What Is the Swiss Cheese Model in Healthcare?

The Swiss Cheese Model is a framework for understanding how medical errors and safety incidents happen, not because of a single catastrophic mistake, but because multiple small failures line up at the same time. Developed by psychologist James Reason in the 1990s, it has become the dominant way hospitals, regulators, and patient safety professionals think about why things go wrong in healthcare settings.¹ The model’s central insight is deceptively simple, but its implications for how we design hospitals, train staff, and investigate incidents run deep.

How the Model Works

Picture several slices of Swiss cheese stacked side by side. Each slice represents a different layer of defense in a healthcare system: protocols, training, equipment design, supervision, double-checks by a pharmacist, electronic alerts, and so on. Every layer has holes, because no single safeguard is perfect. Staff get tired, software glitches, policies get skipped when the unit is slammed. Most of the time, the holes in one slice don’t line up with the holes in the next, so a mistake at one stage gets caught downstream. An error only reaches the patient when the holes in every layer happen to align at the same moment, creating a clear path through all the defenses.

The model is formally called the Theory of Active and Latent Failures, though almost everyone in safety circles just calls it the Swiss Cheese Model.² What makes it powerful is its emphasis on systems rather than individuals. Before this framework took hold, the instinct in healthcare was to find the person who made the mistake and blame them. Reason’s model redirected attention to the organizational conditions that allowed the mistake to become an injury.

Active Failures Versus Latent Failures

The model distinguishes between two kinds of failures that create the holes in the cheese. Active failures are the errors committed by people at the sharp end, the clinicians, nurses, and technicians who are in direct contact with the patient. These are the slips, lapses, and mistakes you can point to in the moment: a nurse draws up the wrong dose, a surgeon marks the wrong limb, a technician misreads a lab value.³

Latent failures, on the other hand, live in the background. They arise from organizational and managerial decisions made weeks, months, or years earlier. Chronic understaffing, confusing drug packaging, a poorly designed electronic health record, inadequate training budgets, a culture that punishes people for reporting near-misses: all of these are latent conditions that quietly widen the holes in the system’s defenses. Their effects can take a long time to become evident, and they often go unnoticed until something goes badly wrong.³ While active errors need to be addressed at the individual level, latent errors point to organizational inadequacies that demand systemic fixes.⁴

This distinction matters because it changes where you direct your energy after an incident. Firing the nurse who made the active error feels satisfying but does nothing about the latent conditions that set them up to fail. The model argues that the real leverage is in patching the organizational holes, the ones that exist long before the bedside mistake ever happens.

What the Model Looks Like in Practice

One of the clearest examples is the surgical safety checklist. The World Health Organization created a standardized checklist to reduce wrong-site surgeries and other operating room errors. When researchers analyzed its effectiveness using the Swiss Cheese Model, they found the checklist worked well as a defense layer, reducing wrong-site surgeries and other errors. But the analysis also confirmed something the model predicts: checklists alone will not prevent all errors, because they are only one slice of cheese.⁵ If a hospital has good checklists but poor staffing, exhausted residents, and ambiguous protocols, there are still plenty of holes for errors to slip through.

Patient safety professionals also use the model when conducting root cause analyses after adverse events. Instead of stopping at “who made the error,” they trace backward through each layer of defense to find which holes aligned. The goal is to help investigators fully leverage the model and its associated tools to understand not just the triggering mistake, but the organizational conditions that allowed it to reach the patient.²

When the Model Went Viral During COVID-19

The Swiss Cheese Model found a new audience during the pandemic, when public health communicators adapted it to explain how layered interventions reduce the spread of infectious disease. Masks, distancing, ventilation, hand hygiene, vaccination, and testing each formed a separate slice, and the message was that no single measure was airtight on its own, but stacking them made transmission far less likely.

Inside hospitals, the model was applied to pandemic preparedness in a more literal sense. The argument was that each facility should maintain multiple layers of defense to prevent even small cracks in the hospital’s quarantine system.⁶ A screening protocol at the door is one layer. PPE compliance on the ward is another. Isolation room availability is another. Rapid testing turnaround is another. If one failed on a given day, the hope was that the others would catch the breach. The pandemic gave millions of people an intuitive grasp of a concept that patient safety professionals had been using for decades.

Technology as Both Defense Layer and Source of New Holes

Electronic health records, computerized medication ordering, and clinical decision support alerts are all designed to be thick, reliable slices of cheese. In theory, they catch the prescribing errors, drug interactions, and allergy mismatches that human memory alone would miss. In practice, technology creates its own holes, sometimes unexpected ones.

A study of allergy-related safety events at a healthcare system found that about half of the failures stemmed from incomplete or inaccurate electronic health record documentation. Human factors accounted for roughly a quarter, while allergy alert limitations or malfunctions contributed to about one in six events. Data exchange and interoperability failures, where different systems fail to share information properly, accounted for about one in eight.⁷ These findings illustrate a Swiss Cheese Model principle perfectly: adding a technology layer plugs some holes but opens new ones. An allergy alert system that pops up so frequently that clinicians start ignoring it is a defense layer with a gaping hole in the middle.

Cognitive biases and conflicts of interest can also create holes at both the team and individual level, breaching the “gates” that organizational, team, and personal safeguards are meant to provide.⁸ A clinician who overrides an alert because of anchoring bias, or a procurement decision skewed by a vendor relationship, can widen the holes in ways that are invisible to the system until an incident occurs.

Designing Systems Around Human Limitations

Human factors engineering is the discipline most naturally allied with the Swiss Cheese Model. It starts from the premise that frontline staff will inevitably make mistakes, so the systems they interact with should be designed to anticipate and catch those errors rather than relying on perfect human performance. Safeguards include usability testing, standardization of processes, and the use of checklists and forcing functions, design features that make it physically difficult to do the wrong thing.⁹

A forcing function is one of the most powerful concepts here. Think of a gas anesthesia machine designed so that the wrong gas connector physically cannot attach to the wrong port. No amount of fatigue, distraction, or rushing can override that safeguard, because the physics prevent it. That is a hole-proof slice of cheese. Contrast it with a policy that says “always double-check the gas line before connecting.” That policy depends on human vigilance and is therefore full of potential holes.

Medical device design is another area where this thinking applies. Manufacturers of interactive devices like infusion pumps need to ensure that their products minimize the risk of unintended harm during use, but development teams face real challenges in incorporating human factors principles into the design process.¹⁰ A pump that allows a nurse to accidentally program a dose ten times higher than intended, because the interface makes it easy to misplace a decimal, is a slice of cheese with a predictable hole.

What Healthcare Borrowed from Aviation

The Swiss Cheese Model was not originally a healthcare concept. Reason developed it by studying high-hazard industries, aviation and nuclear power in particular, where a single failure chain can be catastrophic. Aviation pioneered crew resource management and threat-and-error management, both strategies aimed at minimizing risk by improving team communication, situational awareness, and the willingness to speak up when something looks wrong. These strategies, along with the Swiss Cheese Model and the concept of normalization of deviance, have been applied directly to surgery and the broader healthcare industry.¹¹

The translation is not always smooth. A cockpit has two or three people in a relatively standardized environment with clear hierarchies. A hospital has dozens of professions, shifting teams, variable patient conditions, and deeply entrenched status hierarchies that can make a junior nurse reluctant to challenge a senior surgeon. Still, the cross-pollination has been productive. Surgical time-outs, standardized handoff protocols, and simulation-based team training all trace their conceptual lineage back to aviation safety practices filtered through the Swiss Cheese lens.

Criticisms and Where the Model Falls Short

For all its influence, the Swiss Cheese Model has drawn serious criticism from safety scientists. The most common charge is that it is too linear and too static. Critics argue that the image of cheese slices in a row implies a neat, sequential chain of failures, when real-world accidents in complex healthcare systems emerge from dynamic, nonlinear interactions that are hard to decompose into separate layers. A static view of the organization, these critics contend, fosters the idea that causes line up in a chain, which may lead safety practitioners to focus on strengthening individual components while failing to consider the system as a whole.¹²

There is something to this. A busy emergency department is not a tidy stack of defense layers. It is a swirling, adaptive system where decisions at one level change the conditions at every other level in real time. A surge of patients changes staffing ratios, which changes how carefully protocols are followed, which changes the risk profile of every patient encounter simultaneously. The cheese slices are not just sitting there with static holes; they are reshaping each other constantly.

Other critics note that the model was designed primarily to explain how things go wrong, but not why things usually go right. It focuses on failure pathways rather than on the everyday adaptations, workarounds, and recoveries that frontline staff perform to keep patients safe despite flawed systems. This observation gave rise to a newer school of thought.

From “Find and Fix” to Proactive Safety

The traditional Swiss Cheese Model fits into what safety researchers call a “find and fix” approach, also known as Safety I. Something goes wrong, you investigate, you find the holes, and you try to plug them. This has obvious value, but it also has a ceiling. You are always reacting to the last failure rather than anticipating the next one.

A newer framework called Safety II takes a different tack. Instead of asking only “what went wrong,” it asks “what usually goes right, and how?” Safety leaders across multiple industries have recognized that complex adaptive systems require this new approach, one that focuses on proactive safety and enhancing the adaptive capacity of healthcare providers.¹³ Rather than viewing human variability as the enemy, Safety II sees it as a resource. The nurse who catches a subtle sign because she has been on the unit for fifteen years, the anesthesiologist who deviates from protocol in a way that averts a crisis: these adaptations are not deviations to be stamped out but strengths to be understood and supported.

The two frameworks are not mutually exclusive. Most safety programs still use the Swiss Cheese Model for incident investigation while incorporating Safety II thinking into their proactive improvement efforts. The cheese slices remain a useful metaphor for explaining layered defense, even if the model alone does not capture everything happening in a complex hospital.

Why Good Defenses Keep Eroding

A persistent frustration in patient safety is that even well-designed defense layers degrade over time. A checklist that works brilliantly when it is first introduced starts to feel routine after six months. Staff turn over, and new hires do not get the same depth of training. Budgets get cut, and monitoring systems lose support. The holes in the cheese get bigger, gradually and invisibly.

Research on the sustainability of hospital-based safety interventions has found that the most commonly reported barriers are staff shortages and high turnover, cited in nearly half of the studies in one systematic review. Lack of time, with staff being too busy to consistently implement an intervention, was another frequent barrier. Poor infrastructure also undermined sustainability in multiple studies.¹⁴ These are classic latent conditions: decisions about hiring, scheduling, and capital investment that were made far from the bedside but that shape how wide the holes in the system’s defenses become.

This is one reason Reason’s model keeps resonating even decades after it was introduced. It gives safety leaders a language for explaining to administrators and boards why organizational decisions, not just clinical ones, determine patient safety. The holes in the cheese are not random. They are shaped by resource allocation, leadership priorities, and institutional culture.

Reporting Culture and Its Role in the Model

For the Swiss Cheese Model to work as a practical tool, organizations need accurate information about where their holes are. That requires people to report errors, near-misses, and unsafe conditions without fear of punishment. A culture that blames individuals for honest mistakes drives reporting underground, leaving latent failures undetected until a serious harm occurs.

This connection between reporting culture and layered defense has received attention internationally. A scoping review comparing medication error reporting across different healthcare systems concluded that effective reporting requires anonymous platforms, just-culture policies that distinguish between blameworthy and non-blameworthy errors, structured training, and feedback loops so that reporters see their input actually change practice.¹⁵ Without these conditions, the organization is effectively flying blind, unable to see the holes in its own defenses.

Accreditation programs have tried to formalize some of this. One retrospective study of hospitals that pursued international accreditation found measurable improvements, including reduced returns to the ICU within 24 hours of discharge, lower annual staff turnover by about 13 percentage points, and substantially more complete medical records. Over three years, these improvements translated into total savings of roughly $593,000 for the hospitals studied.¹⁶ In Swiss Cheese terms, accreditation added and reinforced defense layers: better documentation meant fewer information-related holes, and lower turnover meant less erosion of institutional knowledge.

Common Misunderstandings About the Model

People frequently get a few things wrong about the Swiss Cheese Model. The first is treating it as a blame-free carte blanche. The model does not say that individual errors do not matter or that nobody is ever at fault. It says that individual errors usually become harmful only when the system’s defenses have already been weakened by latent conditions. Reckless or malicious behavior is still held accountable. The just-culture framework that accompanies the model distinguishes between honest slips, at-risk behavior that reflects poor system design, and genuinely reckless conduct.

The second misunderstanding is thinking that adding more layers of defense always makes you safer. If your additional layer is another form that nobody reads, another alert that gets clicked away, or another committee that meets quarterly but has no authority, you have not actually added a functioning slice of cheese. You have added a slice that is already mostly hole. The quality of each layer matters more than the quantity.

The third is imagining the holes as fixed. In Reason’s actual framework, the holes are constantly opening, closing, and shifting. A staffing gap that exists on Tuesday night may be gone by Wednesday morning. A software bug that appeared after an update may be patched a week later. The alignment of holes that leads to an accident is often a brief, unlucky convergence of conditions that individually come and go. This dynamic quality is one of the hardest things for organizations to manage, because it means your defenses are never in a stable, known state.

How Hospitals Are Adapting the Model Today

Modern patient safety programs tend to treat the Swiss Cheese Model as a starting point rather than a complete answer. They use it for retrospective analysis of incidents, to communicate the concept of layered defense to frontline staff, and to frame conversations with leadership about where latent conditions are weakening the system. But they supplement it with tools from Safety II, resilience engineering, and human factors to get at the dynamic and adaptive aspects of safety that the cheese metaphor does not fully capture.

In practice, this looks like hospitals running simulation exercises not just to test whether staff follow procedures, but to see how teams adapt when procedures break down. It looks like safety walk-rounds where leaders visit units and ask open-ended questions about what makes it hard to do the job safely, rather than auditing compliance with a checklist. And it looks like investment in design: building forcing functions into medication dispensing cabinets, redesigning handoff protocols based on cognitive load research, and involving frontline staff in the design of electronic health record workflows so that the technology helps rather than hinders safe care.

The Swiss Cheese Model gave healthcare a shared language for understanding that safety is a property of the system, not just of the people inside it. That conceptual shift, from blaming individuals to fixing systems, remains one of the most consequential ideas in modern patient safety. The metaphor has limits, and newer frameworks are filling in its gaps. But as a tool for explaining why one error among thousands actually harms a patient, the image of those cheese slices lined up with their holes aligned is still remarkably hard to beat.