Application of Systemic Accident Analysis (SAA) Approaches in Telemedicine/Telehealth

2.1 AcciMap mapping (AcciMap)

Svedung and Rasmussen developed this approach as a graphical tool for creating a multi-causal diagram of events and decisions across different socio-technical levels, as shown in Figure 1 [13, 18, 23, 24, 25]. This approach is also based on Rasmussen’s theory of accident causation and can be applied either as a standalone method or as a part of a broader Risk Management Framework (RMF) [12, 23]. While there have been different variations of the AcciMap approach, Branford, in her thesis, developed a standardised AcciMap format with a set of guidelines for determining causal/contributing factors, causal relationships between them (linking causal connections within and between socio-technical levels) and formulating safety recommendations [23]. This systemic approach essentially provides the benefit of providing a graphical representation of actions/activities committed at the front end (where clinical practitioners and patients are involved with patients using computing and network technologies) and latent conditions within the health organisation that may have facilitated the events to occur at the front end [21, 26]. Appendix A shows an example application of the AcciMap approach on a medication dosing error relating to a Computerised Order Entry System (CPOE) [21, 27, 28]. The AcciMap approach is based on the safety-I perspective, which essentially involves analysing what went wrong and why it happened so that recommendations can be made to prevent future occurrences.

2.2 Systems theoretic accident modelling process (STAMP)

STAMP is a systemic-based accident approach developed by Leveson (MIT). It is based on systems and control theory regarding safety constraints between various components and determining any disturbances that can potentially affect system safety [9, 15]. As shown in Figure 2, the STAMP model consists of a generic socio-technical system safety control structure and a high-level taxonomy of safety constraints for system hazards. An example of the application of the STAMP approach for modelling a high-level control structure relating to the medication dosing error [21, 27] is shown in Appendix B. The STAMP approach also consists of two aspects of analysis; System Theoretic Process Analysis (STPA), which is a STAMP-based hazard analysis used for defining accidents, control structure and system hazards and Causal Analysis using System Theory (CAST) [15, 29]. This model is also based on the traditional safety-I perspective. Table 1 describes the STAMP's control failure taxonomy of control flaws relating to how they lead to hazards in the system.

STAMP and AcciMap approaches are based on the traditional safety-I perspective, which considers “safety as the absence of failure or the state in which the fewest number of things go wrong” [30]. From this safety perspective, there is a shift in blaming the frontline level (actions/activities) to determining existing causal/contributing factors based on decisions at both organisational and external levels.

2.3 Functional resonance accident method (FRAM)

A systemic model was developed by Erik Hollnagel [31], and it’s based on “Safety II” perspective that “identifies and defines systems functions and variability determining how variability may interact within a system in a manner leading to adverse outcomes” [16]. The development of this model type was motivated by the authors’ dissatisfaction with existing approaches like Fault Tree Analysis (FTA) for addressing safety issues [32]. The FRAM model essentially relies on four principles, (a.) Equivalence of successes and failures where they both have the same origin (i.e., performance variability), (b.) Approximate adjustments where people and organisations continually adjust their performances to cope with daily operating challenges, (c.) Emergence, where identifying a sequence of events is considered impossible because many events are seen as emergent rather than a combination of conditions (i.e., latent), and (d.) Functional resonance representing signals coming from unintended interactions of variability (human, organisational and technical behaviours) of multiple signals [33]. A typical representation of the FRAM function is shown in Figure 3.

Each FRAM function consists of six [6] components which are briefly highlighted below:

1. Time: Focuses on temporal aspects affecting how the function is accomplished.

2. Input: Triggers the function and can be utilised or transformed to output and linking to upstream functions.

3. Preconditions: Describes conditions of the system that must be carried out before the function is carried out.

4. Control: Focuses on supervision or regulation of a function, including guidelines, procedures, or other functions.

5. Resources (Execution Conditions): Resources, including software, manpower, energy etc., that are utilised or needed by the function.

6. Output: Consists of links to downstream functions, which essentially is the result of the function.

This systemic approach, unlike the last two mentioned (safety-I perspective), is based on the safety-II perspective, which focuses on “ensuring that as many things as possible go right” in considering both accidents and outcomes [35]. Based on this safety perspective, human beings are regarded as a resource necessary for system resilience and flexibility, especially when responding to varying conditions [35]. The safety-II view is also considered a proactive approach for anticipating events and allows clinicians’ ability to adapt to pressures to be understood. Incident investigations using this perspective (applying the FRAM model) focus on how processes go right and serve as a basis for determining what went wrong [35, 36].

3.1 AcciMap analysis process

Regarding applying the AcciMap approach to any incidents to analyse severe outcomes or near-misses, a set of guidelines was formally developed based on Branford’s thesis [23, 24] after creating a standardised AcciMap format based on the original AcciMap structure. A graphic template is prepared, which consists of different AcciMap levels and includes the following processes:

1. Identifying the adverse outcome.

2. Determining causal/contributing factors that led to the outcome.

3. Placing contributing factors at the appropriate AcciMap level.

4. Inserting causal links depicting “cause and effect” between causal/contributing factors.

5. Filling any missing gaps in the causal chain where there is missing information.

6. Assessing the causal logic and making sense of any sequence of events.

7. Generating practical and feasible safety recommendations

3.2. STAMP analysis process

There are nine stages involved in applying STAMP, as identified by Leveson [19]. The first eight stages can be carried out, not necessarily in a strict order. When specifically using the Causal Analysis, which is based on STAMP, these stages are summarised as follows:

1. Identify systems and hazards associated with the loss.

2. Identify system safety constraints and requirements relating to the hazard detected.

3. Detail control structures to control the hazard and enforce safety constraints.

4. Determine proximal events that led to the loss.

5. Evaluate the loss at the physical system level.

6. Evaluate the control structure(s) at higher levels.

7. Assess the overall contributors (communication and coordination) to the loss.

8. Determine the changes and dynamics to the control structure and system over time.

9. Develop safety recommendations

3.3 FRAM analysis process

Applying the FRAM method allows positive and negative consequences from work adjustments rather than focusing on causes or contributing factors [37]. There are four processes involved in analysing and developing a FRAM model as follows:

1. Identifying and explaining critical system functions and characterising each one using the six aspects (see Figure 3).

2. Distinguish the functions’ potential and actual variabilities in multiple model implementations.

3. Determine possible functional resonance based on dependencies with other functions considering their potential/actual variability.

4. Generate safety recommendations that focus on monitoring and influencing the variability. This is achieved either by enhancing the variability leading to desired outcomes or attenuating the variability that can lead to undesired results.

4.1 Benefits of SAA approaches

Application and comparative studies across different safety-critical industries have highlighted the benefits of applying systemic accident approaches compared to the linear-based approaches in their ability to graphically highlights weaknesses in complex systems and how these systemic issues can create scenarios where actions/activities are committed that could potentially lead to patient harm. The health industry can only continually reap the benefits of using these approaches for incident analysis. Each approach will be further elaborated in specifically examining the benefits of SAA approaches already highlighted in Section 2. For the AcciMap method, its ability to graphically present causal relationships that exist between multiple causal/contributing factors will allow analysts to not only determine causal flows within different socio-technical levels but will also let systemic issues be traced back to the higher levels (organisational and external) and to determine any existing policies and processes that need to be reviewed. The AcciMap approach can be applied by a single analyst but has more benefits when used by a group of analysts (especially having different specialisations within healthcare). The latter process will help foster brainstorming when analysing incidents and producing the initial AcciMap output to the final result after several iterations. Hypotheses can also be drawn based on the AcciMap analysis, and counterfactual reasoning can also be applied when considering sufficient and necessary causes. The STAMP model allows analysts to portray feedback loops between different components within the system graphically. These feedback loops include communication between practitioners and patients (remote connections), as well as with higher bodies and determine any loss of control. Based on the outputs (Appendices A and B), applying both AcciMap and STAMP approaches was used to illustrate and determine systemic factors and any loss of control between system components using a conventional medical scenario. If these approaches were to be applied in a telemedicine scenario, the links between the patient and medical practitioners (communication) would have to be considered. These analyses will also include issues associated with computing technologies applied remotely for communication or administration. When using the AcciMap method, these aspects can be analysed at the physical/actor level to determine if there was any miscommunication between staff and patient, defects in technology used, and what conditions precipitated it. The STAMP model can also be applied in a telemedical scenario when feedback loops can be analysed to determine any loss of control when looking into issues regarding remote administration and communication (or lack of) between patients and staff. The FRAM model can also be applied in a telemedical situation. However, compared to conventional medicine, the difference is that aspects regarding how technology is “remotely” implemented in communicating and providing patient care will need to be analysed if there are any accidents, near-misses or loss of control. Other aspects can also include patient or medical staff misapplication and accessibility of technology.

4.2 Demerits of SAA approaches

It is also important that while there are benefits to applying systemic approaches, the demerits must also be highlighted. Major drawbacks of using systemic models for incident analysis as applied to telemedicine are resources required in terms of personnel, time, and knowledge needed to apply them effectively. Depending on the approach used, it can take considerable time and effort to understand the causation theory and methodology behind each approach and to apply them to analyse any major incident(s) in healthcare. Also, about this point, it is very important to take into consideration when it comes to each systemic approach’s validity, reliability and usability in producing results that will allow effective safety recommendations to be formulated (retrospectively) and that these safety measures can then be tracked and assessed to ensure that any weaknesses detected will not occur again. While each approach can be applied individually, as each analytical iteration can be reviewed, it is usually recommended that multiple users (team-based) apply the approach to the same incident. This step will allow brainstorming and discussions to produce the final outcome. Health organisations will also require training of staff associated with risk management and computing technology in applying different systemic approaches, which could also take a considerable amount of time. These points highlight why Root Cause Analysis (RCA) techniques are still being used because they do not require as much time in terms of training and application. Still, as stated earlier in this chapter, their underlying methodologies are not considered suitable for analysing complex systems. However, this limitation is somewhat circumvented when using software-based modelling tools based on some systemic approaches. For instance, there are a FRAM visualiser and STAMP Workbench applications for FRAM and STAMP/STPA analyses, respectively. Microsoft Visio application or other graphic tools can construct AcciMap outputs during analysis.

4.3 The Necessity of SAA approaches

Considering the benefits and demerits discussed in previous subsections, it stands to reason that health organisations will need to weigh these benefits versus the limitations of applying these approaches for incident analysis relating to telemedicine. Based on previous studies comparing systemic approaches with other linear-based and systemic-based models [7, 11, 21], there is a clear conclusion that applying the systems thinking paradigm is the way forward in analysing, understanding, and improving system safety relating to telemedicine. This point also encompasses processes that are involved when it comes to telemedicine as far as healthcare professionals and patients are concerned. It is very important to acknowledge the general limitations of these approaches mentioned and understand that there are tangible benefits depending on which systemic approach is implemented. While there have been studies investigating how the “research-practice gap” as coined by Underwood and Waterson [39], can be reduced in terms of applying these approaches in healthcare, there is still a need for providing awareness to clinical safety and risk managers. Aside from the need to improve system safety by ensuring that whatever safety recommendations or mitigating processes are set in place relating to telemedicine processes, there is also a need to protect patient medical data from hacking and other breaches. This issue of patient data being hacked relates to cyber security, especially when the connection is over an unencrypted or public network [40]. The STAMP model can also be applied to analyse this type of security-related incident by implementing an STPA analysis specifically for cyber security analysis called STPA-SafeSec (System-Theoretic Process Analysis for Safety and Security) [41, 42, 43]. The authors added that STPA could be applied to analyse system safety and security and systems regarding emerging properties. Security analysis using STPA-Sec serves as a means of ensuring the safety of patient medical data for telemedicine, according to Young and Leveson. They also indicated that safety and security must be addressed collectively [41, 42].