Use of an identification system based on biometric data for patients requiring transfusions guarantees transfusion safety and traceability

Abstract

Background

One of the most serious risks of blood transfusions is an error in ABO blood group compatibility, which can cause a haemolytic transfusion reaction and, in the most severe cases, the death of the patient. The frequency and type of errors observed suggest that these are inevitable, in that mistakes are inherent to human nature, unless significant changes, including the use of computerised instruments, are made to procedures.

Methods

In order to identify patients who are candidates for the transfusion of blood components and to guarantee the traceability of the transfusion, the Securblood system (BBS srl) was introduced. This system records the various stages of the transfusion process, the health care workers involved and any immediate transfusion reactions. The patients and staff are identified by fingerprinting or a bar code. The system was implemented within Ragusa hospital in 16 operative units (ordinary wards, day hospital, operating theatres).

Results

In the period from August 2007 to July 2008, 7282 blood components were transfused within the hospital, of which 5606 (77%) using the Securblood system. Overall, 1777 patients were transfused. In this year of experience, no transfusion errors were recorded and each blood component was transfused to the right patient.

We recorded 33 blocks of the terminals (involving 0.6% of the transfused blood components) which required the intervention of staff from the Service of Immunohaematology and Transfusion Medicine (SIMT). Most of the blocks were due to procedural errors.

Conclusions

The Securblood system guarantees complete traceability of the transfusion process outside the SIMT and eliminates the possibility of mistaken identification of patients or blood components. The use of fingerprinting to identify health care staff (nurses and doctors) and patients obliges the staff to carry out the identification procedures directly in the presence of the patient and guarantees the presence of the doctor at the start of the transfusion.

Introduction

One of the most serious risks of transfusing blood is an error in ABO compatibility ^1–5 which can cause a haemolytic transfusion reaction and, in the most severe cases, the death of the patient^3,6–7. The risk of ABO incompatible transfusions is generally underestimated but similar in all industrialised countries, being between 1:12,000 and 1:135,000 units of red blood cells transfused^8–9; the risk of mortality is between 1:800.000 and 1:1.800.000^10–12. The frequency and type of errors observed suggest that these are inevitable, in that mistakes are inherent to human nature, unless significant changes, including the use of computerised instruments, are made to procedures^{1,4,8,13–18}.

For years there has been the awareness in Transfusion Medicine that a large part of the residual transfusion risk is due to events that occur outside the areas of transfusion competence^7,18–21. Various reports^10,22–26 have clearly highlighted this problem, showing that over 50% of transfusion-related deaths are due to “clerical errors”, that is, errors in identifying the patient. These errors in identification occur when taking the blood sample for pre-transfusion tests or just before the transfusion, or are errors in identifying the blood components to transfuse.

In recent years there have been notable investments to make blood safer, particularly from the point of view of biological safety. However, despite the fact that the risk of transfusion reactions from ABO incompatibility is higher than the risk of viral infections^{9,18,23,24,27}, relatively little has yet been done to avoid errors of identification, particularly within hospital wards^26,28, in order to be sure of giving the right blood component to the right person.

There does not, therefore, seem to be any doubt that action must be taken to improve the complete control of the transfusion process, in terms of “total quality management”, particularly in the areas outside those strictly of the competence of the Service of Immunohaematology and Transfusion Medicine (SIMT), that is, within wards and operating theatres, because it is in these areas that there are margins for improvement of safety that elsewhere are, frankly, difficult to find^{4,7,10,17,18,22,29,30}.

This problem was recently considered by the Ministry of Health, which, in March 2007 issued a Recommendation³⁰, whose aim was to prevent transfusion reactions due to ABO incompatibility, identified as sentinel event n. 5. This document stated that the absence or lack of application of specific procedures is an important risk factor that can enable the occurrence of an adverse event during one of the various stages of the transfusion process, from taking the sample to determine the recipient's blood group up to the transfusion of the blood components. Among the proposals made with the aim of avoiding ABO transfusion errors, the Recommendation encourages the use of new technologies, implementing safety systems, such as barcode systems based on the use of identification wristbands, request forms, test-tubes and labels with a unique identity code for each patient.

Both national and European regulations^32–36 have also moved, particularly in the last few years, in the direction of total quality of the process, guaranteeing maximum traceability and, with regards to the prevention of ABO incompatibility errors, obliging the use of every safety measure, including those based on computer systems, for the identification of patients, their blood samples and the units allocated to them, both in the SIMT and in clinical areas.

Materials and methods

In order to ensure unequivocal identification of patients who are possible recipients of blood component transfusions and to guarantee the complete traceability of the operations occurring after the allocation and delivery of the blood components, the “Civile- MPA” hospital of Ragusa adopted the Securblood system (BBS srl - Blood Bank Service, San Donato Milanese, Milan, Italy). This system comprises handheld terminals with rechargeable batteries and a microprocessor, a GSM/GPRS modem, a barcode reader, a biometric sensor for reading fingerprints, a keypad and a display (Figure 1).

Figure 1.

Securblood terminal

The biometric sensor records a fingerprint from the people concerned (health care workers and patients) and, through specific software, converts the image of part of the fingerprint into encrypted strings of numbers which are memorised in a protected archive within the instrument itself. The algorithms created are unidirectional (that is, the string of numbers is reached from the fingerprint, but not vice versa) and the strings are not exported out of the terminal. Furthermore, no sensitive personal data are associated with this algorithm, but only numerical codes such as badge number and personal identification number (P.I.N.) for the staff and the transfusion request code for the patients.

The involvement of fingerprinting required a lengthy process of authorisation from the official body safeguarding privacy, since the use of biometric data in Italy is dependent on respecting the regulations concerning the handling of sensitive data included in article 17 of the legislation on the protection of personal data³⁷. On the 19^th June, 2008 the independent authorities responsible for safeguarding privacy authorised our hospital to use biometric data for the recognition of patients to undergo transfusions and health care staff charged with carrying out either the pre-transfusion blood sampling or the transfusion itself³⁸.

The traceability of data

The Securblood system guarantees complete traceability throughout the transfusion process, both during the pre-transfusion stage and during the transfusion, recording the following data:

• - the health care staff (nurses and doctors) involved in the transfusion, who are identified by fingerprinting or by a P.I.N.;

• - the potential transfusion recipient, identified by fingerprinting or a barcode on a wristband applied to the patient, in association with the transfusion request number;

• - date, time of starting and time of completing the transfusion and any immediate transfusion reactions noted.

The system makes it possible to check that the units of blood to transfuse are the same units assigned by the SIMT for that particular patient and, in the case of incongruence of data (because they do not correspond with the patient's data or because of an error in the label of the blood component assigned) the system is blocked, preventing the health care worker from continuing with the procedures and compelling him or her to contact the SIMT to verify the congruence of the data.

Implementation of the system

The Securblood system was introduced experimentally in our hospital in the period between July 2007–April 2008 in 12 ordinary wards, in the day hospital and in three operating theatres. Another terminal was installed in a private nursing home with a stipulated arrangement with the SIMT.

Training and registration of the staff

Before using the Securblood device, the doctors and nurses who carry out transfusions were trained and registered within the terminal destined for use in the wards. At the end of the training course, each participant was certified as able to use the terminal. The procedure of registering the staff was carried out by a person authorised by the Director of the SIMT who, having used an access password, entered the following data into each terminal for each member of staff:

• - personal badge number

• - type of staff (nurse or doctor)

• - fingerprint - secret P.I.N. known only to the member of staff.

Management of the transfusion request

A transfusion request is compiled by the ward doctor for patients who require a transfusion of a blood component. The patient is actively identified and a sample of blood is taken from the patient for the pre-transfusion tests. Before the sample is taken, the patient's fingerprint is recorded in the Securblood terminal together with an alphanumeric code reported on the pre-printed adhesive label that is placed on both the transfusion request and on the test-tube containing the patient's sample of blood. In addition, a barcode on a wristband, which is attached to the patient's wrist, is recorded. The barcode on this wristband is an alternative means of identifying the patient in the case that a fingerprint cannot be correctly recorded.

Figure 2 is a flow chart showing the steps used in the management of a request for a transfusion.

Figure 2.

Transfusion request: ways of identifying a patient who is to receive a transfusion.

Recognition of the blood components to transfuse

Before a transfusion, the member of staff, using the Securblood terminal, reads the four identification bar codes on the two labels attached to each unit to transfuse. These codes, recorded by the Securblood terminal, are: the CDM (codice donazione mondiale, world donation code), the blood component code, the CDMN (world donation code combined with the blood component code) and the BBS code, which identifies the request and corresponds to the code recorded in the pre-transfusion stage. The reading of the CDM and CDMN codes gives a guarantee that the SIMT has correctly matched the assignment label with the unit to transfuse. In this way, the staff in the ward in which the transfusion takes place carry out a sort of control that the assignment procedure by the SIMT is correct; in the case that the CDM and CDMN codes on the assignment label do not match, the system is blocked. For patients requiring the transfusion of two or more units, the registration of each blood component and the recognition of the patient through the use of the Securblood terminal is done in real time, just before the actual transfusion of each blood component.

Recognition of the patient

Immediately before the transfusion the procedures of active recognition of the patient by both the nurse and the doctor are carried out: the patient's fingerprint is compared with that previously recorded when the samples for the pre-transfusion tests were taken, in this way checking that the two correspond.

Checking the doctor before the transfusion

After having checked the data on the unit to transfuse and the patient's data, before starting the transfusion, the Securblood system requires the presence of a doctor who is identified by his or her fingerprint. The presence of the doctor is a further safeguard for the patient, considering that most unfavourable side effects of a transfusion, which could require the urgent assistance of a doctor, occur in the first few minutes of a transfusion²⁸.

Figure 3 is a flow diagram showing the correct management of the transfusion.

Figure 3.

Transfusion: method for identifying the patient and blood components

Closing the transfusion

At the end of the transfusion of each blood component, the nurse records the time of the completion of the transfusion, by reading the CDM and blood component codes reported on the identification label of the unit with the Securblood terminal. On this occasion, the health care worker records amy immediate side effects that occurred during the transfusion, entering corresponding numerical codes using the keypad on the terminal.

Method of transferring the recorded data

All the data recorded are sent automatically from each Securblood terminal to a remote server managed by the BBS and from this sent to the SIMT system for the management of transfusion activities (EmoNet, Insiel, Udine, Italy). The data are also sent to all the other related terminals within the hospital to enable their synchronisation. This sharing of data between various terminals in a hospital enables a transfusion request to be recorded in one working unit of the hospital, the transfusion to be started in another unit and the closure to be recorded in a third unit, thus following the patient in his or her movement through various areas of the hospital (e.g. casualty, operating theatre, ward).

The system of transferring data from the terminals to the server is based on the GPRS/FTP protocol and that in the opposite direction by a SIM Card capable of “machine to machine” data transfer.

All the data recorded are visible in the confidential section of the BBS site, which can be accessed only with the use of a user code and a password (figure 4).

Figure 4.

List of transfusions and traceability of the various stages of the process: sampling stage, start of transfusion, closure of transfusion

Duration of the storage of data

The algorithms of the fingerprints, the badge numbers and P.I.N. recorded by the health care staff remain within the terminal of origin of each ward. These data are cancelled only be the person authorised by the Director of the SIMT, following entry of a special access password, in the case the member of staff ceases to be an employee of the hospital.

As far as concerns the patients' data (fingerprint algorithms, request codes, wristband barcodes), these are cancelled automatically 10 days after the transfusion request was recorded. The numerical data sent to the BBS server are cancelled every 6 months, after having been copied on a magnetic support stored by the Director of the SIMT.

Monitoring transfusions and haemovigilance

The report of the data recorded (Figure 4) shows those cases in which the closure of the transfusion was not recorded and any transfusion reactions. In these cases the system sends a notification by mail to the person in charge of haemovigilance in the SIMT who asks the ward involved to send the SIMT the paper documentation demonstrating that the transfusion took place.

In order to monitor the ways the transfusions were carried out, in particular the identification of the blood components and patients and the duration of each single transfusion, we also established objective time limits; if these were not met, the data registration system notified us of the non-conformity.

The criteria adopted concerned the maximum and minimum duration of a transfusion, the minimum time between the start of the transfusion of two or more consecutive units and the minimum time between the closure of more than one consecutive transfusion. These criteria were adopted for all patients, except those given massive transfusions or undergoing red cell exchange procedures using a cell separator. In these cases neither the duration of the transfusions nor the time between the administration of one unit and the next was monitored.

The maximum duration of a transfusion was set at 240 minutes^28,39, after which there is an increased risk of deterioration of a blood component kept at room temperature.

The other parameters monitored (minimum time between the start of transfusions of consecutive units, minimum time between the closure of transfusions of consecutive units and the minimum duration of a transfusion) are used as indicators of procedural anomalies that can occur in a ward, such as the temporally close registration in the terminal of all the blood components destined to a single patient and the incorrect registration of each blood component just before their actual transfusion.

Results

In the period from August 1, 2007 to July 31, 2008, a total of 7282 blood components were transfused, of which 77% (n=5606) were transfused using the Securblood system. Overall, 1777 patients received transfusion using this system. In 1 year of experience, there were no records of any wrong transfusions and each blood component was transfused to the right patient.

The terminals blocked in 33 cases (corresponding to 0.6% of the blood components transfused) that required an intervention by a member of staff from the SIMT.

The terminal blocked because of errors in reading fingerprints or barcodes on the patients' wristbands or because of errors in reading the barcodes on the labels of the units to be transfused. Following a block of a terminal, a member of staff from the SIMT intervened: after having analysed the various conditions that had occurred and after having been ensured of the correct identification of the patient and the blood components, the SIMT staff restored the terminal's function. In 29 cases (88%) the problem was resolved by telephone, while in four cases (12%) a member of staff of the SIMT had to go to the working unit involved in order to determine personally the problem that had occurred.

The problems that caused the terminals to block were as follows:

• - no record of the barcode of the transfusion request in the Securblood terminal: in this case the system blocked at the time of the transfusion because it could not match the units to transfuse with the patient, who was not registered in the terminal;

• - lack of reading of the request code/sample code by the SIMT during the stage of recording the transfusion request in the EmoNet management system and printing the assignment label with a request code different from that recorded in the terminal during the request at the patient's bedside;

• - inability to read the barcodes on the labels of the blood component because the labels were damaged;

• - repeated errors in reading the patient's fingerprint or incomplete reading of the wristband bar code;

• - lack of the procedure of sharing data recorded for patients whose transfusion request was made in a different ward from the one in which the transfusion was administered.

Most of the anomalies recorded were related to the lack of registration of the completion of the transfusion and any transfusion reactions. Of 5606 blood components monitored and transfused, the closure of the transfusion was not recorded for 153 units (2.7%). The lack of transfusion closure records was greater in wards outside the SIMT, (n=111; 13.4%) than in those within the SIMT (n=42; 0.9%).

There were 11 adverse reactions to 5453 transfusions, equivalent to a rate of 0.2% of the units transfused. Table I summarises the various types of adverse reactions and their distribution in the wards.

Table I.

Number of adverse reactions to transfusions (5,606 transfusions)

Transfusion reactions	Number of reactions	Percentage of reactions to transfusions administered	Wards
Non-haemolytic transfusion reaction	6	0.11%	2 Thalassaemia unit
			2 Medicine unit
			1 Infectious diseases unit
			1 Private nursing home
Urticaria	3	0.05%	3 Thalassaemia unit
Allergy	2	0.04%	2 Thalassaemia unit
Total reactions	11	0.20%

Procedural anomalies related to the duration of the transfusions and times between the start of two consecutive transfusions and between the closure of two consecutive transfusions were found in 131 cases, representing 5.8 % of the blood components transfused. Also in this case the number of anomalies recorded in wards outside the SIMT (n=87 anomalies; 10.5%) was higher than the number recorded in wards within the SIMT (n=44 anomalies; 1.1%) (Table II).

Table II.

Transfusions not recorded correctly

	Wards within the SIMT		Wards not in the SIMT		Total
Start of transfusions temporally too close*	2	0.1%	7	0.8%	9	0.2%
Closure of transfusions temporally too close*	9	0.2%	14	1.7%	23	0.5%
Duration of transfusions too short*	5	0.1%	3	0.4%	8	0.2%
Duration of transfusions too long*	28	0.7%	63	7.6%	91	1.9%
Total number of transfusions recorded incorrectly	44	1.1%	87	10.5%	131	2.7%
Total number of transfusions recorded correctly	3,935	98.9%	743	89.5%	4,678	97.3%
Total transfusions*	3,979		830		4,809

^*Data related to units transfused with a cell separator for red blood cell exchange procedures are excluded

The mean duration of transfusion of each blood component was 1 hour and 10 minutes for transfusions carried out in wards within the SIMT and 2 hours and 31 minutes for those administered in wards outside of the SIMT.

Discussion

All the blood components assigned by the SIMT were transfused to the patients for whom they had been requested and in the observation period there were no errors in identification of either patients or assigned blood components.

Use of the Securblood system did not cause significant delay in the transfusion of blood components in any case and no increase was recorded in the recourse to very urgent transfusions, which involve the use of units of O Rh negative blood cells that can be transfused without any cross-matching tests, in this way by-passing the procedure planned by the Securblood system. In fact, during the period of the study the very urgent transfusion procedure was used for 19 patients who were given a total of 30 units of red cell concentrates. In the corresponding periods in the two preceding years (2005–2006 and 2006–2007), the very urgent procedure was used for 37 and 25 patients, respectively, who were transfused with 53 and 36 units.

Technical or operative problems occurred for only 0.6% of the units transfused and the Securblood system was, therefore, demonstrated to be fairly easy to use.

The training course that we provided, besides having the purpose of explaining the use of the system to the staff, also had the merit of increasing the level of attention dedicated to transfusion procedures, identification of the patient and the duties of the various members of staff involved in the transfusion (nurses and doctors). In this regard, it was repeatedly emphasised that a doctor must be present during the initial stage of a transfusion and this approach, which is aimed at increasing the patients' safety, was well accepted, particularly by the nursing staff.

The technical and operative difficulties that we recorded were related to the experience gained by the staff and, therefore, the number of units transfused: the rate of blocks of the system with respect to the number of units transfused was about 0.2% for wards within the SIMT, whose staff carry out numerous transfusions each day, but reached higher values (2.8%) in wards not in the SIMT, in which transfusions are less frequent and their performance divided among various different members of staff, such that during 1 year a single person, carrying out few transfusions, may use the Securblood terminal only occasionally and introduce anomalies that the block the system.

The traceability of the whole transfusion process outside the SIMT, including the notification of adverse reactions to transfusions, was guaranteed for 97.3% of the units transfused. For all these units whose whole transfusion process was correctly recorded, the SIMT did not request a copy of the form documenting that the transfusion had taken place, as occurred previously, since all the data necessary were already recorded by the Securblood system and could, therefore, be consulted on the EmoNet management system. This percentage of notifications of transfusions administered was higher than that in previous years which remained around 90%. Also in this case we noted that the number of transfusion records that were not closed was much higher for blood components transfused in wards outside the SIMT (13.4%) than for those transfused in wards within the SIMT (0.9%). For those units of blood components whose transfusion record was not closed, we requested a copy of the form documenting that the transfusion had been administered, together with the records of any adverse reactions in order to be able to complete the haemovigilance data. The higher percentage of transfusion records not closed in wards not in the SIMT is again due to the limited experience of the ward staff and we are confident that this percentage will tend to decrease as the staff gain experience.

One of the most serious procedural anomalies to which we gave particular attention was the temporally close registration of the start of more than one unit of blood component in the same patient. Only nine cases of this non-conformity were recorded by the system. This anomaly is an indicator of incorrect application of the transfusion procedure by the ward staff in that the units were recorded on the Securblood terminal contemporaneously, to then be transfused in a normal time, one after another. This type of procedural nonconformity can lead to risks in identification and exchange of units at the time of transfusion and, furthermore, circumvents the obligatory presence of a doctor at the start of the transfusion of each blood component.

The anomaly of the closure of transfusions being recorded in too short a period of time occurred in 23 cases (representing 0.5 % of the blood components transfused) and was due to the closure of all the units transfused being done at the end of the transfusion of the last unit. Once again, this problem was related to the lack of experience of the staff and it is presumed that this anomaly will decrease over the next months.

Conclusions

The SIMT must play an important role in guaranteeing the safety of transfusions and the correct pairing between patients and the blood components they have been assigned⁴⁰. The goals that we set when we adopted the Securblood identification system were to eliminate ABO transfusion errors and guarantee the complete traceability of the whole transfusion process also outside the SIMT. The system enables the patient to be recognised just before the transfusion, thus guaranteeing that this person is the same patient from whom the pretransfusion sample was taken and data recorded. The Securblood system can also be used to carry out transfusions safely in patients who cannot be identified, who are unconscious and without identity documents, admitted urgently and in the absence of relatives or acquaintances who can certify their identify. The system was, therefore, also used in the Reception and Casualty departments and the patients were identified only by fingerprinting paired with a barcode on a wristband.

Two reasons convinced us to use biometric data rather than other systems based only on the reading of alphanumeric codes or the keying in of personal codes to recognise patients and health care staff.

The first reason is that the Securblood system, involving the use of the patients' and staff's fingerprints, obliges the nurses and doctors to carry out the pre-transfusion procedures (such as checking the test-tubes for the pre-tranfusion tests and identifying the blood components to be transfused) directly at the patient's bedside or, at any case, in the presence of the patient since he or she must be fingerprinted both in the stage of blood sampling and in that of the transfusion.

The second reason is that an important part of the Securblood system involves fingerprinting of the doctor at the start of the transfusion, thus “obliging” him or her to stay close to the patient to be transfused, in this way guaranteeing the maximum care in the first few minutes of the transfusion, as laid out in the European R (95)15 recommendation⁴¹.

For patients, the use of alternative identification systems, such as wristbands with barcodes or other even less safe systems, which usually require confirmation from the patient of his or her own personal details or the consultation of identity documents or health care documents (clinical records, laboratory reports), are subject to error in that wristbands with barcodes can be lost or exchanged between patients, just as health care records can get mixed or contain errors.

For the health care staff, a P.I.N. to key into the keypad on the terminal or to read with a barcode reader could be exchanged by error between one member of staff and another or divulgated deceitfully to other members of staff (e.g. by the doctor to nurses) nullifying every regulation concerning the traceability of transfusion procedures and, above all, that of guaranteeing the presence of a doctor at the bedside of a patient receiving a transfusion.

Most of the technical and operative blocks of the system that we recorded were caused by procedural errors by health care staff or by technical errors mainly due to the limited experience with transfusions in some working units in which few transfusions are carried out. These types of errors are destined to decrease over time as the experience of the staff increases. In this respect the SIMT can play an important role through the organisation of training course and continuing education⁴².