Maybe "1,2,3" isn't a good password.

PCA (patient-controlled analgesia) pumps are very useful devices, enabling patients to push a button to control the amount of intravenous pain-killer they want to use depending on how they are feeling.  Of course, the pumps have a limit to how much can be drawn--so the patient doesn't get an overdose.

The pumps can also be set to deliver a "basal rate," a constant infusion of narcotic pain medication, in addition to the dose the patient gets when he or she pushes the button. No matter how sleepy the patient is, the pump will continue infusing narcotics. Normally, without a basal rate, patients using a PCA can only receive medication when they are awake enough to push the button, which serves as a safeguard against receiving an overdose.

As I have noted, PCA pumps need to be carefully employed and can be dangerous without appropriate monitoring:

The Happy Hospitalist explains:

Why is PCA morphine dangerous?  Too much medication can cause patients to stop breathing. Opiates, often inappropriately referred to as narcotics by doctors and nurses, suppress the central nervous system's respiratory drive and increases the risk of life threatening apnea.  This is the cause of death in a heroin overdose.  This is the cause of death in the epidemic of prescription opiate drug overdoses heard about on the news.  Many PCA morphine order sets require continuous oxygen saturation monitoring and frequent documentation of respiratory rate as safety mechanisms.  This is to protect the patient from experiencing prolonged hypoxemia as a result of too much sedation when no family is available at the bedside.   

The Joint Commission published a sentinel event alert on the matter in August 2012. 

In many parts of many hospitals, the basal rate is not used, precisely because of how dangerous it is. There are other options for those patients with high narcotic needs, such as having a nurse give the patient a scheduled dose of narcotic every few hours after making sure it is safe for the patient to receive it.

All this background is to set up a recent event at an academic medical center:

A drug addicted patient "hacked" his PCA pump and gave himself a basal rate of 2mg dilaudid per hour with a 1mg self-administered PCA dose every 5 minutes.  This would have resulted in respiratory arrest if the nursing staff had not quickly realized what was going on. (I'm advised that most people stop breathing at about 2-4mg per hour.  Since this person was tolerant, he probably could have lasted a few hours but inevitably would have overdosed overnight). The staff took the PCA away.

What are some possible lessons from this near miss?  At a minimum, it might be worth thinking about changing the PCA pump passcode from "1,2,3" to something more difficult to guess. Maybe it would also pay to eliminate the basal rate option all together on the machines in parts of the hospital where constant monitoring is not available.