Unremarkable errors: low-level disturbances in infusion pump use

In this paper we describe results from an exploratory study observing infusion pump use in practice. From 31 observations of pump programming we note 10 low-level disturbances, which we conceptualise in terms of unremarkable error. This data supports a view that well performing systems cope with error as part of their normal work. Users are able to recover from error and are resilient to performance deviations. However, it is not clear how we, as HCI researchers, should respond to these minor errors: should we aim to minimise them or instead aim to improve detection, recovery and control in safety-critical systems? What is clear is that without remarking on unremarkable error we cannot begin this dialogue and consider the handling of these issues. To conclude we recognise four important factors that influence remedial action, and we highlight the need for a socio-technical approach for making change that is appropriate for practice.


INTRODUCTION
Traditionally, in HCI, we have focused on things that go wrong.Whilst more recently, there has been a shift towards user experience and novel interactive experiences, some things are still going wrong.Whereas this can be frustrating in ticket machines and websites, it is safety-critical in healthcare.However, things very often also go right despite errors and design vulnerabilities, in ways that are typically unnoticed.People find ingenious ways to cope with challenging circumstances and poor design.Systems are said to be resilient where performance is maintained despite the existence of deficiencies and errors (Hollnagel, 2004).
In this paper, we report on a study in a hospital Day Care Unit, where we focused our attention on how nurses interact with infusion devices while treating patients.In practice, nurses make minor errors (deviations from the "golden path") in number entry and in device use, but they catch and correct these errors, making the system resilient.It is tempting to argue that devices should be designed to eliminate all such errors.In practice, though, this would be extremely costly, and probably infeasible.So the question then becomes: which are acceptable, which are not, and how is design and research effort best directed to prevent errors from escalating and to keep the system working efficiently.Exploring the resilience in unremarkable interactions and errors may help us to achieve this.
We propose to start a dialogue around these issues to make informed decisions about how to handle them.

BACKGROUND
Reporting and learning systems are in place to learn from accidents and SUIs (serious untoward incidents) in the NHS.These systems keep a record of remarkable events.However, studying normal work before things go wrong receives less attention.We utilise the concept of 'unremarkable' to look at normal work (Tolmie et al., 2002).This helps capture the routines and meanings that are not remarked upon, which would otherwise go unnoticed.

Studies in healthcare
To Err is Human (Kohn et al., 2000) is a widely cited report which highlights the need for improved understanding and intervention to reduce the occurrence of preventable harm in healthcare.They make the assertion that at least 44,000 Americans die each year from medical errorswhich is more than deaths separately attributable to motor-vehicle accidents, breast cancer, and AIDS.Preventing avoidable medical errors is a worldwide issue.For example, figures from the National Patient Safety Agency (NPSA) suggest that more than 5,700 patients in England died or suffered serious harm due to errors for the 6 months between October 2008 and March 2009.We believe that some of these errors can be prevented and reduced through the better design and use of medical devices.
One adverse incident which has a detailed inquiry report which is publicly available concerns the death of Wayne Jowett, in 2001, who received an intravenous medication intrathecally (Toft, 2001); i.e. a medication that was meant to be delivered into a vein was delivered into his spinal cord.The report demonstrates how the design of medical equipment and different people in different roles with different assumptions and procedures can contribute to a SUI.Independently these variations in normal performance may be absorbed by the system but here they conspired to cause this accident.Using a similar systemic perspective as demonstrated by Toft (2001) we wish to examine the strengths and vulnerabilities in system design that affect the likelihood of error.However, we look specifically around the design and use of medical devices, and we are looking at 'normal' work and not investigating a particular adverse incident.
Previous HCI-related studies show that medical devices suffer from design problems (Obradovich & Woods, 1996), that many errors can be observed in infusion device set-up but very few are reported (Husch et al., 2005), that staff have difficulty with new equipment and can have little support in using the device from the manufacturer (Randell, 2004a), and that staff and patients react very differently to alarms when devices sound (Randell, 2004b).Collectively these studies show important HCI issues around the design and use of medical devices that need investigating.We plan to build on this work and investigate infusion pump design and use on a Haematology and Oncology Day Unit.

Unremarkable interaction and error
Unremarkable computing was introduced as a concept to orientate the design of ubiquitous computing in domestic life (Tolmie et al., 2002).
Here, the emphasis is on trying to design systems that fit routine actions and support the semantics in context, rather than introducing unfamiliar technology and unnatural semantics, which disturb the context.To achieve this, special attention must be paid to the invisible: i.e. the actions and meanings that go unnoticed but contribute to the successful routine of everyday life.These sorts of expert, habitual, unspoken routines can also be seen in the Haematology and Oncology Day Unit.These routines contribute to the coordination of activities between staff, and between staff and patients.One example involves the preparation of the trolley that is loaded with the patient's medication and equipment needed to administer the treatment before the nurse approaches the patient.For the nurses involved, the movement and preparation of the trolley was found to signify a unit of work, and until it is cleared and tidied the unit of work is incomplete.This was highlighted when a new member of staff had left a trolley untidy after they had finished with a patient.A regular member of staff explained the routine and expected them to follow this practice.From this perspective an unorganised trolley represents an unorganised environment and unfinished work.
One of the key features of unremarkable phenomena is that they are regarded as normal and so people do not feel the need to remark on them.We think this not only applies to normal routines but also to low-level interaction error; e.g.number entry errors which are quickly modified to represent the correct value.Baker (1997) reports that whilst very few nurses have problems with reporting 'real errors' they would not report deviations from the formal institutional rules if according to their own rules these are not considered remarkable errors.These include: • If it's not my fault it is not an error; e.g. if a patient is not in the part of the ward where they were due to receive their treatment the nurse cannot perform their duties.• If everyone knows, it is not an error, e.g. an experienced nurse explained that drugs that should be administered at 0800 hours are administered at 0600 hours to fit the wards routine.The nurses that validated this informal set of rules were described as being "shocked by having to hear them spoken aloud," whilst some, "looked over their shoulders to see if anyone else could hear before they agreed that these are indeed the rules" (Baker, 1997).Given this response, it is not surprising that the nurses did not report interaction issues with their pumps, and that an observational approach is needed to investigate unremarkable interaction and errors.More broadly, it seems a tension exists between a traditional classification of error and actions taken to make the system work.

METHOD
This study focuses on a Haematology and Oncology Day Care Unit in a busy London hospital.
The unit provides treatment to patients on a day basis, i.e. typically patients will come in, get treatment and return home on the same day.This includes the use of infusion pumps for intravenous treatment; e.g.chemotherapy treatment.Given the high frequency of infusion pumps being used, these were the focus of the study.
Volumetric infusion pumps are important and ubiquitous medical devices in hospitals.These devices control the rate of flow of fluid from a bag to a patient.The bag will normally contain some form of medication or nutrient in fluid form.The volumetric pumps can be programmed specifying a VTBI (volume to be infused), an infusion rate and a time for the infusion.These devices will have some sort of number entry system and a display so one can see menus, messages and numbers being entered.
We took an observational approach to study the normal use of infusion pumps in context.These research activities were performed over five study days: • Work shadowing.The researcher shadowed members of the clinical team as they performed their duties with devices, e.g.setting up infusion pumps, making checks on devices, and seeing what happens when infusions were complete.
• Day Care Unit observation.The researcher observed working practices on the Day Care Unit to understand what was going on from day to day in the patient and staff areas.• Semi-structured interviews.We planned to interview five members of clinical staff at different grades (e.g.Band 5 nurse to Matron) but only two could be arranged because of how busy the nurses were.These two interviews were audio recorded and transcribed.Other members of staff were spoken to whilst being observed, and notes were kept of these interactions.

RESULTS
To contextualise low-level error, we describe the normal programming of an infusion pump before detailing ten disturbances that were observed.This normal programming path and its deviations are captured in Figure 1.

Normal infusion pump interaction
Figure 1 details a task analysis of infusion pump preparation and interaction, i.e. putting the right physical elements in place for the treatment and then programming the infusion pump.
In the preparation phase the nurse first needs to establish an access point in the patient.In most cases this will involve a cannula to create an intravenous access point in the arm of the patient.
The medicine for the patient is then collected and another nurse will check that the right medicine has been collected.The nurse will then check the patient's name and date of birth before the treatment is administered.Once these checks are complete, the nurse will hang the bag containing the treatment on a stand and retrieve a 'giving set'.This is the tubing that connects the bag and the patient, which contains a mechanism to be inserted into the pump so it can control and monitor the flow of the fluid.The bag is spiked, which connects the giving set and the bag, and the treatment is allowed to flow through the set until it reaches the end of the tubing so no air is in the line.That end is then attached to the patient and the nurse checks for air bubbles.At this stage, the fluid cannot flow because the roller clamp prevents it.
In the interaction stage the nurse turns on the pump and presses the eject button to open its door.The giving set is inserted and the door is closed.
The nurse then presses the OK button to get to the VTBI (volume to be infused) input screen.They input the correct value and confirm it by pressing OK.The nurse then either enters the infusion rate or the time, confirms this by pressing OK, and then the pump automatically calculates the third missing value, i.e. the infusion rate or the time for the infusion.The nurse will release the roller clamp that allows the fluid to flow.Once the nurse is confident that the pump has the correct values they press START, which starts the infusion, and they tell the patient how long the infusion will take.
Programming the pump in this interaction stage would typically last between 5 and 15 seconds.

Infusion pump error and disturbances
Generally, the devices were used without issue and with little effort.They seemed well designed and the nurses were happy with them.However, from 31 observations of infusion pump programming 10 disturbances or deviations from the 'golden path' were observed.These are interesting because they provide opportunity for learning.We know from the literature and experience that error and disturbances happen frequently (Reason, 2008).
Also, we know that people are very good at avoiding these errors, noticing them, and recovering from them (Hollnagel, 2004).'Resilience strategies' is a concept used to capture these sorts of behaviours (Furniss et al., 2011).
The following numbers correspond to the disturbances in Figure 1:

The access point
The infusion pump alarms when there is an occlusion in the line, which prevents the flow of fluid, and this can happen if the patient moves.This will mean that the nurse has to go over, check the occlusion, and continue the infusion.There was an incident where a nurse had to frequently go back to a patient because this was happening more than normal.The nurse said that she could not make a better insertion point because the patient's veins did not allow her to do so.Whilst the chemotherapy nurses are skilled in establishing intravenous access, the frequent use and subsequently poor state of the veins of some patients may require them to use access points which are prone to occlusion with the potential for more alarms and the need for more nurse attention.
Disturbance 2: Checking with another nurse.Safety procedures on the Unit require nurses to check that they have the right medicine with another nurse.This involves them signing the prescription so it is on record.The first author (hereafter referred to as A1) observed one nurse going through the details of the prescription with the patient, after she had done the checks with a colleague.It was only then she realised that she did not have the magnesium she was meant to have.It was an interesting case because the patient could speak little English and it was unlikely she understood the nurse.However, this explanation served to bring the oversight to the nurse's attention.The nurse reiterated how important it is to check.

Disturbance 3. Priming line with no bubbles
Intravenous therapy requires that the line delivering the treatment is free from air bubbles.The infusion pump also has the ability to detect these.However, the nurses reported that the hospital had recently received a batch of sets that tripped the alarm when there was not really a problem, i.e. it gave a false alarm.The nurses were advised to lubricate part of the set with alcohol gel as a workaround.A1 observed a case where the gel was not applied and the alarm went off.

Disturbance 4. Roller clamp control
The infusion device asks the nurse to release the roller clamp after the set has been inserted and the door has been closed.At this stage the nurse should release the roller clamp and press OK to confirm.However, many nurses do not release it at this stage and it does not appear to matter, just as long as it is done before START is pressed.A1 observed a nurse who pressed START before releasing the roller clamp.The alarm sounded and the nurse recalled they had not released it.In this case the nurse appeared to need to calculate the VTBI rather than it being on the prescription (similar to disturbance 5 below).We speculate that this extra cognitive load may have contributed to the nurse forgetting the roller clamp.
Another nurse A1 observed waited to see if you had to press OK after closing the pump's door, or whether the device would skip this screen after a time delay.This nurse was interested in this and thought A1 would be too given the study's aims so she was willing to carry out this experiment in her work.This demonstrated that the nurse did not understand the request to release the roller clamp upon closing the pump's door.The nurse seemed to just understand that OK needed to be pressed to reach the VTBI input screen.
Through discussing error with the roller clamp, a nurse explained that he was aware of instances where the roller clamp had been left up in gravity infusions.In gravity infusions pumps are not needed and so there is no alarm to warn the nurse the clamp has not been released.In these instances the patient thinks they are receiving treatment when actually nothing is happening.At one level this is merely a frustrating delay, but at another this can extend an already long visit for seriously ill patients, so it is non-trivial.
Disturbance 5. Enter VTBI value A1 observed a nurse who seemed to be interacting with the infusion pump more than normal.It turned out that the prescription she was given did not include the VTBI but only had the infusion rate and the time, i.e. 15ml/hr over 20min.She could not skip the VTBI step to enter the time and the rate directly, and the calculation was not working for her at the time.She guessed at a VTBI, then entered the rate or time to get a feel of what the actual figure was.The nurse then appeared to restart the machine and enter in the correct VTBI.This was unusual because in the majority of cases the VTBI is given on the prescription.

Disturbance 6. Battery charge
After pressing START the nurse immediately stopped the infusion and pointed to the battery indicator of the machine, which showed it was low.This patient had been receiving treatment all day and the battery would not last for the last two hour infusion he had left.The nurse looked for a plug socket but did not appear to be able to find a convenient one.She got another machine and reprogrammed it.She explained that the machine alarms if its batteries are running low and it is annoying having to change pumps part way through an infusion.This is because the new pump would need to be programmed with unfamiliar and partial VTBI and time values so calculations and checks would be more difficult.It was also noted that it is better not to have the infusion pumps plugged in because patients sometimes move around, e.g. to go to the toilet.

Disturbance 7. Tell patient length of treatment
The 'normal' case appears to be to inform the patient how long the infusion treatment will take; however, this step was not always observed.
Sometimes the nurse would also explain about the pump alarms and not to worry when they sounded e.g. if the pumps are within ten minutes of finishing a program their alarm will sound to alert the nurse.
Further disturbances to do with number input entry which are not indicated on Figure 1 include:

Disturbance 8. Within keying sequence
There was a nurse that intended to enter 1010ml for the VTBI.A minor error in their keying sequence meant that they first entered 100ml, then 1100ml, then 1000ml, then 1010ml.This was all done in a fast fluid motion and at no point did the nurse not appear in control.We are confident that this is no more than a very minor keying error.

Disturbance 9. Within menu keying issue
There was a nurse that entered 400ml for the VTBI but then paused rather than pressing OK.They rechecked the script and then changed the VTBI to 200ml and entered the time of 30min.We can speculate that the nurse had already calculated the infusion rate in their head and mistakenly entered this as the VTBI.

Disturbance 10. Between menu keying issue
There was a nurse that programmed the pump to give 250ml over 1hr.On pressing OK to confirm the time they checked the infusion bag, and then changed the time to 2hrs, pressed START and continued.Again, A1 did not sense that the nurse was not in control.

DISCUSSION
These observations raise interesting issues and questions.The first is that the system worked well, both in terms of safety and efficiency, and the nurses' own self-reports suggests that they do not have a problem with the device design or use.We highlight this because the content of this report might emphasise poor performance when this is not the case.We address other interesting areas that precipitate out of the unremarkable errors we observed in this context; including its resilient qualities, factors that influence the response to these low-level disturbances, and the need to consider system-wide socio-technical interventions.

Resilience and Recoveries
From the disturbances above we see that recoveries happened frequently.We have noted 10 types of disturbance in 31 observations.However, all errors were recovered from, suggesting resilience in the system.Recoveries appear to be either self-administered or prompted by some external source, e.g. an alarm or another person (see disturbances 4 and 6 above).We can identify different levels of recovery dependent on its position relative to confirmation checks: • Within menu recovery.This sort of recovery was observed as the nurse entered some value or after they had entered a value but before they had pressed OK to confirm that value (see disturbances 8 and 9 above).• Between menu recovery.This sort of recovery was observed after the nurse had confirmed a value by pressing OK.The nurse would then go back into that interaction to change the value (see disturbance 10 above).• After START recovery.This is where the nurse has committed to start the infusion but then encounters something that needs changing (see disturbances 4 and 6).• After safety check recovery.This sort of recovery was observed to happen after some safety check had been confirmed (see disturbance 2 above).
It seems clear that there is resilience in the system because it copes without incident despite there being relatively frequent performance deviations (Hollnagel, 2004).

How should we respond to these low-level disturbances?
There seem to be two broad ways of viewing minor errors: (i) errors need to be fixed as they represent deviations in performance and potential threats to safety; the frequency of error is a sign of the health of a system; systems can be error-free if procedures and practices are adhered to; (ii) errors are an inevitable part of every day activities, so it is not their overall reduction that we should aim for, but maximizing the avoidance, detection, control and recovery from errors when they occur.
Behind these approaches are very different perspectives on error.The former sees error as part of a world of accidents and near misses and aims for error-free everyday practice.The latter accepts error as part of everyday practice, and recognizes accidents as unfortunate events that occur when performance deviations coincide and errors remain unchecked, so focuses more on avoiding escalation and enhancing control than on avoiding occurrence per se (Hollnagel, 2004).
Since the role of unremarkable errors is unclear, it is important to report unremarkable error to inform our understanding of the system.Errors are ubiquitous in normal work.However, what to do in response to these low-level errors is a non-trivial matter.We highlight four interdependent factors that influence the prospect of remedial action:

Significant issues versus irritations
At the risk of making an obvious point, one of the driving factors that determine what remedial action is taken is the issue's significance.If the highlighted issue poses significant risk then there is more onus on management to fix the issue than if it is a minor irritation.It therefore seems obvious to act on highly significant issues, and it could be considered a waste of resources to act on issues of little significance.
Unremarkable errors by their very nature are likely to be of low significance.However, they could escalate and have the potential to develop into something remarkable if they remain unchecked or are not recovered from.For example, Toft (2001) shows many minor performance deviations can conspire to cause a tragic event.Also, unremarkable errors might be small and frustrating on a local scale but if we imagine the thousands of nurses worldwide who might be suffering the same frustrations on a daily basis then this gives us greater cause for concern.

Recognisable solution
Another important factor that will influence the likelihood of remedial action is whether there is a recognisable solution.Many issues were observed, which are listed in the analysis but some have more apparent design interventions than others.
Here, we focus on the three main ones that readily lead to a design intervention: Disturbance 1. Intravenous Access Point: Sometimes nurses will struggle to establish good intravenous access and when this happens the occlusion alarm might go off more frequently.This uses valuable nurse time and attention.For example, an occlusion alarm is often caused by a patient moving their arm; this can be quickly corrected by repositioning it without the nurse's attendance.However, once the alarm gets tripped a nurse has to restart the pump.Anecdotally we have heard of patients in other wards who observed nurses restarting pumps, and then performed these actions on the pump themselves to save the nurse attending.Subverting official procedures, patients shared this knowledge amongst themselves.A potential design intervention in this case is to have the device check whether the occlusion is clear shortly after the first alarm is triggered.We have been reliably told that at least one pump on the market has this feature.This means that the patient can reposition their arm to clear the occlusion, so the alarm deactivates and the pump continues.In this case, the nurse does not have to attend and patients do not find themselves subverting safety procedures.
Disturbance 5. Enter VTBI value: It is a hindrance a nurse cannot find the VTBI in their prescription because they are forced to input it before they can progress with treatment.It seems that this stage could be skipped to allow the nurse to enter the infusion rate and the time so that the pump calculates the VTBI itself.Other socio-technical interventions are discussed in Section 5.3 below.Disturbance 6. Battery charge: It seems beneficial that the device warns the user if they try to programme a treatment that will outlast the battery's power.Importantly, the device should do this at the point of programming rather than wait until part way through a treatment to announce that it is running out of power.

These design interventions are suggestions on
what should be done to alleviate the issues raised and improve interaction.Previous research has shown that designers and developers respond more positively when presented with suggested design solutions rather than just problems (Hornbaek & Frøkjaer, 2005;Blandford et al. 2006).This provides them with a resource for action that alludes to the potential intervention's cost, benefit and what might be involved in making the change.
HCI has a strong tradition of finding interactive issues and suggesting design implications to improve usability.The three examples above fit this model.In contrast, it is less obvious how one should handle some of the other unremarkable issues and errors.For example, disturbances 8, 9 and 10 are key press errors with no obvious design intervention that would eliminate errors at this level.RFID technology or a bar code reader could eliminate number entry at this stage but these errors would probably just be passed to a different part of the system, e.g. if pharmacy entered the values for the RFID tags they might have the same issues.If we cannot suggest a way forward then it is unlikely that remedial action will be taken, because it is not clear what this would entail.

Focus of interest
Interest is also likely to play a role in the prospect of remedial action.Some issues might be more inherently interesting to the researcher, staff or management, meaning that they will be more likely to commit and expend efforts to solve the problem.For example, we commented that there was no obvious design intervention for the number entry errors (disturbances 8, 9 and 10); however, being reflexive, others with different interests to our own might disagree.
For example, colleagues associated with this project more broadly are starting to engage with number entry error at a finegrained level.We speculate that they would rise to the challenge of reducing these low-level errors through benchmarking, analysis, redesign and retesting.It is not clear what redesigns might achieve these aims but they at least have the interest and skills to engage with the problem.Similarly, others might interpret the issues we have raised in innovative ways and see potential where we do not.Again, this highlights the importance of reporting unremarkable issues as these might lead to remarkable ideas in others; things which the original observers did not see.
Our focus on unremarkable errors has developed from our interest in human error, HCI, and medical device design and use.Clinicians have overlapping interests that are not on HCI per se, e.g.patient safety and improving the provision of healthcare.In short, these low-level interaction errors are attended to through HCI interests but overlap with interests of other professionals, which will affect the potential for remedial actions in practice.

Resource friendly
Changes in design and socio-technical systems come with a cost.The lower the cost and the higher the benefit, the more likely that a change will be made.For changes impacting on safety in the UK the law says that risk should be made to be 'as low as reasonably practicable' (ALARP), which is policed by the Health and Safety Executive.
These four interdependent factors play a part in how researchers and practitioners respond to unremarkable errors in systems.Taken at their extremes, we can see how they work in affecting the likelihood of taking remedial action: (i) Taking remedial action: If the issue is of significance, a solution is recognised, it is of inherent interest to stakeholders, and it is of low cost then it is highly likely the change will be made.(ii) Not taking remedial action: If the issue is of little significance, a solution is not easily identified, it is of little interest to stakeholders, and potential interventions are dramatic and costly then it is highly unlikely a change will be made.
Looking at extremes can often simplify how things work, but these extremes are infrequent in practice.More common and more complicated are the shades of grey that lie between these poles.When there is a mixture of interacting variables it is less clear which issues should be investigated and what remedial actions should be taken.All of these factors need to be considered on a case by case basis to determine potential remedial actions and the directions of further research efforts.

Socio-technical intervention
The performance deviations that we have observed in this study also raise questions with regard to how one should go about deciding on an appropriate intervention.For example, in the case of disturbance 6, the battery charge issue, it seems clear that a manufacture intervention could warn nurses about low battery charge at the point of programming.However, less clear is the response to disturbance 5, which is the VTBI input constraint.
Here, the manufacturer might redesign the device to allow this stage to be skipped; technicians might reconfigure the device set up so that values can be entered into the pump in any order (this solves the problem of needing to skip the VTBI stage as this constraint is removed); managers might review policies to ensure that every prescription has an accurate VTBI on it; and nurses might be taught a workaround whereby they cannot skip the VTBI stage but could get the device to work out the VTBI by entering the time and the infusion rate.To investigate which response is most appropriate, a systems approach is required.A rich dialogue needs to be established between different people with different roles and responsibilities.Where socio-technical systems are complex, as in a hospital, our experience shows that no one person has a complete picture, and so investigations are built up through finding incomplete pieces of the puzzle.

CONCLUSION
Unremarkable errors deserve special consideration in healthcare.They can point to interaction issues that nurses either cannot self-report, or which they do not class as error.Investigating issues from normal work has the potential of recognising vulnerabilities before untoward incidents have occurred, and also of identifying work-arounds that are routinely adopted to mitigate error.Recognising interaction vulnerabilities that are significant, have a solution, hold stakeholder interest and are resource friendly means remedial action is likely.
We have found that unremarkable errors that do not fit this model are harder to handle appropriately.What is clear is that unremarkable error should be investigated and reported to build up a realistic picture of error, and to start a dialogue to consider how to handle these practices.

Figure 1 :
Figure 1: Task steps in infusion pump preparation and interaction.Disturbances are denoted by lightning bolts.