Beware of the Robot Pharmacist
In tech-driven medicine, alerts are so common
that doctors and pharmacists learn to ignore
them — at the patient’s risk.
--
This is part 2 of The Overdose. Read part 1 here.
On the afternoon that 16-year-old Pablo Garcia was admitted for a routine colonoscopy to the University of California, San Francisco Medical Center’s Benioff Children’s Hospital — an admission that would later be complicated by a grand mal seizure as a result of a 39-fold overdose of a common antibiotic — Benjamin Chan was working in a small satellite pharmacy on the seventh floor, directly adjacent to the wards.
As the pediatric clinical pharmacist, it was Chan’s job to sign off on all medication orders on the pediatric service. The chain of events that led to Pablo’s catastrophic overdose unfolded quickly. The medication orders from Jenny Lucca, Pablo’s admitting physician, reached Chan’s computer screen moments after Lucca had electronically signed them.
Pablo had a rare genetic disease that causes a lifetime of infections and bowel inflammation, and as Chan reviewed the orders, he saw that Lucca had ordered 5 mg/kg of Septra, the antibiotic that Pablo took routinely to keep infections at bay.
Chan immediately noticed a problem with this Septra order: the dose of 193 mg the computer had calculated (based on the teenager’s weight) was 17 percent greater than the standard 160-mg Septra double-strength tablets. Because this discrepancy exceeded 5 percent, hospital policy did not allow Chan to simply approve the order. Instead, it required that he contact Lucca, asking her to enter the dose corresponding to the actual pill size: 160 mg. The pharmacist texted Lucca: “Dose rounded by >5%. Correct dose 160 mg. Pls reorder.”
Of the scores of medications that the resident would order — and the pharmacist would approve — that day, this was probably the simplest: an antibiotic pill dispensed by corner drugstores everywhere, being taken as a routine matter by a relatively stable patient. Neither the doctor nor the pharmacist could have anticipated that this text message, and the policy that demanded it, would be a lit match dropped onto a dry forest floor.
Both Chan and Lucca knew that Pablo weighed less than 40 kilograms (38.6 to be exact, or about 85 pounds). But here is where worlds — the worlds of policy, practice and computers — collided. The 40 kilogram policy required that Lucca’s original order be weight-based (in milligrams of medication per kilogram of body weight), but the 5 percent policy meant that Chan needed Lucca to reorder the medication in the correct number of milligrams. What should have been a simple order (one double strength Septra twice daily) had now been rendered hopelessly complex, an error waiting to happen. And so one did.
After receiving Chan’s text message, Lucca reopened the medication-ordering screen in Epic, the electronic health record system used by UCSF. What she needed to do was trivial, and she didn’t give it much thought. She typed “160” into the dose box and clicked “Accept.” She then moved to the next task on her long checklist, believing that she had just ordered the one Septra tablet that she had wanted all along. But she had done something very different.
Do you spot the problem? Perhaps not, since it is hiding in the middle of this dense screen, which faithfully replicates the one seen by Lucca. Focus your attention on the line that begins with the number “160” inside a rectangular box.
Since doses can be ordered in either milligrams or milligrams per kilogram, the computer program needs to decide which one to use as the default setting. (Of course, it could leave the unit [mg versus mg/kg] box blank, forcing the doctor to make a choice every time, which would actually require that the physician stop and think about it, but few systems do that because of the large number of additional clicks it would generate.)
In UCSF’s version of Epic, the decision was made to have the screen default to milligrams per kilogram for all kids weighing less than 40 kilograms, in keeping with the weight-based dosing policy. That seemingly innocent decision meant that, in typing 160, Lucca was actually ordering 160 mg per kg — not one double-strength Septra, but 38½ of them.
Computer experts call this type of problem — when the same action can result in two very different results — a “mode error,” and it is especially problematic when the user is not focused on the mode (in this case, mg versus mg/kg) and the interface offers no obvious clues as to its current status. The most common mode error in day-to-day computing is activation of the caps lock key, which changes the output of all the other keys.
Computer designers try hard to avoid having any modes at all, but the caps lock key is a major convenience, and so it has survived. When you’re stuck with a mode problem, user-centered design principles dictate that the mode should be made obvious to the user. And so most computer manufacturers incorporate a light into the caps lock key to show when it’s activated, and they signal (with a little up-facing icon) that the caps lock key is on, thus explaining why you’re having no luck with your password.
Unfortunately, the Epic interface provides no guidance to alert the user that she is in mg/kg mode. I have shown a picture of the “160 mg/kg” screen to several thousand people — including many experienced physicians, pharmacists and medical computer experts — during lectures over the past year. “Please raise your hand,” I ask, “if you’re 100 percent sure you would have noticed the mg/kg setting.” (Had Lucca noticed it, she could have changed it to “mg” with two clicks.) Not a single hand has gone up.
Of course, both Epic and First Databank, the company that created the rules that govern UCSF’s alerts, know full well that a dose of 6,160 mg of Septra is inconceivable; it would be like seeing a street sign saying the speed limit is 2,500 miles per hour. After Lucca signed the order an alert fired, warning her that this was an overdose.
Whether an automated system is monitoring the status of a nuclear power plant, a commercial jetliner, or your washing machine, perhaps the most challenging decisions revolve around what to do with alerts. On an average day at UCSF Medical Center, we prescribe about 12,000 medication doses, and order thousands more x-rays and lab tests. How should the doctor be informed if the computer thinks there is — or might be — a problem?
Because many academic medical centers installed Epic before 2012, UCSF had the advantage of learning from these early adopters. One near-universal recommendation was to be sparing with alerts, because every alert makes it less likely that people will pay attention to the next one.
Heeding this feedback, the medical center chose to disable thousands of the alerts built into the drug database system that the hospital had purchased along with Epic. Despite this decision, there were still tons of alerts. Of roughly 350,000 medication orders per month, pharmacists were receiving pop-up alerts on nearly half of them. Yes, you read that right: nearly half. The physicians were alerted less frequently — in the course of a month, they received only 17,000 alerts.
The alert problem was especially daunting in pediatrics. Given weight-based doses and the narrow therapeutic range for many medications, alerts fired on several of the 10 to 15 medications ordered by the doctors for the typical hospitalized youngster, and on the vast majority of orders processed by the pediatric pharmacists.
Computerized medication alerts represent only a small fraction of the false alarms that besiege clinicians each day. Barbara Drew, a nurse-researcher at UCSF, has been studying a similar problem, alarms in the ICU, for decades. During that time, she has seen them grow louder, more frequent, and more insistent. She has witnessed many Code Blues triggered by false alarms, as well as deaths when alarms were silenced by nurses who had simply grown weary of all the noise.
A 2011 investigation by the Boston Globe identified at least 216 deaths in the U. S. between January 2005 and June 2010 linked to alarm malfunction or alarm fatigue. In 2013, The Joint Commission, the main accreditor of American hospitals, issued an urgent directive calling on hospitals to improve alarm safety. The ECRI Institute, a nonprofit consulting organization that monitors data on medical errors, has listed alarm-related problems as the top technology hazard in healthcare in each of the last four years.
There are many reasons for false alarms: misprogrammed thresholds; dying batteries; loosening of an electronic lead taped to the patient’s chest. But plenty of alarms are triggered by the activities of daily hospital living. Liz Kowalczyk, who led the investigation for the Globe, spent a morning in the cardiac unit at Boston Children’s Hospital. She observed,
[The nurse] hurried into Logan’s room — only to find a pink-cheeked, kicking 3-month-old, breathing well, cooing happily. Logan was fine. His pumping legs had triggered the crisis alarm again.
The red alarm is the most urgent, meant to alert nurses to a dangerously slow or fast heart rate, abnormal heart rhythm, or low blood oxygen level. But on this morning . . . infants and preschoolers activated red alarms by eating, burping and cutting and pasting paper for an arts and crafts project.
In the face of growing nationwide concern about alert fatigue, Barbara Drew, the UCSF researcher, set out to quantify the magnitude of the problem. For a full month in early 2013, she and her colleagues electronically tapped into the bedside cardiac alarms in UCSF’s five intensive care units, which monitored an average of 66 patients each day. Mind you, this is just the bedside cardiac monitor, which follows the patient’s EKG, heart rate, blood pressure, respiratory rate, and oxygen saturation. It does not include the IV machine alarms, mechanical ventilator alarms, bed exit alarms, or nurse call bell. Nor does it include any of the alerts in the computer system, such as the Septra overdose alert that Jenny Lucca overlooked.
Drew’s findings were shocking. Every day, the bedside cardiac monitors threw off some 187 audible alerts. No, not 187 audible alerts for all the beds in the five ICUs; 187 alerts were generated by the monitors in each patient’s room, an average of one alarm buzzing or beeping by the bedside every eight minutes. Every day, there were about 15,000 alarms across all the ICU beds. For the entire month, there were 381,560 alarms across the five ICUs. Remember, this is from just one of about a half-dozen systems connected to the patients, each tossing off its own alerts and alarms.
And those are just the audible ones.
If you add the inaudible alerts, those that signal with flashing lights and text-based messages, there were 2,507,822 unique alarms in one month in our ICUs, the overwhelming majority of them false.
Add in the bed alarms, the ventilators, and the computerized alerts . . . well, you get the idea.
Like many other physicians, pharmacists, and nurses, Jenny Lucca found alerts to be a constant nuisance. Even giving Tylenol to a feverish child every four hours triggered an alert that the dose was approaching the maximum allowed. Every training program has a “hidden curriculum” (the way things are actually done around here, as opposed to what the policies say or what the administrators told you during that interminable orientation). One of them — passed down from senior residents to the newbies — was, “Ignore all the alerts.”
While Lucca was slightly uncomfortable with that as a governing philosophy, she was convinced that most of the dozen or more alerts she received each day could be safely ignored, and she knew that doing so was the only way she could get her work done.
With her task list brimming with dozens of unchecked boxes and more sick kids in need of her care and attention, Lucca assumed that the alert she received after signing the Septra order was yet another annoying one with no clinical significance, and so she clicked out of it. With that, the order for 38½ Septras now ricocheted back to the pharmacy, having been signed and validated by a licensed physician.
When I spoke with Jenny Lucca months after Pablo Garcia’s overdose, I asked her how she could have clicked out of the Septra overdose alert, knowing now that by doing so, she had confirmed an order for 38½ Septra tablets. She blamed part of it on alert fatigue, of course. But she also pointed to the appearance of the alerts in Epic. “There is no difference between a minuscule overdose — going 0.1 milligram over a recommended dose — and this very large overdose. They all look exactly the same.”
In fact, the Epic alert that Lucca received is a model of bad design (in the updated version of the software, it is a bit better). There are no graphical cues, no skull and crossbones — nothing that would tell a busy physician that this particular alert, unlike the dozens of others that punctuate her days, truly demanded her attention.
Once Lucca signed the Septra order and clicked out of the alert, it boomeranged to Benjamin Chan’s computer within a matter of minutes. The pharmacists at a place like UCSF serve as a crucial layer of protection, and Chan was an experienced professional who prided himself on his carefulness. But, on this particular day, the deck was stacked against him.
First, Chan had been on the wards with Lucca in the past. “I have worked with her, we know each other, and I trust her,” he told me. In retrospect, Chan said, it’s likely that this personal relationship was one of the reasons he let his guard down.
Second, the seventh-floor satellite pharmacy, where Chan works, is a frenzied place. In an 8 × 18-foot room (about the size of a parking space), four individuals — two doctorally trained clinical pharmacists like Chan, and two pharmacy techs — buzz around, bouncing into each other like pinballs. In addition to the bodies, the room is packed tight with equipment, including two ventilated hoods for mixing volatile or toxic medications, a sink, shelves lined with bins stocked with medications, a label printer, IV bags, syringes, needles, and a locked cabinet for storing narcotics. On the day I visited, several months after Pablo Garcia’s overdose, one of the technicians was carefully mixing up medications, her arms sheathed in rubberized sleeves that penetrated a clear plastic tent.
In the midst of this bustle, the pharmacists were checking every order that appeared in a computerized queue (often making several follow-up calls to determine whether the order was correct), while simultaneously answering the phones, supervising the technicians, and dealing with visitors who periodically appeared at the Dutch door to pick up medications.
“The phones just never stop ringing,” Chan told me. “There are always nurses coming to the window to pick up their narcotics; the respiratory therapist comes looking for his meds. In going through one patient’s medication orders, I’ll be interrupted six or seven times, at least.”
It sure seemed risky to me, and a 2010 Australian study confirmed that it is. The investigators observed 98 nurses while they prepared and administered 4,271 medications. Every interruption increased the risk of a medication error by 13 percent. When a nurse was interrupted four times, the rate of errors likely to lead to permanent harm or death doubled.
Abundant research has demonstrated that the term multitasking is a misnomer — performance degrades rapidly when people try to do several things simultaneously, whether it’s your kids doing homework while texting or a pharmacist checking orders while answering the phone. Psychologists speak of the concept of “cognitive load” — the overall volume of things a mind is grappling with at a given time. While there are some individual differences in the ways we manage cognitive load, one thing is clear: none of us does this as well as we think we do.
With all of these social, logistical, and cognitive land mines to sidestep, it’s little wonder that Chan didn’t notice the “mg/kg” when he saw “160” only a few minutes after texting Lucca to order just that dose. Also, by a terrible coincidence, when you multiply 160 mg/kg by 38.6 kg, you get 6,160 mg (after rounding to the nearest tablet size), which contains the number “160,” another opportunity for what psychologists call “confirmation bias”— seeing what one expects so see.
So Chan accepted Lucca’s order for 160 mg/kg. And then he went on to click out of his own alert screen, which looked as bland and busy as the one that Lucca received and — for good measure — contains the number “160” in 14 different places.
Just as with the physician’s alert, the sheer number of alerts the pharmacists receive creates a striking degree of vulnerability. “There are just a lot of them,” Chan told me. “Sitting here, I can tell you a number of alerts that make absolutely no sense, and we are alerted to them every single day.”
During my visit with Chan at UCSF’s satellite pharmacy, I saw the pharmacists verifying many medication orders. A few seconds after the pharmacists approved some of the orders, a label popped out of a nearby printer, and one of the technicians read it and gathered up the appropriate medication. When the order was for pills, she did this by pouring the pills out of bottles or tearing them from strips of serrated blister packs. When the order called for an intravenous solution, she mixed it under the aluminum hood with a meticulousness that would have met with approval from Walter White.
I asked Chan what would have happened if the tech had received a label with instructions to tear out 38½ individual Septra tablets from a large serrated sheet of individually wrapped pills. Partway through the tearing, he told me, “My tech would have said, ‘Hey, this doesn’t look right.’” I don’t doubt this: there is something about a physical act, whether it is tearing off 39 pills from a sheet or writing out an order with a pen, that can jog a mind out of numb complacency.
Even if the pharmacy tech had missed the error and prepared the 39 pills, there would have been another chance for an eleventh-hour save, because Chan and the other pharmacists check the techs’ work before every medication leaves the satellite pharmacy.
But Pablo Garcia’s first Septra dose was not due for about seven hours, which meant there was time for it to be sent electronically to UCSF’s Mission Bay campus, about five miles away, to be processed by the Swiss-made pharmacy robot there. The robot, installed in 2010 at a cost of $7 million, is programmed to pull medications off stocked shelves; to insert the pills into shrink-wrapped, bar-coded packages; to bind these packages together with little plastic rings; and then to send them by van to locked cabinets on the patient floors. “It gives us the first important step in eliminating the potential for human error,” said UCSF Medical Center CEO Mark Laret when the robot was introduced.
Without question, robots have many advantages over humans, which is why they are taking over so many tasks, in medicine and other industries.
Like most robots, UCSF’s can work around the clock, never needing a break and never succumbing to a distraction.
In the blink of an eye, the order for Pablo Garcia’s Septra tablets zipped from the hospital’s computer to the robot, which dutifully collected the 38½ Septra tablets, placed them on a half-dozen rings, and sent them to Pablo’s floor, where they came to rest in a small bin waiting for the nurse to administer them at the appointed time. “If the order goes to the robot, the techs just sort it by location and put it in a bin, and that’s it,” Chan told me. “They eliminated the step of the pharmacist checking on the robot, because the idea is you’re paying so much money because it’s so accurate.”
Like a missile system now set to launch by the simultaneous turning of two keys, the actions by the physician and the pharmacist had created a live order for 6,160 mg of Septra, or 38½ tablets. At this point, the focus of the hospital’s electronic medication safety system shifted from making sure that the order was correct — protections that had been breached by the actions of the doctor, the pharmacist, and the robot — to making sure that the administered dose matched the prescribed dose.
Most of the time, these protections are crucial to patient safety, since one-third of hospital medication errors occur during the drug administration phase, when a nurse gives a patient a medicine that differs from the one ordered. But when the order itself is wrong, these protections become a perversion, shielding the error from being caught.
In the name of patient safety, the machine had taken over. But at this point, Pablo Garcia was very unsafe.
This is excerpted from The Digital Doctor: Hope, Hype, and Harm at the Dawn of Medicine’s Computer Age, by Robert Wachter. McGraw-Hill, 2015. You can buy the book here.
Illustrated by Lisk Feng
Follow Backchannel: Twitter | Facebook
