Why "We'll Figure It Out" Isn't a Plan

Ask any practice owner what happens if a patient has an anaphylactic reaction in the waiting room and most will say something like a doctor or nurse would handle it. Ask who that doctor/nurse is, what they do first, who calls the ambulance, who manages the other patients in the room and who documents what happened and the answer usually gets vague fast. That gap between knowing something could go wrong and knowing exactly what happens when it does is where practices get into real trouble.

It's easy to think of policies and procedures as paperwork that sits in a folder nobody opens, something built for an audit rather than for the people actually doing the work. That's backwards. A good policy isn't there to slow your team down, it's there so that in the moment something goes wrong, nobody has to think on the spot under pressure, because the thinking has already been done. When a policy is clear, specific and known by the team, it removes the guesswork at exactly the moment guesswork is most dangerous. It tells your receptionist what to do when a patient becomes aggressive, it tells your doctor/nurse what to do when a cold chain breach is discovered, and it tells your practice manager what to do when a complaint comes in. None of that should be improvised, because improvisation under stress is where mistakes happen and where patients and staff get hurt.

Most practices have policies for the routine. Far fewer have a genuine plan for when something goes off course, and that's exactly when a plan matters most. A real plan for when things go wrong covers the predictable categories, a clinical incident or adverse event, a complaint, whether from a patient, a family member or a staff member, a data breach or privacy issue, a serious staff conduct concern, an equipment failure or cold chain breach, a patient safety event that didn't cause harm but easily could have. Each of these needs its own clear pathway, because the right response to a complaint looks nothing like the right response to a clinical emergency, and trying to handle both with the same vague instinct of we'll sort it out leaves your team exposed. The strongest practices write these pathways down before they're needed, not while they're living through the event, because decisions made calmly in advance are almost always better than decisions made under pressure in the moment.

This is the part that gets missed even in practices that do have policies. A policy without an owner is just a document. The moment something actually happens, if nobody is clearly responsible for activating that policy, you end up with several well meaning people all assuming someone else has it covered, and precious time gets lost in that gap. Every single one of these areas needs a designated lead, someone whose name is attached to the policy, who knows it's theirs to activate and who the rest of the team knows to look to the second something happens. The lead for a clinical incident might be your senior nurse, the lead for a complaint might be your practice manager, and the lead for a privacy breach might be whoever holds that compliance role in your practice. It doesn't matter exactly who, as long as it's specific, documented and known by everyone on the team, not just the person holding the title. Naming a lead does two things at once. It gives your team certainty in the moment, because there's no hesitation about who's in charge of the response, and it also gives that lead genuine ownership, because when something is clearly assigned to a specific person, it tends to get taken far more seriously than when it's everyone's job and therefore nobody's.

There's a third thing a named lead does and it's just as important. It closes the door on the wrong person stepping in. Without a clear, documented lead, a vacuum opens up in the moment something happens, and vacuums get filled by whoever is standing there and willing to take charge, regardless of whether they actually have the authority, training or clinical knowledge to do so. That might be a well meaning admin staff member who's seen enough TV medical dramas to feel confident giving instructions they have no business giving, it might be the cleaner, the courier driver, or anyone else who happens to be on site and steps in simply because nobody else clearly has, and it might even be someone with genuine expertise in their own field but none in this one, like an accountant who's comfortable making calls about the financial side of the practice and ends up drifting into clinical or patient facing decisions that have nothing to do with their qualifications. None of these people should be making clinical or compliance decisions, but in an undefined moment of crisis, somebody will, and if it isn't the person you've designated, it'll be whoever felt most confident to give it a go. A clear lead protects against exactly that. It means the response to a clinical incident comes from your senior doctor or nurse, not from whoever happened to be nearest the front desk, and it means a privacy breach gets escalated to the person who actually understands the compliance obligations, not improvised by someone guessing at what seems reasonable. Authority in a crisis needs to sit with someone qualified to hold it, and the only way to guarantee that is to decide it in advance, write it down, and make sure your whole team knows exactly who that person is before they ever need to know it.

This isn't only about getting the right outcome for the patient in the moment, although that matters enormously on its own. It's also about who is left holding the risk afterwards. When someone without clinical authority makes a clinical call, or someone without the right training handles a complaint, or an unqualified person decides how to manage a serious incident, the practice doesn't get to walk away from that decision just because the wrong person made it. You're still liable. The patient who was harmed by a poor decision doesn't care whether it came from your senior nurse or your courier driver, the complaint that follows doesn't distinguish between authorised and unauthorised judgement calls, and if it ends up in front of a regulator, an insurer or a lawyer, the absence of a documented, designated lead is exactly the kind of gap that turns an unfortunate incident into a far more serious legal and reputational problem. A named lead isn't just about a smoother response, it's about making sure that when a decision carries real consequences, it was made by someone with the standing, training and authority to actually make it, so that if it's ever scrutinised afterwards, the answer to who made this call and why holds up.

And it isn't only the practice's reputation on the line. If you hold a clinical registration, whether through the Nursing Council or the Medical Council, an undocumented, unauthorised decision making process can put your own standing at risk too, not just the business's. A complaint that escalates to the Health and Disability Commissioner doesn't ask whether the practice generally runs well, it asks specifically who made this decision, what authority they had to make it, and whether the process around it was sound. If the honest answer is that nobody was formally responsible and someone simply stepped in, that's a far harder position to defend, for the practice and for the individual clinicians whose names and registrations are attached to it. A clear, documented lead for each type of incident protects your team in the moment, protects the practice from unnecessary liability, and protects the professional standing of everyone whose registration depends on being able to show that decisions were made by the right person, for the right reasons, through a process that was already in place before anything went wrong.

Good policies and a clear plan for when things go wrong protect more than just the patient in front of you. They protect the staff member who would otherwise be left to make a high stakes call alone, without support or clarity, in a moment that's already stressful enough. They protect the practice from the kind of slow, compounding damage that comes from inconsistent handling of serious events. And they protect you as the owner, because when something does go wrong, the question that gets asked afterwards is rarely just what happened, it's whether there was a plan and whether that plan was followed. If you can answer that clearly, with a name attached to it, you're in a fundamentally different position than a practice that's relying on good intentions and hoping nothing serious ever comes through the door.

It will, eventually. Every practice deals with something difficult sooner or later. The only real question is whether your team is improvising when it happens, or simply doing what's already been planned.