Intended for healthcare professionals

Feature Christmas 2013: Food for Thought

A unified model of patient safety (or “Who froze my cheese?”)

BMJ 2013; 347 doi: (Published 11 December 2013) Cite this as: BMJ 2013;347:f7273
  1. Enrico Coiera, professor and director1,
  2. Sarah Collins, nurse informatician2,
  3. Craig Kuziemsky, associate professor and director3
  1. 1Centre for Health Informatics, Australian Institute of Health Innovation, University of New South Wales, Sydney, NSW, Australia
  2. 2Clinical Informatics Partners eCare, Partners Healthcare Systems, Harvard Medical School and Brigham and Women’s Hospital, Boston, MA, USA
  3. 3Telfer School of Management, University of Ottawa, Ottawa, Ontario, Canada
  1. Correspondence to: E Coiera e.coiera{at}

Patient safety gurus routinely reach for swiss cheese and icebergs when talking about medical error. What would combining these two metaphors look like, wonder Enrico Coiera and colleagues

Students of patient safety rely on a few foundational models to explain the iatrogenic causes of patient harm. Reason’s classic Swiss cheese model1 encapsulates the idea that although an organisation such as a hospital has many defences against error (the cheese), once in a while holes in the defences line up to allow an error through. Heinrich’s iceberg model reminds us that while some harm events are reported (the tip), most remain unrecorded because they are relatively minor or do not lead to harm (perhaps because, to mix metaphors, a bit of cheese luckily got in the way).2

We propose a generalised model of patient safety that unifies these two foundational models to create a more expansive theory for patient safety. This unified theory, we contend, can better explain the nature of patient harm and our responses to it.

The building blocks

Let us begin with two building blocks—cheese and ice. Cheese is a metaphor for organisational defences and ice for safety incidents and their associated harms. Although these are useful simplifications, neither really captures the inherent sociotechnical complexity of healthcare. Clearly our organisations are neither all ice nor all cheese. We thus need a third hybrid building block—ice-cheese—to emphasise that clinical organisations can defend against harms but that nevertheless harms still do occur. Unlike apple-orange, ice-cheese is probably a continuum substrate, a bit like space-time.

Aside from their elemental “substance,” these building blocks exhibit …

View Full Text

Log in

Log in through your institution


* For online subscription