Assessing the safety of a nurse call system using STPA

1. Assessing the safety of a nurse call system using STPA G.R. Kleve, Risk manager University Medical Centre Groningen, Netherlands

2. Prologue

3. How safe is our nurse call system?

4. STPA - preparations 1. Define at system level system, scope/boundaries, accident (significant loss) and hazards, safety constraints/prerequisites, major components, controllers & responsibilities. 2. Depict control structure describe control actions

5. System, scope boundaries The nurse call system is the system the patientusestoget nursing care whenperceivingan acute need Out of scope: connectablemedicaldevices

6. Accidents & Hazards Severe harm or death resulting from not getting adequate care in time. • Patient does not adequately use the NCS • NCS does not succeed in delivering the patients signal to the nurse • The nurse does not adequately react on the signal of the NCS Accidents Hazards

7. Safety constraints/prerequisites The patient must always • monitor his condition and needs • adequately operate the NCS The NCS must always • establish contact between patient and nurse The nurse must always • give timely and adequate care when called • monitor the functioning of the NCS

8. Components and responsibilities Patient • Perform self monitoring • Call nurse if needed NCS • Establish contact between patient and nurse Nurse • Respond to call • Give care • Monitor the functioning of NCS

9. Control structure & control actions Patient Press red button handset Instruct patient about use of handset Give a hand set Check whether the red light lights up Provide care NCS Hand set, Wall set, Central computer Radio transmitter Reset alarm signal Arrive at bedside patient Send signal to beeper of nurse Nurse Nursing care Instruct nurse about use of nurse call system Get the right beeper

10. STPA – step 1 • Analysis of control actions • Identify control actions • Identify under which circumstances they will turn out to be unsafe, when • not provided, • provided, • at the wrong time / in the wrong order • stopped to soon / provided to long • Derive from these situations new safety constraints

11. Control actions • Instruct the patient about the use of the NCS • Give the patient a properly functioning hand set; • Press the red button of the hand set; • Check whether the red light lights up after pressing the button; • Instruct the nurse about the use of the NCS; • Give the nurse the beeper of the NCS; • Send the signal of the hand set to the nurses’ beeper; • Go to the patient indicated on the screen of the beeper; • Reset the NCS in the patients’ room. • Provide care

12. Unsafe control actions Control action: Check whether the red light lights up after pressing the button Unsafe when: The patient does not check the red light of the hand set when the NCS does not transmit the signal of the hand set to the beeper of the nurse Safety constraint: The patient always must check whether or not his call has reached the nurse

13. Unsafe control actions Control action: Check whether the red light lights up after pressing Unsafe when: The patient checks whether the red indicator lights up and sees it does although the signal has not reached the nurse. Safety constraint: The patient always must check whether or not his call has reached the nurse

14. Unsafe control actions Control action: Press the red button of the hand set; Unsafe when: The patient uses the NCS when his need has become very urgent Safety constraint: Instruct the patient to use the NCS in time

15. Unsafe control actions Control action: Go to the patient indicated on the screen of the beeper Unsafe when: While going to the patient the nurse stops when someone else asks for her attention. Safety constraint: The nurse must always be able to give the right priority and arrange for assistance in case of competing priorities

16. STPA - step 2 • Analysis of causes of unsafe control actions • Analyze causes of unsafe control actions • control actions, • feedback • process model used by controller • Refine or add safety constraints • 3. Formulate means to apply/enforce the safety constraints

17. Control structure & control actions Potential Control Flaws Control action: Go to the pr

18. Looking for causes 1. Control Action not executed 2. Unsafe control provided 3. Process model flaws 2 3 1

19. Causes of UCA UCA nurse does not react on call related to urgent need Examples: • Code on beeper illegible or wrong • Right beeper, incorrectly programmed • Beeper malfunctioning during shift • Beeper gets lost during shift, without being noticed • Nurse expects no urgency (last impression, handover) • Nurse occupied with another task • Nurse is halted while answering call

20. One Table/report with: • Description • Goals • Accidents • Hazards • Safety Constraints • Design Requirements • Process model • Control Actions • Unsafe Control Actions • Causal Factors of UCA Results system level

21. Number of safety constraints

22. Safety constraints by theme Selfmonitoring and use of NCS H-1 Knowing whether call is answered Functioning of the whole NCS Enabling adequate respons time H-2 H-3 Knowing kind of need and acuteness

23. How safe is our nurse call system? 8 29

24. Getting findings accepted Highlighted control actions aimed at • Restoring the validity of assumptions underlying the safety design • Restoring the functionality of control feedback loop • Evident vital safety issue while referring to the table with results

25. Define care policy for incapacitated patients (e.g. delirious or confused) Uptime must apply to the whole system The patient must know whether his call has reached the nurse The nurse must know the kind and urgency of the patients’ needs Align response time and redirection settings of the NCS with physiological limits Highlights

26. Simple topic, 37 unique safety constraints Broad array of findings eXSTAMPP really helpful, one table Getting results accepted STPA supported the analysis in 5 ways • Limiting to things that really matter (accidents); • Top down reasoning (instead of free brainstorming); • Structured search for unsafe control actions • Predefined flaws of control feedback loops • Check for fit UCA – hazard Lessons learned

27. How about ….