Every few years a health system rediscovers aviation. A minister visits a flight simulator. A hospital board adopts checklists. Someone quotes the statistic that flying is safer than driving, and the room nods.
Meanwhile the WHO’s patient safety fact sheet estimates that around one in ten patients is harmed in health care and that more than three million deaths a year are due to unsafe care. Aviation would not survive a fraction of that.
The usual conclusion is that medicine needs to copy aviation’s tools. I think that is the wrong lesson, or at least the cheap half of the right one. What made aviation safe was not the checklist. It was a deliberate decision by governments to give up some of their power to punish, in exchange for the truth. That is the part health ministries have been slowest to copy, because it is the part that costs them something.
The checklist is the easy bit
Checklists are the most visible export from the cockpit to the operating theatre, and the evidence around them is instructive. In 2009 the New England Journal of Medicine published a study of the WHO Surgical Safety Checklist across eight hospitals in different countries. Deaths fell from 1.5% to 0.8% after it was introduced. It was a striking result, and checklists spread quickly.
Then, in 2014, the same journal published a study of Ontario, Canada, where hospitals had been required to adopt surgical checklists. Across the province, the introduction was not associated with significant reductions in operative mortality or complications.
There are many explanations for the gap: Ontario started from a lower baseline, the study period was short, and a checklist that is ticked rather than used does nothing. But the most useful reading is this. A checklist is a tool that works inside a culture where people speak up. Mandated into a culture where they do not, it becomes paperwork.
What aviation actually built
In April 1976, the United States launched the Aviation Safety Reporting System, run by NASA rather than the regulator. The design choice matters. The FAA, which licenses pilots and can take their licences away, agreed to give limited immunity to people who reported incidents to NASA. NASA held the reports in confidence and stripped identifying details before analysing them.
Think about what that required. A regulator with enforcement power agreed that, in certain circumstances, it would rather know about a near-miss than punish the pilot who caused it. The programme has since received more than a million reports.
Accident investigation was built the same way. Bodies like the UK’s Air Accidents Investigation Branch or the US National Transportation Safety Board exist to establish causes, not to assign liability, and they sit apart from the organisations that license and prosecute.
The technology came later. The foundation was institutional: separate the people who learn from the people who punish, and protect what is said to the learners.
Health care’s version of the bargain
Health systems have mostly not made that bargain, and clinicians know it.
The case that crystallised this in Britain was that of Hadiza Bawa-Garba, a trainee paediatrician convicted of gross negligence manslaughter after a child’s death at Leicester Royal Infirmary in 2011. The General Medical Council then went to the High Court to have her struck off. In August 2018 the Court of Appeal restored her to the register. Along the way, the case triggered a panic among doctors about whether the reflective notes they were encouraged to write about mistakes could be used against them. It later emerged that her e-portfolio reflections were not used in evidence. The panic was still rational. Nobody had given clinicians a legal promise that honesty was safe.
England has since taken a real step. The Health Services Safety Investigations Body began operating in October 2023 with statutory independence under the Health and Care Act 2022. Material given to its investigators is protected from disclosure, and it explicitly keeps its investigations separate from processes that assign blame or liability. The model it was argued for was, explicitly, the transport sector’s accident investigation branches.
That is the aviation lesson done properly. It is also rare. In many countries the ministry is simultaneously the funder, the employer, the regulator and the investigator. Incident reports go up a single chain that also controls promotions and discipline. Under those conditions, the rational thing for a nurse who nearly gave the wrong drug is to say nothing.
The trade-off nobody wants to name
There is a genuine cost here, and pretending otherwise weakens the case.
Protecting safety investigations from disclosure means that some information a grieving family would want, or a prosecutor would use, sits behind a legal wall. Aviation accepted the trade because the pattern of accidents was more valuable than any single prosecution. Health care has to make that choice consciously, and it has to pair it with separate routes for accountability, so that protection for learning does not become protection for negligence.
Ministries also have to accept a loss of control. An independent investigator will sometimes conclude that the cause of harm was a staffing decision, a procurement failure or a budget cut. In other words, the ministry itself. That is precisely why it has to be independent, and precisely why it is politically hard.
The mechanism: reporting is a function of trust
Every safety system runs on the same raw material: people telling someone about things that went wrong or nearly went wrong. The quality of that raw material depends almost entirely on what happens to the person who reports.
Consider how a nurse on a busy ward weighs a near-miss. She drew up the wrong strength of a drug, noticed before giving it, and corrected it. Nobody was harmed. Reporting it takes time she does not have. It creates a record with her name on it. She does not know who will read it, whether it will appear in her appraisal, or whether a manager under pressure from an inquiry will use it later. On the other side of the scale is a vague sense that the report might help someone, somewhere, if anybody ever analyses it.
Most people, faced with that calculation, stay silent. Not because they are careless, but because the system has made silence the rational choice.
Aviation changed the calculation on both sides. It lowered the cost of reporting by offering confidentiality and limited immunity. And it raised the visible benefit by feeding lessons back to the people who report. NASA’s reporting system still publishes CALLBACK, a bulletin that turns anonymised reports into short, readable lessons for pilots and controllers. Reporters can see their colleagues’ mistakes being used to protect everyone, not to punish someone.
Health systems tend to copy the form, an incident reporting portal, without the terms. The portal exists. The protection does not. The feedback rarely arrives. Then managers wonder why reporting rates are low in the units they worry about most.
A scenario, told two ways
Imagine a district hospital where a child dies after a delayed diagnosis of sepsis. The investigation can go one of two ways.
In the first version, it is run by the hospital’s own management, under pressure from the ministry and the media. The question it asks is who made the mistake. It finds a junior doctor who misread a blood result and a nurse who did not escalate a rising heart rate. Both face disciplinary proceedings. The report is filed. The ministry announces that action has been taken.
In the second version, it is run by an independent body with legal protection for what staff tell it. The question it asks is why the mistake was likely. It finds that the laboratory system displayed results in a format that made a critical value easy to miss, that the ward had one nurse for too many acutely ill children that night because of an unfilled vacancy, and that the escalation protocol required a senior doctor who was covering three wards. It makes recommendations about the lab software, the staffing rules and the escalation policy, which apply to every hospital using the same systems.
The first version produces accountability for two people. The second produces safety for thousands. The first is far more common, partly because it is faster and partly because it does not implicate the institutions that commissioned it.
The strongest counterargument
The obvious objection is that health care is not aviation. Aircraft are standardised machines built to tight tolerances. Patients are not. A pilot follows procedures designed around a known set of failure modes. A clinician faces endless variation in disease, frailty and circumstance, and has to exercise judgement in ways a checklist cannot capture. On this view, aviation’s methods simply do not transfer.
This objection is partly right about tools and wrong about institutions. It is true that a checklist designed for a cockpit will not capture the complexity of an intensive care unit, and the Ontario results suggest that mandating standard tools without the surrounding culture can deliver little. But the institutional lesson, separating learning from blame, does not depend on standardisation. If anything, it matters more in complex settings, because complexity is where a single person’s error is most likely to be a symptom of a system problem rather than the cause.
A second objection comes from families and advocates: that “just culture” can slide into no culture of accountability at all, where harm is analysed endlessly and nobody is ever answerable. That concern is legitimate. The answer is not to abandon protected investigation, but to run accountability processes in parallel, with clear thresholds for recklessness, and to make sure families get honest disclosure about what happened to them even when the safety investigation’s evidence is protected.
Second-order effects
Getting this right creates new problems worth anticipating.
Reporting volumes rise, sometimes sharply. A ministry that has never seen more than a trickle of incident reports may suddenly receive thousands. Without analytical capacity, those reports pile up unread, and staff notice. A reporting system that nobody reads is worse than none, because it teaches people that speaking up is pointless.
Independent investigators will also produce uncomfortable findings. If the root cause of harm is chronic understaffing or a budget decision, the report will say so. Ministries that create independent bodies have to be prepared to be named in their findings, and to act on recommendations that cost money.
Finally, professional regulators and courts have to adapt. If the safety investigator finds that an error was largely systemic, but the regulator still pursues the individual, the protected space collapses in practice. Alignment across institutions matters as much as the law creating any one of them.
What this means for each actor
- For ministries: the decision is whether to give up some control over investigations in exchange for better information. That means independence in law, not just in a policy document.
- For hospital leaders: measure units by reporting rates as well as harm rates, and publicly thank teams that report near-misses. Nothing else changes behaviour as quickly.
- For funders: invest in analytical capacity behind reporting systems, not just the software. Reports are only useful if someone turns them into lessons.
- For clinicians: push for written, legal protection of reflective practice and safety reporting. Assurances from management are not the same thing.
What to watch next
England’s HSSIB is still young. The questions that will show whether it works are whether its protected-disclosure rules hold up when tested in court or by inquiries, whether its recommendations are implemented rather than merely acknowledged, and whether other health systems copy the legal model rather than only the name.
What a ministry could do this year
A few moves that borrow the substance of aviation rather than its props:
- Put safety investigation in a body that does not employ, license or discipline the people it investigates.
- Give that body legal protection for what staff tell it, and publish its findings about systems.
- Keep a separate, clearly defined route for accountability where there is recklessness or intent.
- Measure reporting volume as a good sign. A unit reporting more near-misses is usually safer, not worse.
Aviation did not become safe because pilots are more careful than doctors. It became safe because the institutions around pilots decided that knowing was worth more than blaming. Health ministries can copy that tomorrow. It will cost them some power, which is why they mostly haven’t.
Does your health system separate learning from blame in practice? What would it take for staff to believe it?
