The Protocol That Created the Error It Prevented#
In November 2006, a team of researchers led by Ross Wilson at the University of Toronto published an analysis in the New England Journal of Medicine quantifying adverse drug events in Canadian hospitals. The analysis found that approximately 7.5% of all hospital admissions in the studied population experienced at least one adverse drug event, of which approximately 1% caused permanent harm or death. A subsequent study by Landrigan et al., published in the same journal in 2010, found that in a national sample of 10 hospitals measured at two points over a decade (2002–2007), the rate of harmful events per 1,000 hospital admissions had not declined despite a decade of patient safety initiatives following the landmark Institute of Medicine To Err is Human report (1999).
The To Err is Human report's most-cited figure — that medical errors kill 44,000 to 98,000 Americans annually — was widely interpreted as a call for more rigorous protocols, more comprehensive checklists, and more systematic medication reconciliation processes. The hospital response to the patient safety movement of the 2000s was, in structural terms, the addition of complexity: more mandatory documentation steps, more computerised physician order entry requirements, more pharmacy verification layers, more nursing medication administration protocols. These additions were individually rational. The aggregate finding of the decade following their implementation — that adverse event rates had not declined — suggests that something more subtle is in operation.
The more careful researchers in the patient safety field — particularly the system safety engineers who brought aviation-derived thinking into clinical medicine — identified the mechanism: in a sufficiently complex clinical environment, every additional protocol adds its own failure modes to a system already operating above CRIP. The protocol designed to prevent medication errors introduces a new class of time pressure, alert fatigue, documentation burden, and workflow interruption that generates its own adverse events. The CRIP in hospital systems is not crossed once and then stabilised; it is continuously pushed further by each new safety initiative.
The CRIP Anatomy of a Hospital#
The Medication Process System Complexity#
A hospitalised patient receiving complex pharmacological care may have 20–40 active medication orders at any given time. Each order specifies drug, dose, route, frequency, and administration timing — and is subject to multiple interaction checks (drug-drug, drug-allergy, drug-diagnoses), pharmacist review, nursing administration verification, and documentation requirements. The number of decision nodes in the medication administration pathway for a complex patient — from physician order entry through pharmacy verification through nurse administration through patient charting — exceeds 100 individual decision points per day.
The failure mode profile of this system has been extensively characterised. A 2015 study by the American Society of Health-System Pharmacists found that harmful medication errors in US hospitals occur at a rate of approximately 1 per 1,000 medication administrations. Given that a large hospital may perform 350,000–400,000 medication administrations annually, this rate implies 350–400 harmful medication errors per year per institution — a volume that no manual oversight process can detect and prevent at high reliability.
The specific failure modes that generate the highest harm burden have a CRIP signature: they are primarily failures at the handoff points between the protocol steps rather than failures within any single step. Wrong-patient medication errors occur most frequently during order entry (handoff from prescribing to pharmacy) and during administration (handoff from pharmacy preparation to nursing administration). Dose calculation errors occur at the formulation selection step (handoff from physician order intent to pharmacy preparation). These interface failures — the boundaries between protocol steps — are where the CRIP inversion manifests: each additional protocol step adds a new interface, and complex interfaces between protocol steps generate failure modes that the individual steps do not.
Alarm Fatigue as a CRIP Consequence#
The intensive care unit's alarm architecture, discussed in the Interface Paradox series, is a direct CRIP manifestation. The alarm system's structure violates the modularity principle that enables sub-CRIP operation in TCP/IP and Linux: every monitoring device generates alarms without regard to the state of other monitoring devices, creating a global alarm state that is the sum of all individual alarm states with no cross-device integration. An ICU patient with 12 monitoring devices can simultaneously generate 12 independent alarm streams, each calibrated against device-specific thresholds that were set individually rather than against a system-level model of the patient.
The result is a system that, above a certain patient complexity level, generates more alarm events per hour than the nursing staff can evaluate and respond to. The CRIP for the alarm system is crossed not by a specific new feature but by the interaction of multiple individually reasonable alarm configurations in a shared sensory environment. The failure mode: critical alarms are missed because they are masked by high-volume non-critical alarm traffic, and patient harm results from delayed response to actionable alerts.
The documented institutional response to ICU alarm fatigue has been — consistent with the meta-pattern of CRIP-crossing responses — more complexity: alarm management committees, alarm customisation protocols, alarm escalation procedures, mandatory alarm response documentation, and technology vendor engagement for alarm reduction features. These interventions have demonstrated modest alarm volume reduction in specific institutions with dedicated implementation resources. They have not produced systematic population-level improvement in ICU alarm response rates or in alarm-related adverse events, because the underlying CRIP architecture of multiple independent alarm streams in a shared environment remains unchanged.
Do-Not-Harm Protocols That Harm#
The surgical safety checklist, developed by Atul Gawande and the WHO Surgical Safety Checklist Working Group and published in 2009, is one of the most celebrated brief interventions in modern patient safety. The checklist — three sections of approximately 10–20 verbal confirmations, conducted at defined points in the surgical sequence — was associated with approximately 36% reductions in major complication rates and 47% reductions in mortality in a multi-site international study. It is now mandated in most high-income country hospital systems.
The checklist's success became the foundation for an extensive proliferation of checklists across clinical domains. By 2020, most US hospitals had implemented 10–40 mandatory clinical checklists across areas including central line insertion, ventilator management, perioperative care, medication reconciliation, discharge planning, and fall prevention. Qualitative research on clinical staff attitudes toward checklists, published in multiple journals between 2015 and 2022, consistently finds a threshold effect: below approximately 5–7 checklists per nursing shift, compliance rates are high and staff perceive checklists as useful safety tools. Above this threshold, compliance rates decline, staff describe checklist burden as affecting their ability to attend to clinically urgent tasks, and the documentation requirement for checklist completion becomes a parallel administrative burden that competes with direct patient care time.
The CRIP of the clinical checklist system is at the interaction between the cognitive load of the individual clinician and the total procedural obligations of all mandatory protocols. A checklist added to a system below CRIP improves reliability by forcing attention to procedural steps that might be missed under time pressure. A checklist added above CRIP degrades reliability by adding time and cognitive load to an already overloaded system, reducing the quality of all concurrent tasks rather than improving the specific task the checklist targets. The individual checklist is not the failure mode. The aggregate complexity of all checklists in an over-procedurised system is the failure mode. The next post examines what the institutions that manage this most effectively do differently.
