Patients' safety and haemodialysis devices (2024)

Search for other works by this author on:

Introduction

Chronic and acute extracorporeal detoxification treatments, such as haemodialysis, haemofiltration, haemodiafiltration or haemoperfusion, clearly have become parts of the standard armamentarium of modern medicine. The necessary technical equipment has been transformed in the course of the last decades from prototype‐like monsters (which nobody dared to touch without thorough education) to handy, nicely designed and reliably working commercial products that are produced in large quantities by the medical industry. It has been estimated that in 1999 the worldwide inventory was more than 280000 dialysis machines with about 40000 new devices entering this market in 1999 alone. Given these numbers it is certainly justified to qualify the use of extracorporeal detoxification technology as a ‘routine procedure’.

Are these procedures safe?

We have seen in many other fields, such as air transportation, nuclear power generation and other examples of routinely applied sophisticated technologies, that it is apparently part of human nature to quickly forget that none of these technologies is free of risks and hazards. Consequently, it is only a matter of probability when and where these technologies will fail terribly. Unfortunately, experience tells also that when such apparently inevitable events have occurred, public interest, sometimes even public uproar, flares up for a short time. Subsequently, the problem is laid to rest again and is of interest only to a small number of specialists whose profession it is to deal with such matters.

I do not want to be cynical, but from long personal experience in the technical development of extracorporeal detoxification procedures and devices, it is my opinion that the dialysis community is not very different from this ‘forget as quickly as possible’ mentality of the general public. Let me illustrate this by an anecdote. Once I had to give a lecture to medical doctors about the technical risks of extracorporeal detoxification treatments. A discussion followed and I was struck by a comment from the auditorium ‘… I do not want to know all this!’. Needless to say that such an approach is dangerously wrong. It is therefore the purpose of this comment to emphasize that it is vital, in order to provide safe extracorporeal treatments, that:

• (1) the operators of these techniques must be aware of the risks, well educated and consciously acting, and

• (2) technical safety features must be implemented in such medical devices.

Experience tells me that such technical considerations are not extremely popular with the medical staff, but it is imperative for the sake of the patients' safety that the medical staff deals with these issues.

How great is the technical risk in extracorporeal detoxification?

It is surprising that it is difficult, if not impossible, to provide exact quantitative information on this point for most parts of the world. Currently there is next to no consolidated data source that provides information about accidents, or near accidents, when such medical devices are used. The available information is fragmentary, selected data are available to single manufacturers, some state authorities collect this information for specific countries, but even these sources are not well structured, consolidated or accessible to the public. One of the few exceptions that the author is aware of is the reporting system of the US Food and Drug Administration (FDA). In particular, the most recent database MAUDE (Manufacturer and User Facility Device Experience Database) [1] and the MDR database (Medical Device Reporting) [2] cover events that had occurred before 31 July 1996. Even these databases, valuable though they are, do not provide accurate numbers for structured searches, since a certain subjected element in the reporting process is involved. In addition, the reports in these databases are descriptive rather than conclusive.

A quick scan of the MDR data base for the interval 1992–1996 yields 47 reported cases concerning death of the patients in the presence of a haemodialysis machine. If one applies common sense and experience to interpret these reports, one can come up with a rough estimate: in 17% of the cases the cause of death was listed as ‘unknown’; in 36% of the deaths these are presumably due to underlying disease, the terminal event just happening while the patient was on dialysis; in another 34% of cases the death was related to human error; and in 3% of the cases death can be attributed to allergic reactions. It is only in 10% of the cases that technical failure of equipment is the most likely cause of death. I emphasize that these numbers are imprecise and incomplete, but they may serve to give an impression of the order of magnitude of the problem. It is not unreasonable, however, to assume that these numbers are only the tip of the iceberg. It is clear, nevertheless, that technical failure of the equipment is responsible for only a very small number of deaths relative to the huge number of treatments performed. In contrast, the number of fatal accidents related to human error is unacceptably high. Although the data are soft, one can draw three conclusions:

• (a) it is worth thinking about the problem

• (b) the statistics confirm the old statement ‘in operating the dialysis machine whatever error can be committed will actually be committed in practice’ and

• (c) risk awareness must be heightened and education of the operator of the equipment is indispensable.

What is the contribution of industry to patient safety?

Since the mid 1980s mandatory safety features of dialysis machines have been imposed and they are the subject of various national and international standards. The most important ones are the IEC standards (International Electrotechnical Commission) and the very similar AAMI standards (American Association of Medical Instrumentation). The latter apply to the United States. For every machine sold after the mid 1980s the user is assured that these devices comply with the respective standards. Compliance is enforced by the various approval and certification procedures. These standards, however, define only minimum safety requirements. Every manufacturer is free to do more than these safety standards require. Rarely, however, do safety features go beyond these minimum requirements, since so far safety does not seem to be a major sales argument on the dialysis market which is increasingly dominated by purely financial considerations.

The basic concept underlying these standards is the ‘first failure safety’ strategy. This term means that a dialysis machine must not expose the patient to a safety hazard when a ‘first failure’ occurs in any critical system of the device. It is imperative, however, that the device is transferred into the so‐called ‘safe state’. The ‘safe state’—depending on the nature of the particular hazard—is a certain configuration of the device in which a safety hazard can be excluded. For instance, for all blood alarms the safe state requires to stop the blood pump(s), to close the venous line clamp, to reduce UF to minimum and to activate audible and visual alarm indicators. I emphasize, however, that by definition a patient is not safe against the second fault in the same system during the same treatment. The practical implications of this are discussed later in this Editorial. In this context a common misunderstanding is to mix up safety and reliability. An absolutely unreliable device may fail numeroustimes during the treatment, but it can do so in a safe way, so that no hazard for the patient is created. The topic of this discussion is exclusively safety, and not reliability.

In most cases, the principle of first failure safety is implemented by a so‐called ‘diverse’ technical structure of the dialysis machine (Figure 1). Without going into details, this means that two completely independent technical systems, i.e. the ‘operative system’ and the ‘protective system’ are involved in the same process. The operative system is the part of the device that actually performs a certain function (example: dialysate proportioning system), whilst the protective system (corresponding example: temperature compensated conductivity monitoring) monitors the output of this process for hazardous deviations. When such a structure is implemented, at least two independent failures in the same system during one single treatment are required before the device operates in an unsafe fashion. Dialysis machines are technically complex. The failure probability of the components involved can be calculated and the statistical likelihood for a potentially fatal second failure within the same treatment shows to be in the order of approximately 10⁻⁸ per hour [3]. In order to have an appreciation of what this figure implies, I quote one example: the statistical probability to die from a fatal accident during professional life in a typical Western country is of the same order of magnitude. To put it differently: compliance with the principle of first fault safety renders dialysis as a technical process as safe—or as unsafe—as daily professional life. Viewed in this perspective, patients’ safety during dialysis is a reasonable compromise between the vital interest of the patient and the required technical and economical input.

This argument is valid only, however, if all operative systems and all protective systems function properly at the start of the treatment. It is absolutely indispensable to subject the dialysis machine to a pre‐dialysis test procedure, the so‐called ‘T1‐test’ or ‘initial self‐test’ to verify that the dialysis machine complies with this requirement (Figure 2). Modern machines perform this test automatically and display the respective results to the user. Manufacturers strictly forbid the use of a dialysis machine if the T1‐test cannot be executed successfully. Depending on the complexity of the machine used to perform this test, it takes time and the user does not always appreciate this. I emphasize that it is highly irresponsible (and may result in legal consequences for the operator in case of a subsequent accident) when this test is not executed before treatment starts.

The requirements for the operation of the dialysis machine are outlined in the documents accompanying the device (mainly the operator's manual and the technical manual). These are the most important documents for the user. Detailed knowledge and training is required to use the dialysis machine in a safe fashion. The accompanying documents not only describe the device‐related requirements in detail, but also provide information on the infrastructural environment required to operate the device, e.g. media supply (water, concentrate(s)), electrical installation, maintenance procedures, etc. Especially as regards electrical installation, I have serious doubts that these requirements are always met. This is true particularly, but not exclusively, in developing countries. I would like to draw the attention of the reader to the problem which has recently caused some discussion, i.e. whether specific electrical requirements have to be met if a dialysis machine is used to treat patients with central venous catheters [4]. During haemodialysis the patient is connected conductively via the blood and the dialysate circuit to isolated electrical components of the machine which potentially are operated with mains voltage. Despite the isolation, small but tolerable currents (the so‐called leakage currents) can flow from the machine via the patient to ground. An appropriate electrical design of a haemodialysis machine ensures that even in the presence of a first failure these currents never exceed the tolerable limits. The most stringent criteria for medical devices in this respect apply to cardiac applications (protective class ‘CF’, i.e. cardiac floating). In dialysis, until recently, it was somehow overlooked that the increasing use of central venous catheters, which may end directly in the heart, requires compliance with the CF limits instead of the higher thresholds used for systems where the connection to the patient normally is achieved via peripheral blood access sites. On behalf of the German Electrotechnical Commission (DKE) the TUEV Product Service GmbH Munich (Germany) recently contacted all major manufacturers worldwide on this subject so that users should be able to get particular advice from their respective manufacturers. In general, one must recommend that whenever something is unclear to the operator of the dialysis machine, he or she should contact the manufacturer of the equipment for further advice.

Nothing is perfect

The above mentioned standards deal with potential safety hazards related to dialysis and similar extracorporeal procedures. It is required that a protective system has to be provided for every potential safety hazard. The standards provide typical examples for such systems which are adopted by most manufacturers. Unfortunately, several of the systems proposed by the standard lists, under certain circ*mstances, might have limited sensitivities. This implies that safety hazards cannot always be detected sufficiently fast and sensitively. Therefore, it is required that the documents accompanying a device must inform the user in a detailed fashion about the specific limitations of the various safety measures. Obviously, such knowledge is crucial for the operator in order to be able to conduct safe dialysis sessions. Why is the sensitivity of these systems limited? This mainly results from the necessary compromise between what is technically possible and what is economically affordable.

One major technical risk during extracorporeal detoxification is blood loss to the environment. The protective system addressing this problem comprises monitoring of the extracorporeal venous pressure to detect this kind of leakage. The devices normally have an alarm window with a finite upper and lower limit. It is therefore obvious that a blood leak must be sufficiently large to be detected from the resulting venous pressure decrease (and this only provided the alarm window is appropriately located). It is widely believed, but definitely wrong, that the best location of the alarm window is in the centre position around the pressure that is to be monitored. In reality the system is the more sensitive the closer the lower limit is positioned towards the actual pressure. However, such a favourable alarm limit position can cause frequent nuisance alarms as a result of small pressure fluctuations which are not dangerous at all. This may be the reason that such an asymmetric alarm window position is rarely used. These nuisance alarms are a general problem with many existing brands of dialysis machines where further industry actions are required. Frequent alarms that do not indicate a hazardous situation but are caused by harmless fluctuations are not only disturbing but can reduce the alertness of the operator for the really important events.

Accidents related to undetected blood loss to the environment occur frequently. The worst case is disconnection of the venous needle from the vascular access of the patient. It is obvious from the principle underlying the monitoring that the venous pressure will only change if the blood flow through the venous needle changes. This will not be the case if the venous needle is dislocated. There is no system currently available on the market that would be able to detect this event, which may very rapidly lead to a fatal accident. This problem has been reported in literature [5] and all manufacturers inform the operator in the respective manuals about this specific hazard. Nevertheless, recurrent reports concerning such often fatal accidents document that not all operators fully appreciate this danger. Currently there is no technical system to exclude such accidents, although this will hopefully change in the future. In the meantime the best strategy is to appropriately fix the needle and tubing and to keep the site accessible to inspection, e.g. not to cover it by blankets, etc. Operator awareness of the great danger of extracorporeal disconnections is the only way to prevent such tragic yet stupid accidents which may result in loss of lives.

Another hazard that may go undetected with commonly used protective systems, is mechanical haemolysis. This may result from obstructions in the extracorporeal circuit, e.g. kinking as a result of faulty handling or manufacturing problems [6–8]. The most critical segment is that between the arterial blood pump and the blood inlet of the dialyser. Since in this situation shear stress causes erythrocyte damage, the use of static pressure monitors is of limited value to detect this hazard. Most manufacturers offer advice on how to avoid kinks of the extracorporeal blood lines. Quality line sets have appropriately high wall thickness to further reduce this hazard. Faulty blood lines may soften and tend to undergo kinking, i.e. at blood temperature. The reports on this hazard underline how important it is to use high quality blood lines instead of line sets of dubious origin and even without proper certification that they are suitable for a particular medical device.

Due to limitations of space I cannot describe all potential hazards. Further potential hazards comprise, for instance, ultrafiltration errors, concentrate mix‐ups, and air infusion. One has to be aware that there are inherent hazards involved in extracorporeal detoxification procedures. Even though modern equipment provides a wide array of safety features which are continuously updated and improved by the manufacturers, the educated and consciously acting operator is and will remain a key element to provide safe treatments.

Conclusions

I wish to close by giving a few simple rules which the operator should remember.

• (i) Always read and understand the various accompanying documents of a medical device before using it. Device documentation addresses various levels of operation such as nursing staff, and technical staff. Carefully read what is required for your personal level of operational responsibility.

• (ii) If in doubt, contact the manufacturer for clarification.

• (iii) Strictly comply with all the infrastructural requirements for the operation of a device, especially in relation to the electrical installation.

• (iv) Understand and always be aware of the limitations applying to the safety systems of a device. Pay special attention to these items.

• (v) Always perform the required initial T1‐test before the treatment session starts. Do not omit this because you consider this step as boring or overly time‐consuming. It is crucial for the safety of your patient.

• (vi) Never use a device that has failed in the initial T1‐test. Always ask for competent technical assistance in such cases.

Unfortunately, absolute safety cannot be guaranteed, even for high quality medical devices. Experience tells us, however, that the above rules can lower the probability of incidents during an extracorporeal detoxification to an inevitable minimum.

Correspondence and offprint requests to: Thomas Roy, Fresenius Medical Care, Department PPB‐CE 3‐A012, Else Kröner Strasse 1, D‐61346 Bad Homburg, Germany.

References

European Renal Association-European Dialysis and Transplant Association

Issue Section:

Editorial Comments

Comments

0 Comments

I agree to the terms and conditions. You must accept the terms and conditions.

Email alerts

Citing articles via

More from Oxford Academic