Risk management in healthcare: What it is and why it matters

The importance of risk management in healthcare cannot be overstated. In hospitals, nursing homes, mental health facilities, and private practices, managing risk is an ongoing operational responsibility.

Although the core focus of healthcare risk management is on patient safety, its scope goes far beyond the prevention of medical errors. Therefore, risk management professionals are a vital part of healthcare administration and help guide decision-makers in operations, finance, training, clinical protocols, and more.

A degree in healthcare management or a related field, with professional experience in insurance, finance, or medicine, can provide a strong foundation for a career in healthcare risk management. 

What is risk management in healthcare?

Healthcare risk management, also called ‘medical risk management’, is a collection of practices designed to ensure that a medical facility operates safely and in accordance with financial and governmental regulations. Often referred to as ‘enterprise risk management’, because it touc

Enterprise risk management operates across eight areas, or domains:

Operational

Operational risks include the following categories:

• Inadequate staffing: Overwork and fatigue can lead to mistakes, and many medical errors can be traced back to staffing issues.
• Training: Proper training is crucial to ensure that staff follow protocols and to create a culture of risk awareness. Improperly trained personnel can be a source of safety issues.
• Procedures: Risks lurk in every aspect of clinical and administrative operations. Risk management assesses the effectiveness of current procedures and updates them as necessary, covering everything from surgical checklists to COVID-19 disinfecting procedures. 

Clinical and patient safety

Clinical risks include medical errors caught before injury (near misses) and errors that cause injury to patients or staff. Enterprise risk management processes are responsible for ensuring patient safety by preventing medical errors and mitigating harm. Clinical risk managers research medical errors to identify root causes and establish processes to prevent future occurrences. 

Strategic               

Strategic risks include damage to a hospital’s or provider’s brand or reputation, or a conflict of interest that keeps an organization from achieving its goals. Risk managers who are part of the executive team can help identify potential areas of risk and participate in strategic decision-making regarding any problems that arise. Even one lawsuit can cause critical damage to a healthcare provider’s reputation.

Financial             

Financial risks include malpractice litigation costs, insurance costs, capital expenditures, and insufficient insurance reimbursements. To lower the risk of rising costs, risk managers look at a hospital’s or healthcare organization’s overall risk profile to see how improving patient safety can positively impact finances. Enterprise risk management can include improvements that reduce the number of falls, for instance, which lowers the overall risk of litigation. 

Human capital          

Hiring, staffing, work injuries, and other employment issues can be a source of risk for a healthcare provider, especially when understaffing contributes to medical errors. Healthcare risk management activities also involve monitoring operations to ensure that personnel are following procedures, developing protocols, and keeping their required training and certifications up-to-date.  

Legal and regulatory

Failure to abide by Medicare, Health Insurance Portability and Accountability Act (HIPAA), and other laws regulating healthcare can pose a serious risk to a healthcare provider’s financial and legal standing. For example, falling out of compliance with Medicare regulations can delay or prevent reimbursement for services, causing financial hardship. Ensuring proper licensure and accreditation are a critical part of risk management responsibilities. 

Technological

The rising cases of ransomware attacks on electronic health and billing systems pose a serious risk to healthcare providers and their patients. Risk management must work with information technology (IT) departments to safeguard patient data. The risk of medical errors resulting from the misuse of highly complex medical diagnostic equipment can also impact providers. 

Environmental and infrastructure hazards           

Facilities management, biohazardous materials, restricted access to prescription medications, security, and other infrastructure can be a source of risks if not managed properly. Natural disasters such as hurricanes require evacuation planning and backup power sources. Healthcare executives are planning ahead for the impact of climate change on their operations, which has already caused weather extremes in some regions.

What are the goals of medical risk management?

Most enterprise risk management professionals agree that it’s unreasonable to expect an entirely error-free hospital. Humans are human, after all. Rather, weaving risk management into the operations of the entire enterprise is designed to create risk awareness among all employees. This in turn will help create a culture of error prevention. 

The goals of healthcare risk management include:

Reducing medical errors

Wrong surgery errors, medication dosing mix-ups, cancer diagnosis mistakes — all of these may result in so-called sentinel events, medical errors that result in severe injury or death. While there is some controversy over the number of deaths due to medical mistakes (studies report numbers that range from 98,000 per year to as many as 250,000 per year), the main focus of enterprise risk management is to put protocols in place that prevent and mitigate medical errors.

Catching near misses

Near-miss tracking is an important part of preventing medical errors. Near misses are often a sign that a process or procedure isn’t working properly. By tracking near misses, risk managers can identify areas of concern and retrain personnel or update procedures to prevent a tragedy. 

Ensuring risk awareness

Part of healthcare risk management is building risk awareness. This is accomplished through rigorous training and retraining of all hospital staff to make sure they understand and follow procedures. Best practices include a “no-blame” culture at all levels, so each event, whether a near miss or a sentinel event, can be reported and learned from. 

Providing actionable data

Compiling and reporting on the root causes of errors and failures can help prevent future occurrences. Risk managers keep decision-makers apprised of the organization’s risk profile and make recommendations based on up-to-date information. They use the data to fine-tune protocols to make them more effective at reducing risk. 

Mitigating fallout

When a medical error occurs, a healthcare organization can face legal and even criminal repercussions, as well as backlash from the community and reputational damage. Healthcare risk management first seeks to prevent medical errors, but if and when one occurs, risk managers work to mitigate the fallout from the error. Risk managers may meet with patients and their families when an error occurs to help provide honest communication. 

Protecting patient data

Healthcare providers must abide by stringent patient privacy laws. However, patient data can be vulnerable to cyberattacks, especially with the widespread use of electronic health records (EHRs). Additionally, patient health information may be compromised when used in research, creating ethical and legal issues for healthcare providers. Risk management professionals must be highly aware of these issues and establish protocols for the protection and use of patient data.

Planning for the future

A number of issues are changing how healthcare providers deliver care to patients, including the following:

• Value-based care
• Population health measures
• Climate change
• Artificial intelligence (AI) and big data
• Consumer engagement

Enterprise risk management has to take these changes into account when trying to understand and mitigate their organization’s risks. For example, value-based care changes how providers get reimbursed for care, posing a financial risk. And AI, while a boon to medical research and healthcare administration, may threaten patient privacy.

Areas of risk management in healthcare

Every healthcare facility has risk management protocols in place. From a single-physician practice to a multistate hospital system, risk management is a part of operations. While the goals of risk management are generally the same everywhere, there are some differences based on the setting. Consider these examples of types of risk management in healthcare settings:

Hospital risk management

Hospital risk managers work to prevent medical errors, protect patient privacy, and ensure the safety of patients and staff alike. They work closely with the hospital leadership team, including clinical and nursing leaders, to identify problem areas and help develop processes to reduce risk. One example of a risk management tool that is now entrenched in most hospitals is the surgical checklist, a list of procedures and processes that must take place at every stage of surgery, from the patient’s verbal consent to confirmation of type of surgery, the incision, and other factors. 

Clinical risk management

Clinical risk management is the process of investigating sentinel events and other medical errors. Clinical risk managers investigate these events and identify root causes. They make recommendations to prevent these errors from happening again. 

Nursing home risk management

Patients in nursing homes and assisted living facilities are often frailer than the general hospital population. Risk management must take into account patients’ conditions, including their cognitive ability, in protecting patient health and safety. Preventing family visits during the COVID-19 pandemic is an example of risk mitigation to patients and staff.

Mental health facility risk management

The safety of staff and patients is a major concern for mental health facilities. Some patients can be at high risk for self-harm. Others may be taking medication that improves their emotional or mental health, but impairs them physically. Risk management professionals must balance staff safety with patient rights and ethics in developing safety protocols. 

Independent practice risk management

Medical malpractice insurance premiums rose more than 10% in several states in 2020, according to the American Medical Association. Independent physician practices can help keep their insurance costs low by following risk management best practices. Establishing and following procedures with patient visits, EHRs, patient privacy and informed consent laws, and prompt reporting of adverse events can help prevent and mitigate errors.

Risk management in healthcare: Responsibilities

Even in the most risk-aware organization, people make mistakes. The risk management team, led by a chief risk officer (the title may vary depending on the organization), is responsible for mitigating the impact. Depending upon the severity of the error, the repercussions can be significant. An organization with protocols in place to manage adverse events will have a better chance of learning from it and moving beyond it. On the other hand, an organization that is reactive or mismanages a situation can further damage its reputation or be impacted financially. 

The following are some risk management responsibilities:

Incident management

If a medical error occurs but a nurse or doctor catches the error in time, the risk management team logs the error and uses it to remind staff of procedures or to create new ones. If it is a drastic error that causes death or injury, the risk team works with the hospital legal department and others to notify the patient or family and follow other protocols. 

Financial planning

The goal of risk management is to reduce errors and safeguard the healthcare organization from the financial stress of medical malpractice claims or insurance reimbursement denials. By reducing falls, for example, or preventing pressure sores, organizations can improve their risk profile. Risk managers can use data analysis to determine how best to support the financial goals of the organization. 

Cybersecurity

Ransomware attacks can shut down a hospital, putting patients and their data at risk. Risk managers work with the IT department to prevent cyberattacks, but if a breach occurs, they must have a protocol in place to respond to the attack and mitigate the impact.

Regulatory compliance

Healthcare is a highly-regulated industry. Risk managers are responsible for making sure that every aspect of the organization is in regulatory compliance. That includes patient privacy, certifications and training, and licensures. Healthcare organizations may also be responsible for the regulatory compliance of their third-party vendors, adding another layer of complexity to the role.

Healthcare risk management best practices

Effective healthcare risk management relies on a number of best practices. These protocols work best when they are supported with consistent communication, reliable data, a culture of risk awareness, and a shared sense of mission.

Some of these best practices include:

• Surgical checklists and procedures: Surgical checklists and preoperative procedures are aimed at reducing sentinel events such as operating on the wrong organ.
• Patient handoff procedures: Shift changes can be a vulnerable time for patients and staff. Requiring clinical and nursing staff to follow specific patient handoff procedures can ensure a smooth transition.
• Electronic medical records (EMR) and charting: EMRs are electronic versions of a patient’s chart. Putting patient notes in an EMR rather than on a traditional paper chart can help prevent medication errors and other mistakes.
• Ongoing training: All healthcare employees, from the C-suite to the janitorial staff, should receive consistent, applicable training on policies and procedures.
• Cybersecurity training: All staff should receive regular training in identifying phishing and other hacking techniques to protect sensitive data.
• Adequate staffing: Overworked and stressed staff are prone to errors. Ensuring that the organization is adequately staffed will go a long way toward reducing errors due to fatigue.
• Data gathering: Risk management is responsible for gathering data on errors to better identify areas of concern and make changes in procedures.
• Regulatory compliance: Managing the complex regulatory environment is critical to reducing risk. The high cost of noncompliance is a painful lesson that no risk manager wants to learn.
• Culture of communication and trust: Allow all staff to report incidents and near misses. Encourage open communication and a no-blame culture.

Healthcare risk management salary and career

Healthcare risk managers come from a variety of educational backgrounds and careers. Many risk managers have a healthcare background; others have financial, insurance, or regulatory experience. Some risk management positions require licensing or certification, such as a certified professional in healthcare risk management (CPHRM) or a certified professional in healthcare quality (CPHQ) certification. 

Some attributes of successful risk managers include:

• Analytical skills: Effective risk managers compile and analyze data on errors, sentinel events, and near misses to identify root causes.
• Creative thinking: There are no “one-size-fits-all” solutions to risk management. Risk managers must use data to develop effective protocols to reduce errors.
• Seeing the whole picture: Enterprise risk management touches every department in an organization. Effective risk managers understand how their recommendations in one area impact risk in other departments.
• Encouraging risk awareness: Error reduction and prevention is a team sport. The most effective organizations involve everyone and create a no-blame culture to strive toward a safe and error-free environment for patients and staff alike.
• Planning and forecasting. Changes in the healthcare industry require risk managers to be forward looking and proactive. Identifying risks and preparing for contingencies is vital for an effective risk management program.  
• Communications and presentation. Effective risk managers are comfortable presenting their findings and recommendations to the healthcare leadership team.

The median salary of healthcare risk management managers was approximately $85,000 as of June 2021, according to PayScale. The median pay of those in entry-level positions was around $68,000.

Prepare for a career in healthcare management

If you’re interested in exploring management in healthcare, look into Northern Arizona University’s Master of Business Administration in Healthcare offered in partnership with OpusVi. With courses covering outcomes evaluation, digital and data decision-making, and evidence-based practice, this degree provides learners with a comprehensive foundation in healthcare business leadership concepts.

The program’s focus on strategic integrative thinking to identify problems, generate alternatives, and develop logical solutions supported by relevant analysis and decision model selection for complex business situations in healthcare helps learners demonstrate the ability to perform alternative courses of actions in unpredictable circumstances.

Explore the program offering and take your first step to excel in your career. 

Sources:

• American Medical Association, “Highest Prevalence of Medical Liability Premium Increases in 15 Years”
• American Society for Health Care Risk Management, Professional Overview
• Caitlin Morgan Insurance Services, “Key Factors to Consider in Nursing Home Risk Management Plans"
• Educational Commission for Foreign Medical Graduates, Administrative and Information Managers
• Harvard Business Review, “How Health Systems Are Meeting the Challenge of Climate Change”
• HIT Consultant, “How Digital Health Solutions Can Help Hospitals Eliminate Opportunities for Error”
• Investopedia, “The Importance of Health Care Risk Management”
• Journal of Ethics, “How Might Artificial Intelligence Applications Impact Risk Management?”
• New England Journal of Medicine, “What Is Risk Management in Healthcare?”
• PayScale, Average Healthcare Risk Management Manager Salary
• Risk & Insurance, “10 Critical Health Care Risks for 2020 and Beyond”
• StatPearls, “Risk Management Event Evaluation and Responsibilities”
• Symplr, “What Is Healthcare Risk Assessment?”
• Textbook of Patient Safety and Clinical Risk Management, “Risk Management in Mental Health”
• Verisys, “What Is Risk Management in Healthcare?”