Development of an enterprise risk inventory for healthcare

Abstract

BackgroundThe first phase of an enterprise risk management (ERM) program is the identification of risks. Accurate identification is essential to a proactive and effective ERM function. The authors identified a lack of such risk identification in the literature and in practical cases when interviewing the chief risk officers from healthcare organizations. A risk inventory specific to healthcare organizations that includes detailed risk scenarios and risk impacts currently does not exist. Thus, the objective of this research is to develop an enterprise risk inventory for healthcare organizations to create a common understanding of how each type of risk impacts a healthcare organization.MethodERM guidelines and data from 15 interviews with chief risk officers were analyzed to create the risk inventory. The identified risks were confirmed through a survey of risk managers from a range of global healthcare organizations during the ASHRM conference in 2017. Descriptive statistics were developed and cluster analysis was performed using the survey results.ResultsThe risk inventory includes 28 risks and their specific risk scenarios. Cyberattack was ranked as the principal risk by the participants, followed by sentinel events and risks associated with human capital management (organizational culture, use of electronic medical records and physician wellness). The data analysis showed that the specific characteristics of the survey participants, such as the length of time working in risk management, the size of the organization, and the presence of a school of medicine, do not impact an individual’s opinion of the importance of the risks identified. A personal background in risk management (clinical or enterprise) was a characteristic that showed a small difference in the perceived importance of the risks from the proposed risk inventory.ConclusionsIn addition to defining specific risk scenarios, the enterprise risk inventory presented in this research can contribute to guiding the risk identification phase of an ERM program and thereby support the development of a risk culture. Patient data security in hospitals that operate with high levels of technology is fundamental to delivering high quality and safe care to patients. At the top of the risk ranking, the identification of cyberattacks reflects the importance that healthcare risk managers place on this risk by allocating time and other resources. Exploring opportunities to improve cyber risk management and evaluating the benefits of using the risk inventory at the beginning of the risk identification phase in an ERM program are suggestions for future studies.Electronic supplementary materialThe online version of this article (10.1186/s12913-018-3400-7) contains supplementary material, which is available to authorized users.

The Economic Impact of COVID-19 Treatment at a Hospital-level: Investment and Financial Registers of Brazilian Hospitals

“…In this context, the occurrence of a natural, catastrophic event such as the COVID-19 pandemic is recognized by health-care leaders as a relevant enterprise financial risk, which deserves continuous vigilance from leadership to avoid larger economic impacts. 19 Although recent studies in Brazil have shown that hospitals that provide inpatient care for the public health system are inefficient and should work to increase production and reduce inputs to achieve a better economic sustainability, 20 this research demonstrates an opposite behavior during the COVID-19 pandemic: a decrease in occupancy rates and revenues and an increase in investments, suggesting the importance of developing strategies to contribute to health organizations' financial sustainability for the future. The cancelation or postponement of elective surgeries and procedures could have contributed to the decrease of revenue and occupation rates.…”

The application of clinical risk management in hospitals

“…An important basic part of risk management is the list of possible risks. This list regarding CRM in hospitals is most dealt with by Cagliano et al (2011) and Etges et al (2018). The study of Cagliano et al (2011) is based on the risk management of project management that deals with planning, identifying, analyzing, reactions, monitoring and controlling risks.…”

Proposition of a Shared and Value-Oriented Work Structure for Hospital-Based Health Technology Assessment and Enterprise Risk Management Processes

“…One of the studied healthcare institutions recommended the elaboration of a risk inventory. A risk inventory that contains a detailed description of risk events and specific examples should contribute to create a shared understanding of risks and improve communication between departments (12).…”

“…HB-HTA and ERM are processes implemented by hospitals to increase efficiency and patient safety, and to orient the decision-making process respecting budget restrictions and the organization financial objectives (9–11). The HB-HTA process does this by assessing health technologies (10), while ERM contributes by engaging employees with the hospital's strategic principles, identifying opportunities for continuous improvement without exposing the organization too much (5;8;12).…”

“…One of the studied healthcare institutions recommended the elaboration of a risk inventory. A risk inventory that contains a detailed description of risk events and specific examples should contribute to create a shared understanding of risks and improve communication between departments(12).With the objective of becoming educated, the HB-HTA and ERM teams may work together. HB-HTA units should be willing to improve from their experience and should be open to learn and innovate…”