Investigation report: Risks to medication delivery using ambulatory infusion pumps – design and usability in inpatient settings

We are grateful to the family of the patient whose experience is central to this investigation. In accordance with their wishes, the patient is referred to by his name, Stephen. The information shared by Stephen’s family helped to inform the investigation and provided valuable insight into the impact of such incidents. Stephen’s family hoped that their story might help to promote change.

We would also like to thank the healthcare staff who gave their time to provide information and expertise which contributed towards this report, and the stakeholder organisations and professional bodies that engaged with the investigation to support improvements in this area of care.

The investigation team included a subject matter advisor who is an expert pharmacist in palliative and end of life care. They collaborated with the investigation throughout, and their views are reflected in the report.

HSSIB makes the following safety observations

This investigation explores the use of ambulatory (portable) infusion pumps, which are medical devices that are used to deliver medication to patients, often as part of palliative care. It looks at the risks to patients receiving the intended amount of medication via these pumps, focusing on their use in inpatient settings such as hospital wards or hospices. These medical devices can also be used in the community (in patients’ homes).

This report includes references to ‘hazardous situations’. These are situations in which intervention by a healthcare professional is needed because there is the potential for harm to a patient, or an adverse health outcome. In this context, a problem that prevents an ambulatory infusion pump from delivering medication is a hazardous situation.

This section of the report explains palliative care, how ambulatory infusion pumps work, the regulations that cover medical device design and use, and the reporting mechanisms that capture patient safety issues relating to medical devices.

This investigation used the following patient safety incident, referred to as ‘the reference event’, to examine risks associated with the delivery of medication using ambulatory infusion pumps.

Background – before Stephen’s admission to hospital

2.1 Stephen was diagnosed with gastro-oesophageal cancer (cancer that develops where a person’s food pipe (oesophagus) joins the stomach) in August 2019, aged 45. The cancer was incurable and palliative chemotherapy was started in September 2019.

2.2 Because Stephen was having ongoing difficulties in swallowing and was losing weight, it was agreed that he urgently needed a stent (a short, wire mesh tube) inserted into his oesophagus. The procedure to do this took place in November 2020.

2.3 Stephen had a consultation with a palliative medicine consultant in December 2020 because he was struggling with abdominal pain and nausea. Stephen’s pain was ‘in the left side of his body radiating into his neck. He also experienced severe pain across his abdomen and back’.

2.4 A review of Stephen was carried out (Day 0) which documented that he was experiencing weight loss, dehydration and abdominal pain. A plan was made to admit him to hospital and assess the oesophageal tent, and for palliative care staff to review his pain management.

Admission to the oncology (cancer) ward

2.5 On Day 1 Stephen was prescribed 15 mg morphine (for pain relief) and 150 mg cyclizine (an anti-sickness medication) per 24 hours to be administered by continuous subcutaneous infusion (CSCI), which means the infusion was delivered under his skin. The first infusion for Stephen started at 12:30 hours using a T34 ambulatory syringe pump (the ‘syringe pump’) at an infusion rate of 0.91 millilitres per hour (ml/hr), with associated monitoring documentation raised for syringe pump staff checks every 4 hours. Throughout the day Stephen was also given a total of 20 mg of pro re nata (PRN – as needed) morphine in 5 mg doses. These were at 02:30 hours, 08:10 hours, 10:30 hours and 23:55 hours.

2.6 On Day 2 a review was carried out which documented that over the last week Stephen had increasing abdominal pain and difficulty swallowing. A computerised tomography (CT) scan showed that Stephen’s oesophageal stent had moved.

2.7 After the CT scan a clinical review of Stephen’s care was carried out. It was documented that Stephen expressed that he was in pain and a plan was made to increase Stephen’s syringe pump morphine dose from 15 mg per 24 hours to 30 mg per 24 hours. Stephen’s infusion of 30 mg morphine and 150 mg cyclizine started at 11:35 hours at an infusion rate of 0.72 ml/hr. Throughout the day Stephen was also given a total of 15mg of PRN morphine in 5 mg doses. These were at 08:35 hours, 11:40 hours and 23:55 hours.

2.8 On Day 3, Stephen underwent a procedure to check and reposition his stent. In addition to Stephen’s syringe pump infusion, he also received 15 mg PRN morphine in 5 mg doses. Over Day 4 and Day 5, in addition to his syringe pump infusion, Stephen received 15 mg PRN morphine, and 30 mg PRN morphine, respectively.

2.9 On Day 6 Stephen’s infusion of 30 mg morphine and 150 mg cyclizine, which consisted of a total syringe volume of 22 ml of liquid, was started at 12:10 hours at an infusion rate of 0.91 ml/hr and the syringe pump keypad lock was applied. Stephen also received a total of 15 mg of PRN morphine in 5 mg doses at 03:45 hours, 05:55 hours and 13:20 hours.

2.10 A ‘4-hourly syringe pump checks’ was carried out at 18:10 hours when 5.5 ml of syringe pump medication was documented as being infused, as expected. The next ‘4-hourly syringe pump check’ was at 22:10 hours when 9.2 ml was documented as being infused, as expected.

2.11 At 22:53 hours the syringe pump registered an occlusion; at this time 9.22 ml of medication had been infused. The syringe pump had an occlusion alarm (audible and visual) that lasted for 43 minutes, the alarm stopped at 23:36 hours when it was silenced manually, and the infusion was resumed (see table 1).

Table 1 Syringe pump data

2.12 On Day 7 at 00:15 hours a nursing review was carried out for Stephen. It was documented that there was ‘no pain noted as yet’ and that Stephen was ‘sleeping in his chair’.

2.13 A further three syringe pump occlusion alarms occurred between 00:18 hours and 01:47 hours. These occlusion alarms were manually silenced after periods of between 2 and 6 minutes (see table 2).

Table 2 Syringe pump data

2.14 At 02:05 hours a nursing review was carried out for Stephen. It was documented that Stephen was not confused or agitated.

2.15 A further four occlusion alarms occurred between 02:28 hours and 04:34 hours. The first three were manually silenced after periods of between 2 and 3 minutes, with the fourth silenced when the pump was switched off after 60 minutes (see table 3).

Table 3 Syringe pump data

2.16 There were a total of eight occlusion alarms between 22:53 hours on Day 6 and 04:34 hours on Day 7. After each occlusion, except the last, the occlusion alarm was manually silenced, and the infusion restarted. During this time Stephen did not receive pain relief medication via the syringe pump (see tables 1 to 3), or via PRN morphine administration.

2.17 On Day 7 Stephen telephoned his father at approximately 04:50 hours to say he was “outside, in pain, could not breathe and was unable to move”. Medical records indicate that at approximately 05:00 hours Stephen’s mother contacted the ward by telephone to relay this information.

2.18 While staff were searching for Stephen they went to the opposite end of the ward to the nurses’ station, where Stephen’s bay was located, from here they heard a syringe pump alarm sounding from within a quiet room. Stephen was not in the room; however, his feeding machine and alarming syringe pump were inside.

2.19 A window within the quiet room was found to be open, from which Stephen could be seen outside on the ground (one floor down, around 25 feet). The medical emergency team carried out an immediate assessment and contacted 999.

2.20 Stephen was taken to a nearby emergency department, arriving at 06:05 hours. Stephen had trauma and head injuries for which he had a CT scan and was then transferred to a critical care ward.

2.21 After a period of recovery, on Day 15, Stephen was transferred to a specialist palliative care centre where a few days later he tested positive for COVID-19. Stephen’s condition deteriorated and on Day 27, following a palliative care review, it was recognised that Stephen was approaching the end of his life. Stephen died on Day 28.

3.1.5 The syringe pump had been recently serviced and was not faulty at the time of use. During a Trust incident review, data was downloaded from the syringe pump’s history log. The history log showed that Stephen’s infusion had been interrupted due to one ongoing ‘occlusion event’ for approximately 6 hours, as shown in tables 1 to 3, with an associated ‘high priority’ alarm occurring eight times during this period.

3.1.6 During observations and engagement with Trust staff the investigation heard that the syringe pump alarm is “not very loud” and “may not be heard”. During the alarm there would also have been an associated red light (status indicator – see figure 1), an occlusion indication on the display and the syringe pump would have stopped driving the syringe.

3.1.7 If an occlusion occurs the syringe pump attempts to maintain sufficient pressure on the fluid to cause it to flow through all restrictions and overcome any additional resistance. An occlusion alarm will activate once the pressure in the system reaches a predetermined value, meaning there is a slight delay between the occlusion starting and the occlusion alarm sounding.

3.1.8 For the syringe pump settings at an infusion rate of 0.91 ml/hr used for Stephen’s care, this delay was approximately 40 minutes. The first occlusion alarm was at 22:53 hours, indicating that the occlusion started at approximately 22:13 hours.

3.1.9 An occlusion alarm on a syringe pump will sound continuously until the syringe pump is ‘paused’ to allow intervention to resolve the issue, the keypad will automatically unlock to enable this. If the syringe pump infusion is not resumed within 2 minutes after a pause, a further warning is displayed (and logged) stating ‘pump paused too long alarm’ (CME Medical, 2016).

3.1.10 The history log for Stephen’s syringe pump shows that an occlusion alarm was present for a total period of 121 minutes between 22:53 hours on Day 6 and 05:34 hours on Day 7. The history log also shows that the syringe pump was not ‘paused’ for any longer than 2 minutes during the occlusion alarms. This indicates that the infusion was manually resumed within 2 minutes of each ‘pause’. The investigation was unable to find evidence to determine who paused and resumed Stephen’s infusion. However, the report of a coroner’s inquest stated: ‘It is more likely than not that Stephen had intermittently silenced the alarm by pressing buttons on the syringe driver [pump].’ The investigation therefore proceeded with analysis based upon this.

3.1.11 During observational visits to the oncology ward the investigation was informed that patients would usually be told not to silence an alarm, this was an ad hoc process that was not documented in Trust policy. In addition, patients would not be made aware of the implications of silencing the alarm.

3.1.12 Stephen, like other inpatients that have syringe pumps in place, did not receive training or a specific brief on use of the pump, as the intention is that the controls would only be used by trained staff. Stephen’s syringe pump was contained in a clear lockbox case (see 1.2.3), additionally, a keypad lock function (see 4.2.26) was applied preventing inadvertent key presses during normal operation.

3.1.13 The keypad could still be accessed through the lockbox, providing an opportunity during an alarm condition to silence the alarm, and then to resume the paused infusion.

3.1.14 During this period of Stephen’s care there were eight occlusion alarms over approximately 6 hours during which Stephen was not receiving pain relief and anti-sickness medication. Each occlusion sounded an alarm which was silenced (indicating syringe pump paused) and the infusion was manually resumed. Once the syringe pump infusion has been manually resumed the audible sound will cease, the red light will revert to green, and the occlusion warning message will be removed from the display. Therefore, it will appear that the syringe pump is, and has always, been operating without issue, even though medication has not been delivered. The remaining indication of an occlusion to staff will be that the amount of medication infused will not have increased, checked during ‘4-hourly syringe pump checks’.

3.1.15 During the period of the ongoing occlusion nursing staff were not alerted to an issue with Stephen’s infusion. This included at least two occasions where it was documented they had visited Stephen to carry out routine nursing observations (for example checks of patients’ temperature and heart rate). Routine nursing observations are separate to the 4-hourly syringe pump checks. The 4-hourly syringe pump checks were an opportunity for the occlusion to have been identified between the syringe pump alarms (see section 3.2).

3.1.16 The syringe pump is unable to provide an alarm indication remotely, for example to a centralised monitoring system at a nurses’ station. There are several hospital medical devices that do have this function, such as cardiotocograph (heart monitoring) machines used to monitor babies during labour, some of which use telemetry and are ambulatory to provide continuous monitoring while pregnant women/people are mobile.

3.1.17 The nursing staff at the Trust use portable electronic devices (PEDs) for several functions on the ward, including recording observations. It was discussed by staff that while it would be extremely useful if an issue with an ambulatory syringe pump was indicated on the PED, that it was beyond any technology previously seen or considered.

3.1.18 When the occlusion issue occurred for Stephen, the syringe pump operated as designed. The following patient safety concerns were identified:

3.1.19 Staff were not supported in identifying the occlusion issue, this was due to the functionality of the syringe pump which gave Stephen the opportunity to silence the alarms. Once silenced, this left no enduring indication to staff that an occlusion issue was occurring, other than checking that the volume of medication infused had increased during 4-hourly syringe pump checks. In addition, staff were unable to be notified remotely of the occlusion as this is beyond the syringe pump’s technical capabilities.

Staff checks

Frequency

4.2.3 Palliative care specialists use the Palliative Care Formulary (PCF). This is a:

‘… unique independent professional publication which provides essential information for prescribers and health professionals involved in palliative and hospice care. PCF contains authoritative independent guidance on best practice, and helps to ensure that drugs are used appropriately, safely, and optimally.’

(Wilcock et al, 2022)

4.2.4 Medication is delivered from an ambulatory infusion pump to a patient via a continuous subcutaneous infusion (CSCI). The PCF states that the following ‘Checks should be documented within 1h [hour] of setting up the CSCI and then q4h [every 4 hours]’:

• is the device still working?
• is the correct rate still infusing?
• amount of time and volume of solution left, and whether the infusion is running to time (based on the preceding 4 hours).

4.2.5 The investigation engaged with NHS England’s national palliative care team. The team’s perspective was that the frequency of the checks within the PCF are the “minimum expectation” when carrying out in-use checks for ambulatory infusion pumps in an inpatient setting. Increased checks could also be implemented considering specific risks, such as where alarms cannot be heard or there are patients at high risk of deterioration who may not be able to alert staff to an alarm.

4.2.6 Four-hourly checks for inpatients have been adopted in local guidelines across most palliative care providers in England. The investigation did however identify some local guidelines where checks are instead carried out at specified times, such as at 13:00 hours, 17:00 hours, 21:00 hours, overnight and 09:00 hours. This is not in line with the PCF or NHS England minimum expectations.

HSSIB makes the following safety observation

Staff checks delayed or not carried out

4.2.7 During an observational visit to a comparison site the investigation team observed syringes being prepared for patients in a medication room. The policy at the observational visit trust was for 4-hourly syringe pump checks, these checks were written on a whiteboard in the medication room.

4.2.8 During discussion in the medication room a member of the investigation team noticed an interval of approximately 6.5 hours between two ‘4-hourly syringe pump checks.’ This had not been noticed by the senior staff member from the healthcare provider and the two other investigation team members present, as it was not immediately clear on the screen in use. The senior member of staff informed the investigation that 6.5 hours was “borderline” as to whether it should be reported. However, they said that as the delayed check had “revealed no issues” that it was not necessary in this case.

4.2.9 The observations during the comparison site visit, in addition to the checks being delayed or not carried out in the reference event, indicate that staff checks are a weak control (see appendix) for ensuring ambulatory infusion pumps are delivering medication as prescribed. This is because they are not always carried out at the intended 4-hourly frequency due to challenges such as staff capacity, conflicting tasks, and priorities. It is impossible to understand how often such delays occur nationally as, if identified, they may not be reported unless there has been a poor outcome for the patient.

4.2.10 There may be many reasons that 4-hourly infusion pump checks are delayed or not carried out. However, not reporting delayed or missed checks presents a missed opportunity to understand and address the underlying reasons and contributory factors.

4.2.11 If ambulatory infusion pump alarms were reliably able to notify staff when a hazardous situation occurs, this may reduce the requirement for 4-hourly infusion pump checks to mitigate risks. This includes when these checks have been delayed or not carried out (see 4.2.36 to 4.2.53).

Access to the Palliative Care Formulary

4.2.12 The investigation encountered challenges in accessing the PCF. The PCF is not free and can only be accessed through purchase, either as hard copy or as an online resource. The investigation engaged with an editor of the PCF who was of the view that specialists in palliative care would have access to the PCF. This could be through membership of the Association of Palliative Medicine (APM), or through access purchased by a trust or purchased as an individual.

4.2.13 The investigation was told that not all palliative care providers purchase online access to the PCF for their employees because of the significant cost. Examples were given where previous hard copy versions of the PCF were available, but staff did not have access to the latest online version as it had not been purchased.

4.2.14 The investigation was also told of occasions where healthcare professionals, who may require information provided by the PCF, cannot gain access. An example was given of GP practices which are expected to fund access to specialist resources. If GP practices do not purchase the PCF then staff have been seen to search for open (free) alternative resources, such as via the Palliative Adult Network Guidelines (PANG) (Palliative Care Guidelines Plus, n.d.).

4.2.15 Free access to the British National Formulary (BNF) is available, which provides information regarding ‘Prescribing in palliative care’, however this does not contain the level of detailed clinical information regarding medicines, use, and administration, found in the PCF.

4.2.16 The inability to access the PCF for free may have an impact on patient safety. This can be both in the palliative care specialism and across the wider healthcare system, including healthcare safety investigation.

Perception of risk

4.2.17 When a high-priority alarm occurs, the medical device standards (British Standards Institution, 2021) and the syringe pump information (Becton Dickinson, 2019) regard this as an event that requires an ‘immediate response’. In discussion with healthcare staff across the system, staff members’ perceptions of priority and risk in this scenario varied.

4.2.18 The investigation heard from healthcare staff that an ambulatory infusion pump alarm would not indicate a “life or death” situation that required immediate response, unlike a heart monitor alert, for example, which may indicate that a patient is in cardiac failure requiring immediate resuscitation.

4.2.19 While this indicates variation in the way medical device standards define risk and how healthcare staff perceive it, the key issue is that the lack of a timely response to high-priority ambulatory infusion pump alarms, such as those for an occlusion, means a patient may not be receiving their prescribed medication for long periods. The longer a patient does not receive their medication the more its effects will reduce over time.

4.2.20 Local guidelines across palliative care providers in England specify what actions to take to respond to a high-priority alarm, but do not specify the priority of this action in the same way that the standards and manufacturers’ literature do, for example an ‘immediate response’. The investigation did not identify in any local or national guidance what the clinical perspective of an appropriate response to a high-priority alarm should be. The response can vary depending on the clinician’s perspective, which will be influenced by their local training, experience, workload and capacity.

4.2.21 The investigation spoke with staff at a hospice. These staff also worked at other wards in an acute trust. Staff were asked:

• When you hear an ambulatory infusion pump alarm sounding, how quickly would you respond to this?
• Do you respond differently to the different alarms?
• What factors influence how quickly you would respond?

4.2.22 All staff said that they did not distinguish between the different infusion pump alarms. They said of their reaction to any alarm:

• ‘I tend to deal with the alarms as soon as I hear them.’
• ‘Alarms exist to be responded to at the earliest opportunity.’
• ‘I respond to the alarm when it arises.’
• ‘I don’t hear the alarm … but if I see the flashing light I act immediately.’
• ‘As soon as possible when I hear it, not acceptable to leave alarming for any longer than is necessary.’

4.2.23 The above quotes demonstrate that even within one provider, and across a small number of staff, perceptions of the required response vary, for example the difference between ‘immediately’, ‘as soon as possible’ and ‘at the earliest opportunity’.

4.2.24 The NHS England palliative care team told the investigation that from a clinical perspective, a high-priority alarm requires an “urgent” response. The response is deemed to be urgent because, should an occlusion occur, for example, the medication effect and pain relief would not only wear off, but would also take time to reach the intended levels again once the infusion issue was resolved. Where staff identify an occlusion has occurred, a pro re nata (PRN) dose of medication can be given, mitigating effects on the patient whilst the infusion pump medication returns to previous steady state levels.

4.2.25 The investigation has shown that the current methods of notifying staff of a hazardous situation via an alarm, to facilitate an “urgent” response, are not effective. See 4.2.36 to 4.2.53 for an exploration of infusion pump alarms not being heard/responded to by healthcare staff.

Ability of patients to interact with equipment under alarm conditions

Equipment lockout to prevent patient interaction

4.2.26 Infusion pumps have keypad lock functions so that once the pump is set up by trained staff the keys cannot be pressed inadvertently. Infusion pumps will automatically pause an infusion, either on the first occlusion alarm, or a repeating occlusion alarm, depending on the pump that is being used.

4.2.27 Infusion pump keypads automatically unlock during an occlusion alarm, providing an opportunity for a patient to use the controls. This can be to silence the alarm, and to resume the paused infusion, such as in the reference event.

4.2.28 When used in inpatient environments, patients do not receive instruction or training on the use of ambulatory infusion pumps. When ambulatory infusion pumps are used in the community, patients may be given basic information about what to do in response to alarms and who to contact. For example, one trust’s information for patients states: ‘contact the nurse or the out-of-hours services. Please do not become concerned. You may like to turn the alarm off until someone arrives, by pressing the green button once. Do not press any other buttons’.

4.2.29 The investigation did not find evidence that patients in an inpatient setting are made aware of the implications of interacting with ambulatory infusion pumps in the event of an alarm.

4.2.30 The archived MHRA infusion systems document (Medicines and Healthcare products Regulatory Agency, 2013) states that ‘In most fatal incidents no fault has been found with the infusion device, suggesting … that some form of tampering [patient interaction] could have taken place’. The document also states that staff should demonstrate competence in ‘security against tampering’ and that patients and carers who need to use infusion devices should be given training in the ‘potential consequences of tampering’.

4.2.31 When the MHRA infusion systems document was archived, it was not replaced. The investigation did not identify any other national guidance or policy that discusses infusion pump patient interaction and therefore any requirement for staff and/or patients to have training and competence regarding it, or for it to be reported (see section 4.4).

4.2.32 If patients did not have the opportunity to interact with an ambulatory infusion pump to silence an alarm and resume an infusion, this would give staff an increased opportunity to hear and respond to a hazardous situation. The automatic unlocking function that gives staff easier access to carry out the necessary interventions also has the unintended consequence of allowing patient interaction. See section 4.2.36 to 4.2.53 for an exploration of infusion pump alarms not being heard/responded to by healthcare staff.

Alarms not enduring after patient interaction

4.2.33 Once an alarm has been silenced and the infusion resumed, there is no enduring alert to indicate that a hazardous situation has occurred. If a patient interacts with the infusion pump, staff are not able to easily see on the device that previous alarms have occurred without accessing specific control panel menus. This does not form part of the routine 4-hourly infusion pump checks. To gain a full understanding of infusion pump events, for example for a local investigation, the device history log is downloaded by a medical engineering department when the infusion pump is not in use.

4.2.34 However, the adoption of new remote technologies can ensure that data can be accessed by clinical staff without the need to download information via medical engineering teams.

4.2.35 The lack of an enduring indication on the physical device to show that there has been a hazardous situation, if patient interaction has occurred, limits the opportunity for staff to know and provide appropriate intervention. See section 4.2.36 to 4.2.53 for an exploration of infusion pump alarms not being heard/responded to by healthcare staff.

Ambulatory infusion pump alarms not heard/responded to by healthcare staff

Audible alarm

4.2.36 Product information states that a high-priority alarm ‘Requires immediate user response’ (Becton Dickinson, 2019). An occlusion is classed as a high-priority alarm event and, in line with the standards (British Standards Institution, 2021), a ‘means shall be provided … to protect the patient from under-infusion resulting from occlusion’. Occlusion alarm thresholds can be used to activate a high-priority alarm signal and terminate the infusion liquid flow.

4.2.37 The standard states that for ambulatory infusion pumps ‘the volume of auditory alarm signals shall generate a sound-pressure level of at least 45 dBA [A-weighted decibel – an expression of the relative loudness of sounds as perceived by the human ear] at 1 m’. A quiet library is approximately 40 dB [decibels] and a normal conversation is approximately 55 dB (Tinnitus UK, n.d.).

4.2.38 Infusion pumps considered by the investigation had high-priority alarms between ‘58 dBA’ (Becton Dickinson, 2019) and ‘70± [plus or minus] 2 dBA at 1 meter’ (Eitan Medical, 2022).

4.2.39 The NHS Supply Chain essential specifications for ambulatory infusion pumps include a technical requirement that a device must ‘audibly and/or visually alert the end user when it requires end user intervention, for example when devices malfunction, occlusion, air detection, conclusion of therapy, low battery’ (NHS Supply Chain, 2021).

4.2.40 During the reference event healthcare staff were not alerted to the ‘high-priority’ occlusion alarm. In conversations with clinicians across this area of healthcare, it was regularly stated that ambulatory infusion pump alarms were “not very loud” and can be “difficult to hear”. Although there was no evidence of it in the reference event, the investigation heard from staff that patient’s also often put their ambulatory infusion pumps under pillows or sheets, further affecting the ability to hear an alarm.

4.2.41 The length of the lumen (tube) which delivers the medication from an ambulatory infusion pump to the patient is relatively short, which limits where the infusion pump can be placed. The lumen is short to minimise waste of medication during priming (removing air prior to attaching to the patient). This can contribute to patients putting their infusion pump “under their pillow or sheets”. Some ambulatory, and non-ambulatory, infusion pumps can be used on a stand beside a patient’s bed, which means they are not affected by the issue of placement in an area that could affect the audibility of the alarm.

4.2.42 During observational visits, the investigation encountered difficulty in hearing a high-priority alarm from directly outside a patient’s room. The infusion pump was located under the side of the patient’s pillow.

4.2.43 Patients who use ambulatory infusion pumps in the community are advised to ‘Place the syringe [infusion] pump in a safe and comfortable position. Tucked slightly under a pillow can be a good place’ (Marie Curie, n.d.). This may become normal practice for patients and families/carers while receiving care in the community, a practice they may continue to follow if they go into an inpatient environment such as a hospital or hospice.

4.2.44 Placing ambulatory infusion pumps on dedicated stands/cradles (see figure 5) would mitigate the impact of reduced alarm audibility caused by the pump being placed under sheets and pillows. However, the lumens used would need to be long enough to accommodate this. However, using a dedicated infusion pump stand/cradle must be balanced against maintaining a patient’s independence, and opportunities to mobilise.

Figure 5 An Avoset ambulatory infusion pump in a cradle (can also be mounted to a bed railing) (Eitan Medical, 2022)

4.2.45 Although devices have an audible alarm, this does not always mean the end user is alerted to a hazardous situation that requires an ‘immediate’ operator response.

4.2.46 An ambulatory infusion pump that provides an alarm when there is a hazardous situation is a device that is working as designed. However, the exclusion of human factors requirements, can lead to an infusion pump not working as intended. The alarm is intended to provide a warning that is then acted upon – if the alarm is not heard, the design does not meet the intent. Alarms may occur, but if staff are not alerted to them, required interventions may not take place.

4.2.47 The investigation engaged with the British Standard Institution’s (BSI’s) healthcare sector team. Team members recommended that the methods used to alert staff to hazardous situations should be inclusive of all staff and take in to account the diversity of the work environment. During observational visits, the investigation engaged with members of staff with impaired hearing, whose only way of recognising that an alarm was occurring was by a visual alert. Based on human factors and usability requirements in AAMI TIR59:2017 and ANSI/AAMI HE75:2009, BSI recognised that devices that alerted staff in multiple ways to a hazardous situation would improve patient safety and ensure inclusivity for a diverse workforce.

4.2.48 There are examples of remote or centralised warning alarm systems (also called distributed alarm systems) that are used where intervention is required, and it is recognised that an audible medical device alarm may not be sufficient to alert staff. These are commonly used for monitoring pregnant women/people and their babies during high-risk labours, critical care patients, and in other clinical settings.

4.2.49 A previous National Patient Safety Agency guide (NPSA, 2010) regarding the ‘design of electronic infusion devices’ discussed the issue of:

‘Devices alarming while attached to patients in isolated rooms may not be noticed by nursing staff.’

4.2.50 This issue led to the subsequent recommendation of:

‘In addition to the audible and visual alarm on the device, consider the additional function of alarms signalling to pagers or other remote devices and at a central nurse’s station.’

4.2.51 The investigation did not find evidence of this recommendation leading to actions taken in response.

4.2.52 During discussions with a manufacturer, the investigation was told that they have developed technology that can support ‘push notifications’ for hazardous situations. This can be in the form of a notification on a mobile device, or an email to a dedicated address. This technology mitigates the need to be in the vicinity of an ambulatory infusion pump to hear or see an alarm, with staff being able to be alerted to a hazardous situation remotely.

4.2.53 Although outside the scope of this investigation, this technology could also realise benefits where ambulatory infusion pumps are used by patients in the community (in patients’ homes), automatically alerting community nursing staff to hazardous situations. This is a specific benefit where staff intervention is required in a hazardous situation, but where the patient may not be capable of notifying staff.

HSSIB makes the following safety observation

Alarm fatigue

4.2.54 If an ambulatory infusion pump alarm can be heard in a specific environment, there is a further recognised and researched phenomenon, known as alarm fatigue, that can affect whether staff respond appropriately.

4.2.55 Alarm fatigue occurs ‘when clinicians experience high exposure to medical device alarms, causing alarm desensitization and leading to missed alarms or delayed response’ (Woo and Bacon, 2020).

4.2.56 The British Standards Institution (British Standards Institution, 2021) states that there are several factors that can cause a degraded response. Examples set out in BS EN 60601-1-8:2007+A2:2021 include:

• ‘high number of false positive alarm signals;
• signals from other patients in the area for whom the operator is not responsible;
• high number of auditory alarm signals that are insufficient for detection, identification, localization or prioritization;
• volume (sound pressure level) of the auditory alarm signal (too quiet or too loud);
• other environmental aspects (i.e. ambient noise, ambient light and glare, level of operator rest, work area temperature, additional workflow interrupts) that impair the operator's cognitive abilities.’

4.2.57 Alarm fatigue is a significant and recognised risk to staff responding appropriately to an alarm to provide an intervention in a hazardous situation. Although in-depth analysis of alarm fatigue is outside the scope of this investigation, innovation and technology could help to mitigate the associated risks.

4.2.58 BSI recognised that alarm fatigue remains a challenge for healthcare staff. The previous safety observation, O/2023/006, could help to mitigate alarm fatigue risks by using new technology to alert staff to hazardous situations.

Human factors, including usability and environment of use considerations

4.2.59 The investigation carried out observations across several inpatient environments that use ambulatory infusion pumps. These included oncology (cancer) wards in acute hospitals, and in hospices.

4.2.60 The environments encountered were significantly different, for example open wards, closed bays and individual side rooms. When wards were spread over a large area, or there were doors separating staff from bays, side rooms and communal/rest areas, this made it increasingly difficult to hear, or see, an alarm.

4.2.61 During one observational visit, refurbishment work meant that power tools were being used. This made hearing alarms from the nurses’ workstation a significant challenge, if not impossible.

4.2.62 During engagement with the NHS England national palliative care team, nursing staff gave examples of the set-up of inpatient wards making ambulatory infusion pump alarms difficult to hear. The investigation was told that in these environments, if a patient (or their visitor) is unable to press a nurse call bell to notify them of an infusion pump alarm, then nurses will not be aware that a potential hazardous situation is occurring.

4.2.63 During an observational visit the investigation queried whether patients and/or their visitors were briefed about calling for the nurse if a pump alarm went off. The investigation was informed that they were not, but that the alarm would “become quite annoying after a while and [patients/families] would just do that”. See section 4.3 for further exploration of inpatient safety netting advice.

4.2.64 If a patient does not have a visitor with them when an infusion pump alarm sounds, the patient would need to follow the unspecified and ad hoc process of alerting staff via a nurse call bell. This relies upon the patient having the capacity to do so. If the patient is alone and unable to press the nurse call bell, then staff response and intervention is solely reliant upon staff being able to hear (or see) an alarm.

4.2.65 The infrastructure (physical structure) and working environment (background noise, staff location, staff numbers, patient location) in which ambulatory infusion pumps are used, pose a significant threat to staff members’ ability to hear an alarm and provide an intervention to a hazardous situation. Given their volume levels, ambulatory infusion pump alarms are unable to alert staff to hazardous situations in all environments.

4.2.66 The investigation engaged with the BSI, to discuss the investigation’s findings. The BSI recognised that further work in human factors engineering (HFE – the application of human factors principles to the design of devices and systems) and usability engineering (UE – how user-friendly a product will be) in consideration of the environments within which medical devices are used would be advantageous. Human factors and usability should be applied by manufacturers as part of the design requirements, and by healthcare providers as part of their equipment procurement processes.

4.2.67 Medical device standards used by manufacturers can be national or international standards. When revising a national standard, the BSI directly manages the UK standardisation committees and can request that they consider recommendations. As national standards only require approval at the UK level, the time it takes to revise a standard can be easier to manage. However, international standards require review and approval from all international members and the revision process can therefore be lengthier.

4.2.68 The BSI stated that it is within its power to produce additional content at a national level. This could be in the form of a white paper, national guidelines, or a technical report, which can be used to support and influence international standards.

4.2.69 The BSI recognised that the current medical device standards for alarms and alarm systems do not address patient safety and usability requirements in relation to human factors and the variable environments in which devices are used. Incorporating aspects of usability and human factors principles, and environment of use considerations, in the device innovation and design processes, would minimise reliance on staff to mitigate usability risks.

4.2.70 The BSI is keen to collaborate with HSSIB and other stakeholders, including the NHS, to further understand the environmental and human factors challenges that can affect the safe use of medical devices, including ambulatory infusion pumps. The BSI informed the investigation that the development of guidance on human factors and environmental use considerations to support the current medical device standards is within its power at a national level. This is something the BSI is keen to explore as it would have application across the wider healthcare sector where human factors, including environments of use, aspects could be considered in greater detail.

4.2.71 The BSI said that the US Food and Drug Administration (FDA), the Association for the Advancement of Medical Instrumentation (AAMI) and the American National Standards Institute (ANSI), have a more comprehensive body of standards addressing human factors, including environment of use considerations, for medical devices. This is set out in documents such as:

• ‘AAMI TIR59:2017 Integrating human factors into design controls’ –information regarding human factors engineering/usability engineering activities and their corresponding applicability to design controls.
• ‘ANSI/AAMI HE75:2009 (R2018) Human factors engineering – design of medical devices’ – covers general human factors engineering (HFE) principles, specific HFE principles geared towards certain user-interface attributes, and special applications of HFE.

4.2.72 The FDA also has a document ‘Applying human factors and usability engineering to medical devices’ (Food and Drug Administration, 2016). It states: ‘HFE/UE considerations in the development of medical devices involve the three major components of the device-user system: (1) device users, (2) device use environments and (3) device user interfaces. The interactions among the three components and the possible results are depicted graphically’ see figure 6.

Figure 6 Interactions among HFE/UE considerations result in either safe and effective use or unsafe or ineffective use (Food and Drug Administration, 2016)

4.2.73 Specifically in relation to the environments of use for medical devices, the document states:

‘You should evaluate and understand relevant characteristics of all intended use environments and describe them for the purpose of HFE/UE evaluation and design. These characteristics should be taken into account during the medical device development process, so that devices might be more accommodating of the conditions of use that could affect their use safety and effectiveness.’

(Food and Drug Administration, 2016)

4.2.74 Medical device design is an essential component in patient safety by supporting staff to deliver safe care. As discussed in the HSIB blog post, ‘The importance of equipment design in patient safety’:

‘… there are certain contexts or design features that can make it more likely that an error can occur. The design and usability of healthcare devices and equipment can impact on delivering the correct care in the context of busy and distracting healthcare environments.’

(Healthcare Safety Investigation Branch, 2023a)

4.2.75 The MHRA’s archived ‘Infusion systems’ document (Medicines and Healthcare products Regulatory Agency, 2013) stated that ‘In most fatal incidents no fault has been found with the infusion device, suggesting that use error is the most significant contributing factor’. Use error is ‘when staff who are trying to use devices for their intended purpose but make errors that are predictable, which may be due to devices and equipment not accommodating or being tested in the environments or conditions that staff work in’ (Healthcare Safety Investigation Branch, 2023). An example is staff not responding to ambulatory infusion pump alarms because they are not able to hear them in the environment in which they are used.

4.2.76 The investigation found that healthcare staff had limited perception of the risk to patient safety from the environments in which ambulatory infusion pumps are used. Equipment training can only be effective for ensuring patient safety alongside an understanding of additional risks that require management, such as environments, staffing levels, staff routines, background noise, frequency of checks and patient interaction. These additional risks are constantly fluctuating and are unpredictable, and staff are required to recognise and manage them accordingly. In essence this is a continuous dynamic risk assessment for the context and situation in which an ambulatory infusion pump is used.

4.2.77 The design and innovation of equipment using new technology (engineering controls – see appendix) can support patient safety by helping staff to mitigate fluctuating and unpredictable risks when accounting for HFE, UE and environments of use (O/2023/006). However, the development of new technology can take considerable time. In the interim, administrative measures such as additional guidance can provide some mitigation of risks.

4.2.78 International standards used by manufacturers of medical devices do not fully consider the environment in which the equipment is used. Furthermore, NHS staff are not always given guidance on how to use specific medical devices in the context of their varying environments, and how this may impact on patient safety.

HSSIB makes the following safety recommendations

4.2.79 In 2017 the MHRA published a document ‘Guidance on applying human factors and usability engineering to medical devices including drug-device combination products in Great Britain’, this was updated in 2021 (MHRA, 2021). The guidance ‘does not represent a compliance requirement’ and is ‘not intended to be prescriptive, but to be advisory for developers and UK Approved Bodies.’

4.2.80 A previous HSIB investigation recommended that the MHRA review this document to determine whether more specific guidance was required on how to incorporate human factors into post-market adverse event investigations (investigations into patient safety incidents involving medical devices once they are available on the market) (Healthcare Safety Investigation Branch, 2018). Therefore, this area was not explored further with the MHRA in this investigation.

Becton Dickinson (2019) T34TM syringe pump. 3rd edition updates. Available at https://www.bd.com/documents/international/brochures/infusion/IF_CME-T34-Ambulatory-Syringe-Pump-Updates-to-3rd-Edition_BR_EN.pdf (Accessed May 2023).

British Standards Institution (2015) Medical electrical equipment part 2-24: particular requirements for the basic safety and essential performance of infusion pumps and controllers. BS EN 60601-2-24:2015.

British Standards Institution (2021) Medical electrical equipment. Part 1-8: general requirements for basic safety and essential performance – collateral standard: general requirements, tests and guidance for alarm systems in medical electrical equipment and medical electrical systems. BS EN 60601-1-8:2007+A2:2021.

Carayon, P., Schoofs Hundt, A., et al. (2006) Work system design for patient safety: the SEIPS model, Quality and Safety in Health Care, 15(1), i50-i58.

Care Home Direct (2023) T34 ambulatory syringe pump T34 lockbox. Available at https://carehomedirect.co.uk/product/t34-ambulatory-syringe-pump-t34-lockbox/ (Accessed May 2023).

CME Medical (2016) T34™ ambulatory syringe pump. Available at https://www.bd.com/documents/international/guides/quick-guides/infusion/IF_CME-T34-Ambulatory-Syringe-Pump-Lock-Off-Duration_UG_EN.pdf (Accessed October 2022).

CME Medical (2019) T34™ syringe pump (3rd edition). Lock on duration (prime and load). Quick reference guide for homecare. Available at https://www.bd.com/documents/international/guides/quick-guides/infusion/IF_T34-QRG-Homecare-PAT-999-103EN_Rev04_QG_EN.pdf (Accessed October 2022).

Eitan Medical (2022) Avoset™ Redefining Post-Acute Care. Available at https://eitanmedical.com/avoset-infusion-pump/ (Accessed May 2023).

Eitan Medical (2023) Avoset™. Available at https://eitanmedical.com/wp-content/uploads/2023/04/Avoset-Brochure_2023_EN.pdf (Accessed May 2023).

European Commission (n.d.) Competition policy. Available at https://competition-policy.ec.europa.eu/consumers/why-competition-policy-important-consumers_en (Accessed October 2022).

Faculty of Pain Medicine of the Royal College of Anaesthetists (2023) Guidance on Competencies for the Management of Cancer Pain in Adults. Available at https://fpm.ac.uk/sites/fpm/files/documents/2023-05/Guidance-management-cancer-pain-adults.pdf (Accessed June 2023).

Food and Drug Administration (2016) Applying human factors and usability engineering to medical devices. Available at https://www.fda.gov/media/80481/download(Accessed March 2023).

Healthcare Improvement Scotland (2020) Guidelines for the use of the Version 2 CME T34 syringe pump for adults in palliative care. Available at https://www.palliativecareguidelines.scot.nhs.uk/media/71389/2020-cme-t34-guidelines.pdf (Accessed February 2023).

Healthcare Safety Investigation Branch (2018) Design and safe use of portable oxygen systems. Available at https://www.hssib.org.uk/patient-safety-investigations/design-and-safe-use-of-portable-oxygen-systems/ (Accessed October 2023).

Healthcare Safety Investigation Branch (2020) Placement of nasogastric tubes. Available at https://www.hssib.org.uk/patient-safety-investigations/placement-of-nasogastric-tubes/ (Accessed October 2023).

Healthcare Safety Investigation Branch (2022) The use of an appropriate flush fluid with arterial lines. Available at https://www.hssib.org.uk/patient-safety-investigations/the-use-of-an-appropriate-flush-fluid-with-arterial-lines (Accessed October 2023).

Healthcare Safety Investigation Branch (2023a) The importance of equipment design in patient safety. Available at https://www.hssib.org.uk/news-events-blog/the-importance-of-equipment-design-in-patient-safety/ (Accessed October 2023).

Healthcare Safety Investigation Branch (2023b) Safety risk of air embolus associated with central venous catheters used for haemodialysis treatment. Available at https://www.hssib.org.uk/patient-safety-investigations/safety-risks-associated-with-central-venous-catheters-used-for-haemodialysis-treatment/ (Accessed October 2023).

Marie Curie (n.d.) Syringe pumps in palliative care. Available at https://www.mariecurie.org.uk/professionals/palliative-care-knowledge-zone/symptom-control/syringe-drivers#stops-working (Accessed February 2023).

Marie Curie (2022) What is palliative care? Available at https://www.mariecurie.org.uk/help/support/diagnosed/recent-diagnosis/palliative-care-end-of-life-care(Accessed October 2022).

Medical Devices Regulations (2002) Available at https://www.legislation.gov.uk/uksi/2002/618/contents/made (Accessed December 2022).

Medicines and Healthcare products Regulatory Agency (2013) Infusion systems. Available at https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/832481/Infusion_systems_2013_archived.pdf(Accessed October 2022).

Medicines and Healthcare products Regulatory Agency (2020) All T34 and T34L (T60) ambulatory syringe pumps – check pumps before each use due to risk of under-infusion and no alarm (MDA/2020/007). Available at https://www.gov.uk/drug-device-alerts/all-t34-and-t34l-t60-ambulatory-syringe-pumps-check-pumps-before-each-use-due-to-risk-of-under-infusion-and-no-alarm-mdr-2020-007(Accessed May 2023).

Medicines and Healthcare products Regulatory Agency (2021a) Infusion pumps: T34 syringe drivers. Available at https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/1026856/T34_syringe_pump_guidance_for_gov-uk.pdf (Accessed October 2022).

Medicines and Healthcare products Regulatory Agency (2021b) The Yellow Card scheme: guidance for healthcare professionals, patients and the public. Available at https://www.gov.uk/guidance/the-yellow-card-scheme-guidance-for-healthcare-professionals (Accessed October 2022).

National Institute for Occupational Safety and Health (2023) Hierarchy of controls. Available at https://www.cdc.gov/niosh/topics/hierarchy/default.html (Accessed January 2023).

National Patient Safety Agency (2010) Design for patient safety - A guide to the design of electronic infusion devices. Available at https://www.rca.ac.uk/documents/401/NPSAInfusion_devicesSallyHalls.pdf (Accessed June 2023).

NHS (n.d.) Welcome to NRLS reporting. Available at https://report.nrls.nhs.uk/nrlsreporting/Default.aspx (Accessed October 2022).

NHS (2022) What end of life care involves. Available at https://www.nhs.uk/conditions/end-of-life-care/what-it-involves-and-when-it-starts/ (Accessed October 2022).

NHS England (2014) NHS/PSA/D/2014/006 Improving medical device incident reporting and learning. Supporting information. Available at https://www.england.nhs.uk/wp-content/uploads/2019/12/psa-med-dev-0414.pdf (Accessed February 2023).

NHS England (2015) Serious Incident Framework 2015/16 – frequently asked questions. Available at https://www.england.nhs.uk/wp-content/uploads/2015/03/serious-incident-framwrk-15-16-faqs-fin.pdf (Accessed October 2022).

NHS England (2021) Digital Clinical Safety Strategy. Available at https://transform.england.nhs.uk/key-tools-and-info/digital-clinical-safety-strategy/ (Accessed January 2023).

NHS England (2023) Learn from Patient Safety Events (LFPSE) service. Available at https://www.england.nhs.uk/patient-safety/learn-from-patient-safety-events-service/ (Accessed January 2023).

NHS England and NHS Improvement (2021) NRLS official statistics publications: data quality statement. Available at https://www.england.nhs.uk/wp-content/uploads/2021/09/NRLS-Data-Quality-Statement-Sept-21-FINAL.pdf (Accessed April 2023).

NHS Supply Chain (n.d.a) About NHS Supply Chain. Available at https://www.supplychain.nhs.uk/about-us/ (Accessed October 2022).

NHS Supply Chain (n.d.b) Safety. Available at https://www.supplychain.nhs.uk/clinical-and-product-assurance-capa/safety/ (Accessed October 2022).

NHS Supply Chain (2021) Essential spec template 2021 V1 – ambulatory syringe pump. Excel spreadsheet – provided by email July 2022.

Palliative Care Guidelines Plus (n.d.) Welcome to Palliative Care Guidelines Plus. Available at https://book.pallcare.info/index.php?op=plugin&src=opiconv (Accessed May 2023).

Tinnitus UK (n.d.) How loud is loud? Available at https://tinnitus.org.uk/join-the-cause/plugem/how-loud-is-loud/ (Accessed May 2023).

Wilcock, A., Howard P., et al. (Eds.) (2022). Palliative Care Formulary (8th edition). Pharmaceutical Press.

World Health Organization (2020) Palliative care. Available at https://www.who.int/news-room/fact-sheets/detail/palliative-care (Accessed October 2022).

Woo, M. and Bacon, O. (2020) Alarm fatigue. In Hall, K.K., Shoemaker-Hunt, S. et al, Making healthcare safer III: a critical analysis of existing and emerging patient safety practices. Available at https://www.ncbi.nlm.nih.gov/books/NBK555526/pdf/Bookshelf_NBK555526.pdf (Accessed May 2023).

Investigation approach

The reference event was reported to HSIB by the Trust where it took place. After completion of the reference event investigation the HSIB’s Chief Investigator authorised a national investigation based on HSIB’s patient safety risk criteria, as described below.

Outcome impact – what was, or is, the impact of the safety issue on people and services across the healthcare system?

Ambulatory infusion pumps are used in the provision of palliative care nationwide. This can be in hospitals, hospices and in the community. Risks to the successful delivery of medication via ambulatory infusion pumps may affect patients who are receiving care across all these environments.

Systemic risk – how widespread and how common a safety issue is this across the healthcare system?

Patients who have been diagnosed with a terminal illness can be cared for in all healthcare settings. Ambulatory infusion pumps can therefore be found in both acute and community settings, including in patients’ own homes.

Cancer pain affects up to 75% of patients with advanced disease (Faculty of Pain Medicine of the Royal College of Anaesthetists, 2023), for which ambulatory infusion pumps may be used to provide pain relief.

Learning potential – what is the potential for an HSIB investigation to lead to positive changes and improvements to patient safety across the healthcare system?

A national safety investigation can provide insight into persistent safety risks and make recommendations that stimulate change. In addition, HSIB investigations provide an opportunity to share learnings from stakeholders and/or healthcare providers who have made improvements to processes and practices.

Evidence gathering

The investigation was completed between March 2022 and May 2023.

The investigation interviewed several staff involved in the reference event and met with additional staff from the wider organisation. The investigation was however unable to interview two key members of staff who were directly involved in the reference event. This limited the investigation’s understanding of events and decision making.

The investigation visited the Trust where the reference event took place and observed the systems and processes used in providing palliative care on an acute oncology ward. The investigation also visited the medical engineering department at the Trust.

During the national investigation, observational visits were made to an acute oncology ward and a hospice where the investigation engaged with clinical staff providing palliative care.

The investigation also engaged with national healthcare bodies in the areas being explored (see below). Further evidence was gathered from national policy and guidance, and research literature.

The investigation also considered previous HSIB investigations where incident reporting was considered. These are listed below.

• ‘Placement of nasogastric tubes’ (Healthcare Safety Investigation Branch, 2020). This investigation found that:

‘Reporting NG medical device related incidents to the Medicines and Healthcare products Regulatory Agency (MHRA) via its Yellow Card scheme is less frequently done in comparison to NG tube related incidents reported on the National Reporting and Learning System or Strategic Executive Information System (national systems for reporting patient safety incidents).’

• The finding resulted in an observation (O/2020/087) which included:

‘… arrangements for ensuring all medical device related incidents, Yellow Card reports, or other device safety related information … are shared between the relevant organisations to inform their respective patient safety responsibilities.’

• ‘The use of an appropriate flush fluid with arterial lines’ (Healthcare Safety Investigation Branch, 2022). This report discussed several considerations ‘regarding the reliability of using the NRLS and MHRA Yellow Card reports to establish the frequency of incidents and associated level of harm’. These included:
• ‘Yellow Card reporting by the public and healthcare professional is promoted but reporting is not compulsory.’
• ‘Medical device manufacturers are obliged to report certain types of incidents directly to the MHRA; this is influenced by the robustness of their post market surveillance processes.’
• ‘The number of reports submitted reflects the reporting culture, not how often incidents happen (NHS England and NHS Improvement, 2021).’
• The report contained an observation (O/2022/179) that stated:

‘It may be beneficial to recognise that safety risks are not reliably reported and therefore that the likelihood and level of harm may not be accurately reflected through existing reporting systems.’

• ‘Safety risk of air embolus associated with central venous catheters used for haemodialysis treatment’ (Healthcare Safety Investigation Branch, 2023b). This investigation found that:

‘Incidents appear to be under-reported due to misconceptions about ‘human error’ being the cause [of an incident], rather than the design of the equipment.’

• The investigation report found that:

‘… the MHRA had undertaken an alpha (development) phase, in conjunction with [NHS England], to explore options for the integration of the Yellow Card database with LFPSE. While a recent bid for an in-service solution was unsuccessful, the MHRA has advised that both organisations are committed to work in partnership to drive this project forward.’

Analysis of the evidence

The investigation used the Systems Engineering Initiative for Patient Safety (SEIPS) (Carayon et al, 2006) to explore the wider national picture. This tool was used as a guide during site visits for collecting evidence and in analysing the data gathered. SEIPS provides a human factors framework for understanding structures, processes and outcomes, and the relationships between these.

The investigation also used the hierarchy of hazard control (Health and Safety Executive, 2019) (see figure A1) during the analysis of controls. The hierarchy of hazard control is used by those in industry who plan and implement mitigations to reduce risks that have been identified in the workplace. Risks should be reduced to the lowest practicable level and the hierarchy helps decision makers assess and prioritise mitigations that are more likely to be effective.

Figure A1 Hierarchy of hazard control (National Institute for Occupational Safety and Health (2023).

Stakeholder engagement and consultation

The investigation engaged with stakeholders (see table A1) to gather evidence during the investigation. This also enabled checking for factual accuracy and overall sense-checking. The stakeholders contributed to the development of the safety recommendations and safety observations based on the evidence gathered.

Table A1 Stakeholders engaged during the investigation