Risk management is the organized process of identifying, analyzing, and reducing risks that could harm clients, visitors, and staff or cause financial and legal loss to the organization. Quality improvement asks "how do we make care better?"; risk management asks "what could go wrong, and how do we prevent and respond to it?" The two overlap and share data.

Main areas of risk in a health care organization

• Clinical care: medication errors, falls, pressure injuries, health care–associated infections, surgical and procedural events, delayed diagnosis or rescue
• Environment: fire, electrical hazards, medical devices, hazardous materials, security
• Staff: needlestick and sharps injuries, lifting injuries, workplace violence
• Legal and financial: malpractice claims, privacy breaches, consent problems, documentation gaps

Incident (occurrence, variance, safety event) report — an internal, confidential form (usually electronic) that records any event inconsistent with routine care or operations: an error, a near miss, an injury, an unsafe condition, a complaint, or equipment failure. Its purpose is identifying risks and improving systems, not punishing the reporter.

The risk management process

1. Identify risks — incident reports, claims, complaints, audits, surveillance of indicators, rounding, safety culture surveys, external alerts
2. Analyze — frequency and severity; trend data; RCA for serious events; FMEA for high-risk processes before they fail
3. Control / treat — prevent (redesign, protocols, education, equipment), reduce severity, transfer (insurance), or avoid the activity
4. Evaluate and monitor — track whether the change reduced events; report to leadership and quality committees

Proactive vs. reactive. Reactive risk management responds after events (incident review, RCA, claims management). Proactive risk management looks ahead (FMEA, environmental rounds, preventive maintenance, drills).

Principles of incident reporting

• Report every error, near miss, and unsafe condition, whether or not harm occurred
• Complete the report promptly — usually by the person who discovered or was involved in the event
• Record objective facts: date, time, place, what was seen and done, client's condition, who was notified. No opinions, blame, or guesses about cause
• The report is an administrative document, not part of the medical record. Do not place a copy in the chart and do not write "incident report filed" in the chart. Chart only the facts of the event, the assessment, the care given, and the notifications
• Do not keep a personal copy; route it through the facility system
• Reports are aggregated to find trends and trigger analysis; reporters receive feedback on changes

Sentinel events and serious reportable events. For a Joint Commission–accredited organization, a sentinel event requires a comprehensive systematic analysis (usually an RCA) and a corrective action plan; if the organization reports to The Joint Commission, the analysis and action plan are due within 45 business days of becoming aware of the event. Reporting to The Joint Commission is voluntary but strongly encouraged; the analysis itself is required. Many states also require reporting of specified serious adverse events to the state health department.

Device-related events. Under the Safe Medical Devices Act, hospitals and other user facilities must report device-related deaths to the FDA and the manufacturer and device-related serious injuries to the manufacturer (or to the FDA if the manufacturer is unknown), within 10 work days of becoming aware (FDA Form 3500A), plus an annual summary report to the FDA. Voluntary reports of device and drug problems go to FDA MedWatch. The nurse's part: remove the device from use, keep it with its tubing, packaging, and settings (do not discard or reset), label it, and notify biomedical engineering and risk management.

Nurse's immediate response to an incident (priority order)

1. Assess and protect the client — check vital signs and injury; give first aid; stop any ongoing harm (stop the infusion, keep the client still after a fall until assessed)
2. Notify the provider and charge nurse; implement orders
3. Monitor the client closely for delayed effects
4. Document in the medical record — objective facts, assessment, interventions, notifications, and the client's response
5. Complete the incident report per policy
6. Participate in review and disclosure as directed

Environmental safety

Clinical risk reduction programs often monitored by risk management

• Fall prevention: risk screening (e.g., Morse Fall Scale), bed low and locked, call light in reach, nonslip footwear, scheduled toileting, medication review, bed/chair alarms as one layer, multidisciplinary plan. Restraints are not a fall-prevention strategy
• Infection prevention: hand hygiene; aseptic IV practice (scrub the hub, single-use vials when possible, never reuse syringes); ventilator-associated event prevention with head-of-bed elevation 30–45 degrees, daily sedation interruption and readiness-to-wean assessment, oral care per protocol, and cuff pressure checks; surgical site infection prevention with preoperative bathing as ordered, clipping (not shaving) when hair must be removed, and timely prophylactic antibiotics
• Pressure injury prevention: risk assessment (Braden Scale), repositioning, support surfaces, moisture and nutrition management
• Allergy and anaphylaxis readiness: allergy documented and flagged in the record and on the band per policy; emergency drugs (epinephrine) and equipment available

Workplace violence is a recognized occupational hazard. Organizations need a violence prevention program: risk assessment, reporting of all incidents (including verbal abuse and threats), de-escalation training, security support, and post-incident support for staff. OSHA can cite employers under the General Duty Clause, and The Joint Commission has workplace violence prevention requirements for accredited hospitals (from 2026 part of National Performance Goal 2, Culture of Safety; see Topic 17).

• Know and use the facility reporting system; report errors, near misses, hazards, and violence
• Respond to incidents in priority order: client first, then notification, documentation, and reporting
• Maintain competence with equipment; do not use devices you are not trained on
• Keep the environment safe (fire exits clear, equipment inspected, spills cleaned, alarms on)
• Communicate clearly and document accurately — good documentation is the best defense in litigation
• Managers: review reports, trend data, lead or join RCAs, implement corrective actions, give feedback, and coordinate with the risk manager and patient safety officer

• Confidentiality of incident reports: many states protect incident reports and quality/peer-review records from discovery; protection is stronger when the report is kept out of the chart and prepared for quality purposes. Patient safety work product reported to a listed Patient Safety Organization is privileged under the Patient Safety and Quality Improvement Act of 2005
• Malpractice requires duty, breach of duty, causation, and damages (see Topic 5); timely, factual documentation and following policy reduce liability
• Disclosure and apology: clients should be told honestly about errors that affect their care; communication-and-resolution programs (such as AHRQ's CANDOR approach) support prompt disclosure and learning. Many states have apology laws that make expressions of sympathy inadmissible as evidence of liability; the scope varies by state
• Mandatory reporting: state adverse-event reporting laws, device reporting, reporting of impaired or unsafe practice to the board of nursing as required by state law
• Honesty: altering records after an incident is illegal and unethical; late entries are labeled as late entries

Case 1 — Fall. A nurse finds a client on the floor. She first assesses for injury and keeps the client still while checking for head injury and hip pain, calls for help, notifies the provider, then documents the facts ("found on floor beside bed at 0215; states he slipped trying to reach bathroom; no visible injury; neuro checks initiated; provider notified at 0220") and completes an incident report. Why: client safety first; chart facts without referring to the report.

Case 2 — Charting error. A new nurse writes in the progress note, "Incident report completed for medication error." The preceptor explains that the chart should describe the error, assessment, and actions, but not mention the report. Why: the report is a confidential administrative document; referencing it in the chart can undermine its protection.

Case 3 — Pump malfunction. An infusion pump delivers a bolus unexpectedly. The nurse stops the infusion, assesses the client, notifies the provider, and removes the pump with its tubing and settings intact, tagging it for biomedical engineering. Why: the device is evidence for the investigation and must not be reused or reset.

Case 4 — Fire. Smoke comes from a client's room. The nurse removes the client from the room, pulls the alarm, closes the door, and then uses the extinguisher only if the fire is small. Why: RACE puts rescue first.

• Writing "incident report filed" in the chart or placing the report in the record
• Filing a report only when harm occurred — near misses and hazards must also be reported
• Including opinions, blame, or speculation in the report
• Completing paperwork before assessing the client
• Discarding a malfunctioning device or its tubing
• Thinking the purpose of reporting is disciplinary — it is system learning and risk reduction
• Reversing RACE (extinguishing before rescuing) or forgetting to confine by closing doors
• Assuming restraints prevent falls — they increase injury risk

• Risk management cycle: identify → analyze → control → evaluate
• Incident report: prompt, objective facts, by the person involved or discovering; not part of the chart; never referenced in the chart
• After any incident: client first, then notify, document in the chart, then report
• Report near misses and unsafe conditions, not only harm
• Sentinel event → comprehensive systematic analysis (RCA) and action plan; 45 business days if reported to The Joint Commission
• Device problems: keep the device and tubing, tag it, notify biomedical engineering and risk management; deaths reported to FDA and manufacturer
• Fire: RACE; extinguisher: PASS
• Electrical safety: grounded three-prong plugs, no damaged cords or extension cords
• Malpractice: duty, breach, causation, damages; good documentation is the best defense
• Workplace violence and verbal abuse should be reported and addressed at the organizational level