The Functional Resonance Analysis Method (FRAM) Application in the Healthcare Sector: Lessons Learned from Two Case Studies on Medical Device Management

Featured Application

The article provides two applications of the Functional Resonance Analysis Method (FRAM) in the healthcare sector. These analyses can be used as a reference by safety managers and practitioners prospectively and retrospectively for the effective risk assessment of interoperable medical device systems.

Abstract

In the recent literature, numerous tools have been found that have been used to evaluate and improve the resilience of socio-technical systems such as hospitals. The Functional Resonance Analysis Method (FRAM) is certainly one of the most diffused, as it can provide information on the system structure and its components through a systemic analysis approach. FRAM has been successfully applied in different contexts. However, in the healthcare sector, only a few studies propose practical analyses that can support practitioners in systematically observing and analyzing events, both when things go right and when they go wrong. To reduce such a research gap, the current study focuses on the application of FRAM to two different case studies: (1) an accident that occurred in a hyperbaric oxygen therapy unit, and (2) the risk assessment of a magnetic resonance imaging unit. The results show the effectiveness of FRAM in detecting discrepancies and vulnerabilities in the practical management of these devices, providing valuable insights not only regarding the analysis of adverse events (i.e., retrospectively) but also concerning the improvement of safety procedures (i.e., prospectively).

1. Introduction

Healthcare systems are nowadays seen as complex systems, which consist of individual agents that have the freedom to act in unpredictable ways, with their actions being interwoven in such a manner that the actions of one agent alter the context for the others, to use the words of Plsek and Greenhalgh [1]. The increasing acknowledgement of this complex nature of healthcare systems has prompted the implementation of systems engineering approaches to better enhance quality and safety [2,3]. To achieve such a goal, it is necessary to go beyond the analysis of the individual components of care systems and examine how outcomes, both desired and undesired, arise from the interactions within and adaptations to everyday working conditions [4]. This is particularly true when dealing with medical devices [5,6], whose complexity has greatly increased in recent years [7].

It must be noted that in this study, we intend as a “medical device” any instrument used for medical purposes, e.g., diagnosis and treatment, as defined by Article 2 of the Regulation (EU) 2017/745 [8]. Factors negatively impacting the safety and reliability of high-tech medical devices include their design features, their interactions with one another, as well as insufficient training related to their use and maintenance operations [9]. Despite such complexity, traditionally, the safety of medical devices has been treated in a linear manner following a root cause analysis approach [10], which is based on a “find and fix” mentality [11]. This implies that hazardous causal events are identified and corrected to prevent the recognized accident or incident from occurring again. However, this approach is not sufficient to face the complex interactions occurring between operators and patients on the one hand, and medical devices and equipment on the other [12,13]. Healthcare systems, such as hospitals, are dynamic, partially described, and thus underspecified when considering safety management. In these systems, the use and management of medical devices are regulated by strict safety procedures/protocols relying on the above-mentioned linear approach [11,14], the conformity to which can reduce the opportunity to enhance the system [15].

For this reason, in recent studies addressing occupational health and safety (OHS) management in the healthcare sector, ever greater attention has been paid to combining traditional risk management tools with more proactive approaches that allow the achievement of resilient systems [16,17,18]. At a general level, Costella et al. [19] defined four main resilience engineering (RE) principles: Commitment (top management), Flexibility, Awareness, and Learning.

In this study, we focused on the fourth one, which emphasizes the ability to learn from both incidents/accidents and normal work to provide successful working strategies [20]. The former issue, i.e., a retrospective analysis of incidents/accidents, should be addressed not only to understand what went wrong but also to learn lessons to avoid a repetition of the adverse event [21,22]. The need for further research focused on the analysis of adverse events related to the use of medical devices is stressed by Amoore [23], who underlines the necessity of bringing to light the wider causes of an accident/incident based on the interactions among the medical device, the clinical team, and the infrastructure, which all revolve around the patients.

As in other industrial contexts, adverse events such as accidents or incidents can be caused by the non-trivial socio-technical interactions among these agents, rather than by a linear causal chain, as clearly argued by Nakhal Akel et al. [24].

Moreover, besides the analysis of adverse events, learning should be based on the analysis of how procedures are implemented, as this can allow a reduction in the gap between work-as-imagined (WAI, i.e., how managers envision work activities) and work-as-done (WAD, i.e., how front-line operatives actually perform work activities) [25]. However, in practice, this gap cannot be completely abated by aligning WAD and WAI [26]. Thus, safety managers have to be aware of this discrepancy fostering adaptations that can allow the achievement of good outcomes [27]. Needless to say, the Learning principle is strictly related to the third principle, Awareness, as learning lessons from the analysis of adverse events or normal work can augment individual and team awareness of safety [15].

Based on the above considerations, this study aims to investigate the WAD–WAI discrepancies in two case studies related to the use of medical devices. For this purpose, the Functional Resonance Analysis Method (FRAM) [28] was utilized, as it represents one of the most well-known tools for systemic safety assessment in complex and dynamic domains [29]. FRAM is a performance-based risk identification tool to model socio-technical systems, which enables the characterization of these systems by providing a detailed description of their functional relationships [30]. The FRAM application can successfully allow safety managers to augment their awareness of medical device management [16]. As outlined by Patriarca et al. [31], FRAM is mainly used for both retrospective and prospective risk analyses: the former use consists in the analysis of past accidents and, based on the reporting of these events, aims to examine how an adverse outcome propagated and how its causes or effects were amplified across the socio-technical system. In the latter case, instead, FRAM is used to model the behavior of the socio-technical system to better identify and manage its risks.

According to Salehi et al. [32], healthcare is the most common sector that has employed FRAM for risk assessment purposes. The number of these studies can be considered significant, and this confirms the fact that hospitals are dynamic, partially described, and underspecified socio-technical systems, which need to be analyzed by means of a resilience engineering approach [2]. Most studies using FRAM in healthcare focus on the analysis of work procedures such as the discharge process of frail patients [33], the management of primary care [25], preoperative anticoagulation [34], and medication administration [35,36,37]. Other studies used FRAM for the analysis and improvement of intensive care units by focusing on the transition process of critically ill patients [38], the recovery following intensive care treatment [39], or the co-administration of multiple medicines [40]. Moreover, several studies aimed at the improvement of guidelines and safety procedures, for example, the provision of indicators to better manage and monitor the blood sampling process [41]; the identification of characteristics, skills, preconditions, and resources necessary for safety investigations [42]; and the implementation of a clinical decision support system to reduce the gap between WAI and WAD [43]. In contrast, in a few studies, FRAM was applied to analyze accidents/incidents in the healthcare context. For example, Pickup et al. [44] investigated incidents in blood sampling activities with the goal of bringing to light the most influential factors affecting the variability of the blood sampling process. Goldman et al. [45], by means of interviews with nurses and physicians, identified several incident cases and applied FRAM to create an instantiation and identify areas of variation. FRAM was also used to investigate an accident where surgical materials were left in a patient’s abdomen during a surgical procedure [46].

However, compared to other sectors such as maritime and air transportation [47,48,49,50], manufacturing plants [51], or offshore drilling units [52], the use of FRAM for accident/incident analysis in the healthcare context appears scarce. At the same time, the risk analysis of the use of medical devices by means of FRAM is also infrequent, although this method can be applied both prospectively and retrospectively for effective the risk assessment of interoperable medical device systems, as stressed by Samaras and Samaras [53].

Hence, to augment knowledge on the use of FRAM in the healthcare sector by means of practical analyses that can support practitioners in systematically observing and analyzing events, this method was applied retrospectively and prospectively. The first case study concerned the analysis of an accident in an HBOT room that occurred in Italy in 1997 and caused 11 victims [54], while the second case is related to the analysis of the current management of a room where an MRI machine is used for patients’ diagnosis.

These case studies were selected as they present similar safety criticalities, which are due to the fact that in both cases, a “special” room has to be managed where both patients and medical staff interact.

Accordingly, on the one hand, this study aims to augment knowledge on the practical application of a resilience approach for the risk assessment of medical device management, given that, compared to other sectors, the use of FRAM in the healthcare context appears scarce especially for what concerns accident/incident analysis.

On the other hand, the practical contribution of the study consists in bringing to light discrepancies between clinical practice (WAD) and hospital protocols (WAI) to allow the safer management of the above-mentioned safety devices and thus enhance the performances of clinical personnel, in line with van Dijk et al. [55]. As a matter of fact, although the occurrence of several accidents related to the use of complex medical devices such as the HBOT room [56] has led to strict safety regulations and standards, current safety management practices related to the use of these devices still present vulnerabilities when analyzed from a resilience engineering standpoint.

The remainder of this manuscript is organized as follows. Section 2 concerns a brief explanation of the FRAM’s main features and its application in the healthcare sector. In Section 3 and 4 the two case studies are respectively described, while in Section 5, the discussion of the study outcomes is proposed. Finally, conclusive remarks are addressed in Section 6.

2. Materials and Methods

2.1. Functional Resonance Analysis Method (FRAM) Main Features

In synthesis, the method generally involves five key steps, starting from the definition of the objective of the analysis (e.g., the system’s risk analysis). Then, the system’s functions are identified, characterized, and described by means of the taxonomy and graphical representations suggested by Hollnagel [28]. In Figure 1, a scheme of FRAM’s hexagon or snowflake is illustrated, which represents a general function (or activity) of the investigated system.

Then, the variability of the functions individuated in the previous step (which can be endogenous (or internal), exogenous (or external), or influenced by upstream functions) is evaluated. The next step consists in determining if and where functional resonance may occur, i.e., how the output of each function is related to the various aspects of other functions. Thus, from the graphical point of view, the hexagons (i.e., the functions) are connected (Figure 2). Such a process, which is called “coupling” [57], aims to bring to light the dependencies among the functions. It is noteworthy to observe that while the link between the output (O) of one function and the input (I) of the following one goes without saying, additional dependencies can occur.

Finally, the consequences of the variability are evaluated to determine interventions to reduce the variability of the function’s performance when it is negative or to enhance it when the variability is considered beneficial for the system. It is worth noting that when describing a sequence of activities, each phase can be represented by a function, which can be a human, technological, or organizational activity.

2.2. Study Features

Based on the above considerations, our study focused on the application of FRAM to two complex medical devices (a magnetic resonance imaging (MRI) machine and a hyperbaric oxygen therapy (HBOT) room) that have the same risk profile according to Regulation 2017/745 [8] and similar use and management procedures, which can be summarized as follows. The treatment is carried out in a specific room or chamber, which is isolated from the rest of the hospital. To access the room, strict control is needed to avoid the patient/hospital staff carrying in hazardous objects and substances, as well as some types of implants. For these reasons, in both cases, specific information has to be provided to patients during the acceptance phase and the medical staff in charge of operating these devices must receive specific training. Regarding the latter aspect, in the team, the presence of a medical manager (who is responsible for the safety, quality and appropriateness of the therapies administered) and a technician (who is responsible for the management and proper functioning of the whole system and operates under the direction of the medical manager) is mandatory. Besides these organizational requirements, it must be noted that the maintenance of these devices and the related safety systems undergo similar procedures that foresee periodic checks and continuous monitoring [8].

3. Case Study 1

3.1. Case Study Context and Goal of the Analysis

The first case study concerned the analysis of the accident that occurred in 1997 in an Italian hospital and consisted in a fire in a hyperbaric oxygen therapy (HBOT) room (or chamber). This accident caused the death of ten patients and one nurse, who were in the HBOT when the fire broke out [58]. A multi-place HBOT room can provide oxygen therapy treatment to two or more people at the same time. For this purpose, each patient inside the room uses a mask or a hood for breathing, and a nurse or a technician is usually in the room during the treatment to assist patients. This type of device allows patients to breathe oxygen at a pressure higher than the atmospheric pressure, and it is used for the treatment or prevention of several diseases [59]. The presence of high-pressure oxygen and its augmented percentage represents a serious hazard of fire, explosion, or implosion, which has led to numerous accidents worldwide [56,60].

Nowadays, to prevent the occurrence of these types of accidents, international regulations and technical standards establish strict safety requirements for both manufacturers and users [8,61]. In particular, as far as operational safety is concerned, several basic rules must be observed during the use of the device, such as avoiding the presence of volatile or flammable liquids in the chamber; avoiding the presence of combustible lubricants; keeping the oxygen concentration below 23%, etc. [62]. Furthermore, the continuous monitoring of the chamber is requested during its use, as well as the periodic maintenance of fire suppression systems [63]. For this purpose, specific training of the hospital personnel in charge of using the device is foreseen, as well as providing information to patients [64]. At the time of the accident in Milan, most current safety requirements were not issued yet. However, procedures on the proper use and maintenance of the equipment were in use at the hospital, as well as constructive safety requirements for the device manufacturer. As emerged from the investigations carried out following the accident, a gas-operated hand warmer introduced into the chamber by a 77-year-old female patient was the probable trigger, and it is likely that the chamber was pressurized with oxygen rather than air, as an explosive fire would not occur in a chamber pressurized with air. The increase in the oxygen percentage was caused by the use of hoods that were modified by the hospital personnel to make them easier to wear: in detail, two zips in the latex collar were added, causing a significant oxygen leakage from the zips and the collar itself. Thus, in the chamber, the percentage of oxygen was much higher (27%) than the requested level (23%). Moreover, the fire suppression system of the chamber was found to be not functioning, as the water tank of the fire extinguishing system was empty and the shutter of the water delivery pipe was found closed, as was the valve of the compressed air cylinder used as propellant (although the fire tank was prepared for the installation of the level gauge, this had never been installed). Hence, due to the failure of the extinguishing system, the fire was extinguished only due to the exhaustion of the oxygen present inside the chamber: it was found that some people in the chamber survived for at least a minute after the fire broke out. They could have been saved if the fire suppression system had been working. Although police investigations and the subsequent trial provided a detailed technical analysis of the accident, a proper accident analysis method was not used, missing a systemic perspective on the elements and events that were analyzed independently.

With this goal in mind, to achieve a more comprehensive understanding of the accident, a FRAM model was developed, starting from the analysis of the correct functioning of the HBOT room considering the safety requirements and procedures in force when the accident occurred. The analysis was carried out with the support of an expert, i.e., a maintenance engineer specializing in medical devices management.

3.2. Identification and Definition of the Functions

As suggested by Hollnagel and Goteman [57], the use of FRAM for accident investigation starts from the identification and characterization of essential functions. Then, the variability of each function is analyzed based on the accident reports, and its impact on the other functions is evaluated.

The first step consisted in the definition of essential functions, which are the following:

• ACC. Patient acceptance: the function that activates the entire process is related to the patient’s suitability for the oxygen therapy treatment. Hospital staff has to verify the patient’s anamnesis and the request for the treatment issued by a specialist. In this phase, the patient should be informed about the risks related to the treatment, the prohibition of introducing flammable objects into the room, etc. The output of this organizational function is represented by the patient’s suitability for the oxygen treatment.
• PREP. Chamber preparation: the hospital staff has to check the correct functioning of the HBOT room, including its safety systems, such as the fire extinguishing devices, as well as the masks/hoods to be used by the patients during the treatment. At the same time, the intervention threshold of the oxygen analyzer has to be set.
• DEV. Provide devices: the hospital staff provides patients with a hood or a mask depending on the type of therapy and verifies they are worn correctly.
• SET. Chamber closing and oxygen settings: once patients are equipped with the mask/hood and are in the correct position inside the chamber, the door is closed, and the HBOT room is set for the treatment.
• RUN. Running treatment: the treatment is performed.
• MON. Monitoring: during the treatment, the hospital staff has to monitor the correct functioning of the system and the proper percentage of oxygen administered. This control is carried out both outside the HBOT room through a control panel and inside the room (usually by a nurse who assists patients).
• END. End treatment: when the treatment time is completed, the staff starts the decompression phase that is concluded with the opening of the chamber door.

3.3. Definition of the Variability

The further step concerned the analysis of the variability of each function: when the output of one function affects an aspect of another function, a coupling was established between them. An excerpt of the variability analysis of the Function SET (chamber closing and oxygen settings) is shown in Figure 3: the FRAM method was applied using the software FRAM Model Visualiser (FMV Pro, rel. 2.1.6 [65]) and the related FMV file is provided in the Supplementary Material.

3.4. Variability Aggregation

Then, the analysis of the variability aggregation was carried out considering how the variability of the output of a function affects the aspects of the other functions. Hence, starting with the instantiation represented in Figure 4, we focused on the following issues:

• The inaccurate acceptance of the patients, which as a result allowed one of them to bring a gas hand warmer inside the chamber (Function ACC).
• The inaccurate chamber preparation, when the hospital staff missed the fire extinguishing system check (Function PREP).
• The lack of conformity of hoods: tampering with the hoods by the hospital staff caused an increase in the percentage of oxygen in the chamber, and the wrong setting of the oxygen analyzer did not allow the alarm system to detect the too-high percentage of oxygen (Function DEV).

3.5. Results

While a more detailed analysis is beyond the scope of this study, the variability of these three functions demonstrates how FRAM progressively constructs an explanation of the accident. Actually, each of these functions is related to the failure of individual and organizational performances, while their combination has led to the adverse event that caused the death of all the people inside the chamber.

In Figure 5, the FRAM model of the propagation of the accident due to the above variabilities is illustrated, bringing to light the critical couplings of functions and the non-linear propagation of their adverse effects. The FRAM instantiation allows us to better understand how the occurrence of an adverse event can trigger another one and how the outcome of the initial event can result in the emergence of a new accident factor amplifying the effects of the original event.

In fact, the missing control and lack of information that occurred in performing Function ACC (patient acceptance) alone could have led to the injury of one patient only in the case of the correct performance of the other functions. Instead, the combination of these wrong actions with the tampering of the hood caused an explosion that affected the other occupants of the chamber. Some of the latter could have been saved anyway if the extinguishing systems inside the chamber (i.e., a sprinkler system and a fire hose) were correctly functioning. At the same time, the lack of alert systems capable of impeding the treatment, both in the case of the presence of a dangerous item inside the chamber (i.e., the gas-operated hand warmer) and when the fire systems are unavailable, must be highlighted, as the latter aspects are preconditions to correctly carry out the treatment. Moreover, the HBOT room was equipped with a system to regulate the maximum percentage of oxygen in the chamber, whose nominal value for the correct functioning of the system and effectiveness of the treatment was 23.5%. However, to avoid the activation of alarm systems, the intervention threshold of the oxygen analyzer was usually set by operators at concentrations above 27%, as they knew that the tampering of hoods could cause oxygen leakages.

4. Case Study 2

4.1. Case Study Context and Goal of the Analysis

The second case study concerns the analysis of the current management of a room where an MRI machine is used for patients’ diagnoses in an Italian public hospital. MRI is a widespread non-invasive diagnostic technique thanks to its ability to obtain high-quality two-dimensional and three-dimensional images of the human body.

The rapid technological development that has affected this sector has brought increasingly powerful and complex devices to the market, which has seen the affirmation of tomographs with superconducting magnets. However, this system requires considerable quantities of cryogenic liquids, the leakage of which, in a confined environment such as the MRI room, can cause severe effects on the health and safety of both patients and operators. The risks associated with the massive use of cryogenic substances have led to the issue of specific safety parameters concerning the structural and plant requirements (i.e., the MRI room), as well as the device itself [66].

Patients and operators working near the equipment are exposed to several hazards related to the MRI environment, which are due to the presence of three types of magnetic fields simultaneously: static magnetic field, time-varying magnetic field gradients, and radiofrequency (RF) magnetic field. More in detail, following the study by Stecco et al. [67], the main risks related to the use of this device can be summarized as follows:

• Projectile effect: Magnetic fields can attract objects toward the magnet, posing dangers to both patients and operators. The static magnetic field is conventionally categorized into two zones: Zone 1 (close to the magnet’s center) and Zone 2 (surrounding the magnet with decreasing magnetic intensity). Ferromagnetic objects in the former area are subject to torsion, and if the object is inside the patient’s body, it can potentially cause tissue damage. In the latter, ferromagnetic objects are also subject to a translational force, leading to the “projectile effect,” where these objects can be rapidly drawn into the magnet, potentially leading to injury or damaging the magnet. Several accidents are reported, which have involved the presence in the room of oxygen and helium cylinders, cleaning trolleys, metal chairs, scissors, etc. [68].
• Twisting: this effect is due to the deflection or torsion of magnetic objects, such as vascular clips and cochlear implants, that can lead to incorrect implant functioning or cause damage to patients.

Besides these risks, other negative effects on the patient’s and operator’s health can be due to the RF field (which can lead to tissue heating) as well as the magnetic field gradients (which can lead to peripheral nerve stimulation and implant heating). The latter can also cause abnormal noise in the MRI scanner room that can lead to hearing damage [69]. To prevent these hazardous situations, the use of an MRI room is subject to strict safety requirements worldwide, where the Italian situation differs due to stricter regulations than the European Union ones [70]. Based on these safety requirements, the hospital issued an internal regulation that includes the use of a questionnaire that has to be filled out by the patient and checked by the MRI room manager before the patient is allowed to access the room for the diagnosis. Actually, the involuntary introduction of ferromagnetic objects into the MRI room or the entry of subjects with life-saving implantable medical devices has to be avoided. Hence, since the MRI room access represents a high-risk activity, we decided to analyze the procedures for accessing the MRI room by means of FRAM in order to identify where functional resonance phenomena could emerge and spread. It has to be noted that the MRI room is located inside a Controlled Access Zone (ZAC). Hence, the MRI unit consists of an acceptance zone, the ZAC, and the MRI room.

The final aim of this application is also to propose concrete measures to manage the variability of systemic performance so that the system is constantly kept under control.

4.2. Identification and Definition of the Functions

With this goal in mind, following the approach proposed by Hoy et al. [71], the hospital staff in charge of using and managing the MRI room was interviewed to better understand the access procedure (AP), which is characterized by a sequence of activities. Accordingly, each step of the procedure was identified as a function. This allowed us to define the main steps of the AP, which can be described as follows:

• REG. To register the patient for an MRI examination (this activity is carried out outside the MRI room).
• EVA. To evaluate the MRI examination request issued by the medical staff: in more detail, the MRI staff, after having assessed the appropriateness of the diagnostic investigation, must identify any contraindications to carrying out the examination (e.g., the presence of ferromagnetic prostheses, implantable medical devices, etc.). In this phase, it is essential to make an initial distinction between patients who are able to provide adequate information for the safe execution of the MRI examination or not.
• ANA. To perform the patient anamnesis: in order to identify any contraindications to carrying out the diagnostic test or to the entry of occasional workers into the MRI room, the interested parties must be subjected to an anamnesis by filling in an anamnestic questionnaire. If the information provided by the patient/caregiver is not considered sufficient, or if a patient is unconscious, the MRI staff may request further investigations (e.g., X-rays to verify the presence of ferromagnetic objects inside the patient’s body or specialist visits in the case of the presence of medical devices such as pacemakers).
• AUT. To issue the authorization for performing an MRI examination: once all necessary information is gathered and evaluated, MRI staff releases the authorization to carry out the MRI examination.
• INF. To provide information for entry to the MRI room: both patients and workers who are allowed access to the Controlled Access Zone (ZAC) are provided with specific information concerning the MRI-related risks and safety procedures.
• DEP. To deposit all ferromagnetic objects: before entering the ZAC, both patients and workers are asked to leave all hazardous objects out of the ZAC.
• ACC. To access the ZAC: once the permission to enter the ZAC is given, both patients and workers are authorized to enter the ZAC.
• CHE. To perform the metal detector check: in the ZAC, both patients and workers are scanned with a portable metal detector to verify that there are no ferromagnetic objects.
• PRE. To prepare the patient for the examination: the patient is prepared to undergo the MRI examination (e.g., the contrast liquid is administered).
• ENT. To enter the MRI room.
• MRI. To perform the MRI examination.
• EXI. To exit the MRI room.

Besides these functions, two additional functions must be considered, which are essential for the correct functioning of the whole process:

13.

TRA. To train authorized healthcare personnel.

14.

MAN. To verify the correct maintenance of the MRI device.

4.3. Definition of the Variability and Aggregation

Similarly to case study 1, the analysis of the variability of each function was carried out, evaluating when and how the output of one function affects an aspect of another function. In Figure 6, a scheme of the FRAM instantiation is represented, while the complete output is available in the Supplementary Material (the method was applied using the software FRAM Model Visualiser (FMV Pro, rel. 2.1.6 [65])).

In more detail, the analysis of the variability of each function was carried out in collaboration with the hospital staff. From this analysis, it emerged that although Function CHE (to perform the metal detector check) represents the last checkpoint before entering the MRI room (and thus it is crucial to avoid a ferromagnetic object being introduced in the room), it presents a high level of vulnerability. Indeed, as reported by the medical staff, it is not rare that one of the following situations happens:

• Untrained/unauthorized hospital personnel enter the MRI room for different tasks, such as picking documents and avoiding the metal detector check;
• When an emergency occurs, the patient is rapidly brought to the MRI room without passing the previous check phases.

Unfortunately, the above situations are not uncommon, resulting in the onset of risks related to the presence of ferromagnetic objects inside the MRI room. In particular, as the hospital has an accident and emergency department (A&E), the need for an urgent MRI examination is frequent. Besides these outcomes, the vulnerability of Function CHE also emerges from Figure 6, since in the case of operators, no further controls are foreseen before Function ENT. Accordingly, if Function CHE is not carried out correctly, Function ENT also cannot be performed correctly.

4.4. Identification of Possible Solutions

To reduce this vulnerability, together with the hospital experts, an additional technological control function was included, i.e., the installation of fixed metal detectors, to be placed outside the door of the MRI room. Such a system is capable of passively detecting ferromagnetic materials, signaling their presence through visual and acoustic alarms. This solution does not replace the already foreseen safety controls but augments them, mitigating and controlling the variability of the upstream functions.

4.5. Results

Based on the above considerations, a new function was included in the analysis (Function SCA. To pass the ferromagnetic scan before entering the MRI room) and the whole function list is the following:

• REG. To register the patient for an MRI examination;
• EVA. To evaluate the MRI examination request issued by the medical staff.
• ANA. To perform the patient anamnesis.
• AUT. To issue the authorization for performing an MRI examination;
• INF. To provide information for entry to the MRI room;
• DEP. To deposit all ferromagnetic objects;
• ACC. To access the ZAC;
• CHE. To perform the metal detector check;
• PRE. To prepare the patient for the examination
• SCA. To pass the ferromagnetic scan before entering the MRI room;
• ENT. To enter the MRI room;
• MRI. To perform the MRI examination;
• EXI. To exit the MRI room;
• TRA. To train authorized healthcare personnel;
• MAN. To verify the correct maintenance of the MRI device.

Then, a new instantiation including this new function was carried out and the scheme is reported in Figure 7, while an excerpt better illustrating the new Function SCA and its couplings is reported in Figure 8. The complete FRAM application is available in the Supplementary Material. It must be noted that the new Function SCA is the one marked with a red circle in Figure 7.

On the one hand, this improvement was discussed with the hospital medical staff, and its feasibility was evaluated positively. On the other hand, this output demonstrates the discrepancies existing between WAI and WAD also in working contexts where safety management complies with the utmost requirements in terms of risk assessment and personnel training.

5. Discussion

The use of medical devices for patient treatments in a hospital context represents a dynamic and interwoven activity, which depends on organizational, human, and technical factors. Hence, the intricate relationships between them reveal that safety management in this context cannot be a linear and straightforward process [72]. The study demonstrates two case studies (an accident and a risk assessment) of the value of FRAM in examining and thus identifying discrepancies and vulnerabilities that in turn could be improved. These case studies were chosen because they can be considered complex sociotechnical systems per se, sharing similar safety concerns, which stem from the procedures that must be followed to access the treatment room where patients and medical staff interact with the infrastructure.

5.1. Research Implications

Accordingly, to deal with these complex sociotechnical systems, a systemic thinking approach to risk assessment is needed, as traditional safety analysis methods fail to capture non-linear interactions that characterize the system [73]. Indeed, this aspect emerged from the case study related to the HBOT room accident, where the three main criticalities that led to the death of all occupants of the chamber are not related in a linear manner. Actually, the FRAM analysis can offer valuable insights into the propagation of variability, highlighting how even minor changes in following safety procedures can lead to unpredictable interactions among the system functions, which result in disproportionate undesired effects. Such an outcome is consistent with the study on the variability propagation effects by Bueno et al. [74], who outlined how FRAM can provide a more realistic explanation of the system outcomes over the conventional cause–effect relationships.

This brings us to another noteworthy issue, which is related to the improper information and training of the hospital staff operating the HBOT room, which affected all the abilities that a resilient system should have (i.e., the abilities to respond, to monitor, to learn, and to anticipate [27]). Indeed, although information and training represent a key precondition of all the functions characterizing the treatment process, it must be observed that at the time of the accident, no specific rules were foreseen. In Italy, the first safety requirements for operating an HBOT room in a hospital were issued following the Milan accident several months after its occurrence. Nowadays, most of the above-mentioned criticalities cannot occur thanks to the issue of strict regulations [8] and technical standards [75,76].

Furthermore, as demonstrated by the second case study, despite compliance with all safety requirements and the use of safety procedures and checklists, something could still go wrong in the daily operation of the device. Similarly, also the HBOT case study showed that WAD (i.e., the tampering with the hoods by the hospital staff) was not in line with safety protocols (i.e., the instructions of the hoods manufacturer), as at the time of the accident, it was considered “normal” to adjust these devices to better fit the patients. This outcome highlights the discrepancies between work-as-imagined and work-as-done, even in workplaces where safety management adheres to mandatory standards in terms of equipment safety and personnel safety training. Accordingly, it can be concluded that even though modern medical devices comply with the latest safety requirements, a systemic approach is needed to detect the vulnerability of the system to reduce the discrepancies between safety protocols adopted by the hospitals (WAI) and current practices of these peculiar work environments.

Focusing more on the MRI case study, where interviews with the medical staff could be carried out, the application of the FRAM method allowed the critical issues of the system to emerge and at the same time to highlight the points where it was possible to intervene to reduce the probability of occurrence of a potentially adverse event. In particular, the lack of time in emergency situations and the imprecision due to inexperienced/untrained personnel dealing with the MRI room generated a high level of variability that can lead to adverse events. In accordance with research hints by Meulman et al. [77], the study findings confirmed that the primary reasons for deviating from safety protocol typically involve time constraints and the operator’s insufficient knowledge. Although WAI and WAD cannot be perfectly aligned, improvements can be carried out at the practical level without changing consolidated practices. Additionally, the FRAM application to the MRI room confirmed that the use of a slack (i.e., the additional resource represented by the ferromagnetic scanner) can damper unexpected variability, in accordance with research findings by Werle et al. [78].

From the methodological point of view, this study has demonstrated the effectiveness of FRAM in bringing to light vulnerabilities that traditional safety analysis approaches have not detected. Such a finding confirms research by Hollnagel and Goteman [57], fostering the use of resilience engineering approaches to detect multiple factors contributing to the occurrence of an accident. Furthermore, in line with Guo et al. [79], it was demonstrated how FRAM can facilitate the identification of functional variability, unveiling the mechanism of risk transmission by analyzing adverse functional resonance. Moreover, differently from other research in the healthcare sector (e.g., in [20]), the current study (especially in the second case study) proposed a more holistic function individuation, focusing not only on those explicitly related to resilience system abilities but also on those that can appear distant from the event in both time and space by taking into account what occurs in reality. Accordingly, in line with O’Hara et al. [80], it must be outlined that augmenting the granularity of the FRAM instantiations allows analysts to better capture the WAD.

Then, it is worth noting that analyzing past accidents by means of resilience engineering tools can augment knowledge on how an adverse event can be propagated through organizational and/or individual vulnerability to trigger further ones that can lead to catastrophic outcomes.

Lastly, as noted by Verhagen et al. [13], few studies have applied the FRAM method in the healthcare sector, advancing from conceptual thinking to evidence-based insights by applying this method to develop and evaluate practical improvement interventions. Hence, the output of the second case study can certainly contribute to reducing such a research gap and represent a basis for further FRAM applications aimed at providing actionable insights and solutions.

5.2. Research Limitations

Besides these practical findings that can contribute to expanding knowledge on the use of resilience engineering approaches in the management of complex medical devices, some limitations of the current study must be outlined as well. From the methodological point of view, the use of FRAM alone can provide a qualitative description and analysis of the functions’ coupling mechanisms, but it lacks quantitative analysis and assessments of the coupling and correlation relationships between the system’s components [81,82,83]. Moreover, as observed by Hulme et al. [84], even though FRAM is one of the few systems thinking accident analysis tools allowing safety managers to account for normal performance variability, the outcomes of the analysis can be complex and difficult to interpret. Hence, the use of supporting tools such as the Resonance Analysis Matrix (RAM) [85], the Montecarlo Analysis [86,87], or the Bayesian Network (BN) and Failure Modes and Effects Analysis (FMEA) used by Fu et al. [88] can certainly augment the effectiveness of the FRAM application. Also, the use of Fuzzy Logic and Rough Set Theory (RST) was investigated to better characterize the internal variability of a FRAM function [89]. Similarly, several augmentations of FRAM were proposed in the healthcare sector to investigate performance variability in complex operations [32]. Additionally, the use of descriptive statistics tools to prioritize variability sources as in Saurin and Werle [90], as well as to evaluate functions’ coupling as in Guo et al. [79], can certainly augment the effectiveness of the FRAM use.

Another criticality is related to the fact that when analyzing the accident that occurred in the HBOT room, the system and accident analysis were based on accident reports only. Hence, although this case study shows the effectiveness of FRAM in illustrating how different types of failures have stimulated each other, amplifying the consequences of the accident, field research and interviews with the involved parties could have certainly allowed us to apply the FRAM more holistically. Therefore, this case study should be regarded mostly as an illustrative example of retrospective analysis.

Finally, it must be noted that the analysis of the MRI room considered the system per se, rather than in connection with other hospital facilities, staff, and equipment. On the one hand, this allowed us to focus on the MRI room as a single sociotechnical system for its detailed analysis. On the other hand, in this way, the influence of the above-mentioned connections was not taken into account.

6. Conclusions

As healthcare complexity has grown, so too have concepts of safety management and the understanding of human variability’s impact on it. Hence, there is a need for a methodology that enables safety managers to systematically analyze events, whether they go right or wrong. To contribute to reducing this research gap, the current study proposed a FRAM application to two different case studies related to the use and management of complex medical devices. The main question of the present study is how FRAM could be used in the healthcare sector, and two case studies (an accident analysis and a risk assessment) are presented that highlight the value of FRAM in analyzing a system’s structure and components, enabling the identification of discrepancies and vulnerabilities that can be addressed for improvement.

The results achieved show that FRAM in the healthcare sector can help safety managers bridge the gap between how managers envision work activities (WAI) and how front-line operatives actually carry out these activities (WAD). In particular, the study showed how time constraints and workers’ insufficient knowledge can augment the variability of functions and thus the vulnerability of the system. Hence, discrepancies between WAI and WAD can occur even in systems where safety prescriptions are correctly applied.

Furthermore, the study shows how FRAM can enhance our understanding of how an adverse event can propagate in a non-linear manner through organizational and/or individual vulnerabilities, potentially leading to additional events that may cause further harmful situations.

In conclusion, we believe that through the case studies presented in this study, some lessons can be learned, and emphasizing the use of FRAM in the healthcare sector could therefore be highly beneficial for healthcare managers and policymakers, enabling them to gain a deeper understanding of their systems’ vulnerabilities.

However, the study upshots need to be further investigated to extend their validity and augment knowledge on the safe use of complex medical devices. Thus, additional research is needed to overcome the limits of the study, and FRAM augmentations are suggested to perform more quantitative analyses.