Multidisciplinary Evaluation for Severity of Hazards Applied to Hemodialysis Devices: An Original Risk Analysis Method

Abstract

Background and objectives: Risk analysis for medical devices is a crucial process to grant adequate levels of safety. Identification of device exposure–related hazards is one of the main objectives.

Design, setting, participants, & measurements: Hazard analysis for hemodialysis devices has been performed by a multidisciplinary team involving engineers and clinical experts. A potential harm list was identified from clinical and technical experience, postproduction information, and literature. Various hazardous situations (circumstances when the use of the dialysis device may lead to described harms) were described. Such hazardous situations were correlated to the extent of the deviation of a specific device parameter from expected ranges. The clinical severity that was relevant to any specific harm was categorized for each hazardous situation using a descriptive and numerical scale with five levels (from negligible [i.e., discomfort only] to catastrophic [i.e., potentially lethal]).

Results: Harms in which the deviation of a parameter strictly coincides with the clinically measured effect on the patient are defined as “direct.” Otherwise, when another clinical parameter must be involved to quantify severity, the related harm is considered “indirect.” Two complete examples of multidisciplinary evaluation for severity of hazards (MESH) are given for a direct harm (air embolism) and for an indirect harm (hypothermia). For other harms, the maximum value of severity involved is provided.

Conclusions: MESH represents a possible example of risk management for dialysis equipment in which, although the manufacturer is directly responsible, a multidisciplinary task force may contribute to a better link between engineering and clinical perspectives.

Medical devices are used to improve patients' survival and quality of life in end-stage kidney disease. A combined effort should be made by engineers who are involved in device design and production and medical professionals who are involved in its clinical use and application to anticipate potential risks, to identify potential hazardous situations that derive from the practical application of the device, and to implement mitigation strategies to reduce the level of possible harms.

The main characteristic of a medical device, even before its diagnostic or therapeutic effectiveness, is to be safe. That means to reduce the probability of occurrence of any harm, intended as damage to health, property, or environment, to an acceptable (minimum) level. Risk analysis is a universally known method to grant a sufficient safety level for a medical device that either is under development or is already being used in the field. In fact, risk management of medical devices aims first at quantifying and then at determining the necessary mitigations to minimize the unavoidable level of risk connected to the functioning and use of the device itself.

The concept of risk is prominent in the European Medical Devices Directive (1): Manufacturers are requested to fulfill the requirements considered as essential for medical devices both by minimizing the risk and by taking into account state-of-the-art technology, practice, and economy.

The International Organization for Standardization/International Electrotechnical Commission (ISO/IEC) 14971 standard (2) is entirely devoted to the risk management of medical devices. According to this standard, each manufacturer shall establish a process for the identification, estimation, and control of the risks that are associated with the medical device. This process shall follow the product throughout its entire life cycle, from the very early stages of the requirement identification and design to its launch and use in the field.

Risk management standards define the process to be used but do not answer the following questions: (1) What are the harms related to a particular medical device? (2) What are the levels of severity and probability of occurrence of the identified risks? (3) Which criteria shall be used to accept or not accept the risks? The manufacturer is required to address these unsolved questions, choosing appropriate criteria for the medical device under analysis, but the clinical experts must present specific instances to characterize what is acceptable at the clinical level. In fact, a risk may be considered acceptable by a discipline such as engineering but be defined as unacceptable by other disciplines, such as biology or medicine. The need for a multidisciplinary approach to the risk analysis and the multiprofessional agreement on the definition of risks and their acceptability emerges clear. As a result, engineers can focus on specific aspects while physicians or nurses can be exposed to the sad yet true concept that risks cannot be fully eliminated.

The purpose of this article is mainly to describe the methods and the results used by a multidisciplinary task force composed by manufacturers of dialysis machines, clinical nephrology, and dialysis experts of an independent center; representatives of hospitals' department of nephrology (clinical engineering section); and quality control of procedures of a dialysis company to quantify the risk associated with the use of the new-generation hemodialysis (HD) devices. In particular, attention is paid to the identification of potential harms and their severity.

Materials and Methods

According to the terminology suggested in the ISO/IEC 14971 standard (2), the manufacturer is requested first to compile a list of known and foreseeable hazards, intended as sources of harm, that are associated with the medical device. Second, because a causal sequence of events is necessary for a hazard to be able to result in harm, the manufacturer should also identify such sequences of events, including both normal and fault conditions. A circumstance in which people, property, or the environment is exposed to a hazard is called a hazardous situation. Third, the risk that is associated with each hazardous situation shall be estimated using available information. It is generally accepted that the risk results from the product of two components (2): The consequences of the harm that is generated by a hazard (i.e., how severe the harm might be) and the probability of occurrence of that harm. This is the basis for the quantification of the risks. Each manufacturer is requested to evaluate the acceptability of the risk connected to the device. If a risk reduction is necessary, then risk control measures shall be put in place and the related residual risk shall be evaluated again. This risk management process is to be followed recursively until the final residual risk is judged acceptable. For a process to be robust and reproducible, clear metrics should be identified to define severity, probability, and the resulting risk.

In particular, five levels of severity have been identified, with a corresponding discrete numerical scale, S (Table 1). Also, the probability has been described with five different levels; as far as electrical equipment–related risks are concerned, these levels derive from statistical frequency per number of dialysis treatments (Table 2). Quantitative estimation of probability is the preferred approach; however, if sufficient data are not available, then a qualitative description should be given. Then the two approaches can converge into a numerical scale, P. The probability level will be given on the basis of postproduction information, historical data related to similar products, or engineering and/or clinical expert judgment. The levels of severity and probability chosen are the same reported as one of the examples in Annex D of ISO/IEC 14971 standard (2). As regards the resulting risk, three levels have been identified, always in accordance with ISO/IEC 14971. Indeed, when evaluating the residual risk, this can be acceptable or not, with respect to the criteria established by the manufacturer. Moreover, a third case is realistically possible; that is, the risk may result as low as reasonably practicable if the costs of any further reduction and the benefits that result from its acceptance are considered together. The crucial concept that the risk is relative is highlighted: In particular cases, given the intended use of the device under analysis, the related risk is a matter of balance between the clinical benefits and the technological and economic practicability to make it safer. Again, this is the responsibility of the manufacturer. Table 3 reports an example of risk chart used; a risk level is assigned for all of the combinations (product) of severity and probability values.

Table 1.

Severity levels example

Level	Generic Description	Description Based on Clinical Situation	S
Catastrophic	Death	Reasonable expectation of death in the absence of SMIa	5
Critical	Permanent impairment or life-threatening injury	Symptoms and signs, SMI required	4
Serious	Injury or impairment requiring professional medical intervention	Symptoms and signs; GMIb required	3
Minor	Temporary injury or impairment not requiring professional medical intervention	Symptoms	2
Negligible	Inconvenience or temporary discomfort; no injury	No symptoms or signsc	1

GMI, generic medical intervention; SMI, specific medical intervention.

^aSMI shall be determined by medical experts for each particular harm.

^bGMI consists of possible administration of corrective action by health professional according to procedures within the clinic, which may be administered with or without a physician's order (e.g., positioning of patient, administration of over-the-counter drugs).

^c“Symptoms” are subjective conditions that are felt/declared by the patient (e.g., headache, backache, dizziness). “Signs” are physiologic alterations that are objectively determined by the physician or health professional (e.g., hypotension, change in the electrolyte values, pulmonary edema).

Table 2.

Probability levels example

Level	Probability of Occurrence of Harm (Events per Number of Dialyses)	P
Frequent	P ≥ 1/1000	5
Probable	1/1000 > P ≥ 1/10,000	4
Occasional	1/10,000 > P ≥ 1/100,000	3
Remote	1/100,000 > P ≥ 1/1,000,000	2
Improbable	1/1,000,000 > P	1

Table 3.

Risk chart example

Probability Levels	Severity Levels
	Negligible	Minor	Serious	Critical	Catastrophic
Frequent	ALARP	Unacceptable	Unacceptable	Unacceptable	Unacceptable
Probable	ALARP	ALARP	Unacceptable	Unacceptable	Unacceptable
Occasional	Acceptable	ALARP	ALARP	Unacceptable	Unacceptable
Remote	Acceptable	ALARP	ALARP	ALARP	Unacceptable
Improbable	Acceptable	Acceptable	Acceptable	ALARP	ALARP

ALARP, as low as reasonably practicable.

Given the metrics for the risk, a significant effort has been devoted to identifying the main harms that are associated with the HD device and the associated levels of severity (the first task in the risk management process). Because of the multidisciplinary nature of this activity, a team that comprised both physicians (M.A.H. and J.P.B.) and medical device engineers (F.P., A.V., and C.A.L.) was established. A clinical expert (C.R.) and a clinical engineer (F.G.) from an independent dialysis center were also involved. Figure 1 depicts the workflow followed to perform this hazard analysis.

Figure 1.

Flow diagram of the hazard analysis process followed. The steps of the process are indicated on the right, and the related input is reported on the left. MDD, Medical Devices Directive (1).

Results

The first step of hazard analysis in Figure 1 is related to the identification of the hazards and harms that are connected to our application (i.e., HD device intended use). By convention, the harms listed in the risk analysis are identified at the first point in the causal sequence of events at which people, property, or the environment is affected by a hazard (J. Heiler, TÜV Product Service GmbH, personal communication, September 10, 2008). To identify the harm causes, we used fault tree analysis (FTA) (3). FTA is a technique for system safety analysis; it uses a top-down approach and allows visualization, through logic operators, of the combinations of events that can lead to the top event of the tree. For example, the FTA related to injection of air into a patient is reported in Figure 2. The first event of the chain that affects the harm recipient is “air embolism,” which is the identified harm. The subsequent happenings at the upper levels are the potential consequences of the event; because in this case the top event might be the death of the patient, this harm will be ranked with the maximum severity level. The level immediately below the harm is the circumstance that leads to the exposure of the recipient to the hazard, in this case, “air injection into blood vessels” (i.e., the hazardous situation). This can generally be thought of as the system level effect observable on the medical device as responsible for the harm; hence, the hazardous situation is mainly intended as a technical feature. The causal chain can be extended at the bottom of the tree, to find the technical causes to explain the passage of air from the extracorporeal circuit to the patient; we can find at this level the “reasonably foreseeable sequences or combinations of events that can result in a hazardous situation,” according to ISO/IEC 14971.

Figure 2.

Clinical and technical fault tree for air embolism harm. The AND gate means that the event at the top is true only when all of the events at the bottom happen simultaneously. The OR gate means that the event at the top is true when at least one event at the bottom happens.

The list of harms, hazards, and hazardous situations identified for an HD device is reported in Table 4, alphabetically sorted by harm. The types of hazard have been taken from the examples reported in Table E.1 of ISO/IEC 14971 (2). The recipient of the harm has also been indicated to highlight that the risks toward people, property, and environment have been considered. Moreover, the sources from which harms have been identified are reported.

Table 4.

Example of hazard, harm, and hazardous situation list for an HD device

Harm	Hazard	Hazardous Situation	Recipient of the Harm	Exposure Related Quantity	Harm Type	S (max)	Sources for Harm Identificationa
Acid-base imbalance	Operational (use error)	Massive injection of disinfectant in dialysate/substitution fluid	Patient	Not a measurable extent	Indirect	5	Adverse events databases
	Operational (function deterioration or use error)	High/low bicarbonate in dialysate/substitution fluid	Patient	Bicarbonate in dialysate (mmol/L)		4	Literature (26)
	Operational (use error)	Performance-related disequilibrium (i.e., too rapid correction of acidosis)	Patient	Not a measurable extent		3	Clinical experience
Air embolism	Operational (function deterioration or use error)	Air injected into blood vessels from venous or arterial extracorporeal branch	Patient	Volume of air injected into vessels (ml/kg)	Direct	5	Literature and standards (4–6,17–22)
Bleeding tendency	Operational (function deterioration or use error)	Overadministration of anticoagulant	Patient	Anticoagulant dose (IU/kg)	Indirect	4	Literature (27)
Blood loss	Operational (function deterioration or use error)	Blood tubing rupture or disconnection	Patient	Blood volume lost (ml/kg)	Direct	5	Adverse events databases and literature (5,14,23)
	Operational (function deterioration or use error)	Dialyzer membrane rupture	Patient	Blood volume lost (ml/kg)		5
	Operational (function deterioration or use error)	Extracorporeal circuit blood clotting or not returned	Patient	Blood volume lost (ml/kg)		2
Burn	Operational (function deterioration)	Burning of the machine	Patient/clinical personnel/technical personnel	Not a measurable extent	Indirect	5	Adverse events databases
	Operational (use error)	Contact with hot water	Clinical personnel/technical personnel	Not a measurable extent		4
	Operational (use error)	Contact with hot surfaces	Clinical personnel/technical personnel	Not a measurable extent		3
Chemical injury	Operational (use error)	Massive injection of disinfectant in dialysate/substitution fluid	Patient	Not a measurable extent	Indirect	5	Adverse events databases, clinical experience
	Operational (function deterioration or use error)	Contact with cleaning/disinfection chemicals	Clinical personnel/technical personnel	Not a measurable extent		4
	Operational (use error)	Contact with chemicals (inhalation)	Clinical personnel/technical personnel	Not a measurable extent		4
	Operational (function deterioration)	Contact with chemicals (to blood, i.e., expected chemical residuals in unprimed lines)	Patient	Not a measurable extent		2
Damage to environment or property	Biological or chemical or information	Improper disposal of hazardous material	Environment	Not a measurable extent	Indirect	1	Technical experience
Damage to hearing	Energy (mechanical)	Sound pressure level too loud	Patient/clinical personnel/technical personnel	Sound pressure level (dBA)	Indirect	3	Standards (6,28)
Electric shock	Energy (electromagnetic)	Electric touch current to patient or operator (connected to the machine via extracorporeal circuit)	Patient/clinical personnel/technical personnel	Entering electrical current (mA)	Indirect	5	Standards (29) and technical experience
	Energy (electromagnetic)	Electric patient leakage current via needle connection	Patient	Entering electrical current (mA)		5
	Energy (electromagnetic)	Electric patient leakage current via central catheter connection	Patient	Entering electrical current (mA)		5
	Energy (electromagnetic)	Electric touch current to patient or operator not connected (static electricity)	Patient/clinical personnel/technical personnel	Entering electrical current (mA)		1
Harm as a result of unnecessary medical intervention	Energy (electromagnetic)	Electric interference from HD machine to ECG or EEG	Patient	Not a measurable extent	Indirect	4	Adverse events databases
Hemolysis	Operational (function deterioration)	Reduced dialysate tonicity	Patient	Dialysate conductivity (mS/cm)	Indirect	5	Literature (30)
	Operational (function deterioration) or energy (thermal)	Blood exposed to high temperature	Patient	TD (°C)		5	Literature (5)
	Chemical	Residuals from water treatment system	Patient	Not a measurable extent		5	Literature and standards (31–33)
	Chemical	Residuals of disinfection agents in dialysate or reused dialyzers	Patient	Not a measurable extent		5	Literature and standards (34–36)
	Energy (mechanical)	Mechanical stress to red cells as a result of extracorporeal circulation	Patient	Extracorporeal BP (negative and positive; mmHg)		5	Literature (5,37), theoretical considerations
	Information	Kinking of the blood tubing (including needle/catheter incompatibility with flow regimen)	Patient	Extracorporeal BP (negative; mmHg)		5
Hyperthermia	Operational (function deterioration)	Extracorporeal blood exposed to high temperature	Patient	TD (°C)	Indirect	5	Literature and standards (5–7)
Hypothermia	Operational (function deterioration)	Extracorporeal blood exposed to low temperature	Patient	TD (°C)	Indirect	5	Literature (5–7)
Hypovolemia (negative fluid imbalance)	Operational (function deterioration or use error) or labeling	Excessive total fluid removal (cumulative error)	Patient	Fluid volume removed (ml/kg)	Direct	5	Adverse events databases, clinical experience, literature (16,24)
	Operational (use error) or labeling	Excessive fluid removal flow (UF rate error)	Patient	Fluid volume removal rate (ml/h per kg)		5
Infection	Biological	Blood transmission (to operator or another patient)	Patient/clinical personnel	Not a measurable extent	Indirect	5	Adverse events databases, literature (38)
	Biological	Bacterial/viruses in dialysate	Patient	Colony- or plaque-forming unit (CFU/ml or PFU/ml)		4	Literature and standards (39–41)
Mechanical damage to vascular access	Operational (function deterioration)	Access needle stuck on patient vessel wall as a result of excessive negative arterial pressure	Patient	Not a measurable extent	Indirect	3	Clinical experience
	Operational (use error)	BP monitor cuff wrapped around limb with vascular access	Patient	Not a measurable extent		3
Mechanical injury	Operational (function deterioration) or labeling	Exposure to sharp surface	Technical personnel	Not a measurable extent	Indirect	3	Technical experience
	Operational (function deterioration) or labeling	Pinching	Clinical personnel/technical personnel	Not a measurable extent		3
	Operational (function deterioration)	Plastic container (e.g., rigid bicarbonate bag) explosion	Patient/clinical personnel/technical personnel	Not a measurable extent		3
Particle embolism	Operational (function deterioration)	Plastic material released by extracorporeal circuit (spallation)	Patient	Particle dimension (μm)	Direct	4	Literature, theoretical considerations (5)
	Operational (function deterioration)	Blood clots injected into blood vessel	Patient	Particle dimension (μm)		3
Patient fluid overload (positive fluid imbalance)	Operational (function deterioration) or labeling	Insufficient fluid removal/fluid gain	Patient	Fluid volume (not) removed (ml/kg)	Direct	5	Adverse events databases, clinical experience, theoretical considerations
	Operational (use error) or labeling	Priming or bolus volume too high	Patient	Fluid volume added (ml/kg)		5
Patient reaction	Chemical	Residuals of sterilization process in blood tubing or dialyzer	Patient	Not a measurable extent	Indirect	4	Adverse events databases
	Biocompatibility	Bioincompatible membrane/materials	Patient	Not a measurable extent		4	Literature (42–44)
	Biological	Endotoxins in dialysate	Patient	Endotoxin unit (EU/ml)		3
Plasma electrolyte imbalance	Operational (function deterioration)	High/low sodium in dialysate/substitution fluid	Patient	Sodium in dialysate (mmol/L)	Indirect	5	Adverse events databases, literature (45)
	Operational (function deterioration)	High/low potassium in dialysate/substitution fluid	Patient	Potassium in dialysate (mmol/L)		5
	Operational (function deterioration)	High/low calcium in dialysate/substitution fluid	Patient	Calcium in dialysate (mmol/L)		5
Underdialysis	Operational (function deterioration or use error)	Reduced dialysis effectiveness (i.e., inadequate urea removal)	Patient	Kt/V	Indirect	2	Clinical experience, literature (46)
	Operational (function deterioration)	Technical problems preventing treatment administration/treatment interruption	Patient	Not a measurable extent		1	Technical experience

ECG, electrocardiogram; EEG, electroencephalogram; UF, ultrafiltration.

^aAmong the cited sources, adverse events databases are intended either as internal or on other devices, such as FDA MAUDE database (25). References given from literature are not aimed at being exhaustive.

The next step of our hazard analysis consists of determining the exposure, which is a measure of the extent of the hazardous situation that leads to harm with a certain severity. According to the significance assigned to the hazardous situation, the exposure is mainly related to technical causes. For the sake of brevity, for each hazardous situation, Table 4 gives only the quantity whose deviation is measured to identify the exposure. In some cases, it is very difficult to measure the extent of a hazardous situation because there is either a lack of quantitative data or a multiplicity of sources, causes, or HD device configurations that lead to it.

The last step in the hazard analysis process is the assignment of severity levels to the identified harms. This requires the “translation” of the exposure into its clinical effect (i.e., a physiologic parameter whose deviation will determine the severity of the harm should be identified). We define the way of clinically measuring the harm extent as medical criterion. It is worth noting that, whereas for some harms the technical exposure coincides with the medical criterion, for others, the variation of a pathophysiologic parameter should be found to determine the effects of the HD device deviation on the recipient of the harm. We define the first type of harm as direct and the second as indirect. For example, when a malfunction that leads to some air flowing through the extracorporeal circuit or to some deviation in calculated weight loss occurs, these technical exposures also have a direct effect on the patient, causing the harm of air embolism and fluid imbalance, respectively. Regarding hemolysis or dialysate temperature (TD) imbalance, on the contrary, the consequences to the patient can be measured only indirectly by knowing how the red cells will react to thermal, mechanical, or osmotic stress or how blood temperature will answer to TD deviations. Table 4 reports also the type of harm, together with the maximum value of severity assigned for each hazardous situation.

Although for the second and third steps of our hazard analysis a knowledge of the medical device is required, for the fourth step, clinical judgment and, in some cases, model-based competencies on the interactions between the HD device and the patient (or recipient of the harm) are necessary. Hence, the multidisciplinary nature of this activity is evident.

The result of the hazard analysis process applied is given for a selection of identified harms in Tables 5 and 6; examples of one direct (air embolism) and one indirect harm (hypothermia) are shown. For each level of severity, if applicable, both technical exposure and medical criterion are reported, together with the related clinical description: Symptoms and signs and generic and specific medical interventions (see Table 1). The arrows indicate the extension of the exposure along the severity ranking: Their length increases with the exposure. What is important from the risk analysis standpoint is the maximum level of severity reached.

Table 5.

Example of “air embolism” harm severity evaluation

Table 6.

Example of “hypothermia” harm severity evaluation

The limits identified for air embolism harm (Table 5) are given both as infused bolus and as continuous infusion; they derive from specific standards, literature, and clinical judgment. In particular, according to the IEC standard on air infusion pumps (4), infusion of 1 ml of air within 15 minutes is not considered to be a safety hazard, and the bubbles of <50 μl of air each can be omitted in summing up the 1 ml. Moreover, Polaschegg and Levin (5) did not consider the continuous infusion of air of <0.03 ml/kg per min and infusion of a bolus of <0.1 ml/kg as a safety hazard. This is also reported in a rational of the third edition of IEC 60601-2-16 (6). In the “Exposure” column, some levels are collapsed, but the resulting two allow differentiation between two potential technical failures of the air detector: A temporary malfunctioning or drift (S up to 3), rather than a permanent failure during the whole treatment (S up to 5).

As regards hypothermia (Table 6), the medical criterion thresholds reported for S up to 4 correspond to the limits of functioning of thermoregulation mechanism (7). A unique threshold for the minimum value of TD is present, according to what is stated in the IEC standard 60601-2-16 (6), where it is also stated that “no adverse effects besides patient discomfort are known for low dialysate temperatures.” Indeed, through a mathematical model of the temperature balance in the system dialysis patient–extracorporeal circuit, a more accurate value could be found (see the Discussion section).

Discussion

Risk management is of paramount importance for the design and maintenance of medical devices; this method is being used also for clinical care problems (see, e.g., references 8–10). A challenging field seems to be the dialysis setting, where many different aspects—device technology, medical judgment, human factor, and logistic organization—exist and interact in a complex system (11,12). In particular, much progress has been made in the development of dialysis machines, but hazardous situations may still occur without the safety system triggering an alarm, as in the case of venous needle dislodgment (13–16).

Even if risk management and risk analysis are thoroughly described and recommended in several standards, it is the manufacturer who shall identify a proper harm list and the metrics for the severity, probability, and risk evaluation for the particular application considered. In particular, this article reports a possible harm list and related severity levels for HD devices.

As regards severity, it should be by nature a continuum, but the use of a discrete number of severity levels is more practical for the analysis (2). Five levels have been identified, together with their descriptions (Table 1). In general, potential for death is related to a condition in which a series of deaths have been observed; however, theoretically speaking, it would be sufficient to have at least one death episode to define the situation as a condition that potentially leads to death. In any case, as suggested by ISO/IEC 14971 (2), the severity levels do not include any element of probability, which is to be considered separately as a second factor to calculate the risk. In particular, an example of identification and description of risk probability is provided in Table 2. According to Table 3, an unacceptable risk results when either an event that is associated with a severity 5 harm happens once or more in 1,000,000 treatments or a severity 2 situation occurs once or more in 1000 treatments.

For evaluation of the intrinsic harm severity in a dialysis session, acute or chronic comorbid conditions are not supposed to be present in the patient who is selected for the analysis. Medical interventions such as those cited in Table 1 have to be considered a factor for retrospective definition of severity estimation but not a means for harm prevention and/or mitigation. In particular, the harm prevention measures are implemented upstream of the hazardous situation and are based on the specific safety features of the device. From Table 4, it seems that harms may have different levels of severity, and this depends on the hazardous situation.

The harm list reported in Table 4 is intended just as one possible example. Indeed, this type of list is a living document, to be continually updated, according to the evolution of medical knowledge and opinion. It is then fully acceptable that harm lists may be different as a result of harm, hazardous situations, or severity levels: Each manufacturer is responsible for its own risk analysis. Amendment of the third edition of IEC 60601-2-16 (6) will report another example of a harm list for HD devices. The following sections deal with some of the harms presented in Table 4.

Air Embolism

The limits reported are based on the values suggested by IEC standards 60601-2-24 and 60601-2-16; however, some authors think that even microbubbles (well below 1 μl) can constitute a hazard for patients with ESRD because of their effect on microcirculation (17,18). In particular, they could explain the high pulmonary morbidity that affects long-term patients, even if clinical confirmation is pending. In fact, air detectors in current HD devices are not designed to prevent infusion of microbubbles (19,20). In accordance with the rationales given by Polaschegg (21), we considered as NS the long-term effect of this hazardous situation. This is an example whereby a design specification (the sensitivity of the air sensor) is driven more by the risk/hazard analysis than by technology limits, which would allow detection of microbubbles to be approached. Moreover, an overly sensitive detector could be annoying and time-consuming as a result of numerous alarms during the treatment. Should the severity of this hazard be revised, probably the best way would be the prevention of microbubble injection, through some kind of filter or the use of an airless extracorporeal circuit, as proposed by Barak and Katz (22) or Polaschegg (21), respectively.

Blood Loss

Clotting of the extracorporeal circuit (lines and dialyzer) is the second most commonly reported error or adverse event, according to the study by Holley (23). Also the most reported adverse event, vascular access infiltration, can deal with blood loss harm. It is worth noting that an extracorporeal circuit may also clot due to a wrong or missing human intervention following a machine alarm: indeed, the dialysis alarms dealing with the extracorporeal circuit (e.g. presence of air or low/high pressures) put the patient in the so-called “safe state” (15), by stopping the blood pump, closing the venous clamp and reducing ultrafiltration to the minimum. The resolution of the alarm requires appropriate operator action, otherwise blood stopped for too long will clot.

Fluid Imbalance (Hypovolemia and Patient Fluid Overload)

Hypotension is the most common intradialytic complication and is mainly due to the fluid removal applied in a limited time together with patient comorbidities (16); however, occasionally, erroneous fluid management may occur because of inadequate prescription (including both the overall amount of ultrafiltration and the rate of net ultrafiltration [24]) or errors in delivery as a result of device malfunction or misuse (in the presence of a correct prescription). These harms may have a different level of severity from negligible to catastrophic; generally, these errors have a different effect also in relation to patient body weight. The exposure should be calculated in terms of difference between actual and prescribed fluid removal. A positive fluid imbalance (i.e., insufficient fluid removal) is considered less harmful than the negative one, because it can be easily corrected by either prolonging the dialysis session or shortly repeating the treatment. A special condition may be one whereby a net fluid gain occurs during the session; in this case, the harm severity depends on the intradialytic fluid overload (this error is expected to be tolerated in the case of isovolemic treatment).

Plasma Electrolyte Imbalance

The deviations of dialysate bath components other than sodium, potassium, and calcium are not considered to cause significant hazard for the patient. The bicarbonate is taken into account for acid-base imbalance harm. Indeed, the other ion species do not give a significant contribution for the total dialysate conductivity; neither does their concentration vary significantly in the bags that are available on the market.

Underdialysis

This harm is intended as dialysis dosage not delivered. The severity value 2 applies when the harm is protracted over multiple dialysis sessions. This is the only case on the list in which an effect over time is considered, instead of referring to a single treatment. Generally, the exposure of this harm can be calculated in terms of actual Kt/V compared with the prescribed one. Other dialysis quality indicators can be used as, for example, filtration factor or large molecules removal in the case of convective therapies.

This article proposes a distinction between direct and indirect harms, depending on how a machine malfunction is transmitted to the patient as final effect. As it seems from Table 4, most of the harms are indirect. This means that the final effects are more difficult to determine; clinical data and/or mathematical models therefore are necessary to pass from a technical deviation on the medical device to the related alteration of physiologic parameter in the patient who experiences the harm. For example, reference 5 reported a mathematical model to calculate body temperature (TB) changes at any time during dialysis, depending on TD, blood flow, and patient parameters, such as body weight and vasoconstriction induced by ultrafiltration. By applying a TD of 32°C, TB after 4 hours is equal to 32.9°C when body weight is 40 kg, blood flow is 300 ml/min, and predialysis TB is 36.5°C (see equation 67). We should also add the effect of physiologic thermal regulation (7) (i.e., peripheral vasoconstriction and shivering as a result of patient's perception of cold [not included in this model]), which will contribute to increase TB. Finally, if we extrapolate the data from literature reported in Figure 61 of the same reference, then the theoretical application of a 32°C dialysate will cause a difference between post- and predialysis TB of approximately 1°C and a TB of <33°C cannot be reached. Hence, the limit for TD reported in Table 6 could be lowered to 32°C.

Conclusions

The aim of the risk analysis cannot be limited to a retrospective analysis, but it should above all drive the design for safety. In particular, we highlight the importance of a preliminary hazard analysis as a way to save time and money during the development of a medical device. In fact, the hazardous situations identified during this process will be translated into high-level safety constraints. Those constraints can be implemented into the product either as intrinsic design decisions or by adding protection and surveillance components. Unless correct risk management is followed, either weakness or overengineering might affect the final design. For this reason, hazardous situations related as closely as possible to the medical device should be found, as shown in Table 4 and by the exposure limits chosen in Tables 5 and 6. Further studies in which science, technology, and medical experts work together for the design, use, and management of more effective and safer medical device through risk analysis would be welcome.

Disclosures

C.A.L. and A.V. have employment contracts with Gambro Dasco SpA; always within Gambro, M.A.H. is Senior Medical Director, J.P.B. is Senior Vice President and Chief Medical Officer, and F.P. is Vice President R&D Gambro Dasco SpA.