The Problem of Risk (Management)

Risk management in the healthcare industry is too often, unfortunately, a misnomer.  What is being managed in many cases is not risk but, rather, litigation.  The traditional method of event reporting to identify safety problems, and the risk thereof, identifies only a small percentage of safety events that result in lawsuits [1]Pascal Community Collaborative data indicates this may be in the range of 10-15% and is subject of an internal study..  If so,the function of “risk management” understandably becomes about reacting to patient and family concerns, and even learning about patient harm only after receiving an associated lawsuit.  Hence, the overuse of the cliché phrase, “looking in the rearview mirror”.  

The reasons for the problem are many.  Three significant ones include:

  • Data:  traditional risk management relying on event reporting identifies at least 10x less than (or only 10% of) the volume of serious harm actually occurring 
  • Timing:  the adverse events which are identified are highly retrospective, suffering from latency of weeks or months
  • Analytics:  data volume and quality issues, along with high latency, limit actionability and practicality of applying advanced analytics 

The Opportunity to Manage Risk 

The Journal of Patient Safety and Risk Management published an article in May 2022 pointing out a significant opportunity for the field.  Co-authored by Dr. Julia Adler-Milstein, Dr. Urmimala Sarkar, and Dr. Robert M. Wachter, the “Perspective” points out various issues in reducing medical malpractice using the current approach which has resulted in “our limited understanding of medical malpractice risk” due to reliance on:

  • Coarse data categories such as specialty-based data (e.g. obstetrics)
  • Simple trends (e.g. a physician’s history of problems)
  • Overall case-by-case and reactive approach (e.g. communication and resolution programs)









The co-authors then make a simple, spot-on observation:  

“Where might we find a more scalable, precise, and proactive approach? Perhaps the answer is hiding in plain sight. A detailed medical record review is the cornerstone of every malpractice case. Yet, even with near-universal electronic health records (EHRs), there has been little effort to mine records in real time—and before an untoward event—for predictors of safety events or for lawsuit risk. We believe that EHRs—and specifically the data on clinician behaviors that they contain—offer untapped potential to advance mal-practice risk mitigation and patient safety.”

Applying Pascal’s VPS to Risk Management in Healthcare 

This is what the Pascal Virtual Patient Safety (VPS) solution already does successfully at scale with respect to “safety events” above.  Therefore, now we turn to how clients are turning to apply VPS to “lawsuit risk”.  To do the latter, the former already relies on the necessary foundation:  applying sound epidemiology on all patients all the time for all harm – generating clinically validated adverse event outcomes using real-time EHR data (“AE Outcomes”) for use enterprise-wide, including in risk management.  

Hearkening back to Adler-Milstein et al, they recommend an approach with the following requirements:

  1. Data:  clinical (EHR), not just claims
  2. Latency:  real-time (excluding adjudication)
  3. Method:  “Gold standard” chart review
  4. Operations:  Scalable
  5. Granularity:  Precise – fine-grained, not coarse
  6. Timing:  prospective

The Pascal VPS delivers on those six requirements and so much more, because far more is required in order for a solution to be:

  • Scientifically valid – because it must be true
  • Clinically credible – because it must be practicable 
  • Operationally scalable – because it must work organization-wide
  • Regulatorily compliant – because it must be satisfy governance
  • Legally appropriate – because it must be lawful
  • Financially generative – because it must be sustainable 
  • Experientially patient-centric – because this is most important

In addition to meeting the requirements of the Adler-Milstein et al article, Pascal VPS goes well beyond with additional requirements met:

  1. OutcomesCensus-wide AE Outcome surveillance & generation
  2. ValidationPhysician-authenticated
  3. ScopeAll-cause harm (vs. arbitrarily selected harms to target)
  4. DefinitionsClinically consistent
  5. FrequencyContinuous, Up to 24/7/365
  6. GranularityHundreds of specific adverse event categories and sub-categories
  7. InterventionWithin minutes, hours, <24 hours
  8. ImprovementTrends, patterns, common causes, contributing factors
  9. ExpandabilityDeeper, more service lines; settings; and much more
  10. ROIOver 3x/year ROI, validated, and 5x-10x in steady state
  11. LongitudePhysician & patient data over time
  12. DomainIntegrated AE vs. Patient Safety or Risk Management functions
  13. Protection: Real-time PSO environment, audited > state level peer review
  14. VolumeLarge AE Outcomes volume; accumulation rate accelerating

VPS Expands ROI Scope & Sources

The opportunity is not simply to understand risk better, or perhaps proactively to avoid or ameliorate patient harm that would eliminate a lawsuit downstream.  The opportunity is nothing short of changing the way that risk management is done in health delivery systems globally with the chief aim of delivering a superior experience for patients and their families.  


Figure 1 illustrates how VPS finds far more harm, sooner:  10x the serious harm as compared to event reporting, and within 24 hours of the serious event occurring:

Figure 1

This method occasions two opportunities for ROI as depicted by Figure 2:

Figure 2

  •  Legal Cost Reduction:  data-driven outcomes and insight within 24 hours of the event results in decisions that deliver a superior patient and family-centered experience; an improved clinical outcome; and reduced financial costs.
  • Indemnity Payout Reduction:  by acting to ameliorate and avoid 10x the serious harm as compared to traditional event reporting, there is mathematically a much larger and sooner opportunity to reduce indemnity payouts.

Legal cost reduction offers a shorter-cycle immediate ROI opportunity.  Pascal Community Collaborative data indicates that legal costs increase by over 80% if a case extends beyond two years.  Counsel, especially if compensation is correlated with case duration, has no incentive to resolve a case and every financial incentive to extend a case.


The takeaways of applying Pascal VPS for risk management are:

  1. Finding far more preventable harm sooner is being done.  Identifying 10x the serious harm as compared to traditional event reporting is not only possible but is being scaled across health systems which are reducing over 25% of that greater harm found.  Indeed, experience in the largest U.S. hospitals and some of the smallest has demonstrated that this method works.
  2. Applying this approach to risk management is not adding a new “tool” or trying to pull this EHR data element or that but, rather, changing how risk is done.  Today risk management is largely defined by processes, technology, and culture that work in a system to manage lawsuits, and what is required is not to “pave the cowpath” with user-friendly case management tools but, rather, to change the goal, the workflow, and use new technology.  Adding “bells & whistles” to a current case management system is tantamount to “paving the cowpath.”
  3. The most important goal of risk management should not be to minimize payout but to deliver a superior patient experience at a lower cost.  Identifying serious harm or the risk thereof within 24 hours and acting to ameliorate and avoid with a requisite level of transparency is the path to a new generation of risk management. Pascal predicts that those who lead in this area will find real meaningful, sustainable results in the service of patients:  generating loyalty and demand to use healthcare delivery services that truly put the patient first.     

Transparency is coming to pricing of healthcare services.  Next will be safety and quality, and just behind it, how health systems adjust to patient expectations of how risk is managed…truly managed.


1 Pascal Community Collaborative data indicates this may be in the range of 10-15% and is subject of an internal study.