The Rising Frequency of IT Blackouts Indicates the Increasing Relevance of IT Emergency Concepts to Ensure Patient Safety

Summary

Introduction: As many medical workflows depend vastly on IT support, great demands are placed on the availability and accuracy of the applications involved. The cases of IT failure through ransomware at the beginning of 2016 are impressive examples of the dependence of clinical processes on IT. Although IT risk management attempts to reduce the risk of IT blackouts, the probability of partial/total data loss, or even worse, data falsification, is not zero. The objective of this paper is to present the state of the art with respect to strategies, processes, and governance to deal with the failure of IT systems.

Methods: This article is conducted as a narrative review.

Results: Worst case scenarios are needed, dealing with methods as to how to survive the downtime of clinical systems, for example through alternative workflows. These workflows have to be trained regularly. We categorize the most important types of IT system failure, assess the usefulness of classic counter measures, and state that most risk management approaches fall short on exactly this matter.

Conclusion: To ensure that continuous, evidence-based improvements to the recommendations for IT emergency concepts are made, it is essential that IT blackouts and IT disasters are reported, analyzed, and critically discussed. This requires changing from a culture of shame and blame to one of error and safety in healthcare IT. This change is finding its way into other disciplines in medicine. In addition, systematically planned and analyzed simulations of IT disaster may assist in IT emergency concept development.

 

MissingLinkText

Keywords

Equipment Failure - Patient Safety - ITIL - Electronic Medical Records - Clinical Information System

 

 

MissingLinkText

^* both authors contributed equally

• References

• 1 Frey D, Schulz-Hardt S. Eine Theorie der gelernten Sorglosigkeit.. [A theory of learned carelessness] (German) Mandl H. editor. 1997; 40: 604-11.
• 2 Sparrow B, Liu J, Wegner DM. Google effects on memory: cognitive consequences of having information at our fingertips.. Science 2011; 333: 776-8.
• 3 Botta J, Walliser P. Die fatalen Folgen der Implementierung einer HL7-ADT-Schnittstelle.. Swiss Medical Informatics 2014 30.
• 4 Dobuzinskis A. Cyber attack snarls Los Angeles hospital’s patient database.. Internet; 17.02.2016.
• 5 Dalton A. Hospital paid 17K ransom to hackers of its computer network.. Internet; 17.02.2016.
• 6 Flade F, Frigelj K, Grabitz I. Cyber Attacks On Hospitals, A New Kind Of Deadly Virus.. Internet; 23.02.2016.
• 7 Avrin DE, Andriole KP, Yin L, Gould R, Arenson RL. Simulation of disaster recovery of a picture archiving and communications system using off-site hierarchal storage management.. J Digit Imaging 2000; 13: 168-70.
• 8 Mansoori B, Rosipko B, Erhard KK, Sunshine JL. Design and implementation of disaster recovery and business continuity solution for radiology PACS.. J Digit Imaging 2014; 27: 19-25.
• 9 Colpas P. DR underscores the importance of security. Regardless of the selected solution, experts agree the most important criteria for a disaster recovery (DR) back-up system is that it is secure.. Health Manag Technol 2013; 34: 6-8 10-1.
• 10 Poelker C. Don’t roll the dice on data loss. Implement smart recovery to reduce disaster recovery costs in healthcare.. Health Manag Technol 2012; 33: 14-5.
• 11 Bandyopadhyay K, Schkade LL. Disaster recovery planning by HMOs: theoretical insights.. Health Care Manage Rev 2000; 25: 74-84.
• 12 Bagalio SA. When systems fail: improving care through technology can create risk.. J Healthc Risk Manag 2007; 27 (Suppl. 13) 15-8.
• 13 Lindeman J, Grogan J. Beyond disaster recovery. Disaster recovery has refocused healthcare organizations from “always being ready” to “always being on”.. Healthc Inform 2007; 24: 72.
• 14 Ong M-S, Magrabi F, Coiera E. Syndromic surveillance for health information system failures: a feasibility study.. J Am Med Inform Assoc 2013; 20: 506-12.
• 15 Warden GL. Health IT and patient safety: Building safer systems for better care.. Washington, DC: National Academies Press; 2012
• 16 Just BH, Proffitt K. Do you know who’s who in your EHR?. Healthc Financ Manage 2009; 63: 68-73.
• 17 Bowman S. Impact of electronic health record systems on information integrity: quality and safety implications.. Perspect Health Inf Manag 2013; 10: 1.
• 18 The European Union Agency for Network and Information Security (ENISA).. https://www.enisa.europa.eu.
• 19 General Secretariat of the Council, European Parliament, Committee of the Regions, Economic and Social Committee.. Computer Emergency Response Team (CERT-EU).. https://cert.europa.eu/cert/clusteredition/en/latest.html.
• 20 Stych C, Zeppenfeld K. ITIL.. Berlin: Springer; 2008
• 21 DIN ISO 14971. DIN EN ISO 14971:2013-04: Medizinprodukte - Anwendung des Risikomanagements auf Medizinprodukte (ISO 14971:2007, korrigierte Fassung 2007-10-01); Deutsche Fassung [Medical devices - Application of risk management to medical devices; German version] EN ISO 14971:2012.
• 22 Mellin-Olsen J, Staender S, Whitaker DK, Smith AF. The Helsinki Declaration on Patient Safety in Anaesthesiology.. Eur J Anaesthesiol 2010; 27: 592-7.
• 23 Diller T, Helmrich G, Dunning S, Cox S, Buchanan A, Shappell S. The Human Factors Analysis Classification System (HFACS) Applied to Health Care.. Am J Med Qual 2014; 29: 181-90.
• 24 Neuhaus C, Röhrig R, Hofmann G, Klemm S, Neuhaus S, Hofer S. et al. Patientensicherheit in der Anästhesie.. [Patient safety in anesthesiology: Multimodal strategies for perioperative care] (Germman) Anaesthesist 2015; 64: 911-26.
• 25 Thomeczek C, Rohe J, Ollenschlager G. Das unerwünschte Ereignis in der Medizin.. [Adverse events in medicine] In: Madea B, Dettmeyer R. editors. Medizinschadensfälle und Patientensicherheit. [Medical Failures and Patient Safety] (German) Köln: Deutscher Ärzteverlag; 2007. p. 13-20.
• 26 Taylor-Adams S, Vincent C. Systems analysis of clinical incidents: The London protocol.. Clinical Risk 2004; 10: 211-20.
• 27 DIN EN 80001-1:2011-11. DIN EN 80001-1:2011-11 Anwendung des Risikomanagements für IT-Netzwerke, die Medizinprodukte beinhalten - Teil 1: Aufgaben, Verantwortlichkeiten und Aktivitäten (IEC 80001-1:2010); Deutsche Fassung [Application of risk management for IT-networks incorporating medical devices - Part 1: Roles, responsibilities and activities; German version] EN 80001-1:2011.
• 28 DAkkS Deutsche Akkreditierungsstelle.. Leitfaden Usability.. 2010. http://www.dakks.de/sites/default/files/71_sd_2_007_leitfaden_usability_1.3_0.pdf.
• 29 Tom Sullivan.. More than half of hospitals hit with ransomware in last 12 months.. April 07, 2016. http://www.healthcareitnews.com/news/more-half-hospitals-hit-ransomware-last-12-months. Accessed 2 Aug 2016
• 30 Sittig DF, Singh H. A Socio-Technical Approach to Preventing, Mitigating, and Recovering from Ransomware Attacks.. Appl Clin Inform 2016; 7: 624-32.
• 31 Olenick D. The Ottawa Hospital fends off ransom-ware attack.. 14 March 2016. http://www.scmag-azine.com/the-ottawa-hospital-fends-off-ransom-ware-attack/article/482921. Accessed 2 Aug 2016
• 32 Magrabi F, Aarts J, Nohr C, Baker M, Harrison S, Pelayo S. et al. A comparative review of patient safety initiatives for national health information technology.. Int J Med Inform 2013; 82: e139-48.
• 33 ISO/IEC 200–1:2011. ISO/IEC 200–1:2011. Information technology -- Service management -- Part 1: Service management system requirements.; 2011
• 34 Kabachinski J. Have You Heard of ITIL?: It’s Time You Did.. Biomedical Instrumentation & Technology 2011; 45: 59-62.
• 35 Hoerbst A, Hackl WO, Blomer R, Ammenwerth E. The status of IT service management in health care - ITIL® in selected European countries.. BMC Med Inform Decis Mak 2011; 11: 76.
• 36 Lapão LV, Rebuge A, Silva M.M, Gomes R. ITIL Assessment in a healthcare environment: the role of IT governance at Hospital São Sebastião.. Stud Health Technol Inform 2009; 150: 76-80.
• 37 Gamble KH. Weathering the storm.. Having a disaster recovery plan can mean the difference between scrambling for a quick IT fix and smooth sailing in the storm. Healthc Inform 2008; 25 (Suppl. 32) 34 36-8.
• 38 NGZ-Online.. Computer-Virus legt das Lukaskrankenhaus lahm.
• 39 Genes N, Chary M, Chason KW. An academic medical center’s response to widespread computer failure.. Am J Disaster Med 2013; Spring 8 (Suppl. 02) 145-50.
• 40 Mazzoleni MC, Baiardi P, Giorgi I. Lesson learnt from a halt of the hospital information system.. Stud Health Technol Inform 1999; 68: 102-5.
• 41 Kilbridge P. Computer crash--lessons from a system failure.. N Engl J Med 2003; 348: 881-2.
• 42 World Health Organization (WHO).. WHO draft guidelines for adverse event reporting and learning systems.. 2005. http://osp.od.nih.gov/sites/default/files/resources/Reporting_Guidelines.pdf Accessed 26 Feb 2016
• 43 European Commission, Patient Safety and Quality of Care working group.. Key findings and recommendations on Reporting and learning systems for patient safety incidents across Europe.. 2014. http://ec.europa.eu/health/patient_safety/policy/index_en.htm. Accessed 26 Feb 2016
• 44 Cooper JB, Newbower RS, Kitz RJ. An analysis of major errors and equipment failures in anesthesia management: considerations for prevention and detection.. Anesthesiology 1984; 60: 34-42.
• 45 Cooper JB, Newbower RS, Long CD, McPeek B. Preventable anesthesia mishaps: a study of human factors.. Anesthesiology 1978; 49: 399-406.
• 46 Vincent C. How to investigate and analyse clinical incidents: Clinical Risk Unit and Association of Litigation and Risk Management protocol.. BMJ 2000; 320: 777-81.