top of page
Gradient Bar.jpg
Homepage

Safety cases in healthcare: can we make the case for safety before harm occurs?

Writer: Steve Franklin
Steve Franklin
Oct 7
12 min read

What healthcare can learn from nuclear and other safety-critical industries about claims, evidence, human factors, independent challenge and proactive assurance.



Can an organisation make a case for safety before it starts?

Healthcare is very good at looking backwards. An incident happens. A complaint is made. A claim arrives. A near miss is reported. We investigate, analyse and agree actions. PSIRF has helped move that work towards compassionate engagement, systems-based learning, proportionate responses and meaningful improvement. But the sequence is still familiar: something happens, the organisation studies it, and change follows.


What if we ask the difficult question earlier? Before a new plant operates, a modification is introduced or a hazardous activity begins, safety-critical industries ask for the reasoned case that the work can be carried out safely. Healthcare should be willing to ask the same question before major change, not because healthcare is nuclear power, but because hope, enthusiasm and a thick project file are not evidence of safety.


That is the purpose of a safety case. It is not simply a risk assessment, a folder of reports or another approval form. It is a structured argument, supported by evidence, that a system or activity is acceptably safe in a defined context. A strong case makes the reasoning open to challenge. From a human factors in healthcare perspective, it should show that work has been designed around people’s real capabilities and limitations, not that trained staff are expected to compensate for weak controls, awkward technology or unrealistic workload.


Key points for healthcare leaders

The main argument can be summarised in six points:

  • A safety case links claims, reasoning and evidence, while exposing assumptions, uncertainty and residual risk.

  • The organisation creating the risk owns the case. Independent review provides challenge; it does not transfer responsibility.

  • Human factors should shape design, task allocation, interfaces, staffing, competence and foreseeable human error throughout the lifecycle.

  • Safety cases can move healthcare upstream by stress-testing change before implementation rather than relying mainly on learning after harm.

  • Healthcare should adopt the principles selectively because clinical work is distributed, adaptive and difficult to bound.

  • The value is not the size of the document. It is the quality of the argument, evidence, challenge, decision and review.


What is a safety case?

A safety case is a documented, reasoned argument supported by evidence. It explains why a system, facility, activity or change is considered acceptably safe for a particular purpose and operating environment. The word “case” matters: it should persuade a suitably sceptical reader through traceable reasoning, not through the volume of material attached to it.


In UK nuclear regulation, the Office for Nuclear Regulation uses Safety Assessment Principles and Technical Assessment Guides to inform regulatory judgements. The legal setting is goal-based: the duty holder must demonstrate that risks have been reduced so far as is reasonably practicable, often described as ALARP. Regulatory guidance does not remove the duty holder’s responsibility to decide and justify how safety will be achieved.


Claim, argument and evidence

  • Claim: a clear statement about safety and the conditions under which it applies.

  • Argument: the reasoning that explains why the evidence supports the claim.

  • Evidence: analyses, tests, observations, design records, simulations, competence records and operational information.


Context, assumptions and residual risks matter just as much. A claim that is reasonable for one patient population, staffing model, technical configuration or environment may not remain reasonable when those conditions change.


How are safety cases used?

In high-hazard industries, safety cases support decisions across design, construction, commissioning, operation, modification, periodic review and decommissioning. They connect hazard identification, engineering analysis, human factors, operating limits, maintenance, emergency arrangements and organisational controls. They should identify the conditions that must remain true for safe operation and develop as evidence matures.


Who writes the case, and who reviews it?

The organisation creating and managing the risk owns the safety case. In nuclear, that is the licensee or duty holder. Designers, operators, engineers, human factors practitioners, specialist analysts, contractors and a lead safety case author may contribute, but accountability cannot be outsourced to the consultant who writes the document.


Operational authorship

The case should be developed by a multidisciplinary team with access to people who understand both design and work. The people expected to use the system should be involved early enough to influence it, not asked only to validate a near-final document.


Independent challenge

The dutyholder arranges independent nuclear safety advice and challenge that is sufficiently separate from project delivery. Reviewers test the argument, evidence, assumptions and use of relevant good practice. They may identify gaps, require further analysis or challenge whether risk has genuinely been reduced as far as reasonably practicable.


Regulatory assessment

The regulator makes its own judgement using regulatory principles and specialist guidance. It may assess whether the case is adequate for a permission or decision, but regulatory acceptance does not make the regulator the owner of the risk. Responsibility remains with the dutyholder.


Why separation matters

Separation creates constructive tension. Delivery teams hold essential knowledge but may also face deadline pressure, sunk cost, optimism and assumptions that have become normal. Independent reviewers bring distance and another route for concerns. Independence is not isolation: reviewers still need access to operational knowledge and authority to require a response.


Why human factors belongs inside the safety case

A nuclear facility is a socio-technical system. Safety depends on engineered structures and controls, but also on people interpreting information, coordinating work, maintaining equipment and responding under pressure. ONR guidance expects human and engineered interactions to be understood throughout the lifecycle.


Human factors should influence the design before the case is finalised. It should not appear at the end as an argument that trained staff will compensate for weak interfaces, awkward procedures or unrealistic workload.


Human factors questions the case should answer

  • What safety functions are allocated to people and technology, and why?

  • Which human actions prevent, detect, recover from or worsen a hazardous situation?

  • Are tasks feasible under realistic time, workload, staffing, interruption and fatigue?

  • Do interfaces, alarms, controls and information support accurate perception and action?

  • What competence, training, supervision and team coordination are required?

  • What assumptions are being made about compliance, vigilance, memory and communication?


Tools, techniques and methods

No single technique creates a safety case. Methods should be selected in proportion to hazard, novelty and complexity, and different methods answer different questions.


Hazard identification and scenario analysis

Methods can include HAZOP, FMEA, what-if analysis, structured walkthroughs, bow-tie analysis, fault trees and event trees. The important question is whether the method fits the system and involves people who understand how work will actually be performed.


Goal Structuring Notation

GSN graphically shows how a top-level claim is supported by strategies, subclaims, context, assumptions and evidence. It can expose gaps more clearly than a long narrative, but the diagram is not proof. A polished chart may still contain weak evidence or an optimistic claim.


Human factors integration

Human factors methods can include operating-experience review, task analysis, allocation of function, workload and staffing analysis, interface evaluation, usability testing, training-needs analysis, human error analysis, human reliability analysis and simulation. Their strongest use is formative: finding and fixing design weaknesses while change is still possible.


Critical controls, simulation and stress testing

The case should identify the controls on which safety depends and how their effectiveness will be verified. Simulation, walkthroughs, peer review, red-team challenge and sensitivity analysis can test what happens when ordinary pressures combine, such as reduced staffing, degraded equipment, delayed information and high demand.


What could healthcare gain?

Where could this add most value? A proportionate safety-case approach would require leaders to explain the hazards, controls, evidence, assumptions, residual risks and conditions for safe operation before approving a new service, pathway or technology. Healthcare is not starting from zero. Digital clinical safety already uses a related model: DCB0129 applies clinical risk management to health IT manufacturers, while DCB0160 applies it to organisations deploying and using health IT. This is closely connected to Promethean HD’s work on digital and technology assessment, implementation planning, governance and transformation.


Where the approach may add value

  • Major electronic patient record, AI or digital workflow deployments.

  • Redesign of urgent, maternity, medicines or deteriorating-patient pathways.

  • New facilities or transfer of activity between organisations.

  • Changes to staffing, skill mix, escalation or out-of-hours cover.

  • Automation, remote monitoring and new clinical devices.

  • Major efficiency programmes that alter controls or organisational capacity.


These are suggested applications, not a claim that every change needs a nuclear-style case. A short, focused case may be more useful than a large document assembled mainly for approval.


What does healthcare evidence tell us?

The strongest direct evidence is a 2024 peer-reviewed multisite case study in BMJ Quality & Safety. Drawing on 143 interviews and 13 safety cases from the Safer Clinical Systems programme, Liberati and colleagues found that teams broadly welcomed the proactive, systematic approach and that compiling cases revealed hazards that had previously been obscured. However, the work required scarce expertise and time; some hazards sat beyond the control of frontline teams and even provider boards; and leaders had to weigh prospectively identified risks against problems that had already caused harm. This supports cautious adoption, not a claim that safety cases are proven to reduce patient harm.


The wider literature points in the same direction. A 2025 systematic review of safety-management systems in publicly funded healthcare found some improvements but substantial variation in implementation and outcomes, and concluded that context-specific design matters. A 2023 international expert study likewise described effective patient-safety governance as a system of interacting leadership, risk-management, learning and accountability practices rather than a single tool. The defensible conclusion is therefore that safety cases can improve the quality and transparency of prospective reasoning, but evidence that they directly improve patient outcomes remains limited and should be evaluated as the approach is used.


Evidence strength and limitations

This article distinguishes three kinds of support. First, regulatory and standards sources explain what organisations are expected to do; they are authoritative but do not by themselves prove effectiveness. Second, peer-reviewed empirical studies describe implementation, mechanisms and observed outcomes, but the direct healthcare safety-case evidence base is still small. Third, the proposed board questions and nine-part model are reasoned applications by Promethean HD, informed by that evidence and by human-factors practice. They should be tested proportionately, with predefined measures, patient and staff involvement, independent challenge and explicit review triggers.


Why healthcare needs a different application

Healthcare is not merely a less mature version of nuclear power. Clinical pathways cross organisations, professional groups, homes and communities. Patients have different needs, demand fluctuates, goals conflict and work is adapted in real time. The system boundary is porous, and a local team may identify a hazard without authority to control it.


Risks created by the method

There is a real risk that the method becomes the problem. A poorly used safety case can create bureaucracy, false confidence and confirmation bias. Teams may decide that a preferred option is safe and then work backwards to justify it.


Complex diagrams can make challenge harder. Quantitative models can hide uncertainty. Independent review can become ceremonial. The same pattern appears when organisations overlook weak signals in patient safety governance: the evidence is not necessarily absent; it may be partial, normalised or simply not reaching the room where decisions are made.


Safeguards include defining the decision clearly, inviting challenge early, stating uncertainty, recording dissent, testing assumptions in real work, involving staff and patients, and keeping the case understandable to those relying on it.


How safety cases could strengthen CQC well-led

A proportionate safety-case approach is consistent with, rather than required by, CQC’s well-led expectations. CQC’s governance, management and sustainability quality statement calls for clear responsibilities, effective accountability, proportionate management of current and future risk, and the use of information about risk, performance and outcomes to improve care. A safety case is one possible way to make the reasoning behind a significant decision inspectable; it is not a substitute for the wider evidence CQC considers.


The developing hospital framework retains well-led and emphasises strategic direction, culture, capable leadership, governance, management of risk and performance, partnership, and improvement and learning. A safety case can make these elements visible around a real decision: who owns the risk, what evidence was considered, what was challenged, what residual risk remains and how the organisation will know if the case is no longer valid.


Evidence of decision quality, not an inspection folder

This must not become another inspection folder. A good case shows how the organisation thinks when evidence is incomplete and pressure is real. Did leaders test assumptions? Did they involve staff, patients and people who understand the work? Did they hear dissent? Were implementation and continuation made conditional on controls that can actually be monitored? These are questions of governance, risk and assurance, not document production. A templated case that never changes a decision may demonstrate activity without demonstrating informed governance.


Safety cases and the insightful provider board

NHS England’s Insightful Provider Board guidance focuses on how boards handle and act on information. It promotes curiosity, openness, problem-sensing and a focus on outcomes rather than activity. A safety case supports this by organising information around a decision rather than around departmental reporting.

For a significant change, the board could ask:

  • What is the top-level claim and what is in scope?

  • What evidence supports it and how current is that evidence?

  • Which assumptions are most important and how were they tested?

  • What does human factors evidence say about real work, workload and recovery?

  • What did independent reviewers challenge and how was it resolved?

  • What residual risks remain, who owns them and what would trigger review?

  • How will the board know whether the system remains safe after implementation?


How safety cases complement PSIRF

PSIRF sets expectations for effective systems and processes that respond to patient-safety incidents for learning and improvement. It emphasises compassionate engagement, systems-based approaches, proportionate responses, and supportive oversight. Safety cases address a different point in the lifecycle: the reasoning and evidence used before and during an activity to decide whether risks are sufficiently understood and controlled. The two approaches are complementary, but neither removes the need for continuing operational vigilance or evaluation.


From retrospective learning to prospective assurance

The two approaches should form a loop. Learning under PSIRF can update the safety case, challenge assumptions and strengthen controls. The safety case can use earlier incident learning prospectively, asking whether known contributory factors have been designed out or controlled before implementation. That matters because the value of learning is not the volume of analysis produced; it is whether the organisation has the capacity and governance to turn insight into action, a challenge explored further in PSIRF, Human Factors and the Resource to Turn Patient Safety Learning into Action.

  • Before implementation: identify hazards, analyse the work system, test assumptions and define controls.

  • During implementation: monitor leading indicators, weak signals, workarounds and control reliability.

  • After an incident or near miss: use PSIRF learning to revise the argument, evidence and controls.

  • During review: confirm whether the original claim remains justified as context changes.


This moves safety towards anticipation without pretending that every outcome is predictable. The aim is not to eliminate retrospective learning, but to stop it being the main route to discovering foreseeable weakness.


A proportionate healthcare safety-case model

A concise case could contain nine elements:

  1. Decision and scope: define the activity, population, boundaries and decision.

  2. Safety claim: state what is claimed and under which conditions.

  3. System and human factors context: describe people, tasks, technology, environment and dependencies.

  4. Hazards and scenarios: identify credible routes to harm and combined pressures.

  5. Controls and requirements: specify preventive, detective, recovery and mitigating controls.

  6. Evidence and uncertainty: link evidence to claims and expose assumptions and gaps.

  7. Independent challenge: record who reviewed, what they challenged and unresolved matters.

  8. Decision and residual risk: document rationale, conditions, dissent and ownership.

  9. Monitoring and review: define indicators, triggers and how learning updates the case.


Start with the decision, not the template

A major digital deployment or service redesign may require substantial analysis; a smaller change may need a concise argument. The test is whether the case improves the decision, exposes uncertainty and strengthens control, not whether every box has been completed.


The real test: does the case improve safety or only describe it?

This is where the idea either earns its place or becomes another governance burden. A safety case can turn an implicit belief that a change should be safe into an explicit argument that colleagues, patients, specialists and boards can test. It can bring human factors into design, make critical controls visible and give leaders a clearer basis for deciding whether an activity should proceed.


But if the case is written after the design is fixed, if review becomes ceremonial, if boundaries are too narrow or uncertainty is hidden, it may create paperwork and confidence without stronger safety.


So the question is not, “Do we have a safety case?” It is, “Has the case changed the design, strengthened the controls, improved the decision and created a reliable way to know when the original argument no longer holds?”


How Promethean HD can help

Promethean HD helps healthcare organisations turn these principles into practical work. Our governance and transformation support connects board assurance with frontline reality; our human factors approach examines how people interact with tasks, technology, information, teams and environments; and our work on just culture in healthcare helps organisations learn fairly without removing accountability. We can support a focused safety case, independent challenge, PSIRF implementation, digital change or a wider programme of governance improvement. The aim is simple: better-designed work, stronger decisions and assurance that is useful, not paperwork for its own sake.




References:


 

Comments

bottom of page