It was two in the morning in the middle of a liver transplant, and the insulin vial was not where it had always been. I reached for the drawer the way I had a few hundred times before. Empty. Someone was going to have to leave the room, the resident or me, walk to the central cabinet, and come back with a drip. I was annoyed. I was also the reason. I had sponsored that change. I knew exactly why the vial was gone, and I still stood there for a second resenting it.
That second is the subject of this piece. The best safety work in medicine tends to feel like an obstacle, even to the people who built it, and the people who never lived the problem it solved cannot feel it at all.
Three ways to fix the same problem
Most of the fixes we reach for in healthcare fall into one of three tiers. The weakest is broadcast: tell people. Education, a memo, a policy, a sign above the sink. The middle tier is prevent: make the error harder. A checklist, a default, a standard kit, a device that stops the harm as it starts. The strongest is preclude: make the error impossible.
Hot water at a scrub sink is a simple place to see the first two. You can warn people the water runs hot, and some of them will remember. You can install a thermostatic valve that shuts the flow when the temperature reaches a level that burns, and almost all of them will be protected. Safety scientists have ranked these options for decades. The Institute for Safe Medication Practices publishes a hierarchy of effectiveness with six levels, forcing functions at the top and education at the bottom. I use three because three is what I can hold in my head in a committee meeting.
The ladder is not controversial. Ask any group of clinicians which tier is strongest and they will get it right. Ask the same group what they built the last time something went wrong, and the answer is usually a memo.
The strongest fixes are the ones we stop noticing, which is exactly what makes them easy to undo.
Moving up the ladder
Some of the clearest examples of preclusion in medicine started as ordinary injuries.
Needlesticks used to be a routine hazard of working with IV lines. Education did not end them. Sharps containers helped. Needleless connectors removed the needle from much of the work, and federal law in 2000 pushed hospitals to adopt them. The story did not end cleanly. Within a few years, several hospitals reported higher bloodstream infection rates after switching to certain mechanical-valve connectors. Preclusion removed one harm and, in some designs, moved risk somewhere else. That is worth remembering. Preclusion is a design choice like any other, and design choices have side effects.
Concentrated potassium chloride is the example I come back to often, because it involved no device at all. For years, vials of concentrated potassium sat in floor stock beside look-alike vials, and every so often one was administered to a patient undiluted. The Joint Commission warned hospitals about it in the late 1990s, and taking concentrated potassium off general patient care units became one of the first national patient safety goals. No clinician lost any judgment. A vial left the shelf, and with it went the error.
Then there is the connector most of us never think about. For decades the Luer fitting connected nearly everything — IV lines, feeding tubes, epidural catheters. It was a standardization success, and that was the problem. One connector that fits everything is how feeding formula ended up in veins and how drugs meant for a vein reached the spinal fluid. The fix is a family of connectors, ENFit for feeding tubes and NRFit for neuraxial lines, built so that the wrong pieces cannot mate. It is a good fix that has yet to be widely adopted. B. Braun announced what it called the first NRFit conversion at a US hospital in 2024.
Insulin in the anesthesia cart works the same way and is an example of all three tiers with one drug. A vial at 100 units per milliliter and a syringe make a tenfold or hundredfold overdose a matter of one misread line. Taking the vial out of the cart and putting pens there precludes that error at the point of care. Pens come with their own failure, which is why the FDA has warned since 2009 against sharing a pen between patients. One pen, one patient. When a patient needs IV insulin, it is given as an infusion or bolus from a low-concentration preparation, and at many sites pharmacy mixes it. After hours, a vial can still be pulled from a central automated cabinet, which is prevention through distance and access control. Many sites stock premixed drips in that cabinet for exactly that moment, which pushes the IV path most of the way to preclusion. That was the walk the resident made at two in the morning.
The example anesthesia providers take most for granted is medical gas supply. Three systems work together. Cylinders mount to the machine on a pin index that only fits the right gas. Pipeline hoses connect to the machine with a diameter index that only fits the right gas. Wall outlets, in the operating room and in every patient room, accept only the connector for their own gas. Together they make it physically impossible to connect air, nitrous oxide or suction where oxygen belongs. Most of us have never once wondered why.
Even here, preclusion only guards the point where it is built. In 2016, at a hospital in south-western Sydney, an outlet meant to deliver oxygen to newborns delivered nitrous oxide because the pipe behind the wall had been installed wrong and the testing missed it. One baby died. This is why the oxygen analyzer is still on every anesthesia machine. Strong interventions work in layers, not alone.
The option, not the judgment
Here is the objection I hear from clinicians who write protocols, and it is fair. Preclusion works for connectors and gas lines. It does not work for clinical care, because the patient in front of you is never the average patient, and a pathway that removes clinical judgment will eventually hurt someone it was not written for.
That is true about judgment. It is not true about options.
Potassium and insulin are the proof. Neither change took a decision away from anyone at the bedside. Each removed an option that was almost never necessary and occasionally catastrophic. Protocol writers spend most of their effort deciding what clinicians should do. Very few of us ask the other question: which option on the shelf, in the order set or in the kit is almost never right, and could simply be removed? Defaults are prevention. Removal is preclusion. Neither touches the judgment you are trying to protect.
Where our council starts
I chair the clinical council for the anesthesia management company where I’m chief clinical officer, about 150 sites in all. Two weeks ago I wrote about how that council sets standards. Here is the less flattering part. Most of what the council has produced so far is broadcast. Our first guidelines, on medication management and on patient selection, are approved and still live in documents and messages to our sites. They sit on the weakest tier of the ladder.
That is early in the lifecycle, and it is by design. When a group of sites starts with few shared standards, writing one down and sending it out is the place to begin. You cannot build a forcing function around a practice the group has not agreed on.
What moves a standard up the ladder is the team understanding that the ladder exists. That goes for the council and for the clinical teams who carry the work at each site. It also takes the people who own the levers. In most hospitals the pharmacy stocks the cart and the cabinet, and a pharmacy and therapeutics committee decides what is on the formulary, so a council like ours can recommend a removal but rarely makes it alone. A group that does not know the difference between broadcast and preclusion will keep writing better memos. Sometimes the push comes from a failure: the broadcast went out, and the problem came back anyway. When the results of an intervention do not show what we hoped, my favorite question is a simple one. Does the intervention not work, or are we not doing it? A dashboard cannot answer that. Someone has to go and look.
I am aware that an essay explaining the ladder is itself a broadcast.
The cost of the cabinet
The strongest objection to preclusion is the one I felt in the operating room that night. It costs time, at the worst possible moment, and it costs the most to the most experienced people, who are sure they were never going to make the error in the first place. Constraints that feel like friction invite workarounds. I have seen the insulin vial come back, in a scrub pocket, a fanny pack, a bag under the cart. The gas system has the same history. In 2001 the FDA reported seven deaths and fifteen injuries over four years in which a container of the wrong gas had its connector changed to fit an oxygen line, often by someone who did not know the connector was the safeguard. A workaround to a forcing function is often worse than having no constraint at all, because the system now believes the hazard is gone.
I do not think the answer is to give up the constraint. I think it is to build the next layer so that the friction lands where it can be absorbed. The premixed drip in the cabinet exists because someone took the two-in-the-morning case seriously. A preclusion that ignores the emergency will be defeated by it.
The vial
I still remember being annoyed. I also remember that the annoyance passed before the resident got back to the room.
The point of moving the vial was never that I remember why it moved. It is that the resident who walked to the cabinet that night will never have to learn.