Step one: Definition of the HFMEA topic

Potential vulnerability topics in the on-site mass-gathering medical response system that should be examined by HFMEA were defined as the core process—from detecting a patient on the scene to completing transport to a hospital. The on-site medical response system’s outcome was defined as delivery of immediate care to patients with life-threatening conditions, timely patient transport without exacerbating disease, and appropriate selection of patients who do not need a hospital visit.

Step two: Definition of the risk assessment team

The multidisciplinary risk assessment team was established with 9 members, consisting of board-certified emergency physicians skilled to provide prehospital emergency care (also for obstetric, pediatric, and geriatric patients) at prehospital, board-certified general surgeons, trauma surgeons, members of the Disaster Medical Assistance Team who had experience in working with mass-casualty events, educational personnel, and administrative personnel. These specialties were selected because the prehospital on-site medical response system was the target topic. They had a training period to learn the basic concepts of HFMEA before the analyses were initiated.

Step three: Graphical description of the process/processes

Processes between patient identification and hospital transfer were outlined by the risk assessment team and then sub-processes were described. During this step, each team member answered a questionnaire, specifically designed to identify and describe the processes and sub-processes, based on literature and scenario-based simulations. Subsequently, all the team members were asked for agreement or disagreement with each process identified with the first questionnaire through a 3-round Delphi survey, until consensus was reached. All processes that fulfilled the predefined threshold for the inter-percentile range in agreement were then integrated, and appropriate modifications were adopted for similar sub-processes. The final diagram of processes and sub-processes was drawn by consensus.

Step four: Hazard analysis

First, team members independently listed all possible/potential failure modes for each sub-process. Then suggested potential failure modes were integrated via team discussion in which the failure mode was defined as a different way a particular sub-process could fail to accomplish its intended purpose. ^{Reference DeRosier, Stalhandske, Bagian and Nudell12}

Second, the severity and probability of potential failure modes were assessed by each member independently on a 4-point scale: 1 = remote, unlikely to occur; 2 = uncommon, possibly occurring once during the entire event; 3 = occasional, likely to occur once a day; and 4 = frequent, likely to occur several times a day (Supplementary Table S1). To determine the probability, each member independently performed a literature search on the proposed failure modes and scenario-based simulations. Each member’s probability scores were averaged, with consideration of a weight for each member’s total scores. The severity of failure was determined by team consensus with a 2-round Delphi method on a 4-point scale: 1 = minor, no injury and no increased level of care; 2 = moderate, increased length of stay or increased level of care; 3 = major, permanent lessening of bodily functioning; and 4 = catastrophic, death or major permanent loss of function (Supplementary Table S1). A hazard score was then calculated by multiplying the severity and probability scores. ^{Reference DeRosier, Stalhandske, Bagian and Nudell12,Reference Taleghani, Rezaei and Sheikhbardsiri13}

Third, potential failure modes with a hazard score equal to or greater than 8 were identified as unacceptable risks (this threshold was predefined in the formal HFMEA methods) and transferred to a 3-step decision tree, following the formal HFMEA decision tree (Supplementary Figure S1). ^{Reference DeRosier, Stalhandske, Bagian and Nudell12} Any potential failure mode identified as a single-point weakness in the system, even if the hazard score was less than 8, was sent to the decision tree for further evaluation.

Fourth, the risk assessment team used the 3-step decision tree to assess criticality in the process, existence of an effective control measure, and detectability. The failure mode that was determined to be critical, uncontrollable, and undetectable was validated as the critical vulnerability in the entire process of the on-site mass-gathering medical system. The assessment in the decision tree was conducted with Delphi rounds.

Finally, effect analysis was performed to identify effective corrections for validated failure modes. Corrections were categorized into either an intervention within the system or at a health care provider (HCP).

Step five: Action plans and outcome measures for test events

Each member developed and integrated a description of action as corrective intervention. At this step, the VMO examined the feasibility of each action to ensure execution of corrections. Then, outcome measures for test events before TOKYO2020 was held were proposed to ensure that the action plans effectively amended the mass-gathering on-site medical system.