Analyzing Medical Processes Bin Chen, George S. Avrunin, Lori A. Clarke, Leon J. Osterweil, University of Massachusetts, Amherst Elizabeth A. Henneman School of Nursing, University of Massachusetts, Amherst Philip L. Henneman Tufts-Baystate Medical Center, Springfield, MA
Problem: Medical Errors According to a 1999 IOM study, medical errors are a leading cause of death in the U.S. 5 years after the original study, no substantial reduction Resulted in many efforts to mandate and/or model critical processes Guildelines In English, with imprecise and ambiguous terminology Usually incomplete E.g. no indication of how to handle unusual situations Modeling notations Data flow diagrams Also, UML, Petri Nets, finite-state machines Again, no indication on how to handle unusual situations Some of these notations lack semantics for specifying them 2
Goal: Detecting and Reducing Medical Errors Hypothesis: Finite-state verification can be used to help detect defects in medical processes that are modeled using a semantically rich, rigorously defined process-definition language And to verify that efforts to remove the defects have (or have not) been successful 3
Approach Create detailed models of medical processes using the Little-JIL process definition language Represent medical guidelines as property specifications using the Propel property specification system Use finite-state verification techniques to detect violations of these properties by the process definitions Using FLAVERS and SPIN Working with medical professionals, modify the processes and reapply finite-state verification An approach to Continuous Process Improvement for complex, human-intensive processes 4
Desiderata for a Process Definition Language Well-defined semantics Support analysis Support execution Rich set of constructs for supporting (e.g.) Hierarchy Abstraction Scoping Exception handling Concurrency (synchronous and asynchronous) Iteration and conditionals Resource utilization Human-desired flexibility (E.g., choice operators) Facilities for elaboration of details Sufficient clarity to facilitate validation of process definitions by domain experts 5
Little-JIL Process Definition Language Three major components artifact specification resource specification coordination specification Visual Representation Supported by an Environment with capabilities for Editing Execution Analysis Static (e.g. FSV, FTA) Dynamic (e.g. discrete event simulation) 6
Coordination Diagram Cardinality and artifact flow Artifact flow via channels 7
An Example Little-JIL Process 8
An Example Property; Defined with Propel Example property: Once the nurse notifies the blood bank to prepare the blood product,the nurse will eventually pick up the blood product Notify_Bloodbank Pick_Up_Blood Notify_Bloodbank About 60 such were properties derived from requirements stated in standard nursing text. 9
Overview of our Verification Approach Construct a finite model that represents all sequences of events, relevant to the property to be evaluated, that can arise during system s execution Use reasoning methods (e.g., model checking, data flow analysis) to determine whether the property holds for all executions Used FLAVERS and SPIN represent distinct modeling and reasoning approaches Could build on our existing technology to automatically generate the models needed by them 10
The Verification Process Two-stage translation approach Little-JIL process definition Bandera Internal Representation (BIR) BIR Input representations of FSV tools & Optimizations 11
Optimizations Little-JIL process definitions yield large BIR models Optimizations needed Optimizations on BIR applicable to models derived from BIR Take advantage of the scoping rules of Little-JIL Optimizations include Alphabet refinement Abstraction Partial order reduction Resulting BIR model Usually a significant reduction in size Conservative wrt the property 12
Evaluation Based on Case Studies Process definition: Computer Scientists, working with teams of medical professionals, define processes in Little-JIL Process definition validation: Iterative review and refinement of definitions until full buy-in Medical Process Domains In-Patient Blood Transfusion Administration Breast Cancer Chemotherapy Administration Emergency Room Patient Treatment 13
The Process to be Verified (Top Level) 14
Elaboration of Nurse s Process take from bloodbank status channel 15
Now Elaborate on Blood Bank Process 16
Example Blood Transfusion Process (Bloodbank) Property: Once the nurse notifies the blood bank to prepare the blood product,the nurse will eventually pick up the blood product take from bloodbank status channel Error! In obtain blood product from blood bank" step the nurse could repeatedly check the blood bank status" channel for a blood product ready" message 17
Obtain Blood Product from Blood Bank Obtain Blood Product from Blood Bank X Look at Blood Bank Status Channel Get Blood Product Wait Blood Product Is Ready Read From Blood Bank Status Channel 18
Improving the Process When the patient's type and screen are not available, the blood bank is unable to prepare the blood Check List and Process Model assumed type and screen obtained prior to the transfusion order But this is not always true In real process, nurse eventually notices that the blood unit is still not available and calls the blood bank. Then the nurse does the type and screen and re-issues the blood unit request Nurses knew this problem sometimes arose, but did not know why Problems like this are one reason why the average wait time in an emergency room is 6 hours! 19
New Obtain Blood Product from Blood Bank Look at Blood Bank Status Channel Obtain Blood Product from Blood Bank X Get Status Read From Blood Bank Status Channel Blood Product Is Ready O_ React Blood Product Not Ready Blood Type and Screen Unknown Reorder Get Blood Product Look at Blood Bank Status Channel Type and Screen Notify Blood Bank To Prepare Blood 20
The rest of the story Medical professionals proposed a fix for the error: require the nurse to check for blood type and screen unknown" message and respond by drawing a blood specimen for determining type and screen and sending this as part of a new request to the blood bank Modified process introduced another problem in the process definition Sample for type and screen might not be drawn until after all of the other preparations for the transfusion have taken place, resulting in a (possibly life threatening) long delay for the patient Analysis found this problem But this might not be the best way to deal with this situation 21
Elaboration of Nurse s Process Verify blood type take from bloodbank status channel 22
The happy ending Second proposed modification: require the nurse check for the availability of the type and screen before notifying the blood bank of the transfusion order and, if necessary,draw the specimen at that time Second modification consistent with all the properties (created so far) >60 properties Just one example of a real error in a real process Paper describes another related property Demonstrates systematic support for process improvement 23
Observations about the analysis Rarely have a false positive Process definitions are primarily control-based No aliasing or interactions with complex data structures Optimizations crucial for the feasibility of this approach Use small configuration sizes Have encountered very few properties that can not be easily represented in Propel Apply the usual tricks (e.g. decompose the property, represent timing and state concerns as events, etc. ) 24
Related Work Process Modeling and Definition Property Specification Finite State Verification Improving Medical Processes Asbru language (Shahar et.al), then KIV theorem prover (tenteije et.al.) Asbru language, then SMV (Baumler, et.al.) GLARE language; Promela then SPIN (Molino, et.al.) Baysean Belief Networks, then Discrete Event Simulation (van der Gaag, et.al.) 25
Conclusions Current process definitions used to define medical processes are inadequate for Capturing important details Supporting rigorous analysis about safety problems Processes (and process models) too complex to be well understood Esp. with concurrency, indeterminacy, and exceptional behavior Detailed process model plus FSV can be effectively used to: Validate the model Find process problems Evaluate proposed process improvements 26