Assessing the safety of a nurse call system using STPA G.R. Kleve, Risk manager University Medical Centre Groningen, Netherlands

Prologue

How safe is our nurse call system?

STPA - preparations 1. Define at system level system, scope/boundaries, accident (significant loss) and hazards, safety constraints/prerequisites, major components, controllers & responsibilities. 2. Depict control structure describe control actions

System, scope boundaries The nurse call system is the system the patient uses to get nursing care when perceiving an acute need Out of scope: connectable medical devices

Accidents & Hazards Accidents Severe harm or death resulting from not getting adequate care in time. Patient does not adequately use the NCS NCS does not succeed in delivering the patients signal to the nurse The nurse does not adequately react on the signal of the NCS Hazards

Safety constraints/prerequisites The patient must always monitor his condition and needs adequately operate the NCS The NCS must always establish contact between patient and nurse The nurse must always give timely and adequate care when called monitor the functioning of the NCS

Components and responsibilities Patient Perform self monitoring Call nurse if needed NCS Establish contact between patient and nurse Nurse Respond to call Give care Monitor the functioning of NCS

Control structure & control actions Patient Nursing care Send signal to beeper of nurse Arrive at bedside patient Nurse Press red button handset Instruct patient about use of handset Instruct nurse about use of nurse call system Reset alarm signal Hand set, Wall set, Central computer Radio transmitter Provide care NCS Give a hand set Check whether the red light lights up Get the right beeper

STPA – step 1 Analysis of control actions Identify control actions Identify under which circumstances they will turn out to be unsafe, when not provided, provided, at the wrong time / in the wrong order stopped to soon / provided to long Derive from these situations new safety constraints

Control actions Instruct the patient about the use of the NCS Give the patient a properly functioning hand set; Press the red button of the hand set; Check whether the red light lights up after pressing the button; Instruct the nurse about the use of the NCS; Give the nurse the beeper of the NCS; Send the signal of the hand set to the nurses’ beeper; Go to the patient indicated on the screen of the beeper; Reset the NCS in the patients’ room. Provide care

Unsafe control actions Not providing CA causes hazard Providing CA causes hazard Wrong timing/order of CA causes hazard CA stopped too soon/applied too long Control action: Check whether the red light lights up after pressing the button Unsafe when: The patient does not check the red light of the hand set when the NCS does not transmit the signal of the hand set to the beeper of the nurse Safety constraint: The patient always must check whether or not his call has reached the nurse

Unsafe control actions Not providing CA causes hazard Providing CA causes hazard Wrong timing/order of CA causes hazard CA stopped too soon/applied too long Control action: Check whether the red light lights up after pressing Unsafe when: The patient checks whether the red indicator lights up and sees it does although the signal has not reached the nurse. Safety constraint: The patient always must check whether or not his call has reached the nurse

Unsafe control actions Not providing CA causes hazard Providing CA causes hazard Wrong timing/order of CA causes hazard CA stopped too soon/applied too long Control action: Press the red button of the hand set; Unsafe when: The patient uses the NCS when his need has become very urgent Safety constraint: Instruct the patient to use the NCS in time

Unsafe control actions Not providing CA causes hazard Providing CA causes hazard Wrong timing/order of CA causes hazard CA stopped too soon/applied too long Control action: Go to the patient indicated on the screen of the beeper Unsafe when: While going to the patient the nurse stops when someone else asks for her attention. Safety constraint: The nurse must always be able to give the right priority and arrange for assistance in case of competing priorities

STPA - step 2 Analysis of causes of unsafe control actions Analyze causes of unsafe control actions control actions, feedback process model used by controller Refine or add safety constraints 3. Formulate means to apply/enforce the safety constraints

Control structure & control actions Potential Control Flaws Control action: Go to the pr

Looking for causes 2 3 1 1. Control Action not executed 2. Unsafe control provided 3. Process model flaws 2 3 1

Causes of UCA UCA nurse does not react on call related to urgent need Examples: Code on beeper illegible or wrong Right beeper, incorrectly programmed Beeper malfunctioning during shift Beeper gets lost during shift, without being noticed Nurse expects no urgency (last impression, handover) Nurse occupied with another task Nurse is halted while answering call

Results One Table/report with: Description Goals Accidents Hazards Safety Constraints Design Requirements Process model Control Actions Unsafe Control Actions Causal Factors of UCA system level

Number of safety constraints

Safety constraints by theme Selfmonitoring and use of NCS H-1 Knowing whether call is answered Functioning of the whole NCS Enabling adequate respons time H-2 H-3 Knowing kind of need and acuteness

How safe is our nurse call system? 8 29

Getting findings accepted Highlighted control actions aimed at Restoring the validity of assumptions underlying the safety design Restoring the functionality of control feedback loop Evident vital safety issue while referring to the table with results

Highlights Define care policy for incapacitated patients (e.g. delirious or confused) Uptime must apply to the whole system The patient must know whether his call has reached the nurse The nurse must know the kind and urgency of the patients’ needs Align response time and redirection settings of the NCS with physiological limits

Lessons learned Simple topic, 37 unique safety constraints Broad array of findings eXSTAMPP really helpful, one table Getting results accepted STPA supported the analysis in 5 ways Limiting to things that really matter (accidents); Top down reasoning (instead of free brainstorming); Structured search for unsafe control actions Predefined flaws of control feedback loops Check for fit UCA – hazard

How about ….