Risk and Reliability In Healthcare and Nuclear Power ... · Risk and Reliability In Healthcare and Nuclear Power Learning from Each Other Edited by Matthew B. Weinger, MD, Bruce P

Risk and Reliability In Healthcare and Nuclear Power Learning from Each Other

Edited by Matthew B. Weinger, MD, Bruce P. Hallbert, PhD, and Mary K. Logan, JD

aami monograph

PREVIEW COPYThis is a preview edition of an AAMI document and is

intended to allow potential purchasers to evaluate the content of the document before making a purchasing decision.

For a complete copy of this AAMI document, contact AAMI at +1-877-249-8226 or visit www.aami.org.

Published byAssociation for the Advancement of Medical Instrumentation4301 N. Fairfax Drive, Suite 301Arlington, VA 22203-1633www.aami.org

© 2013 by the Association for the Advancement of Medical Instrumentation

All Rights Reserved

Publication, reproduction, photocopying, storage, or transmission, electronically or otherwise, of all or any part of this document without the prior written permission of the Association for the Advancement of Medical Instrumentation is strictly prohibited by law. It is illegal under federal law (17 U.S.C. § 101, et seq.) to make copies of all or any part of this document (whether internally or externally) without the prior written permission of the Association for the Advancement of Medical Instrumentation. Violators risk legal action, including civil and criminal penalties, and damages of $100,000 per offense. For permission regarding the use of all or any part of this document, contact AAMI at 4301 N. Fairfax Drive, Suite 301, Arlington, VA 22203-1633. Phone: +1-703-525-4890; Fax: +1-703-525-1067.

Printed in the United States of America

ISBN 1-57020-488-8

About the Publisher . . .

The Association for the Advancement of Medical Instrumentation (AAMI) is a diverse community of nearly 7,000 healthcare technology professionals united by one important mission—supporting the healthcare community in the development, management, and use of safe and effective medical technology.

AAMI members include device manufacturers, government regulators, physicians, nurses, clinical engineers, biomedical equipment technicians, and other healthcare technology professionals.

AAMI is the only nonprofit community that brings together such a diverse alliance to develop medical device standards, provide education and training opportunities, discuss important medical technology issues, and improve patient safety.




Risk and Reliability In Healthcare and Nuclear Power Learning from Each Other

Edited by Matthew B. Weinger, MD, Bruce P. Hallbert, PhD, and Mary K. Logan, JD

aami monograph







Table of Contents

Page

Preface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . v

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1

Perspectives—What Are the Issues

1. Thorniest Issues in Nuclear Power . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7

2. Thorniest Issues in Healthcare . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

Perspectives—The View of Regulatory Bodies

3. Regulatory Perspective of Advanced Technologies in the Nuclear Power Arena . . . . 17

4. Regulatory Perspective of Advanced Technologies in Healthcare . . . . . . . . . . . . . . . . 23

Team Topic Reports

5. Diagnosis and Prognosis: Approaches to Problem Identification and Prediction in Healthcare and Nuclear Power. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27

6. Human Factors and Human Reliability in Healthcare and Nuclear Power . . . . . . . . 37

7. Software Dependability for the Healthcare and Nuclear Power Industries . . . . . . . . 51

8. Root Cause and Corrective Action . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81

Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103

Acknowledgments and Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105

Authors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107

Tables

1 List of High Consequence Industries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2

2 List of Contributors and Their Primary Affiliations . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3

3 Recommended Discussion Points for the Work Group Teams . . . . . . . . . . . . . . . . . . . 5

4 Important Problems Related to Diagnosis and Prognosis . . . . . . . . . . . . . . . . . . . . . . 31

5 Nontechnical Challenges . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32

6 Cross-industry Methods and Technology Transfer Opportunities. . . . . . . . . . . . . . . . 33

7 Summary of Key Needs. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48

8 Sociotechnical Systems—Examples from the Healthcare and Nuclear Power Industries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55

9 Systems Engineering Approaches to Safety. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58

Risk and Reliability in Healthcare and Nuclear Power: Learning from Each other iii© AAMI




10 Dependable Software Similarities and Differences between the Heathcare and Nuclear Power Industries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63

11 Thorniest Issues in Software Dependability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66

12 Lessons Learned by Healthcare and Nuclear Power Experts . . . . . . . . . . . . . . . . . . . . 70

13 Key Research Questions from Healthcare and Nuclear Power Industries about Developing Dependable Software . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71

14 Comparison of Factors Influencing Quality of Investigations across Industries . . . . 84

15 Overview of High Priority Issues . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85

16 Qualitative Risk Matrix . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87

17 Uses, Advantages, and Limitations of Five Analytical Tools . . . . . . . . . . . . . . . . . . . . 89

Figures

1 The Process Followed by the NRC to Achieve Their Regulatory Mission. . . . . . . . . . 18

2 Elements of the Human Factors Engineering Program Review Model as Specified in NUREG-0711. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20

3 Graphical Representation of Healthcare and Nuclear Power Systems Software Technology as Part of a Complex Sociotechnical System . . . . . . . . . . . . . . . 54

4 Scene from a Critical Care Unit at LDS Hospital in Salt Lake City . . . . . . . . . . . . . . . 59

5 “Analog” Control Room of a Nuclear Power Plant . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60

6 “Digital” Control Room of a Nuclear Power Plant . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61

7 Proposed Movements of Nuclear Power and Healthcare to Have Safer and More Flexible Software in the Future . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73

iv Risk and Reliability in Healthcare and Nuclear Power: Learning from Each other © AAMI




Preface

The primary goal of this monograph is to share the lessons learned about risk and reliability from a unique, interdisciplinary workshop held in San Diego in July 2012. Leaders on risk and reliability from the nuclear power and healthcare industries spent two days together discussing their similarities and differences in four specific topic areas. The overall objective was to promote shared learning to achieve significant gains in risk management and reliability in these safety critical national infrastructures.

A number of system risk and reliability challenges are shared by the two industries. We focused on critical and enabling technologies and practices that affect risk and reliability, especially those related to instrumentation, controls, software, and human factors.

The workshop sought to generate recommendations and decisions on future collaborative activities between the two industries, including research, future workshops, position papers, and the like. The monograph captures the essence of that shared learning in a way that we hope fosters ongoing reflection, discussion, and action.

We would like to thank Lauren Healy of AAMI for her tireless efforts, without which we would have not been able to bring this monograph to fruition. Many other individuals from AAMI, Idaho National Laboratory, and Vanderbilt University also provided support, including organizing the workshop, managing meeting logistics, copy editing, and other administrative work behind the scenes, especially Theresa Flores, Ken Thomas, Julius Persensky, Andrew Kline, Chris Dinegar, Leah Lough, Carol Herman, and Steve Campbell.

We are also grateful for the talent, generous sharing of expertise, and enthusiastic participation in this experiment by all of the attendees. Finally, the small work group leaders deserve our deepest thanks for the extra work of facilitation, preparing presentations, and orchestrating—and at times working alone on—each chapter. Their generous spirits are a gift to all.

Matt Weinger Bruce Hallbert Mary LoganVanderbilt University Idaho National Laboratory AAMINashville, TN Idaho Falls, ID Arlington, VA

January 2013

Risk and Reliability in Healthcare and Nuclear Power: Learning from Each other v© AAMI







Introduction

When we first talked about the idea of this workshop, those of us from the healthcare industry wondered, “Really? Can nuclear power learn anything from healthcare?” Interestingly, some of the folks from the nuclear power industry asked, “Is there really much that healthcare can learn from nuclear power?” So we knew we were on the right track. This introduction provides context for the monograph as a whole, including why we started down this path, how we decided what issues to tackle, and how the event was structured.

Why Did We Even Think This Was Worthwhile Doing?

Through a series of happenstance interactions and a mutual interest in human factors and human performance in complex sociotechnical systems, Bruce Hallbert and Matt Weinger got to know each other. Thus, we began to appreciate some of the challenges each of us faced in trying to improve the safety and reliability of our respective domains. One day over a beer, one of us (there is still disagreement about whom) had an unsolicited idea: “Let’s get people from both industries together in the same room to learn from each other!” The other one of us, being properly lubricated, agreed wholeheartedly. Bruce suggested pairing such an endeavor with a future American Nuclear Society conference. Matt then approached AAMI through Mary Logan who was, as always, enthusiastic and supportive even without a beer. While initially we had no preconceived notions of how this would transpire, over the ensuing months, and as we brought in colleagues from both nuclear power (Ken Thomas, Julius Perensky) and healthcare (Leah Lough, Carol Herman, Chris Dinegar), a clear vision and plan evolved.

A 2005 report issued jointly by the National Academy of Engineering and Institute of Medicine of the National Academies1 recommended a broad partnership between engineering and healthcare. Acknowledging this call by

the U.S. National Academies, the Association for the Advancement of Medical Instrumentation (AAMI), and the U.S. Department of Energy’s Idaho National Laboratory (INL) teamed up to arrange a meeting of leading technical experts from both industries. The resulting workshop (described later) was designed to promote information exchange about current methods and technologies that are being developed and deployed in both domains to achieve significant gains in risk management and reliability. These industries have not benefited from prior formal opportunities to exchange ideas and experience until now.

Why Nuclear Power and Healthcare?

Nuclear power and healthcare are both complex, tightly coupled, high-hazard sociotechnical systems that serve a public good. Both industries rely on highly trained and skilled professionals working in interdisciplinary teams. Moreover, both are undergoing potentially cataclysmic changes due to advancing technology as well as new economic and political pressures.

A number of system risk and reliability challenges are shared by the two industries. We focused on critical and enabling technologies and practices that affect risk and reliability, especially those related to instrumentation, controls, software, and human factors.

Similarities and Differences Between the Industries

As will become clear in the chapters that follow, healthcare differs from nuclear power in that it is much less standardized, more loosely regulated (or at least regulated in a less centralized way), and largely evolved organically rather than being a deliberately “engineered” system. Methods and practices are highly unstandardized with huge process variability, even in the same hospital.

Risk and Reliability in Healthcare and Nuclear Power: Learning from Each other 1© AAMI




aami monographIntroduction

Thus, in general, patients enter the healthcare system both as unique physiological systems and “ill.” Moreover, the various components of the healthcare delivery system, including the different modes of care and caregiver roles, have evolved and assembled in an organic manner over more than a century. As President Bill Clinton wisely stated in a recent speech to healthcare leaders,2 solutions are tacked onto solutions, which get tacked onto solutions, resulting in a messy infrastructure with very little standardization of care (if you’ve seen one hospital, you’ve seen one hospital). In contrast, each component in a nuclear power plant was designed and built to be part of an integrated system, and can be assumed to be highly reliable (at least to the limits of its original design and engineering). Lessons learned are shared among all plants.

Perhaps more importantly, the physical processes associated with nuclear power (i.e., the nuclear reactions) are reasonably well understood and the status of these processes at any moment in time can be discerned with reasonably reliable sensors and measurements. In contrast, during healthcare delivery, the state of the primary process (the patient’s state of health or physiology) is much less certain and poorly understood. Moreover, in healthcare, many of the sensors are unreliable, particularly during the edge cases when the variables are well above or below critical thresholds. Thus, healthcare has far more uncertainty (and thus risk) at the subsystem level (direct patient care) than in nuclear power.

In addition, healthcare lags behind the nuclear power industry, and other high-consequence industries, in at least three other important ways:

1. Novice practitioners learn (“practice”) in the operational environment.

2. There are few objective measures of training success or continued competence.

3. Outcomes and safety rely on effective multidisciplinary teamwork, yet almost no formal team training occurs.

Aren’t These Similarities and Differences with Healthcare Also Present in Other Industries?

Many other high-consequence industries are or include complex sociotechnical (i.e., humans, technology, and work environment) systems and depend on risk and reliability management (see Table 1). Why did we choose nuclear power? Besides the obvious preexisting relationships, some of these other industries have a lower level of technology (e.g., firefighting) or are under less industry-affecting turmoil (e.g., mass transit, chemical process control, military command–control). Nevertheless, one could make a cogent

argument for including other industries such as aviation (e.g., comparisons are often made between commercial aviation and anesthesiology). Without apologies, we wanted to keep the endeavor feasible and focused, so we started with what we knew.

Table 1. List of High Consequence Industries

From Idea to Workshop to Monograph

Nine months of planning culminated in a two-day workshop in San Diego with approximately 50 invited experts from both domains (see Table 2 for list of contributors). In AAMI’s customary convener approach, the voices in the room comprised industry (e.g., medical device manufacturers), academia, independent experts, and regulators. The workshop started with direction-setting presentations by representatives from both fields (see Chapters 2–5) and opportunities for open discussion and exchange.

To assure that the workshop resulted in clear deliverables, we narrowed the scope of the topics to be covered. The organizing team deliberated on possible topics and honed them down to four topics based on the team’s interest in sociotechnical systems and its view of challenges shared by both nuclear power and healthcare:

• Dependability of safety critical software

• Technologies that provide diagnostic and prognostic capabilities

• Human factors and human reliability

• Event analysis and corrective action

• Healthcare

• Nuclear power

• Military command–control

• Aerospace/space exploration

• Military aviation

• Commercial aviation

• Wildfire firefighting

• Chemical process control

• Deep-sea oil/gas exploration

• Deep ground mining

• Mass transit systems

• “Big science” projects

2 Risk and Reliability in Healthcare and Nuclear Power: Learning from Each other © AAMI




Table 2. List of Contributors and Their Primary Affiliations

Diagnostics and Prognostic Capabilities

Facilitators:J. Wesley Hines, PhD, University of Tennessee (A, NP)Daniel R. Masys, MD, University of Washington (A, HC)

Vivek Agarwal, Idaho National Laboratory (I)Tina Krenc, Abbott (I)Daniel C. McFarlane, PhD, Lockheed Martin (I)Chuck Mowll, The Joint Commission (R)Mike O’Reilly, MD, Masimo (I)Emilie M. Roth, PhD, Roth Cognitive Engineering (I)Jason J. Saleem, PhD, University of Virginia (A)Kenneth D. Thomas, Idaho National Laboratory (I)Denny Treu, NxStage (I)

Human Factors and Human Reliability

Facilitators:David M. Gaba, MD, Stanford University (A, HC)Dave Desaulniers, U.S. Nuclear Regulatory Commission (R, NP)

Lane Desborough, Medtronic (I)Rob Fisher, Fisher IT (I)Jacques Hugo, Idaho National Laboratory (I)Edmond W. (Ed) Israelski, PhD, Abbott (I)Ronald Kaye, U.S. Food & Drug Administration (R)Nathan Lau, PhD, University of Virginia (A)Pierre Le Bot, EDF (I)Joanne Pester-DeWan, PhD, CareFusion (I)Christopher Plott, Alion (I)Patricia Trbovich, PhD, University Health Network (A)

Dependability of Safety Critical Software

Facilitators:Reed M. Gardner, PhD, University of Utah (A, HC)Carol S. Smidts, PhD, Ohio State University (A, NP)

David C. Classen, MD, Pascal Metrics (A)Rollin J. (Terry) Fairbanks, MD, MedStar (A)Bruce P. Hallbert, PhD, Idaho National Laboratory (I)Carol L. Herman, AAMI (A)Vadim Okun, National Institute of Standards and Technology (A)Kenneth D. Thomas, Idaho National Laboratory (I)Bakul Patel, U.S. Food & Drug Administration (R)Ted Quinn, Technology Resources (I)Christopher J. (Chris) Rozman, GE Healthcare (I)

Event Analysis and Corrective Actions

Facilitators:Kay Wilde Gallogly, 42Group (I)Robert Wears, MD, PhD, University of Florida (A)

Pat Baird, Baxter (I)John S. Carroll, PhD, MIT (A)Dorian Conger, Conger & Elsea (I)Rob Fisher, Fisher IT (I)Jack Martin, HPRCT (I)Marc Paradies, TapRoot (I)Dominic Siewko, Sr., Philips (I)Kelly Stone, Johnson & Johnson (I)

Planning Team

Steve Campbell, AAMIChris Dinegar, AAMITheresa Flores, Idaho National LaboratoryBruce P. Hallbert, PhD, Idaho National LaboratoryLauren Healy, AAMICarol L. Herman, AAMIMary Logan, JD, AAMILeah Lough, AAMIJulius Persensky, Idaho National LaboratoryKenneth D. Thomas, Idaho National LaboratoryMatthew B. Weinger, MD, Vanderbilt University

A = Academic, I = Industry, R = Regulator HC = Healthcare, NP = Nuclear Power





pErSpECTiVES—WhaT arE ThE iSSUESThorniest Issues in Healthcare

The following is an overview of each of the four topics that were addressed.

Diagnostics and prognostics (Chapter 5). Diagnostic and prognostic technologies provide monitoring of selected physical or biological components and subsystems to detect, characterize, control, and predict the performance of the system. The focus was expected to be on the methods employed to achieve best-practice diagnostic and prognostic capabilities and not on the differences in systems being measured (e.g., biological, biochemical, electrical, electro-mechanical, etc.). The expectation was that this team would focus on physical and computational approaches, models, and algorithms and decision support to achieve advanced monitoring and control capabilities in both industries.

Human factors and human reliability (Chapter 6). Healthcare and nuclear power both rely on effective human performance in all aspects of routine and non-routine operations. Human factors methods and processes can help to ensure that systems are operated safely and reliably under various conditions, and to minimize the occurrence of events and accidents. Human reliability considers the nature and likelihood of human error in safety analysis and risk assessment. The planning team’s vision was that this team would focus on ways in which human factors and human reliability methods contribute to safety and reliability in both industries.

Software dependability (Chapter 7). Safety critical systems are increasingly dependent on software applications. This creates new challenges to ensure system reliability and dependability against stochastic and common-cause failures. Software presents additional regulatory challenges. Common approaches and standardized methods are needed to assure the reliability of software-based applications. Before the workshop, the organizing team’s notion of this topic was that the team would focus on software design, evaluation/audit, failure analyses, and regulatory approaches for safety critical software in both industries.

Event analysis and corrective action (Chapter 8). Events and system failures are inevitable, even in the most reliable processes and activities. The most robust systems have effective mechanisms to proactively identify and mitigate potential failure. Yet, in both nuclear power and healthcare, many challenges exist to analyzing and correcting failure modes. The organizing team believed the focus of this group would be on effective methods of event detection and event analysis, identification of critical failure modes and dysfunctional feedback loops amenable to feasible corrective

action, and optimal methods of implementing corrective actions to reduce the incidence and severity of future failures.

For each of these topic areas, an expert presented the context of their technology base as well as current practices and trends in technology development, deployment, and management, and discussed current issues in managing risk through human-technology initiatives.

A series of parallel technical breakout sessions followed, with each group assigned to focus on one of the four selected technical topics—the four work groups met individually for more than six hours with intermittent check-ins. Post-workshop, work group leaders shepherded the resulting chapters that follow.

The Work Group Team Process

Each work group was co-led and co-facilitated by a member from each industry. All teams took a common approach and had an expected deliverable (this monograph). Each team had a scribe who noted issues of discussion as well as challenges, decisions, conclusions, and actions. Every participant contributed to their group’s report and thus, either directly or indirectly through their workshop contributions, to this monograph.

Work groups started with introductions and discussions of the topic from each member’s perspective. They then defined the nature and scope of the topic and identified the thorniest issues that could be tackled together through shared knowledge and/or shared effort. Table 3 provides the list of discussion points recommended by the organizing team for each work group to consider.

Cofacilitators assigned different work group members, based on interest, to create their chapter in this monograph. Some chapters were primarily written by one or two individuals, while others were truly a collaborative effort. All of the chapters were shaped by the collective thinking during the small group sessions.

In a sense, all of the workshop participants were pioneers. They saw the potential for two diverse fields to learn from and with one another. This was an experiment born by their shared vision: to continuously improve two high-risk domains through methods and technology that address risk and reliability issues. In the pages that follow, these enthusiastic participants in a cross-industry collaboration freely share their collective knowledge in a way that will encourage others to continue to build on their work. That process has already begun.

4 Risk and Reliability in Healthcare and Nuclear Power: Learning from Each other © AAMI




REFERENCES

1. Reid PP, Compton WD, Grossman JH, Fanjiang G, eds; Institute of Medicine of the National Academies; National Academy of Engineering . Building a Better Delivery System: A New Engineering/Health Care Partnership. Washington, DC: National Academies Press; 2005.

2. President Bill Clinton . Speech presented at: Patient Safety, Science and Technology Summit; January 14, 2013; Laguna Niguel, CA.

Table 3. Recommended Discussion Points For the Work Group Teams

• How does your topic already contribute or could it contribute to safer and more reliable systems for nuclear energy production and healthcare delivery?

• What are the existing knowledge/technology/processes (KTP) in each industry?

• What are the current efforts to advance KTP?

• What opportunities are currently available for future advances in KTP?

• What should/will safe and reliable nuclear energy production and healthcare delivery look like?

• What are the most pressing current problems in each industry within your topic area?

• What are the current technical and other gaps that preclude achievement of the desired outcomes?

• What is being done in one industry successfully (or unsuccessfully) that could be productively applied to (or learned from by) the other industry?

• What are the common and unique challenges across the two industries?

• What are the lessons learned from one industry that can apply to the other?

• What are the knowledge, technology, and process gaps and research needs?

• What are the most promising solutions?

• What are current limitations or perceived shortcomings with the status quo?

• What are the critical needs and priorities to make progress?

• What are the “must haves,” enabling capabilities, associated needs and requirements, etc. to correct the problem/gap?





Documents

Risk and Reliability In Healthcare and Nuclear Power ... · Risk and Reliability In Healthcare and Nuclear Power Learning from Each Other Edited by Matthew B. Weinger, MD, Bruce P