The Functional Resonance Analysis Method in Healthcare

1. Introduction

Healthcare systems are nowadays seen as complex systems, which consist of individual agents that have the freedom to act in unpredictable ways, with their actions being interwoven in such a manner that the actions of one agent alter the context for the others, to use the words of Plsek and Greenhalgh. The increasing acknowledgement of this complex nature of healthcare systems has prompted the implementation of systems engineering approaches to better enhance quality and safety. To achieve such a goal, it is necessary to go beyond the analysis of the individual components of care systems and examine how outcomes, both desired and undesired, arise from the interactions within and adaptations to everyday working conditions. This is particularly true when dealing with medical devices, whose complexity has greatly increased in recent years.
It must be noted that in this study, we intend as a “medical device” any instrument used for medical purposes, e.g., diagnosis and treatment, as defined by Article 2 of the Regulation (EU) 2017/745. Factors negatively impacting the safety and reliability of high-tech medical devices include their design features, their interactions with one another, as well as insufficient training related to their use and maintenance operations. Despite such complexity, traditionally, the safety of medical devices has been treated in a linear manner following a root cause analysis approach, which is based on a “find and fix” mentality. This implies that hazardous causal events are identified and corrected to prevent the recognized accident or incident from occurring again. However, this approach is not sufficient to face the complex interactions occurring between operators and patients on the one hand, and medical devices and equipment on the other. Healthcare systems, such as hospitals, are dynamic, partially described, and thus underspecified when considering safety management. In these systems, the use and management of medical devices are regulated by strict safety procedures/protocols relying on the above-mentioned linear approach, the conformity to which can reduce the opportunity to enhance the system.
For this reason, in recent studies addressing occupational health and safety (OHS) management in the healthcare sector, ever greater attention has been paid to combining traditional risk management tools with more proactive approaches that allow the achievement of resilient systems. At a general level, Costella et al. defined four main resilience engineering (RE) principles: Commitment (top management), Flexibility, Awareness, and Learning.
In this study, we focused on the fourth one, which emphasizes the ability to learn from both incidents/accidents and normal work to provide successful working strategies. The former issue, i.e., a retrospective analysis of incidents/accidents, should be addressed not only to understand what went wrong but also to learn lessons to avoid a repetition of the adverse event. The need for further research focused on the analysis of adverse events related to the use of medical devices is stressed by Amoore, who underlines the necessity of bringing to light the wider causes of an accident/incident based on the interactions among the medical device, the clinical team, and the infrastructure, which all revolve around the patients.
As in other industrial contexts, adverse events such as accidents or incidents can be caused by the non-trivial socio-technical interactions among these agents, rather than by a linear causal chain, as clearly argued by Nakhal Akel et al.
Moreover, besides the analysis of adverse events, learning should be based on the analysis of how procedures are implemented, as this can allow a reduction in the gap between work-as-imagined (WAI, i.e., how managers envision work activities) and work-as-done (WAD, i.e., how front-line operatives actually perform work activities). However, in practice, this gap cannot be completely abated by aligning WAD and WAI. Thus, safety managers have to be aware of this discrepancy fostering adaptations that can allow the achievement of good outcomes. Needless to say, the Learning principle is strictly related to the third principle, Awareness, as learning lessons from the analysis of adverse events or normal work can augment individual and team awareness of safety.

Based on the above considerations, this study aims to investigate the WAD–WAI discrepancies in two case studies related to the use of medical devices. For this purpose, the Functional Resonance Analysis Method (FRAM) was utilized, as it represents one of the most well-known tools for systemic safety assessment in complex and dynamic domains. FRAM is a performance-based risk identification tool to model socio-technical systems, which enables the characterization of these systems by providing a detailed description of their functional relationships. The FRAM application can successfully allow safety managers to augment their awareness of medical device management. As outlined by Patriarca et al., FRAM is mainly used for both retrospective and prospective risk analyses: the former use consists in the analysis of past accidents and, based on the reporting of these events, aims to examine how an adverse outcome propagated and how its causes or effects were amplified across the socio-technical system. In the latter case, instead, FRAM is used to model the behavior of the socio-technical system to better identify and manage its risks.
According to Salehi et al., healthcare is the most common sector that has employed FRAM for risk assessment purposes. The number of these studies can be considered significant, and this confirms the fact that hospitals are dynamic, partially described, and underspecified socio-technical systems, which need to be analyzed by means of a resilience engineering approach. Most studies using FRAM in healthcare focus on the analysis of work procedures such as the discharge process of frail patients, the management of primary care, preoperative anticoagulation, and medication administration. Other studies used FRAM for the analysis and improvement of intensive care units by focusing on the transition process of critically ill patients, the recovery following intensive care treatment, or the co-administration of multiple medicines. Moreover, several studies aimed at the improvement of guidelines and safety procedures, for example, the provision of indicators to better manage and monitor the blood sampling process; the identification of characteristics, skills, preconditions, and resources necessary for safety investigations; and the implementation of a clinical decision support system to reduce the gap between WAI and WAD. In contrast, in a few studies, FRAM was applied to analyze accidents/incidents in the healthcare context. For example, Pickup et al. investigated incidents in blood sampling activities with the goal of bringing to light the most influential factors affecting the variability of the blood sampling process. Goldman et al., by means of interviews with nurses and physicians, identified several incident cases and applied FRAM to create an instantiation and identify areas of variation. FRAM was also used to investigate an accident where surgical materials were left in a patient’s abdomen during a surgical procedure.
However, compared to other sectors such as maritime and air transportation, manufacturing plants, or offshore drilling units, the use of FRAM for accident/incident analysis in the healthcare context appears scarce. At the same time, the risk analysis of the use of medical devices by means of FRAM is also infrequent, although this method can be applied both prospectively and retrospectively for effective the risk assessment of interoperable medical device systems, as stressed by Samaras and Samaras.
Hence, to augment knowledge on the use of FRAM in the healthcare sector by means of practical analyses that can support practitioners in systematically observing and analyzing events, this method was applied retrospectively and prospectively. The first case study concerned the analysis of an accident in an HBOT room that occurred in Italy in 1997 and caused 11 victims, while the second case is related to the analysis of the current management of a room where an MRI machine is used for patients’ diagnosis.
These case studies were selected as they present similar safety criticalities, which are due to the fact that in both cases, a “special” room has to be managed where both patients and medical staff interact.
Accordingly, on the one hand, this study aims to augment knowledge on the practical application of a resilience approach for the risk assessment of medical device management, given that, compared to other sectors, the use of FRAM in the healthcare context appears scarce especially for what concerns accident/incident analysis.
On the other hand, the practical contribution of the study consists in bringing to light discrepancies between clinical practice (WAD) and hospital protocols (WAI) to allow the safer management of the above-mentioned safety devices and thus enhance the performances of clinical personnel, in line with van Dijk et al. As a matter of fact, although the occurrence of several accidents related to the use of complex medical devices such as the HBOT room has led to strict safety regulations and standards, current safety management practices related to the use of these devices still present vulnerabilities when analyzed from a resilience engineering standpoint.
The remainder of this manuscript is organized as follows. Section 2 concerns a brief explanation of the FRAM’s main features and its application in the healthcare sector. In Section 3 and 4 the two case studies are respectively described, while in Section 5, the discussion of the study outcomes is proposed. Finally, conclusive remarks are addressed in Section 6.

2. Materials and Methods

Then, the variability of the functions individuated in the previous step (which can be endogenous (or internal), exogenous (or external), or influenced by upstream functions) is evaluated. The next step consists in determining if and where functional resonance may occur, i.e., how the output of each function is related to the various aspects of other functions. Thus, from the graphical point of view, the hexagons (i.e., the functions) are connected (Figure 2). Such a process, which is called “coupling”, aims to bring to light the dependencies among the functions. It is noteworthy to observe that while the link between the output (O) of one function and the input (I) of the following one goes without saying, additional dependencies can occur.

Finally, the consequences of the variability are evaluated to determine interventions to reduce the variability of the function’s performance when it is negative or to enhance it when the variability is considered beneficial for the system. It is worth noting that when describing a sequence of activities, each phase can be represented by a function, which can be a human, technological, or organizational activity.

2.2. Study Features

Based on the above considerations, our study focused on the application of FRAM to two complex medical devices (a magnetic resonance imaging (MRI) machine and a hyperbaric oxygen therapy (HBOT room) that have the same risk profile according to Regulation 2017/745 and similar use and management procedures, which can be summarized as follows. The treatment is carried out in a specific room or chamber, which is isolated from the rest of the hospital. To access the room, strict control is needed to avoid the patient/hospital staff carrying in hazardous objects and substances, as well as some types of implants. For these reasons, in both cases, specific information has to be provided to patients during the acceptance phase and the medical staff in charge of operating these devices must receive specific training. Regarding the latter aspect, in the team, the presence of a medical manager (who is responsible for the safety, quality and appropriateness of the therapies administered) and a technician (who is responsible for the management and proper functioning of the whole system and operates under the direction of the medical manager) is mandatory. Besides these organizational requirements, it must be noted that the maintenance of these devices and the related safety systems undergo similar procedures that foresee periodic checks and continuous monitoring.

3. Case Study 1

3.1. Case Study Context and Goal of the Analysis

The first case study concerned the analysis of the accident that occurred in 1997 in an Italian hospital and consisted in a fire in a hyperbaric oxygen therapy (HBOT) room (or chamber). This accident caused the death of ten patients and one nurse, who were in the HBOT when the fire broke out. A multi-place HBOT room can provide oxygen therapy treatment to two or more people at the same time. For this purpose, each patient inside the room uses a mask or a hood for breathing, and a nurse or a technician is usually in the room during the treatment to assist patients. This type of device allows patients to breathe oxygen at a pressure higher than the atmospheric pressure, and it is used for the treatment or prevention of several diseases. The presence of high-pressure oxygen and its augmented percentage represents a serious hazard of fire, explosion, or implosion, which has led to numerous accidents worldwide.
Nowadays, to prevent the occurrence of these types of accidents, international regulations and technical standards establish strict safety requirements for both manufacturers and users. In particular, as far as operational safety is concerned, several basic rules must be observed during the use of the device, such as avoiding the presence of volatile or flammable liquids in the chamber; avoiding the presence of combustible lubricants; keeping the oxygen concentration below 23%, etc.. Furthermore, the continuous monitoring of the chamber is requested during its use, as well as the periodic maintenance of fire suppression systems [63]. For this purpose, specific training of the hospital personnel in charge of using the device is foreseen, as well as providing information to patients. At the time of the accident in Milan, most current safety requirements were not issued yet. However, procedures on the proper use and maintenance of the equipment were in use at the hospital, as well as constructive safety requirements for the device manufacturer. As emerged from the investigations carried out following the accident, a gas-operated hand warmer introduced into the chamber by a 77-year-old female patient was the probable trigger, and it is likely that the chamber was pressurized with oxygen rather than air, as an explosive fire would not occur in a chamber pressurized with air. The increase in the oxygen percentage was caused by the use of hoods that were modified by the hospital personnel to make them easier to wear: in detail, two zips in the latex collar were added, causing a significant oxygen leakage from the zips and the collar itself. Thus, in the chamber, the percentage of oxygen was much higher (27%) than the requested level (23%). Moreover, the fire suppression system of the chamber was found to be not functioning, as the water tank of the fire extinguishing system was empty and the shutter of the water delivery pipe was found closed, as was the valve of the compressed air cylinder used as propellant (although the fire tank was prepared for the installation of the level gauge, this had never been installed). Hence, due to the failure of the extinguishing system, the fire was extinguished only due to the exhaustion of the oxygen present inside the chamber: it was found that some people in the chamber survived for at least a minute after the fire broke out. They could have been saved if the fire suppression system had been working. Although police investigations and the subsequent trial provided a detailed technical analysis of the accident, a proper accident analysis method was not used, missing a systemic perspective on the elements and events that were analyzed independently.
With this goal in mind, to achieve a more comprehensive understanding of the accident, a FRAM model was developed, starting from the analysis of the correct functioning of the HBOT room considering the safety requirements and procedures in force when the accident occurred. The analysis was carried out with the support of an expert, i.e., a maintenance engineer specializing in medical devices management.

3.2. Identification and Definition of the Functions

As suggested by Hollnagel and Goteman, the use of FRAM for accident investigation starts from the identification and characterization of essential functions. Then, the variability of each function is analyzed based on the accident reports, and its impact on the other functions is evaluated.
The first step consisted in the definition of essential functions, which are the following:

ACC. Patient acceptance: the function that activates the entire process is related to the patient’s suitability for the oxygen therapy treatment. Hospital staff has to verify the patient’s anamnesis and the request for the treatment issued by a specialist. In this phase, the patient should be informed about the risks related to the treatment, the prohibition of introducing flammable objects into the room, etc. The output of this organizational function is represented by the patient’s suitability for the oxygen treatment.
PREP. Chamber preparation: the hospital staff has to check the correct functioning of the HBOT room, including its safety systems, such as the fire extinguishing devices, as well as the masks/hoods to be used by the patients during the treatment. At the same time, the intervention threshold of the oxygen analyzer has to be set.
DEV. Provide devices: the hospital staff provides patients with a hood or a mask depending on the type of therapy and verifies they are worn correctly.
SET. Chamber closing and oxygen settings: once patients are equipped with the mask/hood and are in the correct position inside the chamber, the door is closed, and the HBOT room is set for the treatment.
RUN. Running treatment: the treatment is performed.
MON. Monitoring: during the treatment, the hospital staff has to monitor the correct functioning of the system and the proper percentage of oxygen administered. This control is carried out both outside the HBOT room through a control panel and inside the room (usually by a nurse who assists patients).
END. End treatment: when the treatment time is completed, the staff starts the decompression phase that is concluded with the opening of the chamber door.

3.3. Definition of the Variability

The further step concerned the analysis of the variability of each function: when the output of one function affects an aspect of another function, a coupling was established between them. An excerpt of the variability analysis of the Function SET (chamber closing and oxygen settings) is shown in Figure 3: the FRAM method was applied using the software FRAM Model Visualiser (FMV Pro, rel. 2.1.6) and the related FMV file is provided in the Supplementary Material.

Figure 3. Excerpt of the variability analysis of the Function SET (chamber closing and oxygen settings).

Hence, starting with the instantiation represented in Figure 4, we focused on the following issues:

In fact, the missing control and lack of information that occurred in performing Function ACC (patient acceptance) alone could have led to the injury of one patient only in the case of the correct performance of the other functions. Instead, the combination of these wrong actions with the tampering of the hood caused an explosion that affected the other occupants of the chamber. Some of the latter could have been saved anyway if the extinguishing systems inside the chamber (i.e., a sprinkler system and a fire hose) were correctly functioning. At the same time, the lack of alert systems capable of impeding the treatment, both in the case of the presence of a dangerous item inside the chamber (i.e., the gas-operated hand warmer) and when the fire systems are unavailable, must be highlighted, as the latter aspects are preconditions to correctly carry out the treatment. Moreover, the HBOT room was equipped with a system to regulate the maximum percentage of oxygen in the chamber, whose nominal value for the correct functioning of the system and effectiveness of the treatment was 23.5%. However, to avoid the activation of alarm systems, the intervention threshold of the oxygen analyzer was usually set by operators at concentrations above 27%, as they knew that the tampering of hoods could cause oxygen leakages.