Adverse Event Investigations Require Focus on Just Culture, Improvements
March 1, 2025
By Greg Freeman
Executive Summary
A proper investigation after an adverse event can reduce potential liability and improve patient safety. It is important to have a plan in place before the event.
- The first priority is protecting patients from further harm.
- The investigation should focus on root causes, not placing blame.
- Peer review protections can be spoiled when information is shared indiscriminately.
Adverse events are learning opportunities, but the benefits depend on conducting an optimal investigation that adheres to best practices. Adhering to tenets of just culture and avoiding assumptions are key to yielding the greatest improvements.
Investigations are more successful when the organization has created an environment in which people are comfortable speaking up without fear of retribution, says Andrew Pollak, MD, senior vice president and chief clinical officer with the University of Maryland Medical System (UMMS) in Baltimore.
“When we look at an adverse event, we do our best to establish an environment where there’s psychological safety for people to speak up, and we do that by pursuing what organizations call a just culture,” he says. “A just culture means that we really look for the root cause of events, that we work hard to understand why adverse events occur. And even in situations where there’s a near miss and there’s no adverse event, we’ve worked hard to dig and understand why we got to a near miss, or what went wrong in the process, with a goal of understanding how we avoid doing it again, not with a goal of blaming somebody.”
Rare situations involving reckless behavior or an impaired individual require that the person be held accountable, but UMMS does not hold people accountable for what represents systemic or organizational dysfunction, Pollak explains.
“It’s not just about the root cause of the adverse event, but the root cause of everything else that had to go wrong along the way for that adverse event to occur. People talk about the Swiss cheese model of how these things occur, how something falls through the cracks and all the holes have to line up,” he says. “So, there may be six, seven, eight root causes that contribute to each failsafe mechanism failing. Understanding each one individually becomes important.”
One of the biggest mistakes in investigating adverse events is to let preconceived notions sway the investigation’s direction and conclusions, Pollak says. “There is a grave tendency amongst people like me to walk into a root cause analysis event with a preconceived understanding of what actually happened and who’s to blame. You have to continually have a conversation in a way that really allows you to carefully vet what happened,” he says. “There is a tendency, similarly, at times to blame nobody, even when there are examples of reckless behavior. When that occurs, you have to identify and you have to hold people accountable.”
However, it is important to understand the difference between cultural drift and reckless behavior, Pollak says. Cultural drift is when a mistake gets made by somebody who is doing things the way everybody else on the unit is doing, but everybody is doing it the wrong way, he explains.
“It doesn’t work to blame one person for having done it the wrong way,” Pollak says. “You have to go back and figure out how you got to a cultural drift where everybody wasn’t following a particular policy, vs. a situation where you’ve got one individual who is clearly out of line with the practice.”
Preservation of the medical record should be a top priority after an adverse event, says Justin M. Lugar, JD, of counsel with the Woods Rogers law firm in Roanoke, VA. Preserve the records and make sure no edits are made to the electronic medical record.
“Know that when anyone looks at the medical records, it’s going to be recorded in an event log which can be used down the road. I’ve seen a medical malpractice case in which one of my colleagues was able to get the metadata from the electronic medical records and see who accessed the record in the 30 minutes following the death and saw that it went all the way to the chief medical officer, the head of the hospital, the legal counsel, all of them,” he says. “They all knew about it very quickly, which means they deemed it to be a big deal.”
It would be wise to have a protocol in place for who is authorized to go into the record after an adverse event, Lugar says. Communications with families also are important, he says, because having those witnessed and documented can help avoid having family members claim they were told different information. Lugar once defended a doctor in a malpractice claim that depended on a family member’s allegation of what they were told about the patient’s injury.
“The whole claim was based on a family member of this patient who had was supposedly told after the surgery that the patient’s head was dropped during a fusion of the neck. Of course, that’s kind of a big deal, and I don’t think dropping a head in the middle of a very precise surgery happens very often,” he says. “Ultimately, at the end of the day there was neuro monitoring records that were able to disprove that any head drop occurred, because you would have seen a spike in neural activity if that had happened. But the whole thing could have been nipped in the bud if somebody had taken good records about what was communicated to the family on what day and by whom.”
Have Response Plan Ready
A provider should have a distinct plan in place in the event of an adverse event that should be implemented immediately after the event, says Craig Creighton Conley, JD, shareholder with the Baker Donelson law firm in Memphis, TN. The staff should be educated on the plan, particularly in relation to who to report an event to, what to do to preserve any evidence of such, and how to proceed.
“There should be a team in place that is charged with investigating the event and handling thereafter. The investigative team should immediately interview any staff that were involved in order to preserve their recollection while fresh, should consider having the staff prepare written statements and should preserve or obtain any evidence,” Conley says. “Any responsible party for the patient or resident should be notified along with the attending physician of that patient or resident as soon as possible.”
Any relevant agencies should be notified of the event, depending on the nature of the event and whether it rises to the level of a reportable event, he says. Once the investigation is complete, the team should review its findings, perform a root cause analysis and make any adjustments or implementations to prevent future, similar events. Based on the findings and plan, the staff should be educated or re-educated and that should be documented, he says.
The team’s purpose in investigating should be to review the event to determine a facility’s quality of services and to improve, Conley says. In a long-term care facility, these teams typically consist of an administrator, director of nursing, and charge nurses. These teams report to a quality assurance committee whose task is to review the adverse event and implement any actions to prevent the reoccurrence. Acute care facilities typically have a risk management team in place charged with investigating, reporting, performing root cause analysis and determining any necessary actions.
Any staff member actually involved in or a witness to the adverse event should not be involved, Conley says. Anyone not tasked with reviewing and improving upon the quality of services provided also should not be involved.
“A provider should have a specific form or incident reporting and investigation system in place. That form or system should distinctively provide that its purpose is for quality improvement and assurance purposes in hopes of cloaking it with protection from production,” Conley says. “For example, an incident report should provide on its face that it purpose is peer review and/or quality improvement/assurance and cite to that state’s peer review statute.”
The information also can be protected if the investigation was done in anticipation of litigation. This can best be accomplished with direction from legal counsel to proceed with an investigation for this purpose, he says. Peer review laws and protections vary from state to state, Conley notes. Some are very broad as to what encompasses peer review, while others are narrowly defined. Nevertheless, peer review protections typically apply if the purpose of the investigation and subsequent activity was to review and improve upon the quality of services provided, he says.
Peer review protections can be spoiled by not following the state peer review statute provisions, Conley notes. For example, some state statutes require that there be a designated committee in place whose purpose is to review and improve on the quality of services provided. Failure to have such a committee in place with that designated purpose could prevent a provider from asserting a peer review privilege resulting in the production of the underlying investigation and findings, Conley says.
Patient safety needs to be addressed first in any adverse event investigation, says Paul D. Werner, JD, attorney with the Buttaci Leardi Werner law firm in Princeton, NJ. Before any other steps are taken, the providers need to be sure that the adverse event is being addressed and the patient’s safety is protected, he says.
“Depending on the nature of the situation, this may include referral to another physician or hospital, or simply treating the event within the provider’s own office. Once the provider is certain that the patient’s safety has been addressed, the next step is to fully document everything that happened and everyone who was involved,” he says. “Adverse events are, unfortunately, part of the practice of medicine. They are not something to hide from, and in fact, more often than not, the attempt to cover something up leads to far more severe consequences than simply addressing the issue head on.”
Depending on the situation, other steps may be involved as well. For example, if the adverse event may have been caused by the administration of a medication, that medication must be documented, including lot numbers as appropriate, so that things can be traced, if necessary, Werner says. Other necessary steps also may include preserving physical items associated with the adverse event.
Consider contacting legal counsel and insurers if there is potential of a claim being filed, Werner says. He notes that not all elements of the investigation can be protected from discovery, even if you have involved legal counsel.
“Outside of communications with legal counsel or peer review situations, there is not much legal protection as it relates to the investigation of an adverse event,” he says. “But this is not necessarily a bad thing, as evidence of a comprehensive investigation after an adverse event can be a sign that the provider is engaged and interested in patient safety.”
Formal peer review meetings and applications generally are protected from disclosure, but that can be voided if there was evidence that the peer review was conducted with incomplete or falsified information or was not truly the independent review and analysis of the involved providers, Conley says.
Trying to hide the existence of an adverse event is the biggest mistake a provider can make, Werner says. But he says the legal community is split on whether and how to apologize to patients after an adverse event, with some adopting the philosophy that patients are less likely to pursue claims against a provider if the provider apologizes, and others taking the approach that apologizing is an unnecessary admission of wrongdoing.
“Personally, I have adopted the latter view. I would never advise a client to apologize to a patient for the adverse event, at least not directly. For example, I would not advise a client to say, ‘I’m sorry that the procedure we performed injured you,’” Werner says. “I would, however, suggest that a client say something to effect of ‘I’m sorry that you are having to deal with this.’ My personal opinion is that nothing a provider says after an adverse event is going to dissuade a patient from bringing a claim if that patient was otherwise intending to do so, and, in that vein, the only thing an apology can do is create a statement that the provider will have to defend against later.”
Disclosure Can Be Tricky
When it comes to adverse events in healthcare, disclosure is key, says Henry Norwood, JD, an attorney with the Kaufman Dolowich law firm in San Francisco. Full and timely disclosure is consistent with ethical practice and may even deter lawsuits. The question is how to disclose an adverse incident, he says.
“Disclosures should be made based on the information known at the time the disclosure is made. If an incident is still under investigation, this should not prevent healthcare staff from disclosing the incident to a patient or their loved ones,” he says. “The disclosure should simply be limited to the information known to staff at that time, with a guarantee of additional disclosures as more information becomes known. This ensures patients and their caregivers are brought into the investigative process and establishes a sense of trust and honesty.”
Statements of sympathy should be emphasized, while statements of fault should be minimized, Norwood says. An expression of sympathy for a patient’s current situation can be critical to demonstrating providers genuinely care for their patients. Statements of sympathy generally are protected and excluded from being used as evidence against a health provider in a lawsuit by so-called “apology laws,” Norwood says.
Most states have some form of apology law and the extent to which statements of sympathy are protected varies from state to state, he says. Statements of fault, on the other hand, generally are excluded from the protection of apology laws and normally are admissible in litigation to establish fault by the provider. Apology laws should be reviewed on a state-by-state basis to fully understand the protections afforded by each state, he says.
“Any written reports or other materials produced from an adverse incident investigation should be clearly labeled for its purpose. This is particularly true if the report is part of a peer review process,” Norwood says. “Materials produced as part of a health organization’s peer review process are generally protected from disclosure in litigation by peer review privileges, which exist in some form in each state. If a report or other writing is made pursuant to a peer review process, as opposed to a general investigation into an adverse incident, the writing should reflect this purpose to ensure it is afforded the proper legal protection.”
The first thing to do after an adverse event is respond quickly, says David Gammill, JD, founding partner of Gammill Law in Los Angeles. If there is a response team, activate them within hours, he says. Patients and families should be informed early on also. Avoiding them or delaying communication can create mistrust and lead to bigger issues, he says.
“Start with a basic review to gather quick facts, but don’t jump to conclusions,” Gammill says. “That’s a mistake I’ve seen happen too often.”
The deeper investigation must focus on facts, not blame, he says. Talk to the people involved but keep those conversations confidential, Gammill advises.
“This isn’t about pointing fingers. It’s about finding out what really went wrong. For example, if someone made a mistake like giving the wrong medication, the bigger question is why it happened. Was it poor training? A confusing system? Broken communication?” he says. “Collect all relevant records, like medical charts and protocols, and organize everything into a clear timeline. Tools like a root cause analysis or even just asking ‘why’ repeatedly can reveal the real issues without overcomplicating things.”
It is critical to have the right people involved, he says. Legal counsel should be part of the process from the start to protect important confidentiality protections, such as peer review. Include people from quality or risk management and those with expertise related to the event. “But avoid involving anyone who has a conflict of interest or doesn’t need to be there,” Gammill says. “Too many cooks in the kitchen can muddy the investigation and hurt its credibility.”
Documentation is key, he notes. Every step, every decision, every finding needs to be written down.
“Without that, you can’t prove that the investigation was thorough. Peer review protections can keep this information private, but only if everything stays confidential. Sharing findings outside the investigation team, even accidentally, can ruin those protections,” he says. “Another big error is failing to follow through. If you find issues but don’t make changes, the entire process was pointless, and that can be used against you later.”
The team investigating an adverse event should include experts who can provide insights into clinical care, risk management, and legal considerations, says Kalim Khan, JD, founder of Affinity Law in Markham, ON. A multidisciplinary team should then be formed, comprising clinical staff, legal counsel, and risk management experts, but it also is beneficial to involve external consultants, such as independent medical reviewers, when specialized expertise is required.
However, to maintain objectivity, individuals who were directly involved in the event should not be part of the investigation, he says. It also is important to exclude anyone whose involvement may compromise the peer review privilege, such as individuals outside the organization’s formal peer review structure. One of the most frequent mistakes in adverse event investigations is failing to label documentation as privileged, leading to unintended legal exposure, Khan notes. Another common error is neglecting to follow the organization’s peer review statutes, which can result in the loss of confidentiality protections.
“Rushing the investigation without proper data collection or analysis can lead to incomplete or inaccurate findings,” Khan says. “Organizations must also avoid assigning blame to individuals rather than addressing systemic issues, as this approach hinders meaningful improvements in patient safety.”
Consider A Small Investigative Team
It generally is best to have a small team involved when investigating adverse events, says Ben Michael, JD, attorney with Ben Michael & Associates Criminal Defense Attorneys in Austin, TX. When it comes to investigating adverse events, this team always should have at least one physician of high rank and expertise involved, although it also is beneficial to include nurses and other senior-ranking health providers as well, he says.
“You want several minds who have the knowledge and skill to fully understand the medical events being discussed to prove the quality of the assessment,” Michael says.
To maximize confidentiality, only those covered by peer review protections should be involved, like doctors, risk managers, and quality improvement staff, says Paul Koenigsberg, JD, managing partner with Koenigsberg & Associates in Brooklyn, NY. Outside consultants and legal counsel who are not part of the peer review process should be left out, he says. Any reports, notes, or discussions should be clearly marked as peer review materials and kept separate from medical records or standard incident reports to avoid accidental disclosure, he says.
“One of the biggest mistakes is sharing findings too broadly. If results are shared with people outside the peer review group, like a plaintiff’s attorney, a regulatory agency, or hospital administrators who are not involved in peer review, the protection can be lost, and the information could be used in a lawsuit,” Koenigsberg says. “Another common issue is mixing factual documentation with peer review analysis. Witness statements, medical records, and other factual records should be handled separately so they do not lose legal protection. Keeping the peer review process controlled helps improve patient safety while reducing legal risks.”
Every decision made in the early hours after an incident will shape what follows, says Ramzy Ladah, JD, partner with the Ladah law firm in Las Vegas. The first step is making sure the right people know what happened so they can respond before any details are lost. The risk manager, legal counsel, and medical leadership need to be involved right away, he says. If the facts start shifting because too much time passes or memories fade, it becomes much harder to get a clear picture.
“The people investigating the event should not include anyone directly involved in what happened. Objectivity is everything. When someone has a personal stake, even the most well-intentioned input can create bias,” Ladah says. “The investigation team should be made up of people who can analyze what went wrong without trying to defend actions or shift responsibility. That’s the only way to get useful findings that improve patient safety and hold up legally.”
Gathering information needs to be done methodically, Ladah says. That means reviewing medical records, speaking to staff, checking protocols, and understanding whether policies were followed. Interviews should focus on collecting facts, not assigning blame, he says.
“If people feel like they are being accused, they hold back information and the investigation suffers,” Ladah says. “Patterns matter. If something similar has happened before, that’s a red flag. It’s not just about this one event; it’s about seeing whether there are bigger issues at play.”
Documentation has to be handled carefully, he says. Everything written down needs to be factual, neutral, and secure. Anything speculative or unnecessary in the report can be used against the hospital if legal action follows, Ladah notes.
“Reports should go through legal review before being finalized. Too much detail in the wrong place can create liability,” he says. “Not enough detail can make the findings useless. Balancing that is part of making sure the investigation serves its purpose.”
One of the biggest errors in these investigations is waiting too long to involve legal counsel, Ladah says. If a lawyer is not in the loop from the beginning, mistakes get made that cannot be undone later, he says. Another issue is failing to challenge assumptions. Sometimes the first explanation seems obvious, but digging deeper often reveals contributing factors that were not immediately clear, Ladah says. Hospitals that assume they know what happened without a full analysis make the same mistakes over and over, he says.
“Homegrown reporting systems that rely on paper records or unsecured emails create more problems than they solve. Secure, structured systems prevent information from being altered, lost, or accessed by the wrong people,” Ladah says. “A proper incident reporting system ensures that reports are collected in a way that can be analyzed for trends without exposing the institution to unnecessary risk. Standardizing investigations can also help. Using a method like root cause analysis ensures that each case gets the same level of scrutiny, not just the ones that get the most attention.”
Ladah cautions that a rushed investigation leads to weak conclusions. But an investigation that drags on loses momentum.
“The right balance means being thorough while moving quickly enough to take action before the findings become outdated,” he says. “Every adverse event is an opportunity to correct what went wrong and prevent future harm. That only happens when the process is structured, legal risks are managed, and the findings lead to real change.”
Potential litigation is not the only reason to exercise caution in investigating adverse events, says Benson Varghese, JD, partner with the Varghese Summersett law firm in Fort Worth, TX. “I’ve worked with organizations where adverse events carried not only legal risks but also significant operational and reputational consequences,” he says. “I’ve guided clients on how to handle such incidents while preserving legal protections, ensuring that the findings are used to improve processes without exposing the organization to unnecessary liability.”
The first step in investigating an adverse event is ensuring the process is privileged from the outset, he says. Too often, organizations fail to establish clear legal protections, and this misstep can compromise the investigation. Involving legal counsel early, whether internal or external, ensures that the investigation is conducted under attorney-client privilege, he says. “For one healthcare client, starting the process with legal oversight kept the findings from being found out during litigation,” Varghese says. “This kept them from having to pay more than $500,000.”
Varghese underscores the importance of defining who should and should not be involved. While clinical staff and risk managers are essential for understanding the event, involving too many individuals — especially those without a clear role — can lead to unnecessary exposure and confusion, he says.
“For example, having non-essential staff share speculative opinions can harm the integrity of the investigation. Peer review protections can apply here, but only if all participants and documentation remain strictly within the defined peer review process,” he says. “Even a single misstep, like sharing findings outside of this protected group, can spoil the privilege entirely.”
A common but avoidable error is failing to separate improvement recommendations from liability-driven analysis, Varghese says. “By structuring the investigation to produce two distinct outcomes — one for safety improvements and another for legal defense — organizations can protect themselves while making meaningful changes,” he says. “This two-pronged approach has helped my clients prevent future risks and navigate legal issues.”
Sources
- Craig Creighton Conley, JD, Shareholder, Baker Donelson, Memphis, TN. Telephone: (901) 577-2290. Email: [email protected].
- David Gammill, JD, Partner, Gammill Law, Los Angeles. Telephone: (310) 750-4149. Email: [email protected].
- Kalim Khan, JD, Partner, Affinity Law, Markham, ON. Telephone: (844) 786-5291. Email: [email protected].
- Paul Koenigsberg, JD, Managing Partner, Koenigsberg & Associates, Brooklyn, NY. Telephone: (718) 690-3132. Email: [email protected].
- Ramzy Ladah, JD, Partner, Ladah, Las Vegas. Telephone: (702) 252-0055. Email: [email protected].
- Justin M. Lugar, JD, Woods Rogers, Roanoke, VA. Telephone: (540) 983-7620. Email: [email protected].
- Ben Michael, JD, Ben Michael & Associates Criminal Defense Attorneys, Austin, TX. Telephone: (512) 729-1720. Email: [email protected].
- Henry Norwood, JD, Kaufman Dolowich, San Francisco. Telephone: (628) 219-9814. Email: [email protected].
- Andrew Pollak, MD, Senior Vice President and Chief Clinical Officer, University of Maryland Medical System, Baltimore. Telephone: (410) 328-8667.
- Benson Varghese, JD, Partner, Varghese Summersett, Fort Worth, TX. Telephone: (817) 203-2220. Email: [email protected].
- Paul D. Werner, JD, Buttaci Leardi & Werner, Princeton, NJ. Telephone: (609) 799-5150. Email: [email protected].
Greg Freeman has worked with Relias Media and its predecessor companies since 1989, moving from assistant staff writer to executive editor before becoming a freelance writer. He has been the editor of Healthcare Risk Management since 1992 and provides research and content for other Relias Media products. In addition to his work with Relias Media, Greg provides other freelance writing services and is the author of seven narrative nonfiction books on wartime experiences and other historical events.
Adverse events are learning opportunities, but the benefits depend on conducting an optimal investigation that adheres to best practices. Adhering to tenets of just culture and avoiding assumptions are key to yielding the greatest improvements.
You have reached your article limit for the month. Subscribe now to access this article plus other member-only content.
- Award-winning Medical Content
- Latest Advances & Development in Medicine
- Unbiased Content