Behind the Story #2: Swiss Cheese isn’t Just Cheese

Patient safety depends on layers of protection. The problem begins when weaknesses in those layers line up.

Healthcare is filled with safeguards.

Medication checks. Alarms. Policies. Clinical assessments. Standardized procedures. Technology. Communication. Experienced colleagues who notice when something doesn't look quite right.

Each provides another opportunity to prevent an error—or catch one before it reaches a patient.

But no safeguard works perfectly every time.

Patient safety therefore doesn't depend on creating a single impenetrable barrier. It depends on building multiple layers of defense, so that when one fails, another can interrupt the path toward harm.

James Reason's Swiss Cheese Model gives us a remarkably simple way to visualize how that works.

From the Novel…

In Chapter 3 of Forced ERRORS, Annie's patient in Room 9 is critically ill but stable. He is intubated, mechanically ventilated, sedated, and receiving a continuous paralytic infusion.

Before stepping away, Annie checks the monitors. His heart rate is steady. His oxygen saturation is holding. The infusion is running.

Minutes later, alarms sound.

The patient is awake and moving. He pulls out his endotracheal tube, and his oxygen saturation rapidly falls. As the team responds to the emergency, the charge nurse discovers something unexpected: the IV line delivering the paralytic medication is clamped.

The immediate problem is obvious.

But patient safety asks a larger question:

How did one problem make it all the way to the patient?

Beyond the Story…

Patient care is rarely protected by a single safeguard. Instead, healthcare systems rely on multiple layers of defense intended to either prevent an error or detect it before the error reaches the patient.

Those defenses may include technology, policies and procedures, staffing practices, communication systems, clinical assessment, alarms, medication checks, orientation and training, and the actions of individual clinicians.

James Reason's Swiss Cheese Model offers a useful way to understand how those defenses work.

Imagine each layer of protection as a slice of Swiss cheese. Ideally, every layer would provide an intact barrier between a hazard and a patient. In reality, every defense has weaknesses—the "holes" in the cheese. Those weaknesses may result from active failures occurring close to patient care or from latent conditions embedded elsewhere in the system.

Usually, one weakness is not enough to cause harm.

A nurse catches the discrepancy.

An alarm sounds.

A colleague asks a question.

A medication check reveals the problem.

A policy requires another verification.

One layer compensates for the weakness in another.

The danger increases when weaknesses in several layers temporarily align, creating a pathway through the defenses. The hazard that would normally have been stopped can then reach the patient.

That is the power of the Swiss Cheese Model: it moves the safety conversation beyond identifying the final mistake and asks us to examine all of the opportunities the system had to prevent harm.

Looking at Room 9 Differently

It would be easy to look at the event in Room 9 and focus entirely on the clamped IV line.

But the Swiss Cheese Model invites different questions.

What defenses should have prevented interruption of a critical continuous infusion? What mechanisms were available to detect that the medication was no longer reaching the patient? What clinical changes might have provided an early warning? What alarms, equipment features, communication practices, or verification processes could have interrupted the progression toward harm?

And perhaps most importantly:

How many opportunities existed to stop the event before the patient self-extubated?

That question matters because strengthening patient safety does not depend on creating clinicians who never make mistakes. Human beings working in complex environments will make mistakes. A safer system anticipates that reality and builds multiple opportunities to catch errors before they become harmful.

Don't Just Find the Hole—Strengthen the Layers

After an adverse event, finding the most obvious failure can create the illusion that the investigation is complete.

The IV was clamped.

Someone failed to check.

Someone should have noticed.

Case closed.

But stopping there does little to protect the next patient.

A systems approach examines each layer of defense and asks what worked, what failed, and what additional safeguards could reduce the likelihood that the same trajectory occurs again.

That might mean redesigning a process rather than reminding staff to "be more careful." It might mean changing equipment, improving alarm functionality, standardizing handoffs, strengthening orientation, reducing unnecessary complexity, or adding an independent verification at a particularly vulnerable point in care.

Importantly, systems thinking does not mean individual actions never matter or that clinicians are never accountable. It means individual behavior is considered within the larger system in which care occurs. The goal is not to eliminate accountability. The goal is to avoid mistaking accountability for a complete patient safety strategy.

The safest organizations assume that no single defense is perfect.

So they build another one.

And another.

Leadership Takeaway

“When patient harm occurs, don’t stop when you find the error closest to the patient. Look backward through every layer of defense the error passed through—and ask why none of them stopped it.”

Leadership creates safer systems by making it difficult for any single failure to reach the patient.

Questions to Engage Learners

1. In the Room 9 event, what potential layers of defense might normally prevent an interruption in a continuous high-risk medication infusion from reaching the patient?

2. The clamped IV line is immediately visible once the charge nurse discovers it. Why might focusing exclusively on that finding limit an investigation into the event?

3. Which defenses in healthcare depend primarily on individual vigilance? Which can be designed into equipment, processes, or systems? Which type is likely to be more reliable?

4. Imagine you are participating in a review of the Room 9 event. What questions would you ask before recommending corrective action?

5. A common response to an error is to retrain the staff involved. Under what circumstances might education be an appropriate intervention? When might it fail to address the actual vulnerability?

6. Think about a clinical process familiar to you—medication administration, handoff, patient identification, fall prevention, or another process. What layers of defense protect the patient? Where are the "holes"?

7. How can leaders encourage staff to identify weaknesses in defenses before those weaknesses align and result in patient harm?

Evidence Behind the Story

Reason, J. (2000). Human error: Models and management. BMJ, 320(7237), 768–770.

A foundational discussion of the systems approach to human error, including active failures, latent conditions, defenses, and the Swiss Cheese Model.

Wiegmann, D. A., Wood, L. J., Cohen, T. N., & Shappell, S. A. (2022). Understanding the "Swiss Cheese Model" and its application to patient safety. Journal of Patient Safety, 18(2), 119–123.

A contemporary review of the model and its application to healthcare safety, including organizational influences, supervisory factors, preconditions for unsafe acts, and unsafe acts.

Agency for Healthcare Research and Quality. (2024). PSNet: Systems Approach.

A practical overview of systems thinking in patient safety and the importance of identifying and addressing underlying system vulnerabilities rather than relying exclusively on individual vigilance.

World Health Organization.  (2023). Patient Safety.

Provides a broader systems perspective on preventable harm, emphasizing leadership, safe work environments, effective processes, teamwork, communication, and organizational learning.

Ready to take the discussion further?
The Forced ERRORS Faculty Guide extends the novel into a structured learning experience with chapter-specific leadership and patient safety themes, discussion prompts, competency connections, and tools for engaging learners.