Fresenius Medical Care, Deutschland GmbH, Bad Homburg, Germany
Introduction
Chronic and acute extracorporeal detoxification treatments, such as haemodialysis, haemofiltration, haemodiafiltration or haemoperfusion, clearly have become parts of the standard armamentarium of modern medicine. The necessary technical equipment has been transformed in the course of the last decades from prototype-like monsters (which nobody dared to touch without thorough education) to handy, nicely designed and reliably working commercial products that are produced in large quantities by the medical industry. It has been estimated that in 1999 the worldwide inventory was more than 280000 dialysis machines with about 40000 new devices entering this market in 1999 alone. Given these numbers it is certainly justified to qualify the use of extracorporeal detoxification technology as a routine procedure.
Are these procedures safe?
We have seen in many other fields, such as air transportation, nuclear power generation and other examples of routinely applied sophisticated technologies, that it is apparently part of human nature to quickly forget that none of these technologies is free of risks and hazards. Consequently, it is only a matter of probability when and where these technologies will fail terribly. Unfortunately, experience tells also that when such apparently inevitable events have occurred, public interest, sometimes even public uproar, flares up for a short time. Subsequently, the problem is laid to rest again and is of interest only to a small number of specialists whose profession it is to deal with such matters.
I do not want to be cynical, but from long personal experience in the technical development of extracorporeal detoxification procedures and devices, it is my opinion that the dialysis community is not very different from this forget as quickly as possible mentality of the general public. Let me illustrate this by an anecdote. Once I had to give a lecture to medical doctors about the technical risks of extracorporeal detoxification treatments. A discussion followed and I was struck by a comment from the auditorium ... I do not want to know all this!. Needless to say that such an approach is dangerously wrong. It is therefore the purpose of this comment to emphasize that it is vital, in order to provide safe extracorporeal treatments, that:
Experience tells me that such technical considerations are not extremely popular with the medical staff, but it is imperative for the sake of the patients' safety that the medical staff deals with these issues.
How great is the technical risk in extracorporeal detoxification?
It is surprising that it is difficult, if not impossible, to provide exact quantitative information on this point for most parts of the world. Currently there is next to no consolidated data source that provides information about accidents, or near accidents, when such medical devices are used. The available information is fragmentary, selected data are available to single manufacturers, some state authorities collect this information for specific countries, but even these sources are not well structured, consolidated or accessible to the public. One of the few exceptions that the author is aware of is the reporting system of the US Food and Drug Administration (FDA). In particular, the most recent database MAUDE (Manufacturer and User Facility Device Experience Database) [1] and the MDR database (Medical Device Reporting) [2] cover events that had occurred before 31 July 1996. Even these databases, valuable though they are, do not provide accurate numbers for structured searches, since a certain subjected element in the reporting process is involved. In addition, the reports in these databases are descriptive rather than conclusive.
A quick scan of the MDR data base for the interval 19921996 yields 47 reported cases concerning death of the patients in the presence of a haemodialysis machine. If one applies common sense and experience to interpret these reports, one can come up with a rough estimate: in 17% of the cases the cause of death was listed as unknown; in 36% of the deaths these are presumably due to underlying disease, the terminal event just happening while the patient was on dialysis; in another 34% of cases the death was related to human error; and in 3% of the cases death can be attributed to allergic reactions. It is only in 10% of the cases that technical failure of equipment is the most likely cause of death. I emphasize that these numbers are imprecise and incomplete, but they may serve to give an impression of the order of magnitude of the problem. It is not unreasonable, however, to assume that these numbers are only the tip of the iceberg. It is clear, nevertheless, that technical failure of the equipment is responsible for only a very small number of deaths relative to the huge number of treatments performed. In contrast, the number of fatal accidents related to human error is unacceptably high. Although the data are soft, one can draw three conclusions:
What is the contribution of industry to patient safety?
Since the mid 1980s mandatory safety features of dialysis machines have been imposed and they are the subject of various national and international standards. The most important ones are the IEC standards (International Electrotechnical Commission) and the very similar AAMI standards (American Association of Medical Instrumentation). The latter apply to the United States. For every machine sold after the mid 1980s the user is assured that these devices comply with the respective standards. Compliance is enforced by the various approval and certification procedures. These standards, however, define only minimum safety requirements. Every manufacturer is free to do more than these safety standards require. Rarely, however, do safety features go beyond these minimum requirements, since so far safety does not seem to be a major sales argument on the dialysis market which is increasingly dominated by purely financial considerations.
The basic concept underlying these standards is the first failure safety strategy. This term means that a dialysis machine must not expose the patient to a safety hazard when a first failure occurs in any critical system of the device. It is imperative, however, that the device is transferred into the so-called safe state. The safe statedepending on the nature of the particular hazardis a certain configuration of the device in which a safety hazard can be excluded. For instance, for all blood alarms the safe state requires to stop the blood pump(s), to close the venous line clamp, to reduce UF to minimum and to activate audible and visual alarm indicators. I emphasize, however, that by definition a patient is not safe against the second fault in the same system during the same treatment. The practical implications of this are discussed later in this Editorial. In this context a common misunderstanding is to mix up safety and reliability. An absolutely unreliable device may fail numeroustimes during the treatment, but it can do so in a safe way, so that no hazard for the patient is created. The topic of this discussion is exclusively safety, and not reliability.
In most cases, the principle of first failure safety is implemented by a so-called diverse technical structure of the dialysis machine (Figure 1). Without going into details, this means that two completely independent technical systems, i.e. the operative system and the protective system are involved in the same process. The operative system is the part of the device that actually performs a certain function (example: dialysate proportioning system), whilst the protective system (corresponding example: temperature compensated conductivity monitoring) monitors the output of this process for hazardous deviations. When such a structure is implemented, at least two independent failures in the same system during one single treatment are required before the device operates in an unsafe fashion. Dialysis machines are technically complex. The failure probability of the components involved can be calculated and the statistical likelihood for a potentially fatal second failure within the same treatment shows to be in the order of approximately 10-8 per hour [3]. In order to have an appreciation of what this figure implies, I quote one example: the statistical probability to die from a fatal accident during professional life in a typical Western country is of the same order of magnitude. To put it differently: compliance with the principle of first fault safety renders dialysis as a technical process as safeor as unsafeas daily professional life. Viewed in this perspective, patients safety during dialysis is a reasonable compromise between the vital interest of the patient and the required technical and economical input.
|
|
Nothing is perfect
The above mentioned standards deal with potential safety hazards related to dialysis and similar extracorporeal procedures. It is required that a protective system has to be provided for every potential safety hazard. The standards provide typical examples for such systems which are adopted by most manufacturers. Unfortunately, several of the systems proposed by the standard lists, under certain circumstances, might have limited sensitivities. This implies that safety hazards cannot always be detected sufficiently fast and sensitively. Therefore, it is required that the documents accompanying a device must inform the user in a detailed fashion about the specific limitations of the various safety measures. Obviously, such knowledge is crucial for the operator in order to be able to conduct safe dialysis sessions. Why is the sensitivity of these systems limited? This mainly results from the necessary compromise between what is technically possible and what is economically affordable.
One major technical risk during extracorporeal detoxification is blood loss to the environment. The protective system addressing this problem comprises monitoring of the extracorporeal venous pressure to detect this kind of leakage. The devices normally have an alarm window with a finite upper and lower limit. It is therefore obvious that a blood leak must be sufficiently large to be detected from the resulting venous pressure decrease (and this only provided the alarm window is appropriately located). It is widely believed, but definitely wrong, that the best location of the alarm window is in the centre position around the pressure that is to be monitored. In reality the system is the more sensitive the closer the lower limit is positioned towards the actual pressure. However, such a favourable alarm limit position can cause frequent nuisance alarms as a result of small pressure fluctuations which are not dangerous at all. This may be the reason that such an asymmetric alarm window position is rarely used. These nuisance alarms are a general problem with many existing brands of dialysis machines where further industry actions are required. Frequent alarms that do not indicate a hazardous situation but are caused by harmless fluctuations are not only disturbing but can reduce the alertness of the operator for the really important events.
Accidents related to undetected blood loss to the environment occur frequently. The worst case is disconnection of the venous needle from the vascular access of the patient. It is obvious from the principle underlying the monitoring that the venous pressure will only change if the blood flow through the venous needle changes. This will not be the case if the venous needle is dislocated. There is no system currently available on the market that would be able to detect this event, which may very rapidly lead to a fatal accident. This problem has been reported in literature [5] and all manufacturers inform the operator in the respective manuals about this specific hazard. Nevertheless, recurrent reports concerning such often fatal accidents document that not all operators fully appreciate this danger. Currently there is no technical system to exclude such accidents, although this will hopefully change in the future. In the meantime the best strategy is to appropriately fix the needle and tubing and to keep the site accessible to inspection, e.g. not to cover it by blankets, etc. Operator awareness of the great danger of extracorporeal disconnections is the only way to prevent such tragic yet stupid accidents which may result in loss of lives.
Another hazard that may go undetected with commonly used protective systems, is mechanical haemolysis. This may result from obstructions in the extracorporeal circuit, e.g. kinking as a result of faulty handling or manufacturing problems [68]. The most critical segment is that between the arterial blood pump and the blood inlet of the dialyser. Since in this situation shear stress causes erythrocyte damage, the use of static pressure monitors is of limited value to detect this hazard. Most manufacturers offer advice on how to avoid kinks of the extracorporeal blood lines. Quality line sets have appropriately high wall thickness to further reduce this hazard. Faulty blood lines may soften and tend to undergo kinking, i.e. at blood temperature. The reports on this hazard underline how important it is to use high quality blood lines instead of line sets of dubious origin and even without proper certification that they are suitable for a particular medical device.
Due to limitations of space I cannot describe all potential hazards. Further potential hazards comprise, for instance, ultrafiltration errors, concentrate mix-ups, and air infusion. One has to be aware that there are inherent hazards involved in extracorporeal detoxification procedures. Even though modern equipment provides a wide array of safety features which are continuously updated and improved by the manufacturers, the educated and consciously acting operator is and will remain a key element to provide safe treatments.
Conclusions
I wish to close by giving a few simple rules which the operator should remember.
Unfortunately, absolute safety cannot be guaranteed, even for high quality medical devices. Experience tells us, however, that the above rules can lower the probability of incidents during an extracorporeal detoxification to an inevitable minimum.
Notes
Correspondence and offprint requests to: Thomas Roy, Fresenius Medical Care, Department PPB-CE 3-A012, Else Kröner Strasse 1, D-61346 Bad Homburg, Germany.
References