Anesthesia Incident Reporting System (AIRS) Case 2024-04: ‘Fail-Safe’ Does Not Mean ‘Failure-Proof’

60-year-old coming to OR after redo sternotomy (AVR and ascending aorta aneurysm). Multiple infusions on pumps in addition to insulin infusion via pump (not syringe). Bedside nursing wanted to consolidate and took insulin off pump (patient was euglycemic). The nurse was concerned the clamp and roller had not been closed; she called the OR warning that insulin might have free-flowed. First blood glucose was 23; glucose infusion required for 4 hours. Reeducation of staff occurred.

“You know, I always thought a fail-safe system was supposed to be somewhat safe… from failure.”

— Jack O’Neill, Stargate SG-1 (T.V. series from 1997-2007)

For many years, medications were given via a roller clamp where the clinician “counted drops” to set the dose. Low-volume infusion pumps (LVP) replaced gravity drips in the 1970s, but they still relied on gravity (Biomed Instrum Technol 2016;50:253-62). Evolution of “smart pumps” accelerated in the 1990s with use of medication libraries and “dose-error reduction software” (Biomed Instrum Technol 2016;50:253-62). Syringe pumps also evolved to include medication libraries and dose-error reduction software.

Despite superior ability to control and monitor flow, both syringe and infusion pumps have received thousands of reports of error. The FDA received 56,000 reports of infusion pump errors between 2005-2009, including programming errors (pounds instead of kilograms or wrong rate of administration) together with alarm failures, miscalibration, and errors in loading the tubing/syringe into the pump (asamonitor.pub/49y1d8Z).

While errors occur with both pumps, the free-flow event above is more common in LVPs than syringe pumps. Free-flow occurs when the administration set is not properly loaded into the pump; or, if during removal of an administration set from a pump, the mechanical “fail-safe” device (key) is not engaged or is dislodged and the manual tubing clamp (roller clamp) has not been closed. Removing a syringe from the infusion device without closing the manual clamp could permit inadvertent depression of the plunger, but this is much less likely to occur than free-flow from an unclamped infusion administration set.

Reports of free-flow of medications were reported by the Institute for Safe Medication Practice (ISMP) and ECRI in the 1990s (Hosp Pharm 1992;27:384-90). And in 2003, The Joint Commission implemented a National Patient Safety Goal to promote free-flow protection with all infusions. All manufacturers incorporated free-flow protection mechanisms, but the current fail-safe technologies remain fallible. Free-flow events are uncommon given the number of infusion pump uses, but they can occur with any LVP system and cause patient harm.

A common cause of free-flow events is misloading of the administration set into the pump, as seen in a case report in Anesthesiology (Anesthesiology 2006;105:434-5). Although introduction of the Alaris Medley medication system included education around correct loading of the tubing, a nitroglycerin infusion tubing set was misloaded with the upper flange not inserted into the proper location (Figure), which allowed the door to be latched but still prevented the tubing from being properly engaged. This allowed free-flow infusion of nitroglycerin with no alarm or warning other than patient hypotension. Free-flow can also occur when a set is removed from a pump while still connected to a patient, if the free-flow prevention system is disengaged, and the manual mechanism of flow prevention (e.g., a roller clamp or clip) was not used.

There is little detail in the AIRS report about the exact error, but it seems the manual clamp was not engaged. In one common pump, a blue “key” must be inserted to unlock the door, thus clamping the tubing. However, the “key” can be dislodged when trying to pull the tubing out of the pump. If the manual clamp has been closed or if the tubing has been disconnected from the patient, there is no issue, but if not, free-flow occurs.

In 2023, the ISMP summarized reports of free-flow due to entrapment of tubing or damaged door components, with the conclusion that staff should not rely on device design to prevent free-flow and that the primary intervention is to use the manual clamp. As ISMP states: “The anti-free-flow protection is a secondary protection mechanism; the roller clamp is the primary method of preventing flow” (asamonitor.pub/493mMhZ). A system-wide approach to errors of infusion pumps is required (asamonitor.pub/49aDsDX).

However, relying on an overworked and fallible human to remember to manually close a clamp is simply unrealistic. Devices are often introduced without consideration of how they will be used (Anesthesiology Clinics 2024;In Press). It is incumbent on infusion pump manufacturers to foresee causes of harm and design mitigations into their products, but local purchasing agents must also involve those at the front lines to understand how these devices will be used and how they might fail.

It is not clear from the report what led the ICU nurse to be concerned: her recognition that a free-flow event might have occurred and her call to the OR averted a potentially lethal event. This awareness of a potential incident echoes one of the characteristics of highly reliable organizations: a preoccupation with failure, i.e., a continual “scanning” of the patient’s environment for system failures (Best Pract Res Clin Anaesthesiol 2011;25:133-44).

This report mentions “reeducation of staff” as an intervention. While proper training is always required, reeducation or additional training are among the weakest safety interventions, along with warnings, admonitions, and writing additional policies (Table). Stronger interventions are engineering controls, either redesigned technology that prevents the primary failure mode or an engineered constraint, often called a “forcing function.” Anesthesiologists recognize forcing functions in the pin-indexing of gas canisters and the anti-hypoxia features of modern anesthesia workstations.

A possible engineered solution is to use syringe pumps for all high-risk medications. Syringe pumps have their own issues, including programming errors, but dose-error reduction software, and especially integration of the EHR, can decrease programming errors. However, many high-risk infusions in the OR may continue into the PACU or ICU, where many nurses are unfamiliar with syringe pumps. Conversion to LVPs on transfer may actually increase the risk of free-flow (and other) events. Any “solution” to the free-flow problem will invariably be associated with challenges, tradeoffs, and new failure modes.

Despite a better understanding of system safety and human factors engineering in perioperative care, there remains a tendency to blame humans for the “errors” they make and try to improve safety by reducing “human error” (Anesthesiology 2014;120:801-6). Pursuing this obsolete view of safety makes systems less safe. Instead, a better understand of safety lies in one of James Reason’s paradoxes of patient safety – that the very source of many errors (humans) is also the element that often achieves safety in our complex environment. As he states: “organisations seek to limit the variability of human action, primarily to minimise error, but it is this same variability – in the form of timely adjustments to unexpected events – that maintains safety in a dynamic and changing world.” Highly trained and dedicated individuals both contribute to adverse events and also intervene to prevent catastrophic patient harm.