A Systems Theoretic Process Analysis of the Medication Use Process in the Operating Room

Our systems theoretic process analysis was developed following procedures outlined in the book Engineering a Safer World,¹¹  which was the first to describe the concept of a systems theory–based accident model and the procedure for performing a systems theoretic process analysis. Systems theoretic process analysis involves four steps, as outlined in the sections that follow: defining accidents (adverse events) and hazards, designing a hierarchical control structure, identifying unsafe control actions, and identifying causal scenarios. Our core project team consisted of two analysts (authors A.S-W. and K.N.), who are both systems engineers and anesthesiologists with extensive systems theoretic process analysis (A.S-W.) and medication safety (K.N.) expertise. We conducted analyses individually, including designing the hierarchical control structure and identifying unsafe control actions and their causal scenarios. We also met monthly from January 2018 to April 2019 to discuss the model and analysis and resolve any disagreements through discussion and consensus. Additional subject matter expertise was obtained with input from a range of specialists including pharmacists, anesthesiologists, surgeons, and perioperative leadership, to help define the details of the model. This work was considered quality improvement and so did not undergo Institutional Review Board review. The project did not involve patient interaction/observation or collection of patient data.

Accidents are defined as losses to the system,¹¹  which in health care typically refer to patient harm. In the context of medication administration, these are adverse medication events, which will be the terminology used from here out for accidents.

Hazards are conditions within the system that can lead to an adverse medication event if combined with external factors.¹¹  For example, a medication error is a hazard that may or may not lead to an adverse medication event (patient harm). Thus, hazards include near misses (errors that do not lead to an adverse medication event), which occur when the system moves outside the bounds of control but do not go on to become adverse medication events. These are important signals of potential future harm within the system. Medication error is commonly defined as failure to complete a required action in the medication use process, or the use of a wrong plan to achieve a medication-related aim,^12,,14  which is the definition that we used in this paper.

Systems theoretic process analysis is based in systems theory, which states that systems are comprised of multiple layers of control loops.¹¹ Control loops have four major components (controllers, controlled processes, actuators, and sensors),¹¹  as illustrated in figure 2A. In a system, each person, role group (e.g., surgeon, nurse, anesthesiologist, pharmacist), or piece of software (e.g., the algorithms that can be found in an insulin pump) can act as a controller. Controllers act to send instructions or commands, known in systems theoretic process analysis as control actions, which constrain the behavior of the processes below them. These control actions are directed toward actuators that execute the control action on the process. Actuators may be software (e.g. an infusion pump that is programed to deliver a medication, the electronic medical record that accepts documentation of medication administration); machines (e.g., a bag valve mask used to control ventilation); or people (e.g., an anesthesiologist asking a trainee to administer a medication). Sensors, in turn, must understand the current state of the process and provide feedback to the controller. In the operating room, an infusion pump containing phenylephrine might be an actuator that the anesthesia clinician in the operating room (controller) uses to control blood pressure, and the arterial line providing feedback on the patient’s blood pressure might be the sensor that the anesthesia clinician uses to understand the patient’s current blood pressure. In systems theoretic process analysis, processes such as an assembly line, an airplane being flown by a pilot, or a patient being cared for by a care team all share the trait of being controlled via an actuator while giving feedback back to the controller about their state via a sensor. Downward arrows in figure 2A denote control while upward arrows denote feedback.

When multiple controllers come together in a system, they organize into tiers of control, schematically represented as a hierarchical controlled structure, as shown in figure 2B. A hierarchical control structure is a visual representation of controllers and their associated control processes.¹¹  Each layer in the system is controlled by the layer above and has the responsibility to control the layer below. For example, in health care, a common model involves a physician (controller no.1) providing a control action (medication order) via the electronic health record (actuator) to a nurse (controller no.2). The nurse then has a control action of administering the medication to the patient (the controlled process) via an infusion pump (actuator). The nurse receives feedback about the patient’s condition from the patient monitors (sensors) and additionally gives feedback to the physician about the status of the medication order via the electronic health record (sensor). In this hierarchical control structure, each controller works together to provide safe patient care, which is an example of constraining a system’s behavior within safe bounds.

Importantly, each controller represents a role or responsibility. Sometimes this role or responsibility corresponds to a person, sometimes to just a portion of a person’s job, and sometimes a controller is nonhuman, such as software. Each controller has a mental model (or process model in the case of software) that represents its understanding of the process its controlling, and a control algorithm that dictates how it makes decisions to control the process. As described in the Definitions section, control is exerted through control actions as carried out by actuators, and feedback is provided to the controllers from the process below via sensors.

We used an iterative process to map the hierarchical control structure for the medication use process in the operating room, shown in figure 3. We began to build the control structure from the bottom, with the controlled process. For medication use in the operating room, the controlled process is the patient receiving medication. To add the tier above, we asked who or what immediately controlled the patient receiving the medication, which in the operating room is the anesthesia clinician in the operating room. We progressively developed each tier of the control structure by asking who or what controlled each successive layer that we added. We developed the system upwards toward the higher levels of the control structure, stopping with the perioperative leadership groups. In order to achieve a higher degree of detail in areas that are typically within the anesthesia department’s control, hospital leadership, governmental regulators, insurance payers, and pharmaceutical companies were excluded from our analysis. The initial version of the control structure was created as a high-level outline, with broad control actions such as “anesthesia clinician in the operating room administers medications.” We next iterated through progressive levels of detail at each tier of the control structure, with feedback from our subject matter experts, including pharmacists, anesthesiologists, surgeons, and perioperative leadership. Specifically, we used their expertise to define the controllers’ specific roles and control actions, and to help us define the scope of their control. We described their actions in more detail. For example, “anesthesia clinician in the operating room administers medications” was divided into “anesthesia clinician in the operating room administers medication bolus” and “anesthesia clinician in the operating room administers medication infusion,” and the different processes for preparing and administering boluses and infusions were described. Our goal was to define a control structure that was generic enough to cover a wide range of medication use scenarios, but also detailed enough to provide concrete areas of risk. We incorporated the subject matter experts’ feedback until we reached information saturation, the point at which we were no longer gaining new information or insights from successive consultations.

After building the control structure, we proceeded to identify unsafe control actions, which allow the process to move out of the safe control bounds and lead to a hazard. In the current model, unsafe control actions are the potential root causes of medication errors in the operating room. We systematically asked whether each control action identified in the control structure could be unsafe (i.e., lead to a medication error) in the following conditions: if it was applied, if it was not applied, if it was applied too early or too late, and if it was applied for too long or too short of a duration. If a control action–condition pair could lead to a medication error (as defined in the Definitions section: Hazards) it was determined to be an unsafe control action, which could lead the system into an area outside the boundaries of safe practice and into an area where an adverse medication event may occur. This was determined via consensus between the two analysts, with input from our subject matter experts (pharmacists, anesthesiologists, surgeons, and operating room leadership).

While unsafe control actions are the root cause of errors, causal scenarios are the contributing factors that can be targeted in quality improvement initiatives. Identification of unsafe control actions is highly structured, whereas identifying causal scenarios is qualitative and more subjective, requiring an understanding of human factors and significant subject matter expertise. Unsafe control actions define specific states of the system that are limited and bounded, while there is a nearly infinite set of causal scenarios. To identify causal scenarios, we considered each of the components of a control loop (controller, control algorithm, process/mental model, actuator, controlled process, and sensor), asking how each component may cause the unsafe control action. We completed this procedure for each unsafe control action. The linkage between unsafe control actions and their attendant causal scenarios adds traceability to the analysis. In the example of blood pressure control, an unsafe control action might be to not fail to bring the blood pressure up to the target level, and this may have multiple causal scenarios. First, there could be an issue at the controller level, such as an anesthesiologist who has an inappropriate target blood pressure in mind (e.g., a mean arterial pressure of 55 mmHg, when the patient requires a mean arterial pressure of 65 mmHg). When identifying controller level causal scenarios, we used human factors principles, including both equipment design and its impact on users, as well as inherent psychologic factors, such as the framework set out by Reason.¹⁵  Reason broke down improper actions and decisions into slips (failure of execution), lapses (failure of memory), mistakes (using the wrong procedure to meet a goal, or setting the wrong goal), and violations (actions that break rules governing behavior in a system).¹⁵  All of these behaviors may lead to an unsafe control action, but each constitutes a different causal scenario (contributing factor) with a different potential design change to prevent the adverse medication event. Second, there could be an actuator breakdown, such as a malfunction of the infusion pump running in the vasopressor. Third, there could be an irregularity with the controlled process, such as a patient who does not have a typical response to the vasopressor. Finally, we might consider a sensor failure where the arterial line is not properly calibrated, leading to the controller receiving inaccurate information about the process it is controlling.

Unsafe control actions and causal scenarios were summarized using descriptive statistics, including frequency counts and proportions. All descriptive statistical analyses were performed using Microsoft Excel for Mac version 14.7.7 (USA).

The hierarchical control structure of the medication use process in the operating room is shown in figure 3. Each controller represents a functional role in the system, and there are three types of controllers in our model. First, a controller may be one person, such as the surgeon. Second, a controller may represent a group of people who perform a unified task or control action together, such as those in the operating room pharmacy (pharmacists, pharmacy technicians, and anesthesia technicians) who deliver medications to the operating room on request. Third, a separate controller may be assigned to each role performed by a person. For example, an anesthesiologist who is directly administering anesthesia (without trainees or a nurse anesthetist) in the operating room, plays two roles represented by two separate controllers: (1) the anesthesiologist who performs high level decision making about patient care management; and (2) the anesthesia clinician in the operating room who executes patient care tasks such as medication administration.

The hierarchical control structure of the medication use process in the operating room has three tiers: leadership, management of patient care, and execution of patient care. The leadership tier includes pharmacy leadership, surgical leadership, and anesthesia leadership, who work to set policies and create a culture and environment for safe clinical practice. Their control actions include the creation of medication-related policies and protocols, as well as procuring and supplying the medications in the operating room. They primarily receive feedback through incident reports and high-level quality improvement statistics.

Management of patient care in the operating room involves anesthesiologists, surgeons, and pharmacists. These roles make high level “management” decisions about patient care such as whether a patient coming in for colorectal surgery with a history of severe aortic stenosis is an appropriate candidate for the Enhanced Recovery After Surgery protocol,¹⁶  with its emphasis on low fluid volumes. The management tier receives some feedback from the patient and the patient’s medical record, but also relies heavily on the anesthesia clinician in the operating room to relay real time feedback during a surgical case about the patient’s clinical status.

The execution of patient care includes the anesthesia clinician in the operating room role, who may be a trainee, a certified registered nurse anesthetist, an anesthesia assistant, or an anesthesiologist. Intraoperative medications administered by circulating nurses and surgeons were excluded from this analysis, due to the small number of medications in this category, and the significant complexity it would add to the model. The role of executing patient care involves acting directly on the patient and the medications to execute the control actions decided at the management level in the hierarchical control structure. Providers executing patient care are responsible for administering medications via bolus or infusion, and monitoring the effects of these medications via hemodynamic monitors and intraoperative laboratory tests. They document the medications delivered and relay feedback to the controllers above them. The operating room pharmacy also has actions at this tier of the system, such as when pharmacists work directly on the medications through actions such as compounding and distributing them. Specifically, the operating room pharmacy controller has three actions: compounding medications, distributing medications, and providing intraoperative consults. The former two actions are part of the execution of patient care, while providing intraoperative consults is defined as management of patient care for purposes of this analysis.

We identified 66 unsafe control actions, which could potentially lead to adverse medication events. Of these, 15 (22.7%) were linked to controllers in the leadership tier, 18 (27.3%) to the management of patient care, and the remaining 33 (50.0%) to frontline patient care. Examples of the unsafe control actions are shown in table 1. A full table of unsafe control actions with specific examples is shown in Supplemental Digital Content 1 (https://links.lww.com/ALN/C395).

We identified 342 causal scenarios that could lead to the unsafe control actions identified previously. Table 2 shows several examples of causal scenarios linked to unsafe control actions. Of the causal scenarios, 157 (45.9%) were linked to the execution of patient care, 103 (30.1%) were linked to the patient care management level, and 82 (24.0%) were linked to the perioperative leadership level. (See table 3 for a breakdown of the causal scenarios by controller.) It is important to note that these unsafe scenarios may lead to hazards (medication errors), not necessarily to adverse medication events (patient harm). For example, they may lead to overdoses or underdoses of medications, wrong medications, or an absence of a needed medication, which when combined with patient physiology and surgical procedures, may lead to an adverse medication event, or patient harm. A table of the full causal scenarios considered is presented in Supplemental Digital Content 2 (https://links.lww.com/ALN/C396) with additional guidance on how to identify causal scenarios in a methodical manner.

We used a systems theoretic process analysis of the medication use process in the operating room to provide a framework to capture the nuances of the unique operating room environment that may contribute to medication errors. We identified 342 causal scenarios for medication errors, which represent 342 areas where we can improve our system. While these causal scenarios were linked to controllers at all levels of the hierarchical control structure, about half were linked to frontline care providers executing patient care. There are two reasons for this large number being linked to the frontline. First, the frontline care providers are responsible for each step in the medication use process, usually without the benefit of electronic or manual double checks by a second provider. Errors from the management or leadership levels may be caught by other practitioners, but time pressure and staffing models limit that safety net at the frontline of executing patient care. Second, the medication use process by the frontline workers may have been studied in more detail than the management or leadership levels in our model due to our own biases for focusing on errors at this level, making this large percentage of potential errors an artifact of our modeling process. Despite this bias, more than half of our causal scenarios were linked to controllers in the management and leadership areas, indicating that there is substantial opportunity for quality improvement initiatives at these levels as well.

It is interesting to consider how these hierarchical layers are interconnected, such that changing the system to prevent a causal scenario at the management level may impact safety at lower levels of the hierarchy in positive or negative ways. For example, if perioperative leadership creates a policy requiring a manual triple check (by three providers) of heparin dosing before cardiopulmonary bypass initiation, this cumbersome process may actually decrease safety by encouraging workarounds, leading to violations. Conversely, if perioperative leadership decides to stock only one concentration of heparin and/or incorporate point-of-care electronic clinical decision support with dose alerts, this may reduce the likelihood of several heparin-related medication errors and remove the requirement for a cumbersome manual triple check policy at the frontline. Thus, the presence of 342 causal scenarios does not imply that we need to create 342 solutions for protecting patients. Rather, we should methodically adopt changes and test them by remodeling the new system that they create. As previously discussed, these changes should be considered at every level of the system: double checks at the frontline, formalized communication channels when making management decisions for patient care, and changes to supplies and room design at the leadership level are all options to consider. Implementing these changes will help shift the burden of adverse medication events from the frontline execution of patient care.

Systems theoretic process analysis has several strengths as a modeling tool for healthcare processes. First, it can be used in a variety of settings to help improve patient safety by identifying areas of highest risk to target in quality improvement initiatives. Second, while other prospective models, such as failure mode and effects analysis, focus on the frontline healthcare workers, systems theoretic process analysis allows for inclusion of the entire system in the analysis, including leadership decision making and practices. Because this model extends from frontline execution of care up to the highest leadership decisions, we can also use it to understand how quality improvement initiatives interact in the larger system to increase safety and where gaps exist in these initiatives. Third, systems theoretic process analysis has a nonlinear accident causality model, allowing a more powerful way to look at the risks in our systems compared to linear chain of events models. An example of linear causality is a patient receiving a medication to which they are allergic because of a slip or lapse. The anesthesiologist knew the patient was allergic but accidentally administered the medication. A nonlinear accident classically involves breakdowns in communication as people and/or software work in parallel. For example, an anesthesiologist may be using neuromuscular blockade while the surgeon uses a motor nerve monitor, and neither communicates with the other, exposing the patient to the risk of nerve injury. In this example, the surgeon and anesthesiologist work in parallel with incomplete information due to lack of communication. Neither made a classic error, but their lack of communication led to the potential adverse medication event. Complex systems, which rely on both computer and human controllers, rarely follow simple linear causality the way that more mechanical systems would. Systems theoretic process analysis captures both linear and nonlinear events.

The systems theoretic process analysis hierarchical control structure itself, even without the analysis, can help further understand aspects of patient safety. The impact on safety of proposed changes to the system can be visualized. For example, the hierarchical control structure in figure 3 indicates a lack of formalized lateral communication between the anesthesiologist and the surgeon. Implementing a formal preoperative huddle that requires the attending faculty from both services to be present would add a layer of communication that would be readily apparent in the control structure. Additionally, when adverse medication events occur, the control structure can help analysts understand where the system broke down. For example, was there a critical piece of feedback missing? Or was it a lack of control from a higher level? The control structure can provide the framework for adverse medication event investigations when medication use does not go as planned.

This study and the systems theoretic process analysis modeling system have several limitations. First, a systems theoretic process analysis model is only as exhaustive as the creativity of the people building the model. To ensure that our model was as exhaustive as possible, we consulted with subject matter experts, including pharmacists, surgeons, anesthesiologists, and perioperative leadership. We incorporated their feedback until we reached information saturation, the point at which we were no longer gaining new information or insights from successive consultations. Second, our model may be impacted by our own biases. The most significant bias is availability bias, where recent events or experience influence one’s thinking around similar events. While the systematic nature of identifying unsafe control actions helps to limit the impact of these biases, causal scenario generation is less structured and these biases can again come into play, which is a weakness of systems theoretic process analysis. We limited the role of these biases by involving the opinions of multiple subject matter experts. Third, we made several decisions about the level of detail to incorporate into the model. For example, we intentionally did not specify any one medication or patient subpopulation in order to create a broadly applicable model that can be tailored to a particular medication and patient. Additionally, we incorporated more detail at the management and execution of patient care levels due to the complexities of the relationships and medication use process at these levels. Future analyses could focus on the leadership roles, using our model as a framework to better understand their roles in medication safety. Fourth, medications administered by circulating nurses were excluded from our analysis. At the study site circulating nurses typically do not administer intraoperative medications, except for the occasional preoperative subcutaneous heparin, and the inclusion of these medications would have added significant additional complexity to our model. Fifth, systems theoretic process analysis is a model and therefore makes assumptions about the world. Systems theoretic process analysis assumes that adverse medication events occur because of a loss of control of a system, which is a more complex and nuanced assumption than linear chains of events, but remains an assumption about the rules governing a complex system. Finally, the model reflects the intraoperative medication use process at our tertiary care academic medical center, and there may be variations in other settings. The visual representation of the hierarchical control structure provides a framework to easily identify differences and adapt the model to other settings.

In summary, we identified 342 areas where we can improve our perioperative medication use system to prevent patient harm. Future research should focus on: (1) prioritizing these potential harms and possible interventions, using multidisciplinary focus groups or quality improvement committees, and incorporating a feasibility/impact matrix where the interventions are ranked on these two axes and solutions with the highest combined score are selected first¹⁷ ; (2) implementing and testing interventions; and (3) expanding the model with more detailed analyses of the leadership level. The prospective nature of systems theoretic process analysis means that we do not have to wait for a patient to suffer before we identify ways to improve the system. We identified risks originating at the frontlines of patient care as well as at management and leadership levels. The causal scenarios identified in our model can form the basis of quality improvement initiatives to create a safer system, such as requiring direct communication between the attending surgeon and the attending anesthesiologist during the preoperative time-out, standardizing medication concentrations across all anesthetizing locations, or creating guidelines to assist with opiate dosing in the event of a shortage of one type of opiate. Systems theoretic process analysis can be used across a wide variety of healthcare settings and practice processes to better understand the systems we work in and help us redesign these systems to enhance safety.

The authors are thankful to the surgeons, pharmacists, and anesthesiologists at Massachusetts General Hospital (Boston, Massachusetts) for their assistance and support with this study. Particularly, the authors are grateful to Wilton Levine, M.D., and Leo Tabayoyong, Pharm.D., for their in-depth discussions of patient safety.

Support was provided from institutional and departmental sources. Dr. Nanji is additionally supported by Agency for Healthcare Research and Quality (Rockville, Maryland) grant 5K08HS024764-03.

Dr. Nanji receives royalties from UpToDate (Waltham, Massachusetts) as an author. Dr. Nanji’s research is funded by grants from the Agency for Healthcare Research and Quality (Rockville, Maryland), the Doris Duke Charitable Foundation (New York, New York), and the Massachusetts General Hospital (Boston, Massachusetts). Dr. Samost-Williams declares no competing interests.