|
 
 |
| COMMENTARY |
|
| Year : 2017 | Volume
: 3
| Issue : 3 | Page : 115-119 |
|
Patient safety implications with the rapid adoption of IT-based health technologies
James P Keller
Vice President, International Market Development, ECRI Institute, PA, USA
| Date of Web Publication | 7-Dec-2017 |
Correspondence Address:
James P Keller
ECRI Institute, 5200 Butler Pike, Plymouth Meeting, PA 19462
USA
 Source of Support: None, Conflict of Interest: None  | Check |
DOI: 10.4103/digm.digm_20_17
How to cite this article:
Keller JP. Patient safety implications with the rapid adoption of IT-based health technologies. Digit Med 2017;3:115-9 |
This article discusses some of the many safety challenges associated with IT-based health technologies. It provides examples of strategies and associated resources and tools that many health care organizations now use to help assess and mitigate their risks.
Hospitals have rapidly begun to adopt IT-based health technologies. Physiologic monitoring systems have touch screen displays with nested menus, sophisticated alarms systems, and even their own computer servers. They are often networked or electronically connected to other devices and systems. The more advanced applications involve direct communication of monitoring data with patients' electronic health records (EHRs). Physiologic monitor alarm data can also be transmitted to a nurse's smartphone to warn of a patient's deteriorating condition.
Infusion pumps can also be operated from touch screen displays. Newer models wirelessly link with pharmacy information systems for transmission of drug library data, dose limits, and even patient-specific medication orders. Dose limits warn caregivers if an unsafe medication dose has been entered for a patient.
IT-based health technologies have also migrated into patient homes and other nonhospital settings. In the United States, government incentives to reduce patient readmission rates have driven many hospitals to monitor recently discharged patients in their homes. The home monitoring is used to catch and address the signs of a patient's worsening condition before it becomes serious enough to require readmission. Many patients now wear smart devices that record their pulse rates, sleep patterns, and blood pressure. Moreover, patients begin to ask their doctors and hospitals to use this data to support their care.
| New Benefits and Risks With It-Based Health Technologies | |  |
In general, new IT-based technologies come with features and benefits that can significantly improve the quality and efficiency of patient care. For example, networked vital signs monitors can eliminate the need for nursing staff to manually enter patients' vital signs data into their medical records. It can often take several hours for manually recorded vital signs data to be entered into the medical record and this process is prone to error. Alternatively, data from networked vital signs monitors become immediately available in the electronic medical record. This can avoid delays in care, while doctors wait to see vital signs data in patients' electronic charts. It can also avoid inappropriate treatment if doctors make care decisions before vital signs data show up in the charts. The automatic transfer of data also allows nurses to focus more of their time on direct patient care rather than documentation.[1],[2]
However, as health technologies become more IT-based, they become more complex. This complexity provides helpful new features and functions like those described above. Unfortunately, increased complexity often brings on new risks. In fact, six of the hazards on ECRI Institute's 2017 list of Top ten health technology hazards are associated with IT-based technologies.[3] Similarly, six of the ten hazards on ECRI Institute's 2016 list are associated with IT-based technologies.[4] ECRI Institute is a nonprofit health services research organization that publishes a wide variety of research and recommendations on health technologies. It is also a US government-designated patient safety organization, which maintains problem reporting data from hundreds of hospitals. ECRI's top ten list is based, in part, on analyses from this data. ECRI has published the list for each of the last 10 years to warn hospitals about the potential dangers associated with the use of medical devices and systems. ECRI Institute's goal for the annual hazard list is to provide information to help hospitals prioritize their technology-related patient safety efforts and enact solutions to prevent or avoid these serious risks.
ECRI also publishes a list of top ten patient safety concerns. This list covers a broader set of topics than ECRI's technology-focused list. Similar to the technology list, the cause for and/or the solution to over half of the topics on ECRI's 2017 list of Patient safety concerns are associated with digital health or IT-based technology factors.[5] For example, the first patient safety concern on the 2017 list is “information management in EHRs”. ECRI's coverage of this topic describes a near miss with a newborn due to a problem with system interoperability. In this case, the baby's weight and height were measured at birth and documented in the patient's EHR. The height information was electronically forwarded from the EHR to the hospital's pharmacy information system, but the weight was not. The pharmacy system instead recorded an ideal body weight for the baby, which the pharmacist used to calculate antibiotic doses for the patient. On receiving the medications, the bedside nurse thankfully rechecked the doses. They were more than twice what they should have been given the baby's actual body weight. The nurse contacted the clinician and the pharmacist and entered the correct weight into the weight field so that the appropriate doses could be calculated.[6]
One of the reasons for the complexity associated with IT-based medical technologies is that they can record and transmit a tremendous amount of information. Managing the transmission of this information can be particularly challenging. How can a near miss like the one described above be avoided? It would require meticulous testing of data transfer before system deployment. This includes cataloging every piece of patient information that clinicians intend to transmit from the EHR to the pharmacy information system. Then, test cases should be developed to transfer sample data from a non-live version of the EHR to a non-live version of the pharmacy information system. This should be done for every data item that is designated for transfer. The testing process should include verification that each piece of transmitted data was received from the EHR by the pharmacy information system. Moreover, the testing should confirm that the data were received accurately and without delay. This type of testing needs to happen for each set of devices and systems that exchange data.
As illustrated above, a lot of planning and work is required to help prevent problems with data transmission between the EHR and just one other information system (i.e., in the pharmacy). Multiply that work times all of the other systems that the EHR interfaces with and it can seem to be overwhelming. However, the consequences of not planning for this kind of safety concern can end up causing so much more work and risks causing serious patient harm and major financial loss for the institution.
| Planning for Safety | | |
When deploying new IT-based health technologies, it is important for hospitals to understand the full scope of patient safety risks that they are taking on. The preinstallation testing of the EHR pharmacy information system integration described above deals with just a few kinds of problems that can arise with IT-based health technologies (i.e., incomplete, inaccurate, or delayed transmission of data between two systems). Other examples include new cyber security risks, incorrect or inappropriate adjustment of software-based controls, and failure to maintain battery charge on smartphones being used for notification of clinical alarms.
In its 2016 list of top ten health technology hazards, ECRI noted that “misuse of USB ports can cause medical devices to malfunction.” This type of cyber security risk can happen when unauthorized USB devices or accessories are plugged into USB ports on a medical device. In one case, an anesthesiologist used an open USB port in an anesthesia machine to charge his smartphone. This caused the physiologic monitor being used with the anesthesia machine to repeatedly reboot, effectively disabling monitoring of a patient. In another incident, an anesthesia machine shut down whenever a device was plugged into its USB port. Any kind of unexpected shutdown of an anesthesia machine, especially if it is in the middle of a procedure, can put a patient at serious risk. Part of the safety planning for new IT-based health technologies needs to consider appropriate protections from unauthorized USB devices and other cyber security risks.[7]
Physiologic monitors, which are beginning to look more like computers than medical devices, are designed to warn caregivers about dangerous changes in patient conditions. If a patient's heart rate or pulse oximeter oxygen saturation drop below preset software-based limits, the device will alarm and alert nurses about the need to check on the patient. However, physiologic monitors produce a lot of alarms for many different kinds of alarm conditions and physiologic parameters. They tend to be designed to be more rather than less sensitive. As a result, many alarms are considered to be “false” and do not require clinical intervention. Many false alarms, happening over many days, for many patients, can cause the well-known problem of alarm fatigue. This can cause clinical staff to “tune out” alarms and miss serious events requiring their attention.[8],[9]
Safety planning for physiologic monitors involves a relatively new process often referred to as alarm management. This includes careful review and analysis of a hospital's alarm history to prioritize the most critical alarms and deemphasize the alarms that are not associated with actionable clinical events. The goal of this prioritization is to cut down on the total number of alarms that clinicians must deal with and reduce the risk of alarm fatigue. Another aspect of alarm management involves setting policies for when and how to set alarm limits. These limits need to consider patient type and condition. For example, ECRI Institute is aware of hospitals that maintain patient alarm settings on their monitors at factory preset defaults. These defaults are typically based on the average adult patient. If these monitors are used for both adult and pediatric patients, the default settings will be inappropriate for the pediatric patients. Similarly, an elderly cardiac care patient should have completely different alarm settings than a young post-orthopedic surgery patient who is otherwise healthy.
Smartphones can receive various types of data from medical devices. A typical use involves the transmission of physiologic monitor alarm data to phones being carried by nurses who are working throughout a patient ward. Nurses have begun to rely on these devices to warn them when their patients are getting into trouble. These phones are typically owned by the hospital and are assigned to nurses for use during their shifts. This author is aware of one hospital that has deployed as many as 1000 iPhones for this type of application. After each shift, the nurses are required to leave the phones on chargers so that they are ready for their next shift.
As most of us know with our personal use of smart phones, battery management can be a challenge. In a hospital setting where smartphones are relied on for life-saving alarm information, failure to effectively address battery management can be deadly. Therefore, safety planning related to smartphone battery performance is critical. This involves making sure that (1) a sufficient number of charging stations are available, (2) backup phones are readily available in case of battery charging failures or if phones are lost or damaged, and (3) backup phones are fully configured and ready on a full charge whenever needed. Given the earlier discussion on monitoring of patients in the home, which may often be done using smartphone technology, health-care organizations will need to address issues such as battery performance in that setting as well.
| Tools and Resources for Safety Planning | | |
There are many more safety concerns with IT-based health technologies than are described above. For example, smartphones can lose wireless signals and can even become vectors for hospital-acquired infections. It is important for health-care professionals to carefully assess the risk of deploying each new IT-based health technology. Moreover, if a risk assessment was not done before deployment, it should still be done for those devices and systems currently being used. Mitigation plans then need to be established for each identified risk. Avoiding patient or staff infections from cell phones can be minimized, for example, by placing unused cell phones in ultraviolet-based disinfecting and charging cabinets.
Regardless of technology, common tools and methods can be used to help health-care professionals with their risk assessment. A widely recognized resource to help with this is the Association for the Advancement of Medical Instrumentation (AAMI)/American National Standards Institute ANSI/International Electrotechnical Commission's (IEC) 80001 standard series for the Application of Risk Management for IT Networks Incorporating Medical Devices. It is an international voluntary standard that focuses on the high-level actions that a health-care facility should undertake when connecting medical devices to the hospital IT network. It applies to wired or wireless networks that include at least one medical device. The standard deals with the broad risk management processes that hospitals need to address (e.g., definitions, specification of responsibilities, documentation requirements). It provides a framework and methodology to help conduct risk assessment for any networked medical device and system.[10] The general principles of the standard can also be applied when planning for risk assessment of those IT-based medical technologies that are not going to be networked with other devices and systems.
One of the resources referenced in the IEC standard is the Health Information Management System Society and the National Electrical Manufacturers Association Manufacturer Disclosure Statement for Medical Device Security (MDS 2). It provides medical device manufacturers with a means for disclosing to health-care providers the security-related features of their medical devices. The MDS 2 form can be used as a tool with a health-care organization's risk assessments to evaluate the vulnerabilities and risks associated their IT-based medical devices. This information can, for example, help compare security risks between two or more device models being considered for purchase or help make judgments about the risks of taking on new devices. It answers questions about how medical devices manage passwords and user permissions, what kind of antivirus software is used, how software updates are handled, and whether or not the device can store and transmit protected health information (PHI). PHI is defined as any information in a medical record or device that can be used to identify an individual and that was created, used, or disclosed in the course of providing a health-care service, such as a diagnosis or treatment. Patient privacy (i.e., protection of PHI) is taken very seriously in most health-care institutions and in the United States, for example, health-care organizations face serious financial penalties if it is violated.[11]
A variety of tools and resources are also available to support health-care organizations with safety planning for the clinical alarms in patient monitors. The AAMI Foundation has published a Clinical Alarm Management Compendium. It provides overviews of leading health-care organizations' alarm management initiatives, recommended default alarm parameters for patient monitors, and various educational resources on alarm safety.[12] ECRI Institute published an Alarm Safety Handbook that is designed to help health-care organizations prevent alarm-related adverse events. It provides guidance on ways to scrutinize all aspects of alarms like how they are initiated, how they are communicated, and how staff are responding. Additional guidance is provided on creating practical and environment-specific solutions for the identified problems. This information is often used by hospitals to support the clinical alarm management requirements of accreditation bodies such as the Joint Commission and the Joint Commission International.[13]
| General Perspectives | | |
IT-based health technology has tremendous promise. Moving forward, almost any electronic medical device or system will have some IT-based features in its design. Moreover, the technology will be used in almost any setting, not just in hospitals. Health-care professionals, especially health-care technology managers and clinical engineers, will need to take the lead on cataloging their organizations' use of IT-based health technologies. Once that is done, a careful risk assessment should be performed.
Because so many IT-based health technologies are now being used by hospitals, the risk assessments will likely need to be prioritized. Highest priority should be assigned to life-critical and mission-critical devices and systems. These include devices and systems such as physiologic monitors, ventilators, anesthesia machines, infusions pumps, and EHRs. Because of the complexity and large scope and scale of this work, including the need to develop mitigation strategies after risk have been identified, health-care organizations will need to establish new dedicated staffing roles. Examples include specialists in device and systems integration, medical device security, and IT-based health technologies. Fortunately, many health care organizations have already begun to hire staff for these roles, which paves the way for others to learn.
Conflict of interest
None declared.
| References | | |
| 1. | |
| 2. | Lavin MA, Harper E, Barr N. Health information technology, patient safety, and professional nursing care documentation in acute care settings. Online J Issues Nurs 2015;20:6.  |
| 3. | ECRI Institute. Top 10 Health Technology Hazards for 2017. Health Devices; 04 November, 2016. |
| 4. | ECRI Institute. Top 10 Health Technology Hazards for 2016. Health Devices; 07 November, 2015. |
| 5. | ECRI Institute. Top 10 Patient Safety Concerns for Healthcare Organizations: 2017. Healthcare Risk, Quality, & Safety Guidance; 13 March, 2017. |
| 6. | ECRI Institute. Information Management in EHRs. Concern #1-Top 10 Patient Safety Concerns for Healthcare Organizations: 2017. Healthcare Risk, Quality, & Safety Guidance; 13 March, 2017. |
| 7. | ECRI Institute. Misuse of USB Ports Can Cause Medical Devices to Malfunction. Hazard #10-Top 10 Health Technology Hazards for 2016. Health Devices; 07 November, 2015. |
| 8. | Cvach M. Monitor alarm fatigue: An integrative review. Biomed InstrumTechnol 2012;46:268-77. |
| 9. | Keller J. Clinical alarm hazards: A “Top Ten” health technology safety concern. J Electrocardiol 2012;45:588-91. |
| 10. | |
| 11. | |
| 12. | |
| 13. | ECRI Institute. The Alarm Safety Handbook: Strategies, Tools, and Guidance. Health Devices; 2014. |
|
Search Pubmed for