The Checklist Manifesto (14 page)

At the Kaiser hospitals in Southern California, researchers had tested their checklist for six months in thirty-five hundred operations. During that time, they found that their staff ’s average rating of the teamwork climate improved from “good” to “outstanding.” Employee satisfaction rose 19 percent. The rate of OR nurse turnover—the proportion leaving their jobs each year—dropped from 23 percent to 7 percent. And the checklist appeared to have caught numerous near errors. In one instance, the preoperative briefing led the team to recognize that a vial of potassium chloride had been switched with an antibiotic vial—a potentially lethal mix-up. In another, the checklist led the staff to catch a paperwork error that had them planning for a thoracotomy, an open-chest procedure with a huge front-to-back wound, when what the patient had come in for was actually a thoracoscopy, a videoscope procedure done through a quarter-inch incision.

At Toronto, the researchers physically observed operations for specific evidence of impact. They watched their checklist in use in only eighteen operations. But in ten of those eighteen, they found that it had revealed significant problems or ambiguities—in more than one case, a failure to give antibiotics, for example; in another, uncertainty about whether blood was available; and in several, the kinds of unique and individual patient problems that I would not have expected a checklist to help catch.

They reported one case, for example, involving an abdominal operation under a spinal anesthetic. In such procedures, we need
the patient to report if he or she begins to feel even a slight twinge of pain, indicating the anesthetic might be wearing off and require supplementation. But this particular patient had a severe neurological condition that had left him unable to communicate verbally. Instead, he communicated through hand signals. Normally, we restrain the arms and hands of patients to keep them from inadvertently reaching around the sterile drapes and touching the surgeons or the operative field. In this instance, however, the regular routine would have caused a serious problem, but this was not clearly recognized by the team until just before the incision was made. That was when the surgeon walked in, pulled on his gown and gloves, and stepped up to the operating table. Because of the checklist, instead of taking the knife, he paused and conferred with everyone about the plans for the operation. The Toronto report included a transcript of the discussion.

“Are there any special anesthetic considerations?” the surgeon asked.

“Just his dysarthria,” the anesthesiologist said, referring to the patient’s inability to speak.

The surgeon thought for a moment. “It may be difficult to gauge his neurological function because we have these issues,” he said.

The anesthesiologist agreed. “I’ve worked out a system of hand signals with him.”

“His arm will [need to] be accessible then—not tucked,” the surgeon said. The anesthesiologist nodded, and the team then worked out a way to leave the patient’s arms free but protected from reaching around or beneath the drapes.

“My other concern is the number of people in the room,” the
anesthesiologist went on, “because noise and movement may interfere with our ability to communicate with the patient.”

“We can request silence,” the surgeon said. Problem solved.

None of these studies was complete enough to prove that a surgical checklist could produce what WHO was ultimately looking for—a measurable, inexpensive, and substantial reduction in overall complications from surgery. But by the end of the Geneva conference, we had agreed that a safe surgery checklist was worth testing on a larger scale.

A working group took the different checklists that had been tried and condensed them into a single one. It had three “pause points,” as they are called in aviation—three points at which the team must stop to run through a set of checks before proceeding. There was a pause right before the patient is given anesthesia, one after the patient is anesthetized but before the incision is made, and one at the end of the operation, before the patient is wheeled out of the operating room. The working group members divvied up the myriad checks for allergies, antibiotics, anesthesia equipment, and so on among the different pause points. They added any other checks they could think of that might make a difference in care. And they incorporated the communication checks in which everyone in the operating room ensures that they know one another’s names and has a chance to weigh in on critical plans and concerns.

We made a decision to set up a proper pilot study of our safe surgery checklist in a range of hospitals around the world, for which WHO committed to providing the funds. I was thrilled and optimistic. When I returned home to Boston, I jumped to give the
checklist a try myself. I printed it out and took it to the operating room. I told the nurses and anesthesiologists what I’d learned in Geneva.

“So how about we try this awesome checklist?” I said. It detailed steps for everything from equipment inspection to antibiotic administration to the discussions we should have. The rest of the team eyed me skeptically, but they went along. “Sure, what ever you say.” This was not the first time I’d cooked up some cockamamie idea.

I gave the checklist to Dee, the circulating nurse, and asked her to run through the first section with us at the right time. Fifteen minutes later, we were about to put the patient to sleep under general anesthesia, and I had to say, Wait, what about the checklist?

“I already did it,” Dee said. She showed me the sheet. All the boxes were checked off.

No, no, no, I said. It’s supposed to be a
verbal
checklist, a
team
checklist.

“Where does it say that?” she asked. I looked again. She was right. It didn’t say that anywhere.

Just try it verbally anyway, I said.

Dee shrugged and started going through the list. But some of the checks were ambiguous. Was she supposed to confirm that everyone knew the patient’s allergies or actually state the allergies? she asked. And after a few minutes of puzzling our way through the list, everyone was becoming exasperated. Even the patient started shifting around on the table.

“Is everything okay?” she asked.

Oh yes, I told her. We’re only going through our checklist. Don’t worry.

But I was getting impatient, too. The checklist was too long. It was unclear. And past a certain point, it was starting to feel like a distraction from the person we had on the table.

By the end of the day, we had stopped using the checklist. Forget making this work around the world. It wasn’t even working in one operating room.

Some time after that first miserable try, I did what I should have done to begin with. I went to the library and pulled out a few articles on how flight checklists are made. As great as the construction-world checklists seemed to be, they were employed in projects that routinely take months to complete. In surgery, minutes matter. The problem of time seemed a serious limitation. But aviation had this challenge, too, and somehow pilots’ checklists met it.

Among the articles I found was one by Daniel Boorman from the Boeing Company in Seattle, Washington. I gave him a call. He proved to be a veteran pilot who’d spent the last two decades developing checklists and flight deck controls for Boeing aircraft from the 747-400 forward. He’d most recently been one of the technical leaders behind the flight deck design for the new 787
Dreamliner, including its pilot controls, displays, and system of checklists. He is among the keepers of what could be called Boeing’s “flight philosophy.” When you get on a Boeing aircraft, there is a theory that governs the way your cockpit crew flies that plane—what their routines are, what they do manually, what they leave to computers, and how they should react when the unexpected occurs. Few have had more experience translating the theory into practice than Dan Boorman. He is the lineal descendant of the pilots who came up with that first checklist for the B-17 bomber three-quarters of a century ago. He has studied thousands of crashes and near crashes over the years, and he has made a science of averting human error.

I had a trip to Seattle coming up, and he was kind enough to agree to a visit. So one fall day, I drove a rental car down a long flat road on the city’s outskirts to Boeing’s headquarters. They appeared rather ordinary—a warren of low, rectangular, institutional-looking buildings that would not be out of place on the campus of an underfunded state college, except for the tarmac and hangar of airplanes behind them. Boorman came out to meet me at security. He was fifty-one, pilot-trim, in slacks and an open-collared oxford shirt—more like an engineering professor than a company man. He took me along a path of covered concrete sidewalks to Building 3-800, which was as plain and functional as it sounds. A dusty display case with yellowing pictures of guys in silver flight suits appeared not to have been touched since the 1960s. The flight test division was a fluorescent-lit space filled with dun-colored cubicles. We sat down in a windowless conference room in their midst. Piles of checklist handbooks from US Airways, Delta, United, and other airlines lay stacked against a wall.

Boorman showed me one of the handbooks. It was spiral
bound, about two hundred pages long, with numerous yellow tabs. The aviation checklist had clearly evolved since the days of a single card for taxi, takeoff, and landing, and I wondered how anyone could actually use this hefty volume. As he walked me through it, however, I realized the handbook was comprised not of one checklist but of scores of them. Each one was remarkably brief, usually just a few lines on a page in big, easy-to-read type. And each applied to a different situation. Taken together, they covered a vast range of flight scenarios.

First came what pilots call their “normal” checklists—the routine lists they use for everyday aircraft operations. There were the checks they do before starting the engines, before pulling away from the gate, before taxiing to the runway, and so on. In all, these took up just three pages. The rest of the handbook consisted of the “non-normal” checklists covering every conceivable emergency situation a pilot might run into: smoke in the cockpit, different warning lights turning on, a dead radio, a copilot becoming disabled, and engine failure, to name just a few. They addressed situations most pilots never encounter in their entire careers. But the checklists were there should they need them.

Boorman showed me the one for when the DOOR FWD CARGO warning light goes on in midflight. This signals that the forward cargo door is not closed and secure, which is extremely dangerous. He told me of a 1989 case he’d studied in which exactly this problem occurred. An electrical short had caused a Boeing 747 cargo door to become unlatched during a United Airlines flight out of Honolulu on its way to Auckland, New Zealand, with 337 passengers on board. The plane was climbing past twenty-two thousand feet and the cabin was pressurized to maintain oxygen levels for the passengers. At that altitude, a loose,
unlatched cargo door is a serious hazard: if it opens enough to begin leaking air, the large pressure difference between inside and out causes a “ring-pull” effect—an explosive release like pulling the ring top on a shaken soda can. In the Honolulu flight, the explosion blew out the cargo door almost instantly and took with it several upper-deck windows and five rows of business class seats. Nine passengers were lost at sea. Passengers in adjacent seats were held in only by their seat belts. A flight attendant in the aisle was nearly sucked out, too, but an alert passenger managed to grab her ankle and pin her down, inches from the gaping hole.

The crew had had no time to prevent the catastrophe. From unlatching to blowout and the loss of nine lives took no more than 1.5 seconds. Boeing subsequently redesigned the electrical system for its cargo doors and—because no latch is foolproof—installed extra latches, as well. If one fails, the DOOR FWD CARGO light goes on and the crew has more time to respond. There is a window of opportunity to stop a blowout. That’s where the checklist comes in.

When a latch gives way, Boorman explained, a crew should not tinker with the door or trust that the other latches will hold. Instead, the key is to equalize the difference between inside and outside pressures. The more you lower the cabin pressure, the less likely the door will explode away.

Airplanes have an easy way to lower the pressure, apparently: you hit an emergency override switch that vents the cabin air and releases the pressurization in about thirty seconds. This solution is problematic, however. First, the sudden loss of pressure can be extremely uncomfortable for passengers, particularly given the ear pain it causes. Infants fare the worst, as their eustachian tubes haven’t developed sufficiently to adjust to the change. Second,
depressurizing a plane at an altitude of twenty or thirty thousand feet is like dropping passengers onto the summit of Mount Everest. The air is too thin to supply enough oxygen for the body and brain.

The United Airlines flight offered a vivid lesson in what could happen, for the cargo door blowout instantly depressurized the plane, and once the initial, explosive decompression was over, lack of oxygen became the prime danger for the passengers and crew. Getting sucked into the void was no longer the issue. Everyone was able to stay well away from the ten-by-fifteen-foot hole. The temperature, however, plummeted to near freezing, and the oxygen levels fell so low that the crew became light-headed and feared losing consciousness. Sensors automatically dropped oxygen masks, but the oxygen supply on airplanes is expected to last only ten minutes. Moreover, the supply might not even work, which is exactly what happened on that flight.