Thursday, January 07, 2016

Maybe "1,2,3" isn't a good password.

PCA (patient-controlled analgesia) pumps are very useful devices, enabling patients to push a button to control the amount of intravenous pain-killer they want to use depending on how they are feeling.  Of course, the pumps have a limit to how much can be drawn--so the patient doesn't get an overdose.

The pumps can also be set to deliver a "basal rate," a constant infusion of narcotic pain medication, in addition to the dose the patient gets when he or she pushes the button. No matter how sleepy the patient is, the pump will continue infusing narcotics. Normally, without a basal rate, patients using a PCA can only receive medication when they are awake enough to push the button, which serves as a safeguard against receiving an overdose.

As I have noted, PCA pumps need to be carefully employed and can be dangerous without appropriate monitoring:

The Happy Hospitalist explains:

Why is PCA morphine dangerous?  Too much medication can cause patients to stop breathing. Opiates, often inappropriately referred to as narcotics by doctors and nurses, suppress the central nervous system's respiratory drive and increases the risk of life threatening apnea.  This is the cause of death in a heroin overdose.  This is the cause of death in the epidemic of prescription opiate drug overdoses heard about on the news.  Many PCA morphine order sets require continuous oxygen saturation monitoring and frequent documentation of respiratory rate as safety mechanisms.  This is to protect the patient from experiencing prolonged hypoxemia as a result of too much sedation when no family is available at the bedside.   

The Joint Commission published a sentinel event alert on the matter in August 2012

In many parts of many hospitals, the basal rate is not used, precisely because of how dangerous it is. There are other options for those patients with high narcotic needs, such as having a nurse give the patient a scheduled dose of narcotic every few hours after making sure it is safe for the patient to receive it.

All this background is to set up a recent event at an academic medical center:

A drug addicted patient "hacked" his PCA pump and gave himself a basal rate of 2mg dilaudid per hour with a 1mg self-administered PCA dose every 5 minutes.  This would have resulted in respiratory arrest if the nursing staff had not quickly realized what was going on. (I'm advised that most people stop breathing at about 2-4mg per hour.  Since this person was tolerant, he probably could have lasted a few hours but inevitably would have overdosed overnight). The staff took the PCA away.

What are some possible lessons from this near miss?  At a minimum, it might be worth thinking about changing the PCA pump passcode from "1,2,3" to something more difficult to guess. Maybe it would also pay to eliminate the basal rate option all together on the machines in parts of the hospital where constant monitoring is not available.


Anonymous said...

Our PCAs are surrounded by a clear plastic lock box. A key kept in our Pyxis is required to unlock the box of the PCA keypad before it can even be hacked by something such as a simple PIN.

In any case, the PCAs we have at our hospital are no longer supported by the manufacturer due to problems with basal rates (something about "free flow" (!!)). Consequently, we do not use basal rates for our patients, pending approval and delivery of new PCA machines.

Anonymous said...

Here's an alternative approach, Paul:

In our hospital system, we enacted a Dilaudid ED-Free policy that has resulted in a significant decreases in dilaudid use both in our ED's and had carried through on to the floors...without any untoward consequences (we have studied it since implementation). A few patients (addicts) get upset because they can't get the buzz off morphine and other substitutes, but we explain to them the drug has too high a risk profile to use as a first line pain medication.

We've not had a serious event with dilaudid in a long time now. We used to have about 2-3 a year that resulted in harm before the program. Lots of reasons for that harm--mostly that younger MDs and RNs didn't understand how to use dilaudid and would overdose it.

Anonymous said...

Nothing surprises me any more. We had a patient bite through the IV tubing and suck down fluid several years ago. Alcoholics will drink Pine-Sol if they can't find alcohol.

The 1-2-3 just makes it easier to crack the password, just like with our ATM cards.

Luba Gilpatric said...

From Facebook:

I am looking forward to when we do not use passwords anymore. Thumbprint technology has really evolved.

David States said...

From Facebook:

Agree that medical device security is a huge issue, but the other factor here is patient/provider trust. In general we believe that we as providers and the patient are "on the same side". With drug seeking behavior this is not true. It disrupts many hospital and healthcare assumptions.

Vanessa Pettigrew Emery said...

From Facebook:

Not surprising!

Christine Olson Owens said...

With all of the advances in therapies and technology for pain management, why is a known drug addict ever given PCA with a basal rate?

Norma Sandrock said...

From Facebook:

A basal rate via PCA is safer than the same amount of drug being given intermittently by the nurse because the blood levels of the drug remain consistent rather than intermittently rising and falling. When a narcotic-tolerant patient cannot take oral medications but needs pain control, we usually calculate the dose of the PCA medication equivalent to what he or she takes at home then give half of that as a basal rate, adjusting up (or, rarely, down) as needed based on the machine log which tells us exactly how many times the patient needed to push the button for a supplemental dose. The inherent safety of PCA is that before the patient can push the button enough to overdose, he/she would fall asleep and therefore not be pushing the button. (That is why we don't use the basal infusion in narcotic-naïve patients, because that would put them at risk of over-medication because the drug would still be infusing even after the patient is asleep.) Without knowing the whole story, it is impossible to judge just how much danger this patient was in by hacking his pump---he was not likely getting a "high" from the basal rate increase, so it is possible that rather than drug-seeking he was analgesia-seeking because his providers were undermedicating him because giving the amounts a tolerant patient might require could be out of their comfort zone. The patient was clearly wrong to adjust his own pump and it shouldn't be possible for a patient to do so, but we can't judge him without knowing why he did it.

Anonymous said...

From Reddit medicine:

I have to give this guy some grudging admiration. Rather than try and bitch and moan to get the dose increased, or just go at the PCA with a hammer and screwdriver (yup, seen it), he figured out the locking code and reprogrammed it. Also, with the 2mg basal, 1mg q5min bolus, I'm thinking, well, what the hell. Go big or go home.

conversation on Reddit said...

From Reddit medicine:


A basal rate is a normal and safe function to use in opiate dependent patients. It has fallen out of fashion and it has a limited role - there are not many patients who require it.

"Continuous monitoring"....really? In an ideal world, for sure. Maybe my blogging friend from Boston should stick to medical administration and leave acute pain management to the experts.

mrspistolsNurse Practitioner:

He isn't completely wrong. Most PCA sets require continuous pulse ox while on. They also require hourly rounding for a set time, then every 2 hours, then every 4 hours until discontinued. The rounding includes documenting HR, pulse ox, O2 sats, and amount given.

ericstrongMD - Hospitalist:

Its better than nothing, but nurses/docs overrely on continuous O2 monitoring for patients at risk of hypoventilation. It takes a lot of sedation to become hypoxemic from not breathing. An impending catastrophe from excessive opiates will always be evident earlier from RR, breathing pattern/depth, and ability to arrouse the patient. (I.e. Cont O2 monitoring should not substitute for directly examining the pt - which I know you weren't suggesting.)

mrspistolsNurse Practitioner:

Completely agree with you. I think O2 saturation makes it feel like we are doing something.

Anonymous said...

From Reddit:

Medical device security, whether this PCA pump or Dick Cheney's old AICD, is going to be a bigger and bigger issue.

Tom Frederickson said...

Thank you for highlighting an important inpatient safety issue - opiate related respiratory depression and failure. It is the cause of many 100's of unnecessary and preventable hospital deaths every year. The Society of Hospital Medicine recently produced and made available on it web site an detailed and comprehensive implementation guide for improving the safety of opiate prescribing in hospitals. Check it out!

Tom Frederickson, MD
Medical Director Hospital Medicine
CHI Health