A Systems Safety Case for Distributed Care

Applying the MIT STAMP framework to rural coverage loss, veteran health access, and distributed care.

System-Theoretic Accident Model and Processes (STAMP)

Traditional analyses of patient harm focus on the bedside: the wrong dose, the missed interaction, the late intervention. They look for a broken component and set out to fix it. But many of the most serious harms happen when every component works exactly as designed, and the patient is still failed by the system meant to protect them.

STAMP, developed at MIT by Dr. Nancy Leveson and Dr. John Thomas, offers a different lens. It treats safety not as the absence of broken parts but as a property of the control structure around the patient: the layered set of people, policies, and technologies that issue instructions downward and receive feedback upward. An accident is what happens when that structure loses the ability to keep the patient within a safe range, even when no single part has failed.

STPA (System-Theoretic Process Analysis) is the practical method derived from STAMP. It maps the hierarchy of controllers and asks where control breaks down: where a controller lacks authority to act, where feedback goes missing, or where a controller's model of the patient has drifted from reality. Recent MIT-led research has shown that STPA scales beyond a single bedside to national-level healthcare control structures, including CMS, the FDA, and ONC (Leveson, Thomas, et al., Safety Science, 2026).