Category Archives: Root Cause

Root Cause

Sewage Leak Kills Two Mechanics

By ThinkReliability Staff

Two workers were overwhelmed by hydrogen sulfide and later died of their injuries after attempting to fix a sewage leak at a waste water treatment plant in Wichita Falls, Texas on July 2, 2016. The city has released its internal investigation findings into the incident. In order to fully understand the issues associated with the incident, we can capture the information within a Cause Map, or visual form of root cause analysis.

The first step in the Cause Mapping process is to capture the what, when and why of an incident, as well as the impacts to the goals. In this case, the injuries that caused the deaths occurred July 2 in Wichita Falls waste water treatment plant’s basement #2 while the two employees were attempting to repair a valve causing a wastewater leak. Capturing the task being performed at the time of the incident can provide useful information related to the incident.

The deaths of the two employees are an impact to the safety goal. The high levels of hydrogen sulfide are an impact to the environmental goal, while the need for a valve repair is an impact to the property goal. The emergency response and external incident investigation impact the labor goal. The investigation begins with one of the impacted goals as the first “effect” of a cause-and-effect relationship. Additional causes are added by asking “why” questions. Capturing all relevant cause-and-effect relationships offers the highest number of potential solutions, which can act on any cause to reduce the risk of a problem recurring.

The employee fatalities resulted from exposure to high levels of hydrogen sulfide. The high levels of hydrogen sulfide resulted from the leak of sewage with high levels of sulfur. While problems with ventilation can result in high gas levels, the intake and outgoing ventilation were both found to be functioning properly and the door to the building was left open. The sewage was contained in the pipes (as it was a waste water treatment plant) and leaked from a failed valve. However, the investigation found that the sulfur levels were higher than expected and set out to find the cause of the elevated sulfur. Industrial users of the waste water system have been interviewed and did not indicate any sulfur-using production processes or discharges with elevated sulfur. Although the investigation continues, the source of the elevated sulfur may never be determined. The proposed solution – installing permanent detectors in the basement and other areas of risk – will mitigate the risk of potential personnel injury due to high gas levels, regardless of the cause.

The exposure to high levels of hydrogen sulfide also resulted from the employees (both mechanics) being in the basement with the elevated hydrogen sulfide levels without self-containing breathing apparatuses (SCBAs). The employees were in the basement repairing the leak and initially entered wearing SCBAs, having been warned that the area smelled “gassy”. However, for reasons that are unclear the employees did not take air quality measurements or complete initial checklists for using SCBAs. A proposed solution is to require employees to carry gas detectors (which would provide immediate feedback as to whether an additional oxygen source was required) in areas where gas could be present. The investigation found that the training provided to these and other employees regarding the use of SCBAs was adequate and no changes to the program were recommended.

These potential solutions, which would provide real-time feedback as to gas exposure hazards, would increase the likelihood that employees would wear SCBAs or other personal protective equipment, thus reducing the risk of exposure to high levels of gas, when present. To view the outline, initial Cause Map and proposed solutions, please click on download PDF above. Or, click here to learn more.

Root Cause

Man Paralyzed By Medical Error Hopes to Fix System for Others

By ThinkReliability Staff

The team investigating medical errors that happened at a Washington hospital has an unusual member: the man who was paralyzed as a result of these medical mistakes.  Not only does he want to know what happened, he hopes that his design experience (he formerly designed for Microsoft) can be translated to healthcare to “make hospitals everywhere safer for patients.”

While the full analysis of his particular case is not yet complete, the information that is known can be captured in a Cause Map, a visual form of root cause analysis.  The process begins by capturing the what, when and where of the incident, as well as the impact to the organization’s goals.  In this case, treatment was at a Washington hospital’s emergency room for a back injury obtained May 11, 2013. The interaction with the facility involved a missed diagnosis, poor communication, and eventually resulted in paralysis to the patient.  In this case the patient safety goal is impacted due to the paralysis of the patient.  The financial goal is impacted due to a $20 million settlement against the hospital. (Part of the settlement included the hospital working with the patient on the analysis.)  The labor/ time goal is impacted due to the months of rehabilitation required after the injury.

The second step of the process, the analysis, develops cause-and-effect relationships beginning with one of the impacted goals.  In this case, the patient safety goal was impacted due to the paralysis of a patient. The paralysis resulted from a spinal cord injury, which was caused by a significant back fracture.  There are times when more than one cause is required to produce an effect.  The significant back fracture was caused by an untreated hairline fracture on the back AND the patient being moved inappropriately.  If either of these things had not occurred, the outcome may have been very different.  The analysis continues by asking ‘why’ questions of both the causes.

The patient had a hairline fracture on his back that resulted from a fall out of bed (due to “luxurious sheets”) and a condition (ankylosing spondylitis), which makes the spine brittle and more prone to fractures.  Beginning on May 12, 2013, the patient visited the hospital’s emergency room four times in two weeks. The hairline fracture was untreated because it was not diagnosed during any of those visits, despite the patient’s insistence that, because of his condition, he was concerned about the possibility of a back fracture.  While the hairline fracture is visible on the imaging scan, according to the patient’s lawyers, it was missed because the scan was focused on the abdomen.  The notes from the first doctor’s visit were not documented until 5 days after the encounter.

On May 25, 2013, two weeks after the initial injury, the patient returned to the emergency room for severe pain and an MRI was ordered.  While being positioned in the MRI, the patient lost neurological function from about the neck down.  He was transferred to another hospital, who found it likely that the paralysis had resulted from being positioned in the MRI.

The patient was inappropriately moved, given his injury (which at this point was still undiagnosed and untreated).  The patient was being positioned for an MRI ordered to find the cause of his back pain (probably due to the untreated hairline fracture of his back).  Either the previous imaging scan was not reviewed by the doctors at this visit, or the scan was unavailable.  Had the imaging scan indicating a hairline fracture been available, the MRI may not have been necessary. If the patient was given an MRI anyway, the staff would have been aware of the fracture and would likely have moved the patient more carefully.

However, the staff was not aware of the injury.  The patient’s repeated concern over having a back fracture was unheeded during all his visits, and the staff appeared to be unaware of the medical information from the three previous visits, likely due to ineffective communication between providers (a common issue in medical errors).

As more detail regarding the case is discovered, it can be added to the Cause Map.  Once all the information related to the case is captured, solutions that would reduce the risk of the problem recurring can be developed and those that are most effective can be implemented.  The patient will be a part of this entire process.

To view the initial Cause Map of this issue, click on “Download PDF” above. Or click here to read more.

Root Cause

The end of the Guinea worm?

By Kim Smiley 

Guinea worm disease is poised to become the second human disease to be eradicated (after smallpox). In the 1980s, there were millions of cases of Guinea worm disease each year and the number has plummeted to only two confirmed cases so far in 2016, both believed to have been contained before the disease had a chance to spread. This accomplishment is particularly impressive considering that there is no cure or vaccine for Guinea worm disease. In fact, the most effective “cure” for the disease used today is the same one that has been used for thousands of years – to wrap the worm around a stick and slowly pull it out. (Read our previous blog “Working to Eradicate a Painful Parasite” to learn more about the problems caused by Guinea worm disease.)

So how has this horrible disease been fought so effectively?  We need to understand how the disease spreads to understand how the cycle was broken.  (Click on “Download PDF” to see a Process Map of the Guinea worm lifecycle.) The Guinea worm is a human parasite that spreads from host to host through the water supply.  The (rather disgusting) lifecycle begins with Guinea worm embryos squirming and wiggling in a freshwater pond, hoping to attract the attention of unsuspecting water fleas.  Once consumed by a water flea, the Guinea worm embryos drill out of the water flea’s digestive tract, move around the body cavity and feed on the water flea.  When a human then drinks the water containing the infected water flea, the lifecycle continues.

The water flea is dissolved by digestive juices in the human’s stomach and the Guinea worm embryo drills out of the intestines and crawls into the abdominal blood vessels, remaining in the body for several months until it reaches sexual maturity.  If the human is unlucky enough to be hosting both a male and female Guinea worm, the parasites will mate.  The male then die and millions of embryos grow in the female.  The female worm will usually make her way to the host’s leg or foot, pierce the skin and release an irritant that creates a painful blister.

Human hosts will often put the fiery blister into water to soothe the pain.  The female worm senses the water and releases thousands of embryos from her mouth.  She doesn’t release all her embryos at once, but will continue to release embryos when she senses water over a period of time.  If the embryos happen to land in a pond with water fleas, the whole painful process can start anew.

Once the lifecycle of the Guinea worm was understood, communities and aid organizations were able to use the information to disrupt the lifecycle and prevent the Guinea worm from spreading.  Some aid organizations helped provide access to clean drinking water or straws with filters that removed water fleas and prevented Guinea worm infections. In other places, the Guinea worm larvae were killed by treating the water with larvicide. But the most effective solution has been simply keeping infected people out of the water supply.  Once most people understood the consequence of putting Guinea worm blisters in drinking water they simply (if painfully) avoided the ponds used for drinking water, but some communities also implemented new laws and fines or posted guards at water holds to ensure that no infected individuals went into the water. These methods have proven very effective and the Guinea worm is now one of the most endangered animals on the planet.

The key to fighting the Guinea worm was education. The most effective solutions were simple and low-tech. No modern vaccine or modern medical knowledge was needed to prevent Guinea worm infections, just knowledge about how the disease spread. Guinea worms have been infecting people for millions of years (they have even been seen in Egyptian mummies), and the lifecycle could have been broken long ago if it had been better understood.

Root Cause

Programming Errors Can Impact Patient Safety

By ThinkReliability Staff

Clinical decision support systems (CDSS) aim to improve health care quality, safety and effectiveness by providing alerts to providers based on criteria (such as identifying drug interactions). However, a malfunctioning CDSS can actually reduce patient safety when physicians rely on these alerts.

According to “Analysis of clinical decision support system malfunctions: a case series and survey” by Adam Wright, et al, published March 28, 2016, “CDSS malfunctions are widespread and often persist for long periods. The failure of alerts to fire is particularly difficult to detect. A range of causes, including changes in codes and fields, software upgrades, inadvertent disabling or editing of rules, and malfunctions of external systems commonly contribute to CDSS malfunctions, and current approaches for preventing and detecting such malfunctions are inadequate.”

A survey that was part of the analysis found that 93% of Chief Medical Information Officers who responded had experienced at least one CDSS malfunction and two-thirds experienced at least an annual CDSS malfunction. Four such malfunctions were found within the CDSS system at Brigham and Women’s Hospital and were presented as case studies. We will examine one of these case studies within a Cause Map, or visual form of root cause analysis.

The first step in any root cause analysis method is to identify the problem. The CDSS malfunction in this case study involved a stopped alert for annual thyroid testing in patients prescribed amiodarone. When the issue was noticed and resolved in February 2013, it was determined that the alert had been stopped since November 2009, when the internal code for the drug amiodarone was changed.

An important step in describing the problem is to determine the organizational goals that were impacted. In this case, patient safety is impacted because of the potential for untreated thyroid issues and patient services are impacted because of the potential of missed testing.

The second step is to perform the analysis by developing the cause-and-effect relationships that led to the impacted goals. In this case, patient safety is impacted because of the potential for untreated thyroid issues. Patients may have untreated thyroid issues if they are taking amiodarone to treat arrhythmia. Amiodarone has a known side effect of thyroid issues. If staff is unaware of a patient’s thyroid issues, that patient won’t be treated. Staff would be unaware of thyroid issues in a patient if testing is not performed.

The goal of clinical decision support systems is to identify interventions based on patient needs – in this case, the hospital created an alert to suggest thyroid testing for patients who had been amiodarone and had not had a thyroid test in at least a year. Based on typical alert values from the years prior to 2009, the analysis determined that more than 9,000 alerts suggesting thyroid testing were missed.

Thyroid tests were missed because the CDSS did not identify the need for thyroid testing, and because physicians may rely on the CDSS to recommend a test like this one. The alert was originally set up to identify patients taking amiodarone (then code 40) with a start date at least 365 days ago, and no thyroid test values from within the last 365 days. In November 2009, the internal code for amiodarone changed to 7099, but the logic for the alert was not changed. (The reason for the code change is unclear.) As patient records were updated with the new code for amiodarone, the alert failed to identify them for thyroid testing.

The issue was identified during a demonstration of this particular feature of the CDSS and fixed the next day. While the details aren’t known, this issue identifies an ineffective change management program. When changes are made within systems, change management processes are necessary to ensure there are no unintended consequences. While updating the amiodarone code in the alert logic fixed this particular problem, a robust change management program is necessary to ensure that there are no other unintended consequences that could affect patient safety.

To view a visual root cause analysis of this example, please click on “Download PDF” above.

Root Cause

Death from Patient-Controlled Morphine Overdose

By ThinkReliability Staff

Could improving the reliability of the supply chain improve patient safety?

The unexpected death of a patient at a medical facility should always be investigated to determine if there are any lessons learned that could increase safety at that facility. A thorough analysis is important to determine all the lessons that can be learned. For example, the investigation into a case where a patient death was caused by a morphine overdose delivered by a patient-controlled analgesia (PCA) found that increasing the reliability of the supply chain, as well as other improvements, could increase patient safety.

The information related to this patient death was presented as a morbidity and mortality case study by the Agency for Healthcare Research and Quality. The impacts to goals, analysis, and lessons learned from the case study can be captured in a Cause Map, a visual form of root cause analysis that develops the cause-and-effect relationships in sufficient detail to be able to find solutions that will reduce the risk of similar incidents recurring.

Problem-solving methodologies such as Cause Mapping begin with defining the problem. In the Cause Mapping method, the what, when and where of the problem is captured, as well as the impact to the goals, which defines the problem. In this case, the patient safety goal is impacted due to the death of a patient. Because the death of a patient under medical care can cause healthcare providers to be second victims, this is an impact to the employee safety goal. A death associated with a medication error is a “Never Event“, which is an impact to the compliance goal. The morphine overdose is an impact to the patient services goal. In this case, the desired medication concentration (1 mg/mL morphine) was not available, which can be considered an impact to the property goal. Lastly, the response and investigation are an impact to the labor/time goal.

The analysis begins with one impacted goal and developing cause-and-effect relationships. One way to do this is by asking “Why” questions, but it’s also important to ensure that the cause listed is sufficient to have resulted in the effect. If it’s not, another cause is required, and will be joined with an “AND”. In this case, the patient death resulted from a morphine overdose AND a delayed response to the patient overdose. (If the response had come earlier, the patient might have survived.) It’s important to validate causes with evidence where possible. For example, the morphine overdose is a known cause because the autopsy found a toxic concentration of morphine. Each cause in the Cause Map then becomes an effect for which causes are captured until the Cause Map is developed to the point where effective solutions can be found.

The available information suggests that the patient was not monitored by any equipment, and that signs of deep sedation, which preceded respiratory depression, were missed during nurse checks. Related suggestions for promoting the safe use of PCA include the use of monitoring technology, such as capnography and oximetry, and assessing and recording vital signs, including depth of respiration, pain and sedation.

The patient in this case was given PCA morphine. However, too much morphine was administered. The pump settings were based on the concentration of morphine typically used (1 mg/mL).   However, that concentration was not available, so a much higher concentration (5 mg/mL) was used instead. The settings on the pump were entered incorrectly for the concentration of morphine used, likely because of confirmation bias (effectively assuming that things are the way they always are – that the morphine on the shelf will be the one that’s usually there). There was no effective double check of the order, medication and pump settings.

Related suggestions for promoting the safe use of PCA include the use of “smart” pumps, which suspend infusion when physiological parameters are breached, the use of barcoding technology for medication administration (which would have flagged the use of a different concentration), performing an independent double check, storing only one concentration of medications in a dispensing cabinet (requiring other concentrations to be specially ordered from the pharmacy), standardizing and limiting concentrations used for PCA, and yes, improving the supply chain so that it’s more likely that the lower concentration of morphine will be available. Any of these suggestions would improve patient safety; implementation of more than one solution may be required to reach an acceptable level of risk. Imagine just improving the supply chain so that there would be very few (if any) circumstances where the 1 mg/mL concentration of morphine is unavailable. Clearly the risk of using the wrong concentration would be lessened (though not zero), which would reduce the potential for patient harm.

To view a one-page downloadable PDF with the outline, Cause Map, and action items, click “Download PDF” above. Click here to read the case study.

Root Cause

Patients and Insurers Pay Big for Discarded Cancer Drugs

By ThinkReliability Staff

A recent study has found that the size of vials used for cancer drugs directly results in waste, and a significant portion of the high – and steadily increasing – cost of cancer drugs.  With most cancer medications available in only one or two sizes, usually designed to provide an amount of medication for the largest patients, many times medication is left over in each vial.

The researchers estimate that about $2.8 billion is spent by Medicare and other insurers reimbursing for medication that is discarded.

This cost – paying for medication that is literally thrown out in most cases – can be considered an impact to the property goal.  As the cost increases for drugs, it’s not only Medicare and other insurers that are impacted, but patients, many of whom pay a fixed percentage of their drug costs.  This impacts the patient services goal.  The disposal of these drugs has a potential environmental impact, impacting the environmental goal.  The impacts to the goals as a result of an issue, as well as the what, when and where of that issue, are captured in a problem outline, which is the first step of the Cause Mapping process, which develops a visual diagram of the cause-and-effect relationships (a type of root cause analysis).

The second step of the process is to begin with an impacted goal and develop the cause-and-effect relationships.  This can be done by asking “why” questions and ensuring that all the causes necessary to result in an effect are included.  In some cases, more than one cause is required to produce an effect.  In these cases, the causes are both connected to the effect and joined with an “AND”.

In this case, beginning with the property goal, we can ask “Why do Medicare and other insurers have increased costs?”  This is due to the increased cost of cancer drugs, which results from significant amount of medications being thrown away.  We can add evidence to the causes to support their inclusion in the Cause Map or provide additional information.  For example, the study found that the earnings on disposed medication made up 30% of the overall sales for one cancer medication.

A significant amount of medication is being thrown away because there is medication left over in each vial used to deliver the medication, and the leftover medication in the vials is thrown away.  Both these causes are required to result in the medication waste.  Leftover medication is thrown away because it can only be used in rare circumstances (within six hours at a specialized pharmacy).  There is leftover medication in the vials because the vials hold too much medication for many patients.  (Most medication is administered based on patient weight.)  The vials hold too much medication because many medications are provided in only one or two vial sizes.  This is true of 18 of the top 20 cancer drugs.  Providing alternate vial size is not required by regulators, whose concern is limited to patient safety or potential medical errors.  Specifically, Congress has not authorized the US Food and Drug Administration (FDA) to consider cost. Drug manufacturers select vial size based on “marketing concerns” or, effectively, profit.  The study found that providing more vial sizes for one medication would reduce waste by 84% but would also reduce sales by $261 million a year.

Several of the vials for cancer medications are sized based on a larger (6’6″, 250 lb.) patient.  According to one drug manufacturer, this is done by design, resulting from working with the FDA for a vial that would provide enough medication “for a patient of almost any size.”  At least one drug manufacturer has suggested that the full vial be administered regardless of patient size, but one of the study’s co-authors says that extra medication does nothing to help patients, so it would still be wasted.

Instead, the researchers propose that the government either mandate the drugs be distributed in multiple vial sizes that would minimize waste, or that the government is refunded for wasted quantities.  They point out that alternate vial sizes are provided in Europe, “where regulators are clearly paying attention to this issue”, says Dr. Leonard Saltz, a co-author of the study.

To view the initial outline, Cause Map and proposed solutions, please click on “Download PDF” above.  Click here to view the study and drug waste calculator.

Root Cause

Patient death after ambulance delayed due to “extreme demand”

By ThinkReliability Staff

An inquest into the death of a young patient in London after a significant delay in the arrival of an ambulance released some disturbing details into the emergency process. We can perform a root cause analysis of the issues that led to the delay, and death, by capturing cause-and-effect relationships in a visual Cause Map.   As with many complex incidents, it will be helpful to capture the chronology of an event within a timeline. This timeline should not be confused with an analysis, but can be useful in organizing information related to the incident.

In this case, the patient, who had type 1 diabetes and had been feeling sick for more than a day, asked a friend to call an ambulance at about 5:00 pm on September 7, 2015. The friend dialed 111, which is the non-emergency medical helpline from the National Health Service. The initial call handler determined that the situation was not an emergency, but marked it for a 20-minute follow-up with a clinician. A clinical supervisor called back and spoke to the patient at 5:42 pm. She determined that it was an emergency that required an ambulance within 30 minutes. However, because it was known that the ambulance service was delayed, she asked the patient if she could get a friend to drive her to the hospital. The patient said she preferred an ambulance.

At this point it appears there was no contact until 10:15 pm, at which point a call-back was made to check on the patient’s ongoing symptoms. The friend at this time found the patient unconscious, having suffered cardiac arrest, and called 999, the emergency call system, at 10:23 pm. The ambulance arrived at 10:30 pm and took the patient to a hospital, where she died 5 days later.

At the inquest, the coroner testified that if the patient “had received definitive hospital care before she suffered a cardiac arrest in the evening of September 7, the likelihood is she would have survived.” Thus, from the perspective of the National Health Service, the patient safety goal is impacted because a death occurred that was believed to be at least partially due to an ambulance delay. Additional goals impacted are the patient services goal because of the delayed emergency treatment (the stated goal for the patient’s medical condition was 30 minutes, whereas the ambulance arrived nearly 4 hours after that goal). The schedule and operations goal is also impacted due to the insufficient capacity of both ambulances and the call system.

The Cause Mapping begins with an impacted goal and develops cause-and-effect relationships by asking “why” questions. The patient death was due to diabetic ketoacidosis, a severe complication of type 1 diabetes that may have resulted from an additional illness or underlying condition. As stated by the coroner, the delayed emergency treatment also resulted in the patient’s death. The ambulance that would take the patient to the hospital was delayed because the demand exceeded capacity. Demand was “extreme” (there were 200 other patients waiting for ambulances in London at the same time). The lack of capacity resulted from low operational resourcing, though no other information was available about what caused this. (This is a question that should be addressed by the service’s internal investigation.)

The patient was not driven to the hospital, which would potentially have gotten her treated faster and maybe even saved her life. The patient requested an ambulance and the potentially significant delay time was not discussed with the friend who had originally called. At the time of the first call-back, the estimated arrival time of an ambulance was not known. (By the time of the second call-back, it was too late.)

The second call-back was also delayed. Presumably this call was to update the patient’s symptoms as necessary and reclassify the call (to be more or less urgent) as appropriate. However, the demand exceeded supply for the call center as well as for ambulances. The call center received 300 calls during the hour of the initial call regarding this patient, which resulted in the service operations being upgraded to “purple-enhanced”. (This is the third-most serious category, the most serious being “black” or “catastrophic”.)   The change in operations meant that personnel normally assigned to call-backs were instead assigned to take initial emergency calls. Additionally, it’s likely the same “operational resourcing” issues that affected ambulance availability also impacted the call center.

Additional details of the causes related to the insufficient capacity of emergency medical services are required to come up with effective solutions. The ambulance service has completed its own internal investigation, which was presented to the family of the patient. The patient’s brother says, “I hope these lessons will be learnt and this case will not happen again” and the family says they will continue to raise awareness of the dangers of diabetes.

To view the initial analysis of this issue, including the timeline, click on “Download PDF” above. Or click here to read more.

more.

Root Cause

Filter to protect against blood clots implicated in deaths

By ThinkReliability Staff

An NBC investigation released September 3, 2015 raised concerns about the use of a specific retrievable inferior vena cava (IVC) filter, known as the Recovery. The issues behind the concerns are complex and some appear to impact more than one type of filter. A visual root cause analysis, known as a Cause Map, can clearly lay out all the causes associated with an issue, ensuring that all potential solutions can be considered.

The first step in a problem-solving process is to define the problem. Here the specific issue being investigated is the deaths and serious injuries associated with the failure of the Recovery filter. The Recovery was introduced in 2003 and was first implicated in a death in 2004. The Recovery aims to prevent blood clots from reaching the heart or lungs in patients who are unable to tolerate blood thinners and have been placed in a variety of healthcare facilities. An important difference between the expected and actual use of these filters is that studies have found that most are not removed in a timely manner.

The use of Recover filters has impacted the patient safety goal because at least 27 deaths have been related to its use. There are at least 117 lawsuits associated with these problems, impacting the compliance goal. Hundreds of additional non-fatal problems have also been reported, impacting the patient services goal. The operations goal is impacted by the filters not being removed. Lastly, the inadequate holding power of the arms of the filter (meant to hold it in place) can be considered an impact to the property goal.

The analysis begins with one of the impacted goals. Here, the primary concern is the impact to patient safety. The patient deaths result from the filter being pushed into a patient’s heart or lungs. This results from filter migration. In order for the filter to migrate, the force on the filter exceeds the holding power of the arms of the filter. Holding power can be reduced due to improper placement, filter fracture/ failure due to fatigue (a National Institutes of Health, or NIH, study found that 40% of filters fracture within 5.5 years) or design issues. Although these issues can impact any type of blood filter, the Recovery was found to have the lowest resistance to migration of filters examined. Force on the filter can be increased due to exertions, such as bowel movements or respiration, and/or large blood clots. Because these patients are known to have risk factors for blood clotting, this is a particular concern.

The time a filter is in place increases the risk of filter migration. The longer a filter is in place, the more likely it is to be impacted by the concerns discussed above. The use of these filters has been increasing. According to the US Food and Drug Administration (FDA), only 2,000 of these type of filters were installed in 1979; now about 250,000 are installed every year in the US. The devices used are approved by the FDA, though in the case of the Recovery, there are questions about the legitimacy of the review process; a “signer” on the application says her signature was forged. However, studies have found that evidence-based guidelines for implantation of these filters is not being followed, potentially leading to inappropriate use.
These filters (though designed to be temporary) are not being removed. A retrospective review of filter implantations published in the American College of Surgeons Surgery News found that only 1.6% of retrievable filters were removed during the 3-year study period. In 4.2% of cases each, filters were unable to be removed due to technical difficulties or thrombus within the filter. In most cases, though, it appears there was no attempt to remove the filter, believed to be due to a lack of physician oversight.

According to a FDA safety communication, physicians that implant a retrievable filter must remove it as soon as “feasible and clinically indicated”. This is true for all retrievable IVC filters, not just the Recovery. However, implanted Recovery filters are a particular concern – they are more prone to problems and haven’t been sold since 2005. If you believe you have an implanted filter, talk to your doctor about next steps.

To view a downloadable PDF with the causes of the filter issues, click on “Download PDF above. To learn more:

NBC Investigation

NIH Study

ACS Surgery Study

FDA Safety Communication

Root Cause

Medical Device Vulnerable to Hacking

By Kim Smiley

The Food and Drug Administration (FDA) made headlines when they issued a warning that a computerized pump used for infusion therapy, Hospira Symbiq Infusion System, has cybersecurity vulnerabilities. Hacking is scary enough when talking about a laptop, but the stakes are much higher if someone had the ability to alter the dosage of critical medication.

A Cause Map, a visual format for performing root cause analysis, can be used to analyze this issue.  The first step in the Cause Mapping process is to fill in an Outline with the basic background information, including how the issue impacts the overall goals.  Defining the impacts to the goals helps define the scope of an issue.  Once the Outline is completed, one of the impacted goals is used as the starting point to building the Cause Map itself.  For example, the potential risk of serious injury or death is an impact to the patient safety goal and would be the first cause box on the Cause Map.  The rest of the Cause Map is built by asking “why” questions and documenting the answers in cause boxes to intuitively lay out the cause-and-effect relationships.

So why is there potential for injury or death with the use of the Hospira Symbiq Infusion System?  It is possible for a patient to receive the incorrect dosage of medication because the system could be accessed remotely by an unauthorized user who could theoretically change the settings.  There have been no reported cases where this infusion pump system has been hacked, but both Hospira and an independent researcher have confirmed that it is possible.

This system is vulnerable to hacking because it is designed to communicate with hospital networks and the design has a software bug that could allow it to be accessed remotely via a hospital’s network.  The infusion system was designed to interface with hospital networks to help reduce medication dosage errors because the dosage information wouldn’t need to be entered multiple times.

The final step in the Cause Mapping process is to develop solutions to help reduce the risk of similar errors in the future.  In this specific example, the FDA has strongly encouraged healthcare facilities to transition to alternative infusion systems as soon as possible.  Hospira discontinued this specific design of infusion system in 2013, reportedly due to unrelated issues, but it is still available for sale by third-party companies and used by many healthcare facilities. There will not be a software patch provided or any other means to make the Hospira Symbiq Infusion System less vulnerable to hacking so the only option going forward will be to switch to a different infusion system. During the time required to transition to new equipment, the FDA has provided specific steps that can be taken to reduce the risk of unauthorized system access that can be read here.

Root Cause

Attack on Hospital Staff Indicates Systematic Safety Issues

By ThinkReliability Staff

On July 13, 2015, a security counselor at a Minnesota psychiatric hospital was attacked and seriously injured by a patient. Even one injury to an employee is highly undesirable and should initiate a root cause analysis in order to reduce the risk of these types of events recurring. In the case of this hospital, this employee injury is one in a long line. In 2014, 101 staff injuries were reported at the hospital. From January to June of 2015, 68 staff injuries were reported. Clearly this is an extensive – and growing – problem at the site. According to Jennifer Munt, a spokeswoman for a union which represents 790 workers, “Workers at the security hospital feel like getting hurt has become part of the job description.”

An incident like this one can be captured within a Cause Map, or visual root cause analysis. The first step in the method is to define the problem in a problem outline. The problem outline captures the what, when and where of an incident, as well as the impact to the goals. Another important piece of information that is included is the frequency of similar events. Capturing the frequency helps provide the scope of the problem.

Understanding the details for one specific incident will likely reveal systematic issues that are impacting other similar incidents. That is definitely true in this case. Beginning with an impacted goal and asking “why” questions results in developing cause-and-effect relationships. Each cause that is determined to have contributed to an issue can lead to a possible solution. Each cause added to the Cause Map provides additional possible solutions, which, when implemented, can reduce the risk of future similar incidents.

In this case, we begin with the employee safety goal. An employee was seriously injured because of an assault by a patient at the hospital. The assault resulted from two causes, which were both required and so are joined with an “AND”. First, violent patients are housed at the facility. There were no other facilities available for the patient and the hospital is required to admit mentally ill county jail inmates because of a Minnesota law (known as the “48 hour rule” because of the time limit on admissions).

Second, clearly there was inadequate control of the patient. According to the union, limitations on the use of restraints, which are only allowed when a patient poses an “imminent risk”, mean that staff members feel that they cannot restrain patients until after they’ve been threatened – or assaulted. The union also says that inadequate staffing is leading to the increase in assaults. Specifically, union officials say at least 54 more staff members are required for the facility to be fully staffed.

The issues have caught the attention of state safety regulators and government. Multiple solutions have already been incorporated, including use of cameras, a separate admissions unit for new patients and protective equipment for staff. Additional staff is also being hired. The patient involved in the attack is isolated and under constant supervision. There’s no word yet on whether the use of mobile restraints, as requested by the union, will be allowed.

Says Jaime Tincher, Chief of Staff for Minnesota Governor Mark Dayton, “These are important first steps; however we will continue to assess what additional resources are needed to improve safety and treatment at this facility.” No less would be expected for ongoing issues that have such a significant impact on employee safety.