Macadamian Blog

Project Management in the Healthcare Industry: A Risk Based Approach

Tim Parsons

One innovative approach to governance and project management is to tailor the type and level of management to the risk assessed for each project, avoiding the costs of treating all projects as though they carried a high level of risk.

Risk Based Project Management in Healthcare

Healthcare providers face ongoing challenges to combat rising costs while delivering on the promises of advances in medical science and technology. Innovations in medical IT can be a core strategy for finding new efficiencies, but expensive and risky to deliver. Creative thinking about IT project risk management and governance strategies can deliver dramatic cost savings and stretch healthcare dollars further while managing risk.

One innovative approach to governance and project management is to tailor the type and level of management to the risk assessed for each project, avoiding the costs of treating all projects as though they carried a high level of risk.

Why do we care about risk management?

Healthcare project management is an overhead cost that does not directly contribute to patient care, so the more we can effectively control and reduce healthcare project management costs, the more of our limited budgets can be directly spent on patient care needs. It’s a bit like insurance: it’s easy to question the expense until you really need it.  Without effective project management, dramatic cost overruns or even project failure are constant threats.

Once we recognize that traditional “one size” approaches simply don’t fit the realities of dynamic organizations and wide-ranging project complexities, it becomes clear that a scalable solution to project management is required. This allows us to flexibly increase and decrease resource assignments depending on specific project needs and our resource capacity. Without a scalable approach, our ability to balance and adjust resources for current and future project needs is restricted to our resource pool, and we may find ourselves realizing halfway through a project that it requires additional resources that are committed elsewhere.

Program versus project

There are two basic principles of flexible project management. One is to execute project delivery as a program and the other is to assign types and levels of project management resources based on a risk assessment.

First, we need to understand the difference between governing programs and projects.  A program is defined as a grouping of related projects based on a variety of factors or criteria. For example, projects that utilized a similar technology stack or projects being implemented for a specific group within the institution may be grouped into programs.  Depending on organization structure and the available resource pool, there may be one or many programs within an organization.  By grouping projects within a program, resource allocation decisions can be balanced within and for the benefit of the program as a whole, and are not isolated to a specific project. Limited resources can also be shared, and our project management approach can be adjusted based on the program’s priorities.

It’s all about Risk

If we consider and use project risk analysis for each project in the program, we can leverage scarce resources in an intelligent and measured way.  Projects that have the most risk can be assigned a higher risk score, and processes tailored to deliver resources and governance proportionate to the project risk.

Keys to Success

Risk-based program management is light weight, and the governance effort is based on the project risk.  This is more efficient than traditional health care project management and reduces costs when it is used appropriately by allocating resources to the governance of a project based on objective risk assessment.  The higher the level of risk the more governance resources are required.

A risk-based approach is also scalable, providing the right level of governance based on the risk of the project and the program’s resource level.

How does risk-based Program Management Work?

The guiding principle of risk-based Program Management is the level of risk determines the approach we take for oversight and governance.

In risk-based program management, the project manager must not only define a set of anticipated risks during planning but also be vigilant for yellow flags during project execution so that risks are anticipated and identified before they become issues. Once identified, risks must be communicated up the chain of command proactively, providing senior managers with the right level of detail.

Prior to the initiation of a project, an initial risk assessment must be conducted to determine the risk level based on a few easily identified factors.  Based on the assessment, a risk value is assigned to the project.

Risk Classifications

Risk is classified as high, medium, or low based on the project type, such as an enhancement vs. a new application, the type of contract (internally staffed, outsource fixed bid, outsource Time and Material, composite team), the project size, contract complexity, team expertise and other factors.

Low-Risk Classification
A project should be assigned a Low-risk value if the following risk factor characteristics are present:

  • Project type – an enhancement to an existing application
  • Contract type – the project is internally staffed
  • Project size – the team size is less than five full time employees and the project duration is less than three months
  • Contract Complexity – no contracts are required and none of the labor has been outsourced
  • Team Level Expertise – An experienced team with the necessary skill has been tasked.  No training is required

Medium Risk Classification

A project should be assigned a Medium risk value if the following risk factor characteristics are present:

  • Project type – a new application, or a substantial incremental release which includes a significant new feature set
  • Contract type – the project involves outsourced resources.
  • Project size – the team size is less than five full time employees and the project duration is less than three months
  • Contract Complexity – Fixed bid contract
  • Team Level Expertise – The team is composed of a mix of experienced and inexperienced people.  Some training may be required.

High Risk Classification

A project should be assigned a High risk value if the following risk factor characteristics are present:

  • Project type – a new application, or a substantial incremental release which includes a significant new feature set.
  • Contract type – the project involves outsourced resources.
  • Project size – the team size is larger than five full time employees and the project duration is greater  than three months.
  • Contract Complexity – Third party vendors are engaged on a Time and Material based contract.
  • Team Level Expertise – The team is composed of inexperienced people.  Training may be required.
  • The application is mission critical – Enterprise capabilities will be lost or people’s lives put at stake if the project fails.

Project Management Approaches

Having ascertained the level of risk in a project, the appropriate management approach can be determined.  But regardless of project risk level, there are project governance activities that are required for all projects.  These activities ensure that a minimum level or oversight and governance are in place for all projects within the program:

  • Identify a team lead – someone who the program manager will work with
  • Meet with the team lead weekly
  • Review the project budget and timeline weekly
  • Report to the executive weekly.  The program manager gathers the project status and reviews the project status; they don’t just collate the reports.  The program  or project manager must analyze the report to identify any potential risks or deviations.
  • The program  or project manager must execute a weekly risk review for each project

For all projects within the program the following governance deliverables and processes must be executed:

  • Sprint planning sessions must be executed at the beginning of each sprint
  • A demonstration of the work completed during each sprint must be conducted.  Sprint retrospectives must also be completed to ensure that lessons learned are gathered.
  • Project status must be reported to the executive team by the program  or project manager on a weekly basis. Each project is assigned a green, yellow or red ratings for both the status and the budget.

Management Approach for Low Risk Projects

For healthcare projects that have been assessed as a low risk, the level of governance and oversight is minimal.  Oversight can be delivered by either a program or project manager.  In addition to the deliverables and process applied to all projects, projects with a low-risk rating execute the following risk processes:

  • Minimal project management oversight (2 hours or less per week)
  • The program or project manager must designate a team lead.  The team lead will task all the team members and will report to the program or project manager
  • The team lead will manage the team on a day-to-day basis

The team lead is a critical element on low-risk projects.  They must drive project planning activities and task the team on a daily basis while also acting as the primary contact for non-financial decisions. They also implement the recommended governance process and produce the associated deliverables.

For low-risk healthcare IT projects, the following governance deliverables and processes must be executed:

  • Weekly status reports.  These reports are brief and concise.  The reports must include action items, risks and blocking issues.
  • Weekly meetings with the program manager if one has been assigned to manage the project
  • Sprint planning sessions
  • Sprint demonstrations
  • Project status is reported to the executive team by the program manager on a weekly basis. Each project is assigned a green, yellow or red ratings for both the status and the budget.

Management Approach for Medium Risk Projects

For healthcare projects that have been assessed as a medium risk,  governance and oversight are more involved than on a low-risk project.  Oversight is delivered by either a program or a project manager.  In addition to the deliverables and processes that are applied to all projects, projects with a medium risk rating execute the following governance processes:

  • A part-time program or project manager is assigned to provide governance and oversight – 8 hours per week
  • The program  or project manager manages the project team on a daily basis.  The program manager can gain efficiencies by leveraging a team lead
  • The program or project manager will chairs all scrums, planning meetings and demonstrations
  • The program or project manager produces all required project governance deliverables
  • The program or project manager implements all required governance processes

For medium risk healthcare projects, the following governance deliverables and processes must be executed:

  • Customer project kick-off meeting.  The kick-off meeting is used to establish the ground rules for the project and to set up expectations around stakeholders, roles, deliverables, timelines and business goals.
  • Weekly status reports.  Status reports are used to formally communicate project progress, risks and action items.
  • Daily scrums.  These meetings are chaired by the project or program manager, who is responsible to keep them focused and short.
  • Weekly status meetings with the customer
  • Sprint planning sessions
  • Sprint demonstrations
  • Project status is reported to the executive team by the program or project manager on a weekly basis. Each project is assigned a green, yellow or red ratings for both the status and the budget.

Management Approach for High Risk Projects

For healthcare projects that have been assessed as high risk,  additional governance and oversight activities must be undertaken to avoid project failure.  Oversight is delivered by a dedicated project manager.  In addition to the deliverables and processes applied to all projects, projects with a high-risk rating execute the following governance processes:

  • A Customer project kick-off meeting is conducted.  The kick off meeting is used to establish the ground rules for the project and to set up expectations around stakeholders, roles, deliverables, timelines and business goals.
  • Weekly customer status updates are held.
  • A dedicated Project Manager assigned to the project. The project manager is expected to be a full time resource on the project
  • The Project Manager manages the project team on a daily basis
  • The Project Manager chairs focused and short daily scrums, planning meetings and demonstrations.
  • The Project Manager produces all required project governance deliverables
  • The Project Manager delivers weekly status reports.  Status reports are used to formally communicate project progress, risks and action items
  • The Project Manager implements all required governance processes
  • A Program Manager is also assigned to the project on a part time basis (2 hours per week). The Program Manager responsibilities include:
    • Mentoring the project manager
    • Providing a set of templates and processes for the project manager to use and follow
    • Meeting with the project manager on a weekly basis to review the project
    • Participating in planning sessions and demonstrations
    • Acting as an escalation point to the ‘C’ level.  The program manager must have sufficient authority to resolve resource staffing and scheduling issues.  The program manager must also have sufficient authority to negotiate scope management and scheduling solutions with the client.
    • Maintaining an overview of the program.  The program manager must maintain a global view of all projects within a program and adjust project resources for the benefit of the program.

Parting Thoughts

While the risk-based approach is not perfect it does work if the program or project managers keep themselves informed and communicate effectively. The program manager must be inquisitive and proactive: in complex healthcare IT projects. no news is not good news.  When action is required they must take it quickly, assess the results and adjust their approach as required.

You can think of the risk-based approach as the ‘fast food’ of project management. It’s fast, high volume, not the best quality, and no one wants to admit that they use it. But it gets the job done.

Author Overview

Tim Parsons

Tim is the program manager on our healthcare team with over 30 years of experience in the Information Technology field and 25 years of project management experience. His project teams are multi-disciplined and included User Experience (UX), engineering and Quality Assurance team members. Tim has extensive experience in a number of management roles including Program Manager, Technical Project Manager, and Line Manager. He is known for motivating project teams, his organizational skills, attention to detail, multitasking and a can-do attitude.