each technical alarm) Current SpO2 Output[j] Current monitored value of SpO2 displayed on SpO2 monitoring device front panel SpO2 Limit Alarm Notification Output[j] Auditory and visual notification of violation of SpO2 limit alarm on SpO2 monitoring device front panel SpO2 Technical Alarm Notifications (fill in – create a new row for each technical alarm) Output[j] (fill in description of technical alarms) Current RR Output[j] Current monitored value of RR displayed on RR monitoring device front panel RR Limit Alarm Notification Output[j] Auditory and visual notification of violation of RR limit alarm on RR monitoring device front panel RR Technical Alarm Notifications (fill in – create a new row for each technical alarm) Output[j] (fill in description of technical alarms) PCA front panel and technical alarm information (fill in – create a new row for each displayed front panel value reported and each technical alarm). System Monitored Variables: External Entity: Clinician System Interaction Point: Devices – PCA Prescription Drug Name Input[k] Name of opioid to be infused Drug Concentration Input[k] Concentration of drug Loading Dose Input[k] Volume of initial dose of drug to be delivered at the
2800-1-1 should provide requirements that guide the construction of the “Intended use and identification of characteristics related to the safety of the medical device” as necessary to establish compliance with 14971 Clause 4.2. 2800-1-1 should provide qualitative Severity and Likelihood declarations that are used across all ICE (or are at least consistent within cohorts). The following examples are from 14971 Appendix D. [Outline of portion of ICE Risk Management Process based on STPA to be included in 2800-1-1. Annotated Computational View of an ICE-based ICS 2800-1-1 needs to define a template structure for an ICE-based ICS based on the 10746 Computation View. This needs to be a refinement of a generic vocabulary in 2800-0 (or 2800-1). In each ICE-based ICS, list the component provider roles to be used in the Risk Management process for the system. In each ICE-based ICS, working from the 10746 Computation View template for an ICE-based ICS, Identify the ICE functional role of each component and the ICE medium realization of each communication link in the ICS. We anticipate the ICE component roles would include the usual component roles from the ICE architecture (app, service component (further specialized to physiological monitoring device/data stream, actuating device, information system, display, etc.). Communication medium indicates the nature of communication of physical substance, commands, or data between interoperable components for the purpose of establishing common faults for those components. Risk Responsibility Allocation For each component and communication link, declare the ICE provider roles that participate in the risk management associated with the component or link.] Risk Analysis Intended Use and Identification of Characteristics Related to the Safety of the Medical Device The intended use of this system is defined in Section 2.1 [Traceability/Compliance: Compliance with 2800-1-1 Clause XXX, Compliance with 14971 Clause 4.2]
6.2.14 CR_0000000015 Data validation The ICE System shall provide the capability and mechanism for the clinician to validate the physiological data and device data coming in from various sources. 6.2.15 CR_0000000016 Unauthorized access The ICE System shall not allow the clinician to interact with the ICE System until s/he is authenticated and authorized, unless it is an emergency situation or the new clinician identifies himself or herself. [Compound requirement - needs to be decomposed For audit purposes, we need to ensure that only appropriate people view patient information or change settings. We need to be able to track who is using the system. 6.2.18 CR_0000000019 Device interrupt The ICE system shall configure the system such that during clinical operation it shall not allow unauthorized or non-user-initiated (system-initiated) diagnostic tests on the medical device that interrupt the regular use of the device, and allow only Biom To ensure safe operation of all the devices running JMG - excellent comments on complex issue. 6.2.19 CR_0000000020 User-selectable settings The ICE system shall be capable of receiving messages from connected devices indicating when their settings are changed, along with the old and new setting values, and, where possible, the identity of the clinician making the change. For audit purposes (Root Cause Analysis) - analysis would reveal if a particular setting has been changed by the clinician or within the device. May be used for remote control. 6.2.20 CR_0000000021 (POST) The ICE system shall provide a mechanism to accept the (POST) results (pass/fail) from each device upon start-up. If the device is already turned on or ICE is Any device that fails a Power-On-Set-Test (POST) that could have serious consequences on patient care, shall not be used in the clinical
already running, the power-on self-tests shall not degrade normal operation of environment in order to ensure Patient Safety. 6.2.21 CR_0000000022 Failure alarm If the ICE system receives a technical alarm from a device that indicates that the device is unoperational or that the data from that device is no longer trustworthy, then all apps using data from that device must each decide whether to continue using the data from the device or consider it to be disconnected. 6.2.22 CR_0000000023 Glossary of terms The ICE system shall provide users with a link to a 'Glossary' of all the terms and definitions used by the ICE system which connects to the 'Help' section for each particular app. The ICE system's HELP and GLOSSARY sections shall be accessible to users to understand the functionality and terms better. Providing access to external content from the same application (ICE) provides ease of use. 6.2.23 CR_0000000025 Alarm Creation and Annunciation The ICE system shall be able to emit alarms. These may be new alarms created by an app or device alarms annunciated by the ICE system. 6.2.24 CR_0000000026 Alarm activiation Alarm silencing: An authorized clinician shall be able to temporarily disable audible alarm signals; however, after silencing, the alarm should automatically reactivate after t minutes or less. The Joint Commission National Patient Safety Goal on Alarm Management calls for hospitals to identify responsible clinicians who are authorized to turn off alarms or lower their volume. 6.2.25 CR_0000000027 PUSH alerts/alarms to the Alert Management System The ICE system shall be able to PUSH alerts or alarms to the Alert Management System. 6.2.26 CR_0000000028 Alert Management Alert Management role of ICE system: - Persistent alarms? Hospitals use separate Alarm/Alert management systems,
- Silence-able? Time-out? - Ability to configure time-based user management and escalation tree - Categorization of alarms - app should be able to categorize different types of alarms but ICE shall be able to push out these messages to the Alert Management System. 6.2.27 CR_0000000029 Data confirmation The clinician shall confirm data coming in from CPOE (or any other external component) before the data is accepted by the ICE system. 6.2.28 CR_0000000080 User identification, authorization When ICE system operation is turned over to another clinician, the ICE system shall require the new user to identify themselves. For audit purposes (Root Cause Analysis) - analysis would reveal if a particular device setting has been changed by the clinician. 6.2.29 CR_0000000082 device connected to the ICE system is not capable of providing the required frequency / accuracy / r If the device connected to the ICE system is not capable of providing the required frequency / accuracy / reliability of the incoming data for each parameter based on clinical significance, the ICE system shall choose the closest available frequency / accuracy / reliability on the device and provide this information to the clinician for review. Device may be capable of sending data at various frequencies and settings. The ICE system shall be able to help clinician decide what frequency is most useful for a given scenario, i.e. choose the frequency/accuracy available closest to the requirement, and seek clinician's approval before use. 6.2.30 CR_0000000083 Patient Information capture If EMPI (Enterprise-wide Master Patient Index) or other enterprise-wide ID system is implemented in the hospital, the ICE system shall provide a mechanism to capture EMPI or other ID system information correctly within the ICE system. This is to maintain consistent, accurate and current demographic and essential medical data on the patients seen and managed within an enterprise's various departments. 6.2.31 CR_0000000084 Patient Identifiers The ICE system shall verify that the clinician has provided at least two patient identifiers when providing care, treatment,
of the App to the clinician so s/he can use it accordingly. 6.4.9 CR_0000000039 Device alarms, audio and visual The ICE system shall be able to display all the alarm settings from each device. 6.4.10 CR_0000000081 be aware of the required frequency / accuracy / reliability of the incoming data The ICE system shall be aware of the required frequency / accuracy / reliability of the incoming data for each parameter based on clinical significance, and shall choose the closest available frequency / accuracy / reliability on the device and provide this information to the clinician for review. Device may be capable of sending data at various frequencies and settings. The ICE system shall be able to help clinician decide what frequency is most useful for a given scenario. 6.4.11 CR_0000000089 Fixed patient information display The ICE System shall display basic patient information (patient name, MRN, vital signs, allergies, etc.) at all times on the screen. This helps the clinician monitor the patient's status continuously, and ensure the correct patient is being monitored, irrespective of what other screen is being displayed at any given time. 6.4.12 CR_0000000090 Data sources When there are multiple sources of data, the ICE system shall provide the clinician with an option of choosing which device or devices s/he would like to use as the source for each data element for each application. There are different levels of device detail - clinician should be able to choose level based on specific use case to prevent information overload and avoid inaccurate data being used for decision support. 6.4.13 CR_0000000091 Required parameter warning The ICE system shall warn the clinician when s/he turns off a set of 'required parameters' from any device that contributes to "necessary data" 6.4.14 CR_0000000216 Patient monitoring through IV drug infusions. The Infusion Management App shall provide a simple, convenient process for clinicians to set up and monitor patients
throughout IV drug infusions. 6.4.15 CR_0000000230 Continuous evaluation of overdose The patient monitoring system shall have the capability to report 'continuously' throughout the drug infusion on a selectable set of common physiological parameters. 6.4.16 CR_0000000231 Monitoring: respiratory rate The patient monitoring system shall have the capability to display respiratory Rate (RR). 6.4.17 CR_0000000232 Monitoring: display oxygen saturation (SpO2) The patient monitoring system shall have the capability to display oxygen saturation (SpO2) 6.4.18 CR_0000000233 Monitoring: pain and sedation scores. The patient monitoring system shall have the capability to display pain and sedation scores. 6.4.19 CR_0000000234 Monitoring: pain and sedation scores. The patient monitoring system shall have the capability to display pain and sedation scores. 6.4.20 CR_0000000235 Monitoring: carbon dioxide (EtCO2) The patient monitoring system shall have the capability to display end-tidal carbon dioxide (EtCO2) 6.4.21 CR_0000000236 Monitoring: body temperature The patient monitoring system shall have the capability to display body temperature 6.4.22 CR_0000000237 Monitoring: blood glucose level. The patient monitoring system shall have the capability to display blood glucose level. 6.4.23 CR_0000000238 Monitoring: complete blood The patient monitoring system shall have the
cell counts. capability to display complete blood cell counts. 6.4.24 CR_0000000239 Monitoring: activated Partial Thromboplastin Time (aPPT) The patient monitoring system shall have the capability to display activated Partial Thromboplastin Time (aPPT) 6.4.25 CR_0000000249 Infusion Management App The Operator shall have the capability to access patient medical information and medical history through the Infusion Management App. # Rqmt ID Name Description Rationale 7.2.1 CR_0000000041 Pump status The ICE System shall display the pump status at all times. 7.2.2 CR_0000000042 The pump shall conform to standards. The pump shall conform to {specify} standards. To ensure that the pump is compatible with the ICE system. 7.2.3 CR_0000000043 PCA information signals PCA app implementations shall be able to receive information signals, such as alarm signals, generated by other ICE applications running simultaneously on the ICE system. 7.2.4 CR_0000000044 Device alerts, pump alerts If the pump is in a state where user input is required, the ICE system shall issue periodic alerts/indications every t minutes until the required input is provided, as determined by the safety and clinical performance needs for the user input. 7.2.5 CR_0000000045 Medication limits The ICE system shall display the hard and soft limits of the medication being delivered and a warning of overdose limits. 7.2.6 CR_0000000046 Infusion summary The ICE system shall be capable of displaying infusion summary and delivery profile
local control through front panel ICE system, it shall disable programming through its front panel and display an appropriate message. The pump "pause" command shall not be disabled. very clear on the pump's state. Programming disabled to prevent possible unintended interaction between ICE system and clinician. # Rqmt ID Name Description Rationale 7.3.1 CR_0000000001 Configuration authorization The ICE Supervisor shall provide means for an authorized and privileged user to configure key parameters on the device. To prevent unauthorized access to the device settings that may lead to loss of important data or inaccurate data. 7.3.2 CR_0000000049 PCA trigger alarms PCA app implementations shall be able to trigger ICE system alarms and stop the infusion pump. 7.3.3 CR_0000000110 Data verification - from at least one app The ICE system shall verify that it is receiving data from at least one source of devices for the following parameters: • Heart rate • Blood pressure • Respiration rate • SpO2 • Pain score • Sedation score 7.3.4 CR_0000000218 Electronic Medical Record (EMR) Data Requests The Infusion Management Application shall have the capability to request data from the Electronic Medical Record (EMR). 7.3.5 CR_0000000219 EMR: Patient data and time of birth The Infusion Management Application shall have the capability to request and maintain patient date and time of birth. Time is particularly important for neonatal patients 7.3.6 CR_0000000220 EMR: Drug The Infusion
Allergies Management Application shall have the capability to request and maintain data concerning drug allergies. 7.3.7 CR_0000000221 EMR: Blood Pressure Diagnosis The Infusion Management Application shall have the capability to request and maintain a blood pressure diagnosis (high or low) 7.3.8 CR_0000000222 EMR: Matabolic Diseases The Infusion Management Application shall have the capability to request and maintain a listing of diagnosed metabolic diseases. 7.3.9 CR_0000000223 EMR: Patient height The Infusion Management Application shall have the capability to request and maintain patient height. 7.3.10 CR_0000000240 Clinical decision support algorithms The Infusion Management App shall use 'clinical decision support algorithms' to alert clinicians with “smart alarms”. 7.3.11 CR_0000000242 Overdose Detection The Infusion Management App shall have the capability to process available data in order to detect a possible overdose. 7.3.12 CR_0000000243 Pause Drug Infusion The Infusion Management App shall have the capability to pause drug infusion if a possible overdose is detected. 7.3.13 CR_0000000246 Support Algorithms The Operator shall have the capability to select from a
set of clinical decision support algorithms 7.3.14 CR_0000000248 Medication Order The Infusion Management App shall have the capability to verify that the medication order is complete. 7.3.15 CR_0000000250 Lab Result Access The Operator shall have the capability to access Lab results through the Infusion Management App 7.3.16 CR_0000000252 Clinical Decision Support Algorithms The Infusion Management Application shall use clinical decision support algorithms to alert clinicians of alarm conditions. 7.3.17 CR_0000000254 Alarm Settings The application shall provide an interface that will allow clinicians to set alarm settings on monitoring equipment 7.3.18 CR_0000000255 Infusion Pump Pause The application shall have the ability to send commands to pause the infusion pump 7.3.19 CR_0000000256 Patient Hazards Theapplication shall alert clinicians of patient hazards related to their medication order 7.3.20 CR_0000000257 Dose Range The application shall have the capability to ensure that drug doses are within a typical dose range (drug library) 7.3.21 CR_0000000261 Alert Override The operator shall have the ability to override alerts displayed by the application. 7.3.22 CR_0000000262 Infusion Pump Alerts The application shall be capable of receiving alerts from the infusion pump
7.3.23 CR_0000000264 Manual Order Entry The Operator shall have the capability to manually input order information 7.3.24 CR_0000000265 End of session The operator shall have the capability to indicate the end of a patient session, and, with configuration, to clear all patient data. # Rqmt ID Name Description Rationale 7.5.1 CR_0000000057 The ICE System shall recognize and display TALLman drug labeling The ICE System shall recognize and display TALLman drug labeling. 7.5.2 CR_0000000094 Patient medication access The ICE system shall be able to access the patient's medication orders, medication history, and any active medications including infusions. This facilitates medication reconciliation. There is evidence that medication discrepancies can affect patient outcomes. Medication reconciliation is intended to identify and resolve discrepancies. 7.5.3 CR_0000000095 Patient transfer, medication communication When a patient leaves the hospital's care to go directly to his or her home, the ICE system shall provide a mechanism [have a means?] to provide the complete and reconciled list of medications to the patient's known primary care provider, the original referring provider, or a known next provider of service. 7.5.4 CR_0000000096 Patient transfer, medication communication When a patient is referred to or transferred from one care environment to another, the ICE system shall provide a
mechanism for the complete and reconciled list of medications to be communicated to the next provider of service, and the communication to be documented. 7.5.5 CR_0000000097 Patient personal medication The ICE system shall provide a mechanism to compare medication information from the patient's medical record with the medications ordered for the patient by the hospital in order to identify and resolve discrepancies. There is evidence that medication discrepancies can affect patient outcomes. Medication reconciliation is intended to identify and resolve discrepancies. 7.5.6 CR_0000000111 Sedative warning The ICE system shall issue a warning if the patient is already taking sedatives or other relevant drugs. Patient Safety 7.5.7 CR_0000000112 Medication tracking The ICE system shall track medications and issue a warning if any medications are counterindicated. 7.5.8 CR_0000000113 Patient's Risk Analysis: Patient's Risk Analysis: The ICE system shall provide a means to capture essential characteristics of patients who are at higher risk for over-sedation and respiratory depression by considering factors and activities that can help avoid accidental opioid overuse. The ICE system should factor in the risk factors/weight/age (entered by clinician before start of therapy) in order to calculate/predict alarm limits for each patient. Patient Safety. To capture essential characteristics of patients who are at higher risk for over-sedation and respiratory depression by considering factors and activities that can help avoid accidental opioid overuse. 7.5.9 CR_0000000229 EMR: Current medications The Infusion Management Application shall have the capability to request and maintain a list of current medications. 7.5.10 CR_0000000258 5R Drug check The App must support an automated 5R Drug check
control commands. The device may continue to communicate with the ICE system, for instance to send status messages or respond to data requests. 7.7.7 CR_0000000251 Live Physiological Data The Infusion Management Application shall receive live physiological data from the patient monitoring equipment. (Please note that this will change the earlier monitor display requirements). 7.7.8 CR_0000000259 Physician Messages The application shall have the capability, given established criteria, to send messages to Physicians. 7.7.9 CR_0000000260 Pharmacy Messages The application shall have the capability, given established criteria, to send messages to pharmacies.