Why learning from incidents requires looking beyond the individual event to patterns, weak signals, systemic risk and action effectiveness.
When a patient safety incident occurs, the immediate priorities are clear: understand what happened, respond appropriately, investigate the causes and take action to reduce the likelihood of recurrence. This process is fundamental to patient safety, but an individual incident may also be telling us something bigger.
Has something similar happened before? Were there earlier warning signs? Are apparently unrelated incidents connected by the same underlying weakness? Have previous corrective actions addressed the risk or simply closed the investigation?
These questions take us beyond incident reporting towards Incident Intelligence: using the information organisations already collect to understand risk more deeply, learn across incidents and support earlier intervention.
The incident is only the starting point
Incident management has traditionally focused on individual events. An incident is reported, reviewed and investigated. Contributing factors are identified, corrective actions are assigned and, eventually, the case is closed. That remains essential. Every incident deserves appropriate review and response.
But looking at incidents individually can also limit what we learn from them. The significance of an incident may only become apparent when it is considered alongside previous events, Near Miss and No Harm incidents, investigation findings, contributing factors and earlier corrective actions.
The bigger question is therefore not only “What happened in this incident?” It is also “What can this incident tell us about risk elsewhere in the organisation?”
What actually happened?
Before looking for wider patterns, we need to understand the event itself. That can be harder than it sounds because important information may be spread across structured incident fields, narrative descriptions, review notes, investigation findings and other records. Patient safety and quality teams may need to work through considerable amounts of information before identifying what matters.
AI-assisted summarisation and analysis can help reduce this burden by bringing together key information, highlighting possible areas of concern and helping investigators identify issues that deserve closer attention. But speed should not be confused with judgement. AI can help investigators understand an incident more efficiently; it should not determine causation or replace the professional judgement of those responsible for the investigation.
The purpose is to help people get to the important questions faster.
Has this happened before?
Once an incident is understood, a natural next question is whether something similar has happened before. In practice, finding related incidents can be difficult because events involving similar underlying risks may be described differently, occur in different departments or be classified under different incident categories.
Traditional searches based primarily on categories, keywords or exact terminology can therefore miss potentially relevant relationships. Approaches such as semantic search and similarity analysis can help investigators look beyond matching words and identify incidents with similarities in meaning, circumstances or other characteristics.
This does not mean every apparently similar incident is connected. AI can surface potentially relevant events, but investigators still need to examine the evidence and determine whether the similarities are clinically and operationally meaningful.
The technology helps answer “Where should we look?” The investigator still needs to decide “What does this mean?”
Was there warning signs before harm occurred?
Serious incidents naturally attract attention, while Near Miss and No Harm events may receive less. Yet these lower-harm events can contain valuable information about vulnerabilities within systems and processes.
Viewed individually, an event that was intercepted before harm occurred may appear to have been successfully managed. Viewed alongside other events over time, however, it may take on greater significance. Repeated weaknesses, recurring contributing factors or clusters of lower-harm events may indicate conditions that deserve closer investigation.
This changes how we think about predictive safety.
Prevention isn’t about predicting exactly which patient will be harmed next. It is about recognising when the conditions for harm are repeatedly appearing, and acting before the next serious incident occurs.
Near Miss and No Harm events should therefore not be viewed simply as lower-priority incidents. Collectively, they can contribute to a much richer understanding of emerging risk.
Is this an isolated incident or a systemic risk?
Finding potentially related incidents is only the beginning. The more important challenge is determining what, if anything, connects them.
Events that initially appear different may share contributing factors, workflow weaknesses or other underlying conditions. For example, a patient fall, a delayed response to a call bell and a Near Miss involving an unassisted patient may be recorded under different categories. Yet further investigation might find that all three occurred during periods of reduced staff visibility or when patients were moving between areas. The categories are different, but there may be an underlying condition worth investigating.
The reverse can also be true. Two incidents classified as medication errors may have little in common: one might involve selection of a look-alike medication, while another results from an incorrect dose calculation. They belong to the same broad incident category, but the underlying risks – and therefore the appropriate preventive actions – may be quite different.
This is why simply grouping incidents together is not enough. The important question is not only whether incidents look similar, but whether the evidence suggests they share a meaningful underlying risk.
The role of investigation is to examine these possible relationships and determine whether the evidence points to something broader than the individual event.
The learning journey may progress from:
Individual incident → Related events → Recurring pattern → Systemic risk
This broader view does not eliminate the need for structured Root Cause Analysis. Methods such as 5 Whys and Fishbone analysis remain valuable for examining contributing factors and understanding why an incident occurred. The opportunity is to combine investigation of the individual event with a wider view across incident data.
Instead of asking “Why did this incident happen?”, organisations can also ask “Where else might we be seeing similar conditions?”
The answer should come from investigation – not assumption.
Haven’t we already tried to fix this?
This may be one of the most important questions in incident management. Investigations frequently result in corrective actions: staff may receive additional training, procedures may be revised, workflows may change or new controls may be introduced. The actions are completed and recorded, and the incident is eventually closed.
But completion tells us that an action was carried out. It does not necessarily tell us whether the underlying risk was reduced.
This leads to an important distinction:
Closing an action is not the same as reducing risk.
Not all corrective actions provide the same level of protection. Some depend heavily on people remembering to perform an additional step, while others change processes or introduce stronger system controls. Understanding the relative strength of interventions can help organisations think more critically about the actions arising from investigations.
The next question should therefore not simply be “Was the action completed?” It should be “What evidence would tell us whether it made a difference?”
How do we know whether an intervention worked?
Corrective action should lead naturally to effectiveness monitoring. After an intervention is implemented, organisations need to continue looking at what their incident information is telling them.
Are relevant events changing over time? Are similar contributing factors continuing to appear? Is the new control being followed consistently? Are there new weak signals that deserve attention? Has risk reduced, remained unchanged or appeared elsewhere?
The answers will not always be straightforward. Incident data alone cannot prove causation or guarantee that an intervention prevented harm. But combining incident information with investigation findings, control monitoring and other relevant evidence can provide a stronger basis for assessing whether risk is changing.
This creates a continuous learning cycle:
Incident → Investigation → Action → Monitoring → Learning → Prevention
Rather than treating closure of an incident as the end of the process, organisations can use what happens afterwards to determine whether further learning or intervention is needed.
From incident reporting to organisational learning
Digital incident reporting has transformed how healthcare organisations capture incidents, manage workflows, conduct investigations and maintain accountability. The next opportunity is to learn more from the information those systems already contain.
Incident reporting tells us what happened. Investigation helps us understand why it happened. Incident Intelligence extends the conversation by asking: “What are we learning across our incident data and what should we do differently?”
AI has an important role to play in this evolution. It can help teams review large volumes of narrative information, identify potentially related incidents, surface patterns and bring previous information into the investigation. But AI is only one part of the process. Digital workflows, structured investigation, collaboration, Root Cause Analysis, corrective actions, effectiveness monitoring and professional judgement all need to work together.
The goal is not simply to introduce more technology into incident management. It is to create a stronger learning cycle:
REPORT → UNDERSTAND → INVESTIGATE → LEARN → ACT → MONITOR → PREVENT
The real opportunity is to move from treating incidents primarily as events to be recorded and closed towards treating incident information as an organisational learning resource. That means asking better questions, connecting information that may otherwise remain fragmented, testing what the evidence is telling us and continuing to monitor whether the actions we take are actually reducing risk.
That is the transition from incident reporting to Incident Intelligence, and ultimately towards a more proactive approach to patient safety.
What Might We Discover If We Follow the Evidence?
On 22 October 2026, QUASR+ will put these questions into practice in From Incident to Prevention: A Live Incident Intelligence Investigation.
We will start with one realistic medication incident. We won’t begin with the answer. Instead, we’ll follow the evidence – examining the incident, searching for potentially related events, exploring earlier signals, investigating contributing factors and considering what the information means for future prevention.
Thursday, 22 October 2026 | 2:00 PM (GMT+8) 45 Minutes + Live Q&A
Discover How QUASR+ Turns Incident Data into Intelligence
Author: Hak Yek Tan
Founder & CEO, QUASR+
Hak Yek Tan is the Founder and CEO of QUASR+, an AI-powered Incident Intelligence platform helping healthcare organisations learn faster from safety data and prevent harm. He believes the future of patient safety lies in moving beyond reactive incident reporting towards proactive and predictive safety. Through QUASR+, he advocates for the responsible use of AI and data to identify emerging risks, strengthen organisational learning and help healthcare leaders make better-informed decisions for safer care.
