Editor's note: Carl Elliott, an M.D. and Ph.D., is the author of "White Coat, Black Hat: Adventures on the Dark Side of Medicine" (Beacon Press, 2010).
(CNN) -- By the time he was finally arrested in late 2003, Charles Cullen, a nurse, had murdered at least 40 patients, and perhaps hundreds, in nine different hospitals and a nursing home in Pennsylvania and New Jersey.
Cullen's mode of operation was simple. He injected potentially lethal medications such as digoxin and insulin into the IV bags of hospitalized patients. His victims were chosen indiscriminately: a priest, a recovering breast cancer patient, even a teenager. These were not mercy killings. Many of Cullen's victims were improving and on the verge of being discharged from the hospital.
Nor were the murders a secret. The most jaw-dropping revelation to emerge from Charles Graeber's alarming new book, "The Good Nurse," is that in hospital after hospital, officials either knew or strongly suspected that Cullen was murdering patients, but instead of taking measures to stop the killing, they acted to protect the reputation of their institutions.
According to "The Good Nurse," one hospital offered to give Cullen neutral references if he would resign. At another, a risk manager stonewalled police for months as they investigated suspicious hospital deaths, during which time Cullen dispatched several more victims.
For 16 years, hospital officials at one institution after another chose to keep their suspicions secret and let Cullen move quietly on to his next job, where he often escalated the killings.
This ought to be shocking. But can any of us who work in hospitals and academic medical centers honestly say, "This could never happen at my institution"? I doubt it.
Some of the reasons are depressingly familiar. Group loyalty and a fear of retribution discourage many ordinary doctors and nurses from speaking out about wrongdoing or incompetence. But in American hospitals, these pressures are reinforced by real-life functionaries who are paid to protect the assets and reputation of their employers.
When risk managers, compliance officers and hospital attorneys turn a blind eye to a serial killer to protect their institutions, they don't go to prison. They get promoted.
The bureaucracy of health care "risk management" was born in the 1970s and '80s, ostensibly in response to the growth of medical malpractice litigation. The rhetoric of risk management emphasizes ways of minimizing medical errors and promoting patient safety.
The problem is in how success is measured, which is not in the soft currency of ethics or trust, but in how much money the strategy saves for the institution. If it pays for everyone to keep quiet, that's what the bureaucrats will advise.
I have seen it work differently. In 2002, Dr. Colin Bouwer, the Head of Psychological Medicine at the University of Otago in Dunedin, New Zealand, where I used to be on staff, was found guilty of murdering his wife by secretly and repeatedly injecting her with glucose-lowering drugs, sometimes in the university's own teaching hospital.
Bouwer, a native South African, was also a serial fabricator who had engineered his academic advancement with decades of spectacular, self-serving lies. Yet he would still be practicing medicine today if not for the single-minded persistence of a junior doctor, Andrew Bower, who, unlike virtually everyone else in the university hospital, strongly suspected Colin Bouwer of murder and worked with the police to bring him to justice.
New Zealand has a national, no-fault insurance scheme, and as a result, far less anxiety about malpractice litigation. This may be why dozens of University of Otago staff members cooperated fully with the police during their secret investigation. Later, when I wrote about the case for the New Yorker, I found staff members to be remarkably frank -- not just about Bouwer's crimes, but about their own institution's shortcomings.
Contrast this reaction with that of my current employer. For the past five years the University of Minnesota has been furiously trying to beat back the negative publicity generated by the violent suicide of a young man named Dan Markingson enrolled in an AstraZeneca-funded research study. Markingson was acutely psychotic when he was placed under an involuntary commitment order that legally compelled him to obey the treatment recommendations of his psychiatrist, Dr. Stephen Olson.
Olson proceeded to enroll Markingson in a study of antipsychotic drugs, despite the objections of Markingson's mother, Mary Weiss. The University of Minnesota was paid over $15,600 for each subject enrolled, for a total of over $327,000.
For months Ms. Weiss tried desperately to get her son out of the study, warning that his condition was spiraling downward and that he was in danger of committing suicide. She was ignored. Five months into the study, Markingson stabbed himself to death with a box-cutter, nearly decapitating himself.
According to the deposition of the official in charge of human subjects protection, the university never even investigated the suicide, much less the ethics of the troubled study, which has been subjected to withering criticism.
Instead, officials handed the matter over to university attorneys, who have done a remarkable, sustained job of stonewalling investigations, bullying critics, and arguing in court -- successfully -- that the university is statutorily immune from liability.
Those attorneys have been extraordinarily aggressive. When a lawsuit brought by Markingson's mother was dismissed on grounds of immunity, attorneys for the university retaliated by filing a legal action called a "notice to assess costs" against her, demanding $57,000 to cover its legal expenses. They later dropped the demand.
Bullying the mother of a suicide victim strikes many observers as especially shameful, but attorneys for other university hospitals have taken similar actions. In 2004, after Duke University surgeons operated on thousands of patients using instruments inadvertently washed in used hydraulic fluid instead of detergent, Duke attorneys filed an action to recover costs against one of the patients who sued.
In fact, just last month, University of Kentucky attorneys filed a lawsuit against a public radio reporter simply because she made an Open Records Act request for documents about surgeries at Kentucky Children's Hospital.
Sometimes, fortunately, these tactics backfire. Over the past two months, an online petition (which I helped organize) to investigate the University of Minnesota has steadily gathered momentum. It has been signed not just by a roster of medical luminaries from around the world, but also by outraged Minnesotans and university alumni who are ashamed of their university.
Last month, the general counsel for the university announced that he would be leaving Minnesota, and the petition shows no sign of slowing down.
It may be rare, and the process may be slow, but sometimes the humans can defeat the bureaucrats.
Follow @CNNOpinion on Twitter.
Join us at Facebook/CNNOpinion.
The opinions expressed in this commentary are solely those of Carl Elliott.