Healthcare regulators are having trouble keeping up. There is always a lag between regulators getting on top of things and fast-paced changes in health systems. Care is continuously becoming more complex.1 Rapid technological shifts (eg, new-generation drugs, artificial intelligence (AI) and advances in genomics) are accelerating. This confers new opportunities for better care, but it also implies new risks which need to be regulated differently. Yet the current paradigm is largely predicated on regulators mainly inspecting and investigating harmful events in retrospect, responding after they occur.2 This is despite developments and innovations in proactive inspection methods, and more collaborative approaches.

Another problem is that regulators often argue for system-based approaches to adverse events, but then often act by sanctioning individuals—in part because this is what they are empowered to do. The regulatory logic is: assemble objective evidence and assess this against compliance to the standard or procedure, then search for the human cause close to the patient where the active failure occurred. This is not workable: the health system has too many facets and layers. Regulators should reserve the individualised approach only for those healthcare professionals involved in what we (box 1) call ‘sex, drugs, and rock ’n roll’ cases—those where the practitioner wilfully or recklessly breaches the rules, or negligently causes harm, or needs to be treated for a substance use disorder.

Box 1 Anchoring the authors’ perspectives

We clarify our backgrounds and expertise to make transparent where we are coming from. One of us concluded 8 years as Norwegian Minister of Health and Care Services and currently holds the position as leader of the regional supervisory authorities in a County Governor’s Office (BH). Another spent 30 years working in clinical and leadership roles in the National Health Services of England and Scotland and 5 years as Chief Medical Officer for Scotland (CC). Yet another has 12 years of experience from regulation in the Norwegian oil and gas sector and 20 years in healthcare safety science research (SW). A fourth author (JB) has devoted three decades to studying complexity science, learning, patient safety, implementation science and systems improvement in multifaceted sociotechnical care settings.

The author team has long experience (see box 1). Through this lens we have witnessed junior doctors starting out in the past when the situation differed from today. Back then they used to be advised that as long as they worked hard, were not lazy or drunk on duty, did not have sex with or deliberately harm their patients, or misuse funds, and paid their registration fees, they would be safe from the regulator. This is no longer the case because, as we documented in our opening to this paper, healthcare is changing—and radically. This logarithmic complexity adds a whole network of causality when things go wrong. If regulatory bodies do not adopt new methods, competence and capacity to deal with this complexity, they risk far too narrow an understanding of accident causality.

Drivers of change

Of the multiple drivers of change in healthcare, we note a ‘big three’ that add to system complexity and are not readily amenable to control: demographic changes, technology advances and the production of new medical knowledge. Take Norway, by way of example,3 recently judged by an international study as the world’s safest health system.4 While Norwegians believe that advancing technologies such as genomics, new IT systems and AI can further improve opportunities for better, more personalised treatment, this requires new ways of practising and much professional development of the workforce. A key Norwegian mitigating force is the lack of personnel—an international challenge.3 5 This in turn pushes not just Norway but all societies to intensify the use of new technology to do more of the care delivery. It is extremely challenging for healthcare professionals to keep updated on advances in medical knowledge, best practice, current guidelines and to implement new technology while the system, under severe strain, requires them to run faster and jump higher.

Consequences for the healthcare services and regulatory bodies

Put simply, although the system is moving fast, we have not been able to change the way we work and implement new safeguards at the required pace. The response in some health systems is the simplistic knee-jerk reaction: more regulation. We disagree with this reaction. Multilayered and advancing complexity, unless understood and managed, will make healthcare professionals more likely to contribute to an adverse event. Society expects every clinician to be up-to-date and safe when providing medicine and care. And it expects regulators to come down hard on ‘transgressing’ professionals. This is completely counterproductive and leads to defensive medicine. Regulators should not only refrain from blaming individuals, they should be equipped to explain to the public why this is counterproductive.

This is not easy to do. In response to the rising complexity we are discussing, care systems are busily increasing the scope of current roles and employing more people in refashioned, technology-savvy roles—AI data analysts, population genetic counsellors, virtual care specialists or patient transitions experts. We need to re-educate and re-train current professionals for these and many other new work processes. Technical staff, knowledge brokers, big data experts and process re-design engineers will be working shoulder to shoulder with super-specialised clinicians—yet, traditionally, these former roles did not exist. There is limited understanding of the roles each play and will play in a reformed system.3 The required changes call for more responsive policymakers, widespread technological understanding, and sophisticated leaders who can become better at boundary-riding, and effective change architects.

All of this change and increased complexity has significant consequences for quality and safety, and regulatory and inspection agencies. It implies that they too need to radically change—both in their roles, and regulatory practices. Unless they do, regulatory inquiry, methods and laws that will enable them will lag further behind.6 Indeed, healthcare rules and regulations have tended to remain fixed—myopically stuck in the times when the care episode was planned and executed in a face-to-face consultation with a doctor or nurse prescribing care to the patient. This ignores the systems changes we have outlined and the system’s shift to co-production.7–9 In Norway and other countries, regulators increasingly say they want to pay attention to these systems issues in general and when adverse events occur.10 11 Yet at the same time, regulators remain steadfast in looking to penalise individual healthcare professionals and use accountability tools such as withdrawal of licence to practice as a means of sanctioning if something goes wrong (even in situations not involving sex, drugs and rock ‘n’ roll).9 12

This is exemplified in the UK and in Norwegian law where regulators have very wide sanctioning repertoires to target individuals. This scope includes required competence development; withdrawal of authorisation, licence or specialisation approval; limited or full suspension of authorisation; limited authorisation; required expert assessment of healthcare professionals; lost right to prescribe medication; provision of information to employer and other countries when professionals are sanctioned; punishment with use of fines and prison for a maximum of 3 months; work under supervision of others. This scope is in stark contrast to organisational-level sanctions such as the requirement to correct deviations; requirement of closure; or compulsory fine.

Our accumulated experience tells us this individual-centric paradigm no longer makes sense. And it will make even less sense as this decade unfolds. Treatment quality and patient safety are now, and increasingly more so in the future, dependent on results produced in complex organisations, with numerous people involved, and intricate combinations of human, social and technological contributions.13 We argue that targeting the individual healthcare professionals should be reserved only for sex, drugs and rock ‘n’ roll situations. Even in these cases, there needs to be a better understanding of supportive factors. Patently, it is an employer’s responsibility to identify and compassionately help people in such challenging circumstances. The transgressing professional may be ill or depressed, for example. Of course, patient protection is paramount so that professionals must be removed if practising under the influence of drugs or alcohol, or illegal drugs. Regulatory bodies need to be in place—but as a last barrier.

So, in very many episodes of concern to regulators, the individual’s career should not be on the line. Root causes of adverse events are virtually always a complex mix of factors and cannot be analysed and remedied via old-world, linear thinking. How this way of thinking fails can be exemplified through the case of Dr Hadiza Bawa-Garba which, over a decade ago, rocked the medical world (box 2).

Box 2 Short summary of the Bawa-Garba case and regulatory response20 21

Six-year-old Jack Adcock tragically died from sepsis in 2011 in the UK’s Leicester Royal Infirmary. A trainee paediatrician, Dr Bawa-Garba, and two nurses were charged with gross negligence manslaughter. Found guilty in 2015 and given a 2-year suspended prison sentence, the jury ruled that her mismanagement was ‘truly exceptionally bad’. One nurse was also convicted and struck off; the other was cleared. In June 2017 the Medical Practitioners Tribunal Service further suspended Bawa-Garba for 12 months as erasure from the medical profession was deemed disproportionate. The UK’s General Medical Council, disagreeing, then took her case to the High Court where she was permanently struck off the medical register ‘to maintain public confidence in the profession’. In August 2018 the Court of Appeal ruled that she should be reinstated and could return to practice. Her legal fees were crowdfunded by supporters.

The environment and systems in which Dr Bawa-Garba found herself that day were what was really ‘truly exceptionally bad’. She was on her first acute shift on return from maternity leave, covering two absent doctors across six wards over four floors. There was a hospital IT failure. She has always been open and honest about her own errors. Subsequently over 70 actions were taken by Leicester Royal Infirmary to improve how sick children were managed.

With so many systems deficiencies, it is hard to see in retrospect how Bawa-Garba and her nursing colleagues could be comprehensively blamed. The unsafe circumstances within a complex, failing organisation was what should really have been on trial, and subject to most regulatory attention.

The road ahead should target dynamic responsiveness

How can we move away from the myopic blame of the individual to deal with systems failures and the realities of the working environment in investigations into tragic events? How can we ensure we make the multilayered changes needed to prevent recurrence? This requires a new and future-oriented mindset from regulatory and supervisory bodies, and a dynamic responsiveness. Regulators need to deeply understand the safety management system, and the role of technology, leadership and culture in any presenting event. They need to generate a sharper, more profound systems perspective by looking at how things go right as well as how things go wrong.14 15 Regulators and supervisory bodies need new knowledge to apprehend the intricate admixture of factors that go to make up an ‘adverse event’, and collaborate with the sector to develop better systems for harm reduction and quality improvement rather than sit in judgement of erring individuals.15 Today, regulatory professionals are usually senior and experienced health professionals and legal practitioners.8 To keep up, these bodies will need to be bolstered with systems experts, implementation scientists, leadership specialists, IT analysts, anthropologists, organisational scientists, health systems researchers and those with knowledge of complex adaptive systems, change and emerging technologies.

Furthermore, regulators need to devote more attention to how systems are set up, how they are transitioning, and what their new role is in the constantly changing care ecosystem. They should also employ new methods to understand work practices and move from being interested in organisation charts and procedures to understanding more of the messiness of healthcare practice—which always differs from textbooks and the regulatory legal framework. In that messy world, despite its labyrinth-like nature, most healthcare is provided without patient harm. People in situ need soft skills and the ability to negotiate, contextualise, establish relations and care for each other at work—and regulators need to promote these behaviours. Regulatory agents and agencies should adopt a regulatory logic to acknowledge these soft dimensions of safety to a larger degree. In practice this means not privileging the linearity of old-world, legalised, regulatory logic. Reality is much more dynamic—as should be regulatory processes.

In short, we need a reflexive approach to regulation focused on dialogue, mutual learning and understanding the complexity of healthcare. We need a new pattern of relationships between the regulators and the regulated. This has the potential for better management of future challenges healthcare faces. The regulatory landscape ahead is potentially so demanding that a radical reset is required for handling it. Dynamic responsive regulation should move sanctioning to the last resort. Investigations of adverse events should shift to these wider concerns—not just of ‘objective facts’, or ‘who failed’, but of systems causality, organisational factors, behavioural incentives to care, and conditions under which people work.

Outside of sex, drugs and rock ‘n’ roll cases, regulators should be targeting learning about systems dynamics in dialogue with a wide range of groups including professional associations. Regulatory innovation is intermittently occurring in some places—proactive inspections and audits where planned regulatory activities target specific topics or themes (elderly care, access, nutrition), or groups of patients (youth, disabled, dementia, maternity). But we also see an opportunity for adopting dynamic responsiveness to adverse events. If successful, the next-generation regulator will approach patient safety and adverse events with a system-based approach, understanding patterns of risk, working conditions, technology and human factors, and be skilled in deconstructing complex safety problems with the professionals concerned but without blaming the individuals. This is an untapped source of strength for regulators of the future. Will they meet this challenge?

How might healthcare regulators seek inspiration from others?

Healthcare could seek inspiration from high-risk environments in other sectors where progress along the lines we are articulating has been used as guidance for innovation and improvement. We can use the Norwegian oil, gas and ocean industry as an example. The Norwegian Ocean Industry Authority (Norwegian: Havtil) employs a wide variety of professional backgrounds including subject matter experts in, for example, drilling, production, structural integrity, and subsea knowledge but also disciplines such as leadership, anthropology, sociology, organisation science, societal safety, emergency preparedness, security and IT—to mention only a few. The premises for this regulatory regime are trust, performance-based regulation and tripartite collaboration. Arenas such as Safety Forum and Regulatory Forum, comprising interested parties who work collaboratively on projects, have been formally established as central for tripartite collaboration. These arrangements emphasise joint working between companies, unions and government on important health, safety and environment challenges across the petroleum sector as input to regulatory amendments and improvement.

This forward-looking package of activities represents a major investment in efforts to understand risk and uncertainty including research commissioned to deepen knowledge of risk itself, and, risk management, trends in risk monitoring, changing work environments and transitioning safety cultures. Perspectives and positions are constantly debated and refined to advance how the responsible companies and Havtil as a regulatory body monitor and inspect performance and obtain feedback from workers (directly, or via unions).

Healthcare could replicate these arrangements, taking a lead on the degrees of trustful collaboration which nurture new ways of apprehending patient safety performance and variability. Inspired by Havtil, we also support listening and collaborating instead of putting the professionals on the spot as the sole or primary responsibility for system failures.16

Conclusion

Regulation has historically been a key reassurance mechanism for both politicians and patients, but its approaches are rapidly becoming outmoded. Instead, regulatory innovation and understanding of complexity are now fundamental.7 17–19

We have argued the case that successful regulators in the future will display dynamic responsiveness—so regulation remains fit-for-purpose in the real world of constant churn and reform. We can no longer support the pursuing of individual culpability in any other situation than when healthcare professionals demonstrate serious professional misconduct, sexual abuse of patients, use of mind-altering substances, commit criminal offences or intentionally harm patients. This happens very rarely—and does indeed require appropriate and sometimes severe sanctions to prevent further harm. Yet in most other cases, such an approach cannot be justified, and the regulatory enterprise cannot be built on this proposition when adverse events happen. It does not fit with the complexity of healthcare, modern accident models and new understandings of causality, or the way safe services are actually produced. The road ahead needs to be anchored in system-based approaches, with regulatory frameworks to match, and regulators open to improving, evaluating and innovating their own practices in a complex adaptive system.

Ethics statementsPatient consent for publication

Not applicable.

Ethics approval

Not applicable.