[ 2] Canada. Institute for Safe Medication Practices. Fluorouracil Incident Root Cause Analysis. www.ismp-canada.org. 2007.

[ 3] Thimbleby, H. “Interaction Walkthrough: Evaluation of Safety Critical Interactive Systems,” DSVIS 2006, The XIII International Workshop on Design, Specification and Verification of Interactive Systems, Springer Lecture Notes in Computer Science, edited by G. Doherty and A. Blandford, 4323: 52–66, 2007.

September + October 2008

[ 4] Kohn, L. T., J. M. Corrigan, and M. S. Donaldson eds., To Err is Human, National Academy of Sciences, 2000.

interactions

A typical interactive medical device allows users to enter numbers in almost any format, with or without decimals, misleading zeros, and all without any warnings whatsoever. A human factors study of one pump [ 2] found that three out of five registered nurses were “ partially or completely confused” over using the decimal-point key (the user interface doubles up the decimal point with an arrow key that is used for menu selection). A paper on another pump noted that its user manual says that it works like a calculator when in fact it does not [ 3]. If a user enters 0.0.5 on the pump, it is taken as 0.5, whereas on a typical calculator, the same button presses would be taken as 0.05, a very different value. This difference could clearly lead to serious problems. Neither pump nor calculator reports any error when more than one decimal point is entered.

The Alaris pump mentioned in the introduction has no numeric keys, so it cannot suffer from decimal-point errors as such. Instead, it has four buttons to increase and decrease the current number by 1 or by 10. Unfortunately, the close proximity of the buttons might mean a nurse presses the 10 instead of the 1. Here, what is intended as a user-interface accelerator has created a hazard analogous to the decimal-point problems of conventional numeric keypad user interfaces. Overall, this may be better or worse—one would have to do experiments to find out. A potentially worse problem is that different approaches (increment/decrement versus numeric keypad) create their own problems: Most hospitals

have many types of devices, and correct operation of one may be deadly if transferred to another. In short, we need very detailed standards for user interfaces so that there are no unnecessary proliferations of interaction styles.

Decimal-point errors are one of the simplest drug-calculation errors to understand, one of the longest consistently recognized problems in the area, and, arguably, the easiest to do something about. Yet nothing seems to be happening. Well, one might then ask, is it a significant problem?

Medical errors in hospitals in a given year cause about as many deaths as AIDS, car accidents, and breast cancer combined [ 4]. Clinicians accept as routine using workarounds, such as switching a device off and on to recover from errors—often losing data (e.g., drug dose to date) in doing so. Indeed, many near misses are not reported because they do not lead to adverse clinical incidents. Often hospital procedures or training are blamed for not accommodating device design, rather than the other way around. If a device “operates as designed,” it is often assumed to be designed correctly, even if (to more perceptive eyes) the incident is a symptom of bad design, a “system-induced user error.”

nurse’s task was then to calculate how to program an infusion pump to deliver the drug at the appropriate rate. The relevant numbers and units are 5,250 mg of fluorouracil diluted to 45. 57 mg per mL, to be delivered over four days. This is not an easy problem for anybody to work out, even without the many simultaneous jobs that nurses have to juggle.

The nurse had to calculate the rate to be delivered, 5,250/45.57 mL over 24× 4 hours; he or she should have done this calculation:

5,250

45. 57

( 4 × 24)

The nurse attempted the calculation using a calculator, and a second nurse double-checked the work as a routine precaution. It’s a simple calculation, as things go—for instance, a calculation for a dose of gentamicin (an antibiotic) is based on patient weight, gender, and height, and involves powers, as well as many constants and conditionals.

It is easy to take the design of calculators for granted, but we already know that calculators ignore many errors. So let’s look more closely at how one was used (though the report does not give details, presumably because it assumes calculators “just work”).

A Fatal Overdose In 2006 a patient received a fatal overdose of fluorouracil, a chemotherapy drug. Here’s a summary of how it happened, based on the investigation [ 2]. The nurse went to the hospital pharmacy with the drug order and returned with a labeled bag of diluted fluorouracil and a printout of the dose details. The

Calculators Are Mad, Bad, and Dangerous The nurse would have pressed a sequence of buttons to perform the calculation. For example, the keystrokes AC AC 5250 ÷ 45. 57 ÷ ( 4 × 24 ) = will obtain the correct result, 1. 2. However, it is likely that the nurse did not have a calculator with brackets, and instead had to do AC AC 5250 ÷ 45. 57 ÷ 4 ÷ 24 =. What nurse