbial organisms such as salmonella in meat and poultry. USDA data released in 2000 and 2001 showed significant reductions in bacterial levels across a variety of food products following HACCP implementation.24 Numerous academic researchers have also found evidence documenting the usefulness of HACCP in reducing the levels of food-borne pathogens in food production and food service.25

However, HACCP implementation by the two key U.S. food regulatory agencies—FDA and the Food Safety and Inspection Service (FSIS) of USDA—has been challenging. The FDA regulates all foods except for meat, poultry, and some eggs, which are under the purview of the USDA, and does so with a fraction of the monitoring resources available to its sister agency. The FDA has faced diminishing inspectional resources as domestic and international food markets have rapidly expanded. While HACCP shifts a greater inspectional burden to food producers, the FDA says this reinforces industry's responsibility to make safe products. (In the case of the USDA's HACCP program, the greater regulatory requirements for documentation replaced intrusive inspection requirements.) Leading consumer advocate Caroline Smith DeWaal notes that the "two versions of HACCP adopted by the FDA are strikingly different; the version that covers low-acid canned foods is highly prescriptive and has worked very well, while the seafood version is highly permissive."26 In a January 2001 report, the U.S. General Accounting Office (GAO) cited deficiencies in the FDA's seafood HACCP program, including lack of attention to violations and lack of quantifiable data to assess program effectiveness.27 FDA officials note substantial challenges in regulating seafood versus canned foods and meat products due to the wider variety of species, greater diffusion in processing and distribution, and more numerous Critical Control Points.

While the USDA's HACCP program has achieved quantifiable results in reducing levels of food-borne pathogens (unlike the FDA, the USDA developed baseline measures at the inception of its HACCP program), implementation has been controversial and contentious. Many industry groups favor the program to bolster consumer confidence, but others chafe at the considerable paperwork and other regulatory requirements. Unions representing USDA inspectors have challenged changes in their work duties, while one Texas food processor succeeded, in the Court of Appeals for the Fifth Circuit, in blocking USDA efforts to close his plant due to repeated violations of salmonella standards. Both cases are still working their way through the federal court system.28 A recent report by Public Citizen praises the HACCP model but finds significant fault with the USDA's "poor design and implementation."29

In spite of setbacks, HACCP is here to stay, and is becoming an international requirement. The Codex Alimentarius Commission, the international food standards–setting body overseen by United Nations agencies, the Food and Agriculture Organization (FAO), and the World Health Organization (WHO), now recommends HACCP adoption across the globe. HACCP is now embedded in the General Agreement on Tariffs and Trade (GATT), and nations are rushing to implement the process to ensure the safety of their domestic products and to survive in fiercely competitive world food markets.


While FMEA, HFMEA, and HACCP differ in significant ways in operation, the similarities are striking. Table 1 shows the basic steps in performing an HFMEA analysis and in undertaking a HACCP process. The five HFMEA steps are the core elements described in materials produced by the VHA National Center for Patient Safety. The HACCP procedure is slightly modified from a full 14-step process to enable readers to readily see the similarities. Both tools involve selection of process and/or product, selection of a team, creation of a process flowchart, hazard or failure identification, risk assessment, corrective or preventive action, ongoing monitoring and assessment, recordkeeping requirements, and process review. Both rely on decision making driven by data, use of cross-functional teams, and, most importantly, a preventive approach to hazard/failure mode identification and elimination or reduction. There appears to be no literature that compares and contrasts these two widely used hazard analysis tools.

A further similarity is that both systems carry administrative, paperwork, and resource burdens to implement broadly and effectively, though these are greater in the case of HACCP because of its extensive involvement with public-sector regulation. Indeed, onerous regulatory requirements that accompanied FDA and USDA implementation of HACCP have been seen as a significant impediment to broader acceptance. A 1998 international conference on the economics of HACCP, held in Washington, D.C., reached these conclusions:

While there are differences in design elements between the two sets of tools, the key distinction is less related to purpose or structure than to the unique history of each in its application to different economic sectors. FMEA has been significantly confined to product manufacturing. Indeed, its recent application to hospital care adapted by the VHA appears to be the only example of FMEA applied outside the industrial sector.

HACCP, by contrast, has been applied exclusively in food production and service, though it has recently been employed in medical-device manufacturing. In 1997, the FDA launched a pilot HACCP program within the medical-device industry to assist manufacturers in implementing it, including defining critical control points during manufacturing and distribution. A Medical HACCP Alliance, with representation from industry, academia, and government, was formed "to promote the application and implementation of risk management using HACCP principles."31

Because of each tool's evolution and use in separate sectors, a difference in emphasis is also apparent. With FMEA, the hazard is a failure mode in a process, and the principal goal is to redesign the process to reduce or eliminate the risk of the failure occurring. In HACCP, the hazard is unsafe food, and the primary goal is to control the process at critical points to eliminate or reduce the risk of the hazard. Thus, the goal of FMEA/HFMEA is redesign to reduce process failure, while the goal of HACCP is detection and control of process failure to eliminate or reduce bad effects.32

As mentioned, an important difference between FMEA and HACCP is the extensive interaction in the latter case with government: FDA, USDA, and international regulatory bodies. This regulatory experience provides important lessons in considering how to apply proactive hazard analysis more broadly to health care: Application can be thorough and successful (as with, e.g., low-acid canned foods) but can be incomplete and less successful (as with seafood). As consideration is given to the role of governmental authorities or quasi-regulatory authorities such as JCAHO in encouraging or requiring proactive hazard analysis in health care, it is worth reviewing the criteria by which the National Research Council judged the 1973 implementation of HACCP in low-acid canned-food production a success:

  • Industry and government worked cooperatively to develop effective monitoring procedures for Critical Control Points.
  • FDA required that supervision be conducted only by persons who had completed FDA-approved courses.
  • FDA inspectors were trained in the elements of HACCP.
  • Use of HACCP was mandated by federal regulation.33

Toward Broader Health Care Use of Hazard Analysis

Proactive hazard analysis has found medical care—or perhaps medical care has found proactive hazard analysis. Limited though the early steps may be, to the VHA hospital experience and the JCAHO accreditation requirement, the system is heading in this direction. One of the VHA's first applications of HFMEA involved the development of bar codes for pharmaceuticals administered in its hospitals. It is unclear whether this initiative will broaden and deepen, and will be sustained long enough to determine its fit, viability, and durability in medical care. There is no evidence of any sector embracing FMEA- or HACCP-style hazard analysis and subsequently abandoning it.

Experiments to date have been confined to inpatient hospital care, which is also the principal focus of medical errors and patient safety concerns. Still to be determined is how deeply and broadly to apply it in this arena. Also to be determined is the applicability of this approach to outpatient, home-based, and alternate-site medical services. While the prevailing image of FMEA/HACCP relates to large industrial and clinical enterprises, this may be too limited a view. The World Health Organization, for example, has considered use of HACCP to confront the most common cause of death in infants and children worldwide (13 million annually): diarrhea. More than 70 percent of cases are attributable to contaminated food. HACCP's core practice is applicable to safe food practices in the home—even in desperately poor Third World environments. "The usefulness of HACCP research in the promotion of hygiene of weaning foods lies not in the establishment of new risk factors, but in the determination of points in the food-preparation—handling—chain which are critical to safety," note researchers Ehiri and Prowse. "The idea of using HACCP data to inform food safety education is of paramount importance in situations of extreme poverty, and where adequate food-borne disease surveillance may be lacking." 34

Their conclusions point to potentially broader application of proactive hazard analysis beyond inpatient hospital services to outpatient care, home health care, and other arenas such as public health services.

Summary of ECRI/Milbank Policy Conversation, February 26–27, 2002

On February 26 and 27, 2002, the Milbank Memorial Fund and ECRI co-sponsored a policy conversation on proactive hazard analysis with an invited set of national experts (see Appendix for participant list). The purpose was to explore the relevance of proactive hazard analysis to health care and to discuss steps to further its introduction and adoption if deemed appropriate. Following are summaries of the major points raised at the meeting.

1. How does proactive hazard analysis relate to other quality/safety programs?

HACCP/FMEA-style proactive hazard analysis (PHA) represents a new way to think about hazard prevention and safety in health care, a proactive rather than reactive approach requiring and creating a different mind-set and organizational culture. Previous tools (TQM/CQI, RCA) have helped to set the stage for this new direction.

Key PHA process attributes:

  • Identifies vulnerabilities in processes that can lead to undesirable results
  • Enables ranking of risks/vulnerabilities most important to reduce
  • Enables analysis of underlying causes of risks/vulnerabilities
  • Enables identification of actions to reduce risks/vulnerabilities
  • Monitors whether completed actions are effective
  • Enables/requires a decision about preventing, eliminating, or reducing potential hazards

Key points of the process:

  • Explicit goal is safety
  • Reaching goal requires a team approach to thinking about what one is doing
  • Proactive/preventive approach is essential
  • Core model includes systems approach and identification of risk points
  • Tools are targeted to a specific issue and its surrounding system
  • Standardization is balanced with need for innovation and adaptation

2. What can we learn from experience to date with HACCP/FMEA?

Becton Dickinson, Legal Seafoods, and other corporations' experience demonstrate the value of voluntary HACCP. There are many HACCP models, and each regulatory phase has differed from all others. USDA implemented it successfully in 6,000 U.S. plants.

In 1999, the VHA identified FMEA to be a useful tool, and included proactive risk assessment in its Patient Safety Handbook. It looked at HACCP, FMEA, RCA, and HAZOPs (Hazard and Operability Studies, developed in the chemical industry) and found each inadequate for hospitals. The VHA thus developed HFMEA, taking key elements from each approach. The agency now can teach HFMEA to hospitals in half-day structured sessions.

For broader adoption, we need to demonstrate the tangible benefits of PHA in areas such as improved patient safety and quality of care that should be reflected in reduced cost of liability insurance and other benefits. We need to create real incentives for top management/executives to adopt this approach.

Like TQM/CQI, rollout requires organizational cultural transformation, or success will be limited. How do we avoid HFMEA's being perceived as simply the next health management improvement fad?

3. Potential applications of hazard analysis

There is a broad range of topics to which PHA can be applied. JCAHO has targeted "sentinel events." Milbank/ECRI conference participants examined three specific areas as possibilities for future experiments in applying PHA in health care:
A. Patients in surgery: How quality is defined remains a local issue. Credentialing is set at minimal standards. An example was presented and discussed concerning a patient with complications from medical errors who was transferred to another hospital; there was no responsibility from one hospital to the next in identifying or explaining the reason for transfer.
B. Patients with nutrition-related compromised immune systems: Problems exist in addressing this need competently: (1) there is a lack of physician education; (2) there is a lack of standardized, cost-effective tools; and (3) systems are reactive rather than proactive.
C. Patients in ambulatory and home care settings: The major issue still is financial—lack of insurance coverage. The biggest failures in ambulatory and home health care are those that lead to hospitalization, but they can easily be analyzed using run charts. England is now studying ambulatory errors. Overlapping and confusing payment/regulatory systems impede transitions between care sites, interfering with safe, quality care. Fully capitated, integrated delivery systems have the greatest potential to remove these payment barriers.

Key components/criteria/considerations:

  • Focus on conditions sensitive to hospital admission (e.g., asthma)
  • "If not done well, it will be another failed tool"
  • Flexibility is paramount because people will apply PHA differently
  • Needs to be easy/ubiquitous, and show benefits clearly
  • Has to use concrete data and measurement
  • Needs consensus of critical constituencies both public and private

4. Should hazard analysis become a major process in health care?

Intermountain Health Care's experience shows the urgent need to address payment incentives (see box 1). Intermountain's error reduction efforts produced real savings, though most savings went to purchasers (employers, insurers, government) and the institution's own revenues dropped by more than its costs. Intermountain has been able to win back some of the savings, but the payment system is an obstacle to widespread adoption of these techniques and must be addressed. As with prior systems (CQI/TQM, reengineering), effective implementation requires a strong commitment by top leaders and front-line workers across the entire culture. Absent that, it will not succeed. Also, while the health care industry is pressed financially, these improvement systems tend to resemble the "flavor of the month"; instead, we need examples of sustained organizational transformation as models for other institutions to emulate. The tort system is also a serious obstacle, but one that cannot be replaced unless other mechanisms to reduce and redress grievances are adopted.

The act of performing a PHA and any associated documentation could be used offensively or defensively in a tort suit alleging that a health care provider failed to provide a reasonable degree of care or safety. Will providers be reluctant to embrace the PHA process if they fear it will increase their exposure to liability? For example, if a PHA reveals certain deficiencies in a process, and the provider fails to take remedial action, a patient who is later injured by that deficient process could argue that the injury was "reasonably foreseeable"—a standard that applies in tort law. JCAHO has testified to Congress that there needs to be an effective way to protect such efforts from discovery in order to provide a meaningful incentive to engage in PHA processes.

5. If it were to be expanded, what should be the role of regulators versus voluntary action?

Increasing regulatory requirements give institutions more to do without the people or resources to do it, and will collapse if unable to be enforced—the burden issue. The way to proceed is a best-practices and guiding-principles approach, with the possibility of more if not carried out, and co-endorsement by public regulators. If legislation is considered, it needs to protect PHA from litigation, and support independent peer review. Bottom line: guidance and consensus should be pursued first, followed by consideration of regulatory approaches. Perhaps a trigger is necessary if goals are not met.


Proactive hazard analysis—whether in the form of HFMEA, FMEA, HACCP, or other tools—is an important approach to addressing the urgent need to reduce errors and enhance patient safety. A preventive, data-driven approach that eliminates or minimizes hazards before they cause injury has worked in numerous other sectors and fits with the needs of medical care as well. The VHA and JCAHO have taken lead roles in adapting this model to medical care in the inpatient hospital setting. The HACCP experience shows that government has a role to play in successful introduction, and that this can be a challenging undertaking for all concerned. However, at this point in the evolution of the U.S. health care system, we recommend a voluntary consensus to demonstrate the business case for proactive hazard analysis. Public policy needs to address impediments to successful application of PHA, including irrational payment incentives as well as the impact of the tort system.

Appendix: Participants in Policy Conversation, February 26–27, 2002

James Bagian, Director, National Center for Patient Safety

Monica Berry, Vice President, Risk Management, Rockford Health System

Mark Bruley, Vice President, Accident & Forensic Investigation, ECRI

John R. Clarke, Professor of Surgery, MCP-Hahnemann University

Vivian Coates, Vice President, Information Services & Technology Assessment, ECRI

Yank Coble, President, American Medical Association

John Combes, Senior Medical Advisor, Hospital & Healthsystem Association of Pennsylvania

Jay Crowley, Human Factors Engineer, Center for Devices and Radiological Health, Food and Drug Administration

Joseph DeRosier, Program Manager, National Center for Patient Safety, Veterans Heath Administration

Nancy Foster, Coordinator of Quality Initiatives, Agency for Healthcare Quality and Research

Daniel M. Fox, President, Milbank Memorial Fund

Michael J. Fox, President, Healthcare Advisors, Inc.

Philip Frappaolo, Deputy Director, Center for Devices and Radiological Health, Food and Drug Administration

Susan N. Gardner, Acting Director, Office of Surveillance and Biometrics, Center for Devices and Radiological Health, Food and Drug Administration

Norbert Goldfield, Medical Director, 3M Health Information Systems

Larry R. Kaiser, Chair, Department of Surgery, University of Pennsylvania Medical Center

Jeffrey C. Lerner, President and CEO, ECRI

John E. McDonough, Associate Professor, Heller School for Social Policy and Management, Brandeis University

Anthony Montagnolo, Executive Vice President and Chief Operating Officer, ECRI

Faith D. Ottery, President, the Society for Nutritional Oncology Adjutant Therapy (NOAT), and Ottery & Associates, Oncology Care

John B. Reiss, Chair, Health Law Practice, Saul Ewing LLP

Nancy Ridley, Assistant Commissioner, Massachusetts Department of Public Health

Paul M. Schyve, Senior Vice President, Joint Commission on Accreditation of Healthcare Organizations

Ronni Solomon, Executive Vice President and General Counsel, ECRI

Patricia Spitzig, Policy Analyst, Center for Devices and Radiological Health, Food and Drug Adminstration

Erik Stalhandske, Program Manager, National Center for Patient Safety, Veterans Health Administration

Rachael Weinstein, Director, Clinical Standards Group, Centers for Medicare & Medicaid Services

Caren Wilcox, Principal, Caren Wilcox and Associates, former Deputy Undersecretary for Food Safety, U.S. Department of Agriculture


1Brennan et al. 1991.

2Kohn, Corrigan, and Donaldson, eds. 2000.

3Berwick 1989.

4Langley et al. 1996.

5IOM 2001.

6Reason 2000.

7See and

8See (Haviland Consulting Group).

9See (Cayman Business Systems).

10See ibid., (Cayman Business Systems).


12Weeks and Bagian 2000.


14Veterans Administration National Center for Patient Safety 2001.

15Hospitals Tackle New JCAHO Requirement . . . 2002.

aA sentinel event is an unexpected occurrence involving death or serious physical or psychological injury or the risk thereof. Such events are called "sentinel" because they signal the need for immediate investigation and response.

bRoot-cause analysis is part of a feedback loop used either to initiate a proactive hazard analysis or to improve upon one that has already been carried out but has manifested a continuing problem.

16JCAHO 2001.

17Bryan 1992, 4.

18See (Medvet Science Pty Ltd).

19Bryan 1992, 4.

20U.S. Department of Health, Education and Welfare 1972.

21National Research Council 1985.

22Mead et al. 1999.

23U.S. Centers for Disease Control and Prevention 2002.

24USDA 2000, 2002.

25See, e.g., Oliviera et al. 2000; Lambiri et al. 1995; Shanaghy et al. 1993; and Henson 1997.

26Smith DeWaal 1997, 331.

27U.S. General Accounting Office 2001.

28Fuller 2001.

29Nestor and Lovera 2002.

30Unnevehr 2000.


32Observations of Paul Schyve, JCAHO.

33National Research Council 1985.

34Ehiri and Prowse 1999.


Berwick, D.M. 1989. Continuous Improvement as an Ideal in Health Care. New England Journal of Medicine 320(1):53–6.

Brennan, T.A., L.L. Leape, N.M. Laird, L. Hebert, A.R. Localio, A.G. Lawthers, J.P. Newhouse, P.C. Weiler, and H.H. Hiatt. 1991. Incidence of Adverse Events and Negligence in Hospitalized Patients. Results of the Harvard Medical Practice Study I. New England Journal of Medicine 324:370–6.

Bryan, F.L. 1992. Hazard Analysis Critical Control Point Evaluations: A Guide to Identifying Hazards and Assessing Risks Associated with Food Preparation and Storage. Geneva: World Health Organization.

Dillon, M., and C. Griffith. 1996. How to HACCP: An Illustrated Guide. Guelph, Ontario: Guelph Food Technology Centre.

Ehiri, J., and J. Prowse. 1999. Child Health Promotion in Developing Countries: The Case for Integration of Environmental and Social Intervention. Health Policy and Planning 14(1):1–10.

Fuller, M. 2001. Appeals Court Says USDA Exceeded Its Authority with Food Safety Tests. Los Angeles Times (Dec. 12):Pt. 3:3.

Henson, D. 1997. Estimating the Incidence of Food-borne Salmonella and the Effectiveness of Alternative Control Measures Using the Delphi Method. International Journal of Food Microbiology 35(3):195–204.

Hospitals Tackle New JCAHO Requirement with Failure Mode and Effect Analysis. 2002 (Apr.). Risk Management Reporter 21(2).

Institute of Medicine (IOM), Committee on Quality of Health Care in America. 2001. Crossing the Quality Chasm: A New Health System for the 21st Century. Washington, D.C.: National Academy Press.

Joint Commission on the Accreditation of Healthcare Organizations (JCAHO). Effective July 1, 2001. Revisions to Joint Commission Standards in Support of Patient Safety and Medical/Health Care Error Reduction. Chicago, Joint Commission on Accreditation of Healthcare Organizations.

Kohn, L.T., J. Corrigan, and M.S. Donaldson, eds. 2000. To Err Is Human: Building a Safer Health System. Institute of Medicine Committee on Quality of Health Care in America. Washington, D.C.: National Academy Press.

Lambiri, M., A. Mavridou, and J.A. Papdakis. 1995. The Application of Hazard Analysis Critical Control Points (HACCP) in a Flight Catering Establishment Improved the Bacteriological Quality of Means. Journal of the Royal Society for the Promotion of Health 115(1):26–30.

Langley, G., K. Nolan, T. Nolan, C. Norman, and L. Provost. 1996. The Improvement Guide: A Practical Approach to Enhancing Organizational Performance. San Francisco: Jossey-Bass.

Mead, P.S., L. Slutsker, V. Dietz, L.F. McCaig, J.S. Bresee, C. Shapiro, P.M. Griffin, and R.V. Tauxe. 1999. Food-related Illness and Death in the United States. Emerging Infectious Diseases 5:607–25.

National Research Council, Subcommittee on Microbiological Criteria, Committee on Food Protection, Food and Nutrition Board. 1985. An Evaluation of the Role of Microbiological Criteria for Foods and Food Ingredients. Washington, D.C.: National Academy Press.

Nestor, F., and P. Lovera. 2002. Hamburger Hell: The Flip Side of USDA's Salmonella Testing Program. Washington, D.C.: Public Citizen.

Oliviera, M.H., R. Bonelli, K.E. Aidoo, and C.R. Batista. 2000. Microbiological Quality of Reconstituted Enteral Formulations Used in Hospitals. Nutrition 16(9):729–33.

Reason, J. 2000. Human Error: Models and Management. British Medical Journal 320:768–70.

Shanaghy, N., F. Murphy, and K. Kennedy. 1993. Improvement in the Microbiological Quality of Food Samples from a Hospital Cook-Chill System Since the Introduction of HACCP. Journal of Hospital Infection 23(4):305–14.

Smith DeWaal, C. 1997. Delivering on HACCP's Promise to Improve Food Safety: A Comparison of Three HACCP Regulations. Food and Drug Law Journal 52:331–5.

Unnevehr, L. 2000. The Economics of HACCP: Cost and Benefits. St. Paul, Minn.: Eagan Press.

U.S. Centers for Disease Control and Prevention. 2002. Preliminary FoodNet Data on the Incidence of Food-borne Illnesses—Selected Sites, United States, 2001. Morbidity and Mortality Weekly 51(15):325–9.

U.S. Department of Agriculture (USDA). 2000 (Sep. 20). New Inspection System Leads to Further Reductions of Salmonella in Meat and Poultry. USDA News Release No. 0327.00. Washington, D.C.

U.S. Department of Agriculture (USDA). 2002 (Apr. 18). USDA Data Show a Reduction of Salmonella in Raw Meat and Poultry. USDA News Release No. 0154.02. Washington, D.C.

U.S. Department of Health, Education and Welfare. 1972. Proceedings of the 1971 National Conference on Food Protection. Washington, D.C.

U.S. General Accounting Office. 2001 (Jan.). Food Safety: Federal Oversight of Seafood Does Not Sufficiently Protect Consumers. GAO–01–204. Washington, D.C.

Veterans Administration National Center for Patient Safety. 2001. The Basics of Healthcare Failure Mode and Effect Analysis. Videoconference course. Available at (accessed January 30, 2002).

Weeks, W.B., and J.P. Bagian. 2000. Developing a Culture of Safety in the Veterans Health Administration. Effective Clinical Practice (Nov./Dec.). Available at (accessed January 30, 2002).

(To request a bound copy of this report, click here. To see a complete list of Milbank reports, click here.
To request copies of individual reports, be sure to specify which report you want,
your name, mailing address, and phone number.)

Milbank Memorial Fund
645 Madison Avenue
New York, NY 10022

(c) 2002 Milbank Memorial Fund

The Milbank Memorial Fund is an endowed national foundation that engages in nonpartisan analysis, study, research, and communication on significant issues in health policy. In the Fund's own publications, in reports or books it publishes with other organizations, and in articles it commissions for publication by other organizations, the Fund endeavors to maintain the highest standards for accuracy and fairness. Opinions expressed by individual authors, however, do not necessarily reflect opinions or factual determinations of the Fund.

This file may be redistributed electronically as long as it remains wholly intact, including this notice and copyright. This file must not be redistributed in hard-copy form. The Fund will freely distribute this document in its original published form on request.

Printed in the United States of America.

ISBN 1-887748-51-2

Milbank Memorial Fund HomepageMilbank Memorial QuarterlyReportsBooksEditorial and Program StaffBoards