Risky business: health-care risk managers are focusing more on the business side of organizations and assuming more responsibility for insurance.

Insurance is a big part of Richard Kidwell's job as a health-care risk manager. In addition to his involvement with the purchase of all lines of insurance and reinsurance for Baltimore-based Johns Hopkins Health System, he also works with the organization's two captives, handles risk financing responsibilities, keeps the board of trustees apprised of insurance matters and administers all of the institution's claims in house.

But insurance hasn't always been a major part of a health-care risk manager's duties. For years, hospitals' risk-management departments were generally one-person operations that were responsible for administration of incident reports, infection control and ensuring patient safety. The role is now expanding, however, as a growing number of health-care risk managers are shifting to a more enterprise-risk-management model, which includes business operations as well as clinical risk.

"In addition to touching all sectors of the health-care system, health-care risk managers are now being spread across many different fronts and becoming experts in many different areas," said Kidwell. Coordinating and managing insurance duties is one of those areas.

A Changing Approach

Enterprise risk management--an integrated approach to addressing corporate risk--is a popular concept. In a recent Economist Intelligence Unit survey, done in cooperation with MMC Enterprise Risk, 41% of global senior finance and risk management executives surveyed said they use some form of enterprise risk management, and an additional 32% plan to implement it within five years. Many organizations with an enterprise-risk-management program believe that it not only provides the company better understanding of risk across business units and functions, but it also saves money as a result of more effective management of internal resources and capital.

Health-care organizations are getting the idea.

"I've seen [health-care risk management] really evolve from a role that organizations didn't think was very important to where administration has finally begun to take their recommendations with some degree of seriousness and act upon them," said Michael Liebowitz, director of risk management and safety for Bridgeport Hospital and Healthcare Services in Connecticut. Liebowitz is also an executive council member of the Risk and Insurance Management Society Inc. "If you turn the clock back 15 years, risk managers in most hospitals were nurses who really just looked at occurrence reports of adverse events, and the department was generally rolled into quality assurance." But that's all changing, he said, with a greater emphasis now being put on evaluating and overseeing the "business side" of risk. And health-care risk managers' backgrounds are reflecting those changes. While many health-care risk managers have a clinical background, a growing number now come from other industries such as finance and insurance.

In addition, hospital risk managers traditionally functioned in a quasipara-legal manner under the legal department and focused primarily on coordinating and managing a claim after an adverse event, said Linda Pilla, director of corporate risk management for Nemours, one of the nation's largest pediatric group medical practices. Nemours owns and operates the Alfred I. duPont Hospital for Children in Wilmington, Del., multiple pediatric primary and specialty-care practices throughout Delaware, southeastern Pennsylvania and southern New Jersey, and three major specialty clinics in Florida.

"The approach is quite isolated. As organizations became more complex, the delivery of care became more intensive and complicated, and physicians, patients and insurance companies became more demanding, the role of risk managers became more operationally focused," Pilla said. Risk managers not only identified and responded to events, they began to collaborate with internal partners to develop and implement strategies to prevent events from occurring, she said.

In the new risk model, Pilla said that health-care risk managers need to be more flexible, accessible, responsive and focused on the operational and financial impact of programs and services. Further, they need to be able to create programs and linkages among the various entities and services throughout the organization.

Jeffrey Driver, chief risk officer of Stanford University Medical Center and president of the American Society for Healthcare Risk Management, said the industry's increased focus on enterprise risk management is a shift from "our staple of an RN who does excellent loss control in the clinical field to now we're expanding and reaching out from there into all aspects of risk, such as getting involved with employment practices, workers' compensation, property programs, etc., vs. just the clinical aspect of our business." The current national nursing shortage, for instance, is one growing situation in which health-care risk managers must examine both clinical and business-related risk implications for an institution.

Hospitals now embracing an enterprise risk concept are finding it has a positive impact on patient care, quality, patient safety and operational outcomes, said Pilla. "That's really the key to the new approach to risk--a much more collaborative, proactive global perspective to the multitude of hazards an organization faces each day and that could negatively impact your organization."

With a larger capacity in organizationwide risk, hospital risk managers are also becoming a more prominent part of organizations' management teams and are being taken more seriously because ultimately they can impact the bottom line significantly, said Liebowitz." And everyone is focused on the bottom line now and want to see it in the black, and they think risk managers can bring a lot to the table, provided they have resources and tools available to them to do their job."

The changing role of health-care risk managers also is driving many organizations to restructure their risk management departments. According to a recent American Society for Healthcare Risk Management survey, 60% of its members indicated their department had been redesigned in the past 12 months. The reasons for the redesign include a need to create a better focus on patient safety, fragmentation of risk management efforts, staff reductions and increasing risk financing/insurance responsibilities.

Insurance 101

Today, health-care risk managers need to be knowledgeable about all the "ins" and "outs" of insurance as it becomes a growing part of their duties.

About 60% of Liebowitz's time as a health-care risk manager is spent in insurance-related duties. In addition to being the prime buyer of property/casualty insurance, he also is responsible for making recommendations, purchasing and negotiating the product, interfacing with brokers, doing actuarial evaluations and administering self-insurance and workers' comp claims.

Many health-care risk managers also are responsible for regulatory functions, including serving on internal Health Insurance Portability and Accountability Act privacy committees and working with the Joint Commission on Accreditation of Healthcare Organizations for mandated accreditation visits of the facility.

"Traditionally, risk managers simply needed to know the scope of a practitioner's services and level of insurance coverage," said Nemours' Pilla. They focused primarily on the impact of the care with respect to professional liability coverage. As the role expanded, they became experienced with numerous lines of insurance and methods of risk financing. The advent of enterprise risk management, she said, is driving risk managers to be even more educated about the insurance market, the specificity of insurance lines and coverages, and the impact of the market on organizations.

"There's a movement away from the traditional model, and we still are having to maintain a focus on delivery of the core product--health care," said Richard Bryan, director of risk management and patient safety for Bellevue, Wash.-based Overlake Hospital Medical Center. "We're becoming not only health-care risk management experts but now also insurance experts."

Insurance likely will continue to spark health-care risk managers' interest. The American Society for Healthcare Risk Management's recent survey reported that the "hottest issues" among members for the next three to five years include patient safety, tort reform and insurance/risk financing.

Securing Safety

Despite health-care risk management's changing role, the critical responsibility of ensuring patient safety will never change.

Many health-care risk managers are working to protect patients, employees and visitors by setting up patient safety committees, holding staff and physician orientation and training seminars, and developing other internal safety initiatives.

"We remain constantly proactive to the goal of risk management--preventing an injury," said Karol Murov, corporate director of risk management for New York City-based St. Vincent's Catholic Centers for New York. "It's not only for the quality of care to our patients, but also in preventing losses. And since we can avoid an injury, chances are you won't have a lawsuit and financial liability."

The focus on patient safety, over the past three to five years has brought the role of health-care risk management to the forefront, said Melissa Updike, director of risk management for Jewish Hospital Healthcare Services in Louisville, Ky. "Chief operating officers and chief executive officers have moved from looking at risk management as a department that they have to have to one that they really look to for direction and insight today. One of the driving forces in evaluating the awareness of what a risk management department does would be in the area of patient safety, which is causing more interaction with administration than ever before." In addition, she anticipates stronger emphasis around patient safety efforts and the merging of various departments will eventually lead some institutions to restructure their risk management areas.

Dealing With Medical Malpractice 

Rising medical malpractice premiums and a surge in claims are two of the challenges that health-care risk managers now face.

"Medical malpractice and tort reform affect every aspect of what we do," said Pilla of Nemours. "Although tort reform certainly is a viable option to be explored by states in helping drive down costs of medical malpractice, the reality is that alone will not be the answer to the medical malpractice crisis." Although she deems it a reasonable approach, she said if it isn't associated with good best practices in risk, patient safety and quality, as well as alternative dispute pathways, it won't be the cure.

Settlements continue to increase, causing premiums to rise, so more money is going out of institutions or physicians' offices to pay for insurance, said Johns Hopkins' Kidwell. "That's money we can't spend on other initiatives, like patient safety, the latest technological advances or hiring more nurses and other healthcare providers." While the amount of awards has skyrocketed, however, the actual number of cases filed against Hopkins and the number of open claims pending against the hospital--which went down to about 100 a year in the last decade--have decreased.

Hospitals are taking a number of actions to reduce professional-liability coverage costs. For example, 35% of hospitals responding to a 2002 survey by the American Hospital Association/American Society for Healthcare Risk Management said they increased their deductibles. Other hospitals said they changed carriers, reduced the level of coverage, took other self-insurance options, assumed a deductible, created a captive or opted not to purchase coverage.

Another way that some hospital risk management departments are addressing rising medical malpractice claims is by implementing mediation or alternative dispute-resolution programs. Johns Hopkins Health System, for instance, instituted a mediation program in which patients who are completing documents, such as admissions or outpatient forms, sign a clause signifying that they agree they'll mediate with the hospital before they sue the institution.

Risk managers believe the key to helping control the medical malpractice situation begins with having a good risk management program. "Physicians and hospitals make mistakes, but it's just about how well you can control it, and if you have good foundations in place you can affect your premiums to some extent," said Liebowitz of Bridgeport Hospital, which participated in a group captive insuring more than 150 community-based physicians.

Facing the Unexpected

"I don't think anyone ever envisioned risk managers would be as impacted as they are today by things such as terrorism, corporate governance concerns, fluctuation of the insurance markets, unavailability of professional liability insurance, staffing shortages and the overall attention to and public awareness of patient safety issues," said Pilla. All of these factors have increased the scrutiny of federal, state and regulatory agencies and impact the way corporate health-care risk managers approach their roles. Risk managers need to look daily at the impact internal and external forces have on organizations. "The goal is how do we 'think outside the box' and develop and implement programs that will minimize or eliminate potential harm to employees, patients and visitors, as well as potential liability' to the organization," said Pilla. Risk management has become a holistic, mission-driven value of every organization and its transformation is very rewarding, as its result is best practices in patient care and patient safety, she added.

Health-care risk managers also continue to keep a close watch on workers' comp issues. "Workers' compensation programs can be thought of as a three-legged stool: marketing your program, loss control and claims management," said Driver of Stanford Medical, adding that risk managers should constantly evaluate each "leg" of their program and develop local coalitions to address the problem. Driver is a member of a California coalition of risk managers collaborating to identify best practices and improve the state's workers' comp situation.

Security and terrorism also are weighing heavily on health-care risk managers' minds. "How do I lock down my facility and make sure an infant isn't abducted? Do my procedures work? Am I able to prevent a terrorist attack? What do I do for emergency preparedness? These are all growing concerns that we're all trying to solve," said Liebowitz. Bridgeport Hospital recently built a Hospital Incident Command Structure, a military-like approach to handle long-term emergency events. The bunker-like command center is complete with multiple back-up communication systems and special air filtration systems. Staff members across the organization are assigned delineated roles in the command structure to communicate externally in the event of an emergency, and the center is equipped to allow staff to live in it for several days, if necessary. "There's an added degree of seriousness that risk managers have to take into account," said Liebowitz. "We're not the drivers but when all is said and done, we're the people that need to assess losses and determine what the issues are."