Engagement, Retention, Wellbeing and Occupational Safety

Introduction

Hospitals depend on people whose work is clinically complex, emotionally demanding and often performed under time pressure. Doctors, nurses, allied health professionals, technicians, administrators, porters, cleaners and support staff must coordinate continuously while responding to illness, uncertainty, suffering and occasionally death. Human resource management in this environment therefore extends beyond recruitment and payroll. It must create conditions in which employees can perform safely, remain committed, recover from demanding work and develop sustainable careers.

Engagement, retention, wellbeing and occupational safety are interconnected. Poor staffing may increase workload and fatigue; fatigue can increase errors and conflict; conflict can reduce engagement; low engagement may increase absence and turnover; turnover then worsens staffing shortages. Conversely, supportive leadership, fair work design, psychological safety and meaningful recognition can strengthen both employee wellbeing and service quality.

This chapter applies motivation and engagement theories to practical hospital problems, including turnover, absenteeism, burnout, fatigue, workplace violence and psychosocial risk. It also considers resilience, psychological safety, employee assistance, measurement, ethical responsibilities and the limits of individual-focused solutions.

Learning Objectives

By the end of this chapter, the learner should be able to:

1. Distinguish motivation, engagement, job satisfaction, wellbeing, resilience and retention.
2. Apply major motivation and engagement theories to hospital workforce problems.
3. Diagnose the organisational causes of turnover, absenteeism, burnout and fatigue.
4. Design interventions for psychological safety, violence prevention and psychosocial risk management.
5. Select meaningful workforce indicators and interpret them cautiously.
6. Explain the responsibilities of managers, employees and institutions in occupational safety.
7. Evaluate an integrated hospital case and recommend ethically defensible actions.

1. Core Concepts and Their Relationships

Motivation, engagement and satisfaction

Motivation refers to the forces that initiate, direct and sustain work behaviour. It may be intrinsic, such as professional pride or the desire to help patients, or extrinsic, such as pay, promotion and recognition. Engagement is a broader work-related state involving energy, dedication and absorption in work. An engaged nurse, for example, is not merely present; she is attentive, committed to patient care and able to invest effort in improvement.

Job satisfaction is an employee’s evaluation of work conditions and experiences. Satisfaction and engagement are related but not identical. An employee may be satisfied with pay and hours but not emotionally engaged with the organisation. Conversely, a highly engaged professional may remain dissatisfied with a particular policy while continuing to contribute strongly.

Wellbeing and occupational safety

Wellbeing includes physical, psychological, social and, where relevant, financial and professional health. Occupational safety is the prevention and control of work-related injury and harm. Traditional safety programmes focused on physical hazards such as sharps, infection, falls, chemicals and radiation. Contemporary hospital safety must also address fatigue, bullying, moral distress, violence, excessive workload, role conflict, traumatic exposure and inadequate recovery time.

Retention and turnover

Retention is the organisation’s ability to keep valuable employees and sustain their commitment. Turnover is the movement of employees out of an organisation. Voluntary turnover occurs when an employee resigns; involuntary turnover follows dismissal, redundancy or contract termination. Some turnover is beneficial when poor performance is managed fairly or when an employee leaves for appropriate career progression. High avoidable turnover, however, damages continuity, increases recruitment costs and places pressure on remaining staff.

Absenteeism and presenteeism

Absenteeism is absence from scheduled work. It may be short-term or long-term, authorised or unauthorised, health-related or unrelated to illness. Presenteeism occurs when employees attend work but are impaired by illness, exhaustion, stress or other problems. In healthcare, presenteeism can create serious risks because a physically present but cognitively impaired employee may make errors or transmit infection.

2. Motivation and Engagement Theories in Healthcare

Maslow’s hierarchy of needs

Maslow proposed that human needs include physiological needs, safety, belonging, esteem and self-actualisation. The hierarchy is useful as a diagnostic reminder: an employee working excessive night shifts without adequate rest may be unable to benefit fully from development opportunities. However, research does not support a rigid sequence in which one level must be completely satisfied before another becomes relevant. Healthcare workers may seek professional meaning while also experiencing financial insecurity or safety concerns.

Herzberg’s two-factor theory

Herzberg distinguished hygiene factors from motivators. Hygiene factors include pay, supervision, policies, working conditions and job security. Their absence can produce dissatisfaction, but improving them does not necessarily create high motivation. Motivators include achievement, recognition, responsibility, advancement and meaningful work.

The practical implication is that a hospital cannot solve disengagement solely through inspirational messages or awards if staffing, equipment and rostering are inadequate. Basic conditions must be made fair and safe, after which meaningful responsibility, recognition and development can strengthen engagement.

McGregor’s Theory X and Theory Y

Theory X assumes that employees dislike work and require control. Theory Y assumes that people can be self-directed, responsible and motivated when work conditions support them. Neither is a complete description of human behaviour. A safe hospital uses appropriate accountability while also trusting professionals, involving them in decisions and recognising their expertise. Excessive surveillance can weaken trust; insufficient clarity can create unsafe variation.

Self-determination theory

Self-determination theory identifies autonomy, competence and relatedness as fundamental psychological needs. Autonomy means having meaningful discretion; competence means feeling capable and able to improve; relatedness means experiencing respectful connection with others.

In hospitals, autonomy may involve participation in rosters, clinical protocols or improvement projects within professional and legal boundaries. Competence is strengthened by induction, supervision, simulation and feedback. Relatedness is promoted by inclusive teams, respectful communication and reliable support after difficult events. The theory warns against confusing autonomy with abandonment: employees need discretion together with resources and clear standards.

Expectancy theory

Expectancy theory proposes that effort is influenced by three beliefs: expectancy, instrumentality and valence. An employee is more likely to invest effort when they believe effort can produce performance, performance will lead to an outcome, and that outcome is valued. In conceptual form:

Expectancy, instrumentality and valence are commonly represented on a scale from 0 to 1 or by positive ratings. The relationship is multiplicative: if any component is effectively zero, motivation is weakened substantially. For example, a nurse may value promotion but make little additional effort if she believes staffing levels make successful performance impossible, or if promotion decisions appear unrelated to performance. This is a conceptual model rather than a precise clinical measurement equation; its purpose is diagnosis, not exact prediction.

Equity theory and organisational justice

Employees compare their contributions and outcomes with those of relevant others. Perceived inequity may arise from unequal pay, unsafe workload allocation, favouritism, inconsistent leave approval or disrespectful treatment. Organisational justice has at least three dimensions:

• Distributive justice: fairness of outcomes.
• Procedural justice: fairness and consistency of decision processes.
• Interactional justice: dignity, explanation and respect during implementation.

A decision can be unpopular yet accepted more readily when the process is transparent, evidence-based and respectful.

Job Demands–Resources model

The Job Demands–Resources (JD-R) model is especially useful in hospitals. Job demands include workload, emotional labour, time pressure, shift work, exposure to trauma, role ambiguity and violence. Job resources include staffing, supportive leadership, equipment, autonomy, feedback, learning opportunities and teamwork.

High demands can produce exhaustion, while inadequate resources reduce motivation and engagement. Resources may also buffer the effect of demands. The model does not imply that resilience training can compensate indefinitely for unsafe staffing. When demands are structural, structural action is required.

Utrecht work engagement perspective

Work engagement is commonly described through three dimensions: vigour, dedication and absorption. These dimensions help managers distinguish engagement from simple attendance. Measurement tools such as the Utrecht Work Engagement Scale may support organisational assessment, but results should be interpreted in context, with attention to culture, workload, confidentiality and response bias.

3. Diagnosing Turnover, Absenteeism and Burnout

A systems perspective

A resignation interview is only one source of evidence. Employees may report a better opportunity while withholding concerns about bullying or workload because they fear reputational consequences. Sound diagnosis combines multiple sources:

• workforce demographic and tenure data;
• exit and stay interviews;
• absence and overtime patterns;
• engagement and psychological-safety surveys;
• incident and grievance records;
• patient-safety reports;
• focus groups and confidential interviews;
• local labour-market and pay information.

Data should be examined by department, occupation, shift, contract type, gender and other relevant categories, while protecting confidentiality. Aggregated data can reveal that turnover is concentrated among newly qualified night-shift staff rather than being an organisation-wide problem.

Useful workforce measures

A basic turnover rate can be calculated as:

The numerator is the number of employees who leave during the specified period. The denominator is usually the average headcount, often calculated as (opening headcount + closing headcount) ÷ 2 when more detailed monthly data are unavailable. The period must be stated, such as one year, and the organisation should distinguish voluntary from involuntary turnover. Headcount and full-time-equivalent measures should not be mixed without explanation.

An absence rate may be expressed as:

The organisation must define which absences are included, the observation period and whether scheduled workdays are measured for employees or full-time equivalents. Different definitions make comparisons misleading.

A simple retention rate is:

This measure should be interpreted with caution because it can be distorted by recruitment, restructuring and changes in the employee population.

Worked example

A hospital begins the year with 240 employees and ends with 260. During the year, 30 employees leave. Using the average-headcount method, average headcount is (240 + 260) ÷ 2 = 250. The turnover rate is (30 ÷ 250) × 100 = 12%. If 18 of the 30 separations were voluntary, voluntary turnover is 7.2% using the same denominator. These figures do not explain why people left; they identify a pattern requiring qualitative investigation.

Burnout

Burnout is an occupational phenomenon associated with chronic workplace stress that has not been successfully managed. It is commonly characterised by exhaustion, mental distance or cynicism, and reduced professional efficacy. Burnout should not be treated as a personal weakness or as a diagnosis that managers casually assign. Depression, anxiety, sleep disorders and other health conditions may coexist, and assessment should be referred to qualified professionals.

Prevention requires attention to workload, staffing, control, recognition, fairness, community and values. Individual interventions such as mindfulness, counselling and resilience training can be useful, but they are insufficient when the dominant causes are unsafe staffing, incivility or chronic overtime.

4. Fatigue, Shift Work and Recovery

Fatigue reduces alertness, memory, decision quality and emotional regulation. Hospital risks are increased by night work, extended shifts, rapid returns between shifts, unpredictable overtime, inadequate breaks and commuting after work. Fatigue risk management should include:

1. roster design that limits excessive consecutive night shifts;
2. adequate time between shifts;
3. protected meal and hydration breaks;
4. staffing plans for predictable peaks;
5. confidential reporting of fatigue without automatic punishment;
6. appropriate use of rest areas and controlled naps where policy permits;
7. education on sleep, circadian rhythms and safe travel;
8. review of fatigue-related incidents and near misses.

Managers must avoid assuming that employees can always solve fatigue through personal time management. A worker cannot safely recover from a schedule that systematically denies recovery time. Fatigue policies should also consider commuting, caregiving responsibilities, disability and medication effects without discriminating against employees.

5. Psychological Safety and Resilience

Psychological safety is a shared belief that people can speak up, ask questions, admit mistakes and offer concerns without humiliation or retaliation. It is not the absence of accountability. A psychologically safe unit can distinguish a human error, a risky system design, reckless behaviour and deliberate misconduct, then respond proportionately.

Managers promote psychological safety by:

• inviting dissenting views during briefings;
• responding constructively to bad news;
• thanking staff who report hazards;
• conducting fair incident reviews;
• closing the feedback loop;
• modelling admission of uncertainty and mistakes;
• preventing bullying, discrimination and retaliation.

Resilience has individual, team and organisational dimensions. Individual resilience includes recovery skills and adaptive coping. Team resilience includes mutual support, role flexibility and shared learning. Organisational resilience includes spare capacity, reliable systems, competent leadership and the ability to adapt while preserving safety. A narrow focus on individual resilience may unintentionally blame workers for conditions created by the organisation.

6. Workplace Violence and Psychosocial Risk

Workplace violence includes physical assault, threats, sexual harassment, verbal abuse, intimidation and property damage. Healthcare workers may face violence from patients, relatives, visitors, colleagues or other persons. Risk factors include crowded waiting areas, intoxication, dementia, communication barriers, long delays, inadequate security, poor environmental design and insufficient staffing.

An effective prevention programme uses the hierarchy of controls:

Personal protective equipment is the least reliable level when used alone. Violence prevention should include risk assessment, environmental design, communication procedures, trained security support, post-incident medical and psychological care, and clear investigation processes. Staff should not be expected to tolerate abuse as an unavoidable part of compassionate care.

Psychosocial risks include excessive demands, low control, poor support, role conflict, bullying, discrimination, moral injury, job insecurity and poor change management. Risk assessment should identify hazards, people exposed, existing controls, residual risk and further actions. Confidentiality is essential when risks involve senior staff or powerful professional groups.

7. Employee Assistance and Supportive Practice

Employee assistance programmes (EAPs) may provide confidential counselling, referral, crisis support, financial guidance or substance-use assistance. An EAP is most effective when it is accessible, culturally appropriate, available across shifts and clearly separated from disciplinary processes. Managers should explain how confidentiality works rather than promising absolute secrecy beyond legal and safety limits.

Support after traumatic events should avoid forced disclosure or mandatory group debriefing as a universal response. A better approach is practical support, psychological first aid where appropriate, monitoring, voluntary referral and timely professional care. Return-to-work plans should be individualised and may include graduated duties, schedule adjustments, treatment appointments and regular review.

Managers are not therapists. Their responsibilities are to notice concerning changes, hold respectful conversations, address work factors, follow referral procedures and respond to immediate safety concerns. Consent, privacy and anti-discrimination principles must guide support.

8. Designing an Integrated Intervention

A useful intervention follows a prevention cycle:

1. Define the problem. Specify the population, time period and harm, such as rising nurse turnover on night shifts.
2. Collect evidence. Combine quantitative indicators with confidential qualitative information.
3. Identify causes. Separate individual, team, job-design and system-level causes.
4. Prioritise risks. Consider severity, likelihood, exposure, legal obligations and feasibility.
5. Select controls. Prefer redesign of work and removal of hazards over education alone.
6. Implement with participation. Involve staff representatives, occupational health, clinical leaders, HR and safety specialists.
7. Monitor outcomes. Track both leading indicators, such as hazard reports and break compliance, and lagging indicators, such as injuries and resignations.
8. Review equity and unintended effects. Ensure that interventions do not shift burdens to casual staff, minority groups or other departments.

An intervention logic should connect resources, activities, outputs and outcomes. For example, additional night staffing is an input; improved handover and protected breaks are activities; reduced missed breaks and overtime are outputs; lower fatigue, incidents and turnover are desired outcomes. Outcomes should not be attributed automatically to one intervention because labour markets, seasonal illness and policy changes may also influence results.

9. Leadership, Governance and Ethics

Senior leaders determine whether wellbeing is treated as a strategic responsibility or as an employee lifestyle issue. Governance should assign clear accountability for occupational safety, violence prevention, psychosocial risk, workforce planning and incident review. Policies should align with applicable labour, occupational health, anti-discrimination, privacy, professional licensing and health-and-safety laws. Because legal requirements vary by jurisdiction, managers must consult current local legislation and professional guidance.

Ethically, hospitals owe employees dignity, non-maleficence and fair treatment. Monitoring technologies, including electronic rostering analytics, access logs and AI-based predictive tools, create privacy and bias risks. An algorithm that predicts resignation may reproduce historical discrimination or label employees as disloyal. Technology should support human judgement, use proportionate data, be transparent where possible and never become a substitute for a fair conversation.

AI may assist with roster optimisation, workload forecasting, survey-theme analysis and identification of unusual absence patterns. It should not make opaque decisions about promotion, discipline or mental-health status. Data minimisation, access controls, audit trails, bias testing and human review are essential.

10. Illustrative Case: Fatigue and Turnover in an Emergency Department

Background

This illustrative case concerns a 300-bed hospital whose emergency department has 42 registered nurses. Over twelve months, voluntary nurse turnover rises, sick leave increases and several medication near misses occur during early-morning handovers.

Problem

The department manager initially proposes a resilience workshop. Staff surveys, however, show frequent missed breaks, rapid returns after late shifts, unpredictable overtime and fear of speaking up about fatigue. Exit interviews mention workload and inconsistent treatment by senior staff. The department also has a high proportion of newly qualified nurses working nights.

Analysis

HR calculates 12 voluntary separations among an average nursing headcount of 42, giving a turnover rate of approximately 28.6% for the period. The figure is descriptive, not explanatory. Focus groups identify four interacting causes: demand peaks without flexible staffing, weak roster recovery, low psychological safety and limited transition support for new nurses. The problem is therefore not simply a lack of personal resilience.

Approach and solution

The hospital establishes a joint working group involving nurses, medical staff, HR, occupational health, infection prevention, patient safety and a staff representative. Actions include:

• adjusting rosters to reduce rapid returns and excessive consecutive nights;
• creating a small relief pool for predictable demand peaks;
• protecting breaks through charge-nurse cover;
• introducing a structured night-shift handover;
• providing a confidential fatigue-reporting route;
• pairing newly qualified night nurses with experienced mentors;
• training managers in respectful response to safety concerns;
• reviewing violence risks in the waiting area;
• offering voluntary EAP referral and occupational-health assessment;
• monitoring turnover, absence, missed breaks, near misses and psychological-safety scores quarterly.

Outcome

After six months, the hospital observes fewer missed breaks and improved reporting of near misses. Staff report greater confidence in raising fatigue concerns. Turnover has not yet returned to the desired level, so the working group continues to examine pay competitiveness, career progression and patient-flow design. This is important: early improvement in reporting may indicate greater psychological safety rather than worsening safety.

Learning points

The case demonstrates that turnover and safety data should be interpreted together. It also shows why education-only interventions are inadequate, why employee participation improves diagnosis, and why outcomes should be reviewed over time rather than judged after a single workshop.

Challenges and Limitations

First, engagement surveys may be affected by fear, survey fatigue and low response rates. Confidentiality must be credible. Second, a high engagement score may coexist with overwork: employees can be dedicated precisely because they are compensating for system weaknesses. Third, retention is not always desirable if it is achieved through coercive contracts or suppression of mobility. Fourth, wellbeing programmes can become symbolic if leaders do not address staffing, pay, discrimination and workload. Fifth, comparisons between departments can be unfair when patient acuity, labour markets and job roles differ. Finally, interventions may produce unintended consequences, such as transferring overtime to temporary workers or discouraging incident reporting.

Best-Practice Checklist

A hospital seeking sustainable engagement and safety should:

• treat wellbeing and safety as design responsibilities, not solely individual responsibilities;
• provide fair pay, predictable scheduling and adequate equipment;
• involve employees in decisions affecting their work;
• train managers in feedback, conflict resolution and psychological safety;
• use confidential, mixed-method workforce data;
• control fatigue through rostering and recovery time;
• prevent and respond to violence systematically;
• provide accessible, confidential assistance and occupational-health referral;
• distinguish support from discipline while maintaining accountability;
• monitor equity, privacy and unintended effects;
• review interventions using both workforce and patient-safety outcomes.

Chapter Summary

Engagement, retention, wellbeing and occupational safety form a connected hospital-management system. Motivation theories explain how fair conditions, meaningful work, autonomy, competence, relatedness, recognition and justice influence employee behaviour. The JD-R model highlights the balance between demanding work and the resources needed to perform it safely. Turnover, absence and burnout should be diagnosed through multiple data sources rather than assumed to result from individual weakness.

Fatigue management requires safe scheduling, recovery time, breaks and supportive reporting. Psychological safety enables staff to speak up and learn from errors without removing accountability. Violence and psychosocial risks require organisational controls, environmental design, fair procedures and post-incident support. EAPs and resilience programmes are valuable but cannot substitute for adequate staffing and sound work design. Ethical governance requires privacy, non-discrimination, employee participation and careful oversight of analytics and AI. Sustainable improvement is participative, evidence-informed and continuously evaluated.

Key Terms

Motivation: Forces that initiate, direct and sustain work behaviour.

Employee engagement: Energy, dedication and psychological investment in work.

Job satisfaction: An employee’s evaluation of work experiences and conditions.

Wellbeing: Physical, psychological, social and professional health.

Occupational safety: Prevention and control of work-related injury and harm.

Retention: The organisation’s ability to keep employees and sustain commitment.

Turnover: Movement of employees out of an organisation.

Absenteeism: Absence from scheduled work.

Presenteeism: Attendance while impaired by illness, stress or exhaustion.

Burnout: Occupational phenomenon associated with chronic unmanaged workplace stress.

Fatigue: Reduced physical or mental capacity caused by insufficient recovery or demanding work.

Psychological safety: Shared belief that people can speak up without humiliation or retaliation.

Resilience: Capacity of individuals, teams or systems to adapt and recover while maintaining functioning.

Psychosocial risk: Work design or social conditions that can harm psychological or physical health.

Employee assistance programme: Confidential support and referral service for employee difficulties.

Organisational justice: Perceived fairness of outcomes, procedures and interpersonal treatment.

Job Demands–Resources model: Framework linking work demands and resources to exhaustion and engagement.

Presenteeism: Working while health or fatigue reduces effective performance.

Hierarchy of controls: Risk-control model prioritising elimination and engineering controls over individual protection.

Review Questions

Short Answer Questions

1. Distinguish employee engagement from job satisfaction.
2. Identify the three psychological needs in self-determination theory.
3. What is psychological safety, and why is it important in hospitals?
4. State two organisational causes of burnout.
5. Why should EAP confidentiality be explained carefully to employees?

Long Answer Questions

1. Explain how Herzberg’s two-factor theory can guide a hospital’s retention strategy.
2. Discuss the usefulness and limitations of the Job Demands–Resources model in managing burnout.
3. Describe a comprehensive approach to fatigue risk management in a hospital.
4. Explain how organisational justice influences engagement and turnover.
5. Discuss why resilience training cannot replace improvements in staffing and work design.

Analytical / Application Questions

1. A hospital has rising sick leave, missed breaks and medication near misses among night-shift staff. Use the JD-R model to diagnose the problem and propose an intervention plan.
2. A department reports high engagement scores but also high overtime and presenteeism. How should an HR manager interpret this apparent contradiction?
3. Design a measurement dashboard for evaluating a workplace-violence prevention programme, including leading and lagging indicators.

Multiple Choice Questions with Answers

Question 1

Which statement best distinguishes engagement from job satisfaction?

A. Engagement concerns energy and dedication, whereas satisfaction concerns evaluation of work conditions.

B. Engagement is only about salary, whereas satisfaction is only about safety.

C. Engagement measures absence, whereas satisfaction measures turnover.

D. Engagement and satisfaction are exactly identical concepts.

Correct Answer: A. Engagement concerns energy and dedication, whereas satisfaction concerns evaluation of work conditions.

Question 2

According to self-determination theory, which set contains the three fundamental psychological needs?

A. Pay, promotion and job security

B. Autonomy, competence and relatedness

C. Power, status and competition

D. Safety, overtime and supervision

Correct Answer: B. Autonomy, competence and relatedness

Question 3

In the JD-R model, which is an example of a job resource?

A. Emotional labour

B. Role ambiguity

C. Supportive leadership

D. Time pressure

Correct Answer: C. Supportive leadership

Question 4

A hospital starts with 240 employees, ends with 260, and has 30 separations. Using average headcount, what is the turnover rate?

A. 10%

B. 12%

C. 15%

D. 30%

Correct Answer: B. 12%

Question 5

Which action is most consistent with psychological safety?

A. Punishing every employee who reports a near miss

B. Avoiding discussion of errors to protect morale

C. Thanking staff for reporting hazards and reviewing systems fairly

D. Allowing unsafe conduct because accountability is harmful

Correct Answer: C. Thanking staff for reporting hazards and reviewing systems fairly

Question 6

Which is the highest-level control in the hierarchy of controls?

A. Personal protective equipment

B. Administrative training

C. Engineering control

D. Elimination

Correct Answer: D. Elimination

Question 7

Which statement about burnout is most accurate?

A. It is always evidence of poor personal character.

B. It is an occupational phenomenon associated with chronic unmanaged workplace stress.

C. It can be reliably identified by a manager without professional assessment.

D. It is eliminated by a single resilience workshop.

Correct Answer: B. It is an occupational phenomenon associated with chronic unmanaged workplace stress.

Question 8

Which measure is a leading indicator of occupational safety?

A. Number of workplace injuries

B. Number of resignations after an incident

C. Compliance with protected-break procedures

D. Days lost due to injury

Correct Answer: C. Compliance with protected-break procedures

Question 9

Why should hospital managers interpret turnover data with qualitative evidence?

A. Turnover data never contain any useful information.

B. Turnover rates show patterns but do not by themselves explain causes.

C. Qualitative evidence replaces all workforce measurement.

D. Qualitative evidence is required only for payroll calculations.

Correct Answer: B. Turnover rates show patterns but do not by themselves explain causes.

Question 10

Which use of AI in workforce management is most ethically appropriate?

A. Automatically dismissing employees predicted to resign

B. Using opaque scores to diagnose employee mental health

C. Supporting roster forecasting with human review, privacy controls and bias testing

D. Sharing individual absence predictions publicly with department staff

Correct Answer: C. Supporting roster forecasting with human review, privacy controls and bias testing