Investigation report: Design and safe use of portable oxygen systems

The reference event

An 83-year-old man was admitted to hospital via the Emergency Department. He complained of feeling unwell for the previous few weeks, decreased appetite, vomiting after eating, loose stools and abdominal discomfort. A medical history of type 2 diabetes, rheumatoid arthritis, hypertension (high blood pressure) and high cholesterol were recorded.

The following day the patient was transferred to the Acute Medical Unit with a diagnosis of hyperglycaemia (high blood sugar) and acute kidney injury; he was later transferred to a diabetes and endocrinology ward.

Eleven days after being admitted, the patient had recovered enough for a discharge plan to be made to allow him to return home. However, on day 12 his clinical condition unexpectedly began to deteriorate, and this progressed to the extent that over the course of a few hours he became unresponsive.

A nurse began cardiopulmonary resuscitation (CPR) and a resuscitation trolley was brought to the bedside by a care support worker. The resuscitation team arrived, and the patient’s breathing was supported using a bag-valve-mask, with a reservoir bag attached, connected to a portable oxygen supply with a standard valve.

After approximately 10 minutes of CPR, it was recognised that the reservoir bag was not inflating between breaths, which was interpreted by the resuscitation team as an indication that the patient was not receiving supplementary oxygen. The resuscitation team concluded that the oxygen cylinder was empty, so the cylinder was replaced, and the oxygen supply checked as being delivered to the patient. Despite further CPR, the patient remained unresponsive and CPR was eventually stopped. The patient subsequently died.

The following morning the medical gases porter arrived on the ward to replace the cylinder that was thought to be empty. Upon examination, the cylinder was found to be full.

The wider investigation

The Trust informed the HSIB about the incident for consideration as a national investigation. After gathering additional information about the reference event and assessing the incident against the HSIB’s investigation criteria, the decision was made to progress to a national investigation.

The national investigation focused on:

• reviewing how the design of portable oxygen systems is regulated by the Medicines and Healthcare products Regulatory Agency (MHRA)
• reviewing the design of portable oxygen systems used in other industries to determine if there are appropriate lessons for healthcare

Findings

• Portable oxygen systems currently used across the NHS in England do not provide clear and timely feedback that oxygen is flowing to the patient.
• There are various design issues with current portable oxygen systems that may lead users to interpret that oxygen is flowing when it is not.
• It is unclear how the MHRA’s Human Factors guidance document, published in 2017 (MHRA, 2017), is used in practice.
• Devices that contain a medicinal product (such as portable oxygen systems and pre-filled syringes) are regulated as medicines as defined in Article 1 (European Parliament, 2001), and not as medical devices.
• Evidence suggests that design changes, such as updating labelling and instructions for use, are most likely to be made following post-market incident investigations. These are weak solutions for preventing error but can be used to address an issue while long-term solutions are being sought.
• Products used in other industries might improve patient safety and the delivery of portable oxygen but are yet to be tested and implemented.
• Traditional NHS procurement processes thoroughly evaluate the utility and financial feasibility of products to be purchased. There is potential to reduce errors and improve effectiveness and user satisfaction if Human Factors evaluation methods are incorporated into procurement methodology.

Safety Recommendations

Safety Recommendations are directed to a specific organisation for action. They are based on information derived from the investigation or other sources, such as safety studies, and are made with the intention of preventing future, similar events.

The HSIB investigation focused on the design and regulation of portable oxygen systems. The responsibility for ensuring the design of portable oxygen equipment is appropriate rests with the MHRA. Accordingly, recommendations made in this report are directed towards that organisation. Future HSIB investigations will look in detail at different parts of the healthcare system that can also help to address the risks highlighted in this investigation.

HSIB makes the following Safety Recommendations

Safety Observations

Safety Observations are made for wider learning within the NHS. They are made when there is insufficient or incomplete information on which to make a definite recommendation for action, but where findings are deemed to warrant attention.

HSIB makes the following Safety Observations

1.1 Oxygen use in healthcare settings

1.1.1 Oxygen is widely used in healthcare settings, with applications from resuscitation to inhalation therapy.

1.1.2 Examples of clinical use of oxygen include:

• as a component of most general anaesthetic techniques
• to enrich atmospheric air for patients receiving mechanical ventilation
• to restore or maintain blood oxygen in a wide range of conditions, such as lung and heart disease, carbon monoxide poisoning, major trauma, and during cardiopulmonary resuscitation (CPR)

1.1.3 In 2008 the British Thoracic Society produced a guideline for emergency oxygen use in adult patients – this was the world’s first guideline for emergency oxygen therapy. The guideline was updated in 2017 (O’Driscoll, 2017).

1.2 Safe use of oxygen

1.2.1 There are two aspects to be addressed when considering the safe use of oxygen. Only the second of these will be addressed in this investigation.

• safe prescribing and clinical monitoring
• safe administration of oxygen

1.3 Equipment for oxygen administration

Oxygen supply

1.3.1 Most large hospitals will have a pipeline system for medical gases, including oxygen, medical air and, in some areas, nitrous oxide. Oxygen outlets supplying gas at a regulated pressure are widely available in clinical areas. A variety of equipment can be connected to these outlets, such as anaesthetic machines, ventilators, or a simple flowmeter that sets the oxygen flow rate (in litres per minute) to the patient.

1.3.2 Where pipeline oxygen is not available, oxygen is supplied in cylinders. Such cylinders are used for backup in the case of a failure of the pipeline supply, or in areas of the hospital where oxygen is less frequently used and is not supplied by the pipeline. Portable oxygen is also used on transfer trolleys and in ambulances. Patients requiring oxygen at home are supplied with cylinders, or, increasingly, electrically-driven oxygen concentrators that obtain oxygen from compressed atmospheric air.

1.3.3 In this report, the term ‘portable oxygen system’ refers only to systems that use an oxygen cylinder as the source.

Portable oxygen systems

1.3.4 A portable oxygen system contains several components (see Fig 1):

• oxygen cylinder
• pressure regulator
• pressure/contents gauge
• flowmeter and flow selector
• delivery device
• cylinder valve

Oxygen cylinder

1.3.5 Cylinders are available in different sizes and contain gaseous oxygen under pressure. Cylinder capacities vary; for one commonly used medical gas supplier (BOC), cylinder capacity is denoted by letters of the alphabet. While denotations vary across oxygen suppliers, BOC’s lettering system will be used throughout this report for consistency. A table outlining various sizes, capacity and associated duration in minutes from full is available in the Appendix.

1.3.6 A typical oxygen cylinder on a hospital resuscitation trolley in the UK is size E: 680 litres, with a duration of 45 minutes from full to empty at maximum flow rate of 15 litres per minute.

Pressure regulator

1.3.7 The pressure of gas in a cylinder is too high and variable for therapeutic use. As such, a pressure regulator is used to control the pressure, so it is constant from full to empty, allowing the flow to be controlled accurately.

Pressure/contents gauge

1.3.8 As oxygen is used, pressure in the cylinder decreases. A pressure gauge can be used to give an indication of the remaining contents. Depending on the cylinder valve design (see Fig 2 and 3 below), the cylinder valve may have to be open for the gauge to provide an accurate indication of the contents of the cylinder. Newer designs display accurate indications of contents, even when the valve is closed.

1.3.9 Digital contents gauges contain a display highlighting the selected flow rate, remaining treatment time (calculated according to the gas content of the device and the selected flow rate), and a live contents gauge. In addition, the design also provides visible and audible warning signals to advise of issues with the gas supply, such as obstructions in the tubing.

Cylinder valve

1.3.10 The cylinder valve is used to close the cylinder outlet and turn the supply on or off. There are two main types of valves:

1 Standard valve (See Fig 2): This type of valve often requires a hand wheel or key to open it. Hospitals often purchase the pressure regulator separately from the cylinder. There are mechanical restrictions on the type of regulator that can be attached to the standard valve cylinder; however, purchasing of the regulator/flow selector is left to the discretion of individual hospitals.

2 Integral valve (See Fig 3): This design has been available on the healthcare market since the late 1990s. It requires no additional equipment since the valve, regulator and flow selector are integrated into the cylinder ‘head’.

Fig 3 Integral valve

1.3.11 There are two ways of turning on the cylinder and selecting the flow when using an integral valve:

1 Dual action: has two separate controls, one to open the valve and one to set the flow rate. This is the standard integral valve used in most hospital settings (as shown in Fig 3).

2 Single action: a single control operates both the valve and sets the flow rate. At the time of publication, to HSIB’s knowledge, single action systems are not used within hospital settings in England (this is discussed further in section 5.8).

1.4 Previous safety recommendations relating to medical oxygen systems

1.4.1 In 2009 the National Patient Safety Agency (NPSA) released a Rapid Response Report (National Patient Safety Agency, 2009) highlighting the risk associated with accidentally administering medical air instead of oxygen. The alert noted 281 reports of serious incidents related to inappropriate administration and management of oxygen, including nine patient deaths. Common themes identified included confusing oxygen with medical compressed air, and inadvertently disconnecting the oxygen supply. The NPSA outlined several immediate required actions, including minimising the use of oxygen cylinders and ensuring a multidisciplinary group (such as a Medical Gases Committee) was responsible for reviewing oxygen-related incidents, and developing a local policy and training programme.

1.4.2 In 2013, following three oxygen-related fires, including a fire in the Intensive Care Unit of Royal United Hospital, Bath, in 2011, the Royal College of Anaesthetists Safe Anaesthesia Liaison Group released a safety notification (Royal College of Anaesthetists, 2013). The recommendations included placing cylinders in an appropriately designed upright holder, ideally fitted to the bottom of the bed, or to the back of wheelchairs.

1.4.3 In 2016, NHS Improvement released an alert titled Reducing the risk of oxygen tubing being connected to air flowmeters (NHS Improvement, 2016). The alert noted that, notwithstanding the NPSA Rapid Response Report issued seven years earlier, incidents continued to occur – over 200 were reported over a three-year period from January 2013. Directions focused on creating barriers to remove the potential for oxygen and medical air connectors to be confused.

1.4.4 In 2018, NHS Improvement released a further alert titled Risk of death and severe harm from failure to obtain and continue flow from oxygen cylinders (NHS Improvement, 2018). This alert focused on the incorrect operation of cylinders. Over a three-year period, more than 400 incidents (including six deaths) were reported to the National Reporting and Learning System (NRLS)[1] in which oxygen had been perceived to be flowing when it was not.

1.4.5 In addition to the alerts released within the UK, there are other alerts relating to the safe use of portable oxygen internationally. Notably, a Patient Safety Learning Advisory issued in Manitoba in March 2017 (Manitoba Health, Seniors and Active Living, 2017), outlined a case in which an oxygen cylinder was found to be empty during a patient transfer. The patient suffered a respiratory arrest, and resuscitation attempts were successful. Ongoing work in Australia has found that the rate of failure of supplemental oxygen delivery during post-operative transfer is 6.3%, with the main causal factors being the cylinder not being switched on (i.e. valve was not open, or flow rate not dialled up) or tubing not connected (Matusik & Smith, In press).

1.4.6 Oxygen is a widely used therapeutic agent, but there is potential for serious harm or death if it is not administered correctly, and incidents continue to occur. This is despite efforts from national bodies to raise awareness of the issues surrounding its use.

2.1 Patient story

2.1.1 An 83-year-old man was admitted to hospital via the Emergency Department. He complained of feeling unwell for the previous few weeks, decreased appetite, vomiting after eating, loose stools and abdominal discomfort. He had a medical history of type 2 diabetes, rheumatoid arthritis, hypertension (high blood pressure) and high cholesterol.

2.1.2 The following day the patient was transferred to the Acute Medical Unit with hyperglycaemia (high blood sugar) and acute kidney injury; he was later transferred from the Acute Medical Unit to a 33-bed diabetes and endocrinology ward. The ward was originally opened as a ‘winter pressures’ ward to cope with increased demand on healthcare services during winter months. The hospital had subsequently been unable to close the ward due to consistent high demand for patient beds throughout the year. The patient was transferred to the ward in June when its occupancy had started to reduce. In the four days prior to the patient’s death, there were between 22 and 16 patients being cared for on the 33-bed ward.

2.1.3 Upon arrival on the ward the patient was reviewed by a diabetes nurse specialist. Over the next 11 days, the patient was seen regularly by the diabetes nurse specialist and adjustments were made to his insulin medication to try to stabilise his blood glucose levels. The patient was seen by a consultant, and a discharge plan was made based on him leaving hospital two days later, with district nurses to attend at home to administer insulin and monitor blood glucose levels. However, on day 12 his clinical condition began to unexpectedly deteriorate, and this progressed to the extent that he became unresponsive.

2.1.4 Cardiopulmonary resuscitation(CPR) was commenced by a nurse and the resuscitation trolley was brought to the bedside by a care support worker. The resuscitation team arrived including two specialist registrars (one medical and one anaesthetic), five foundation doctors (two FY1, three FY2)[2], and two advanced nurse practitioners[3]. The patient’s breathing was supported using a bag-valve-mask, with a reservoir bag attached, connected to a portable oxygen supply with a standard valve cylinder (size E).

2.1.5 Although the team believed oxygen was being delivered, after approximately 10 minutes of CPR it was recognised that the reservoir bag was not inflating between breaths. The team interpreted this as an indication that the patient was not receiving oxygen, and concluded that the cylinder was empty. The cylinder was replaced with a smaller integral valve cylinder (size CD), and a check was made that the supply of oxygen was being delivered to the patient. However, despite further CPR, the patient remained unresponsive and CPR was stopped. The patient subsequently died.

2.1.6 The following morning the medical gases porter arrived on the ward to replace the cylinder that was believed to be empty. Upon examination, the cylinder was found to be full.

2.1.7 The death was reported to the Coroner and the patient’s family informed. It was noted on reviewing the death that, due to the patient’s co-morbidities, and the fact that the patient did not display any life signs when resuscitation started, the potential lack of supplementary oxygen during the resuscitation would not have made a difference to the patient’s outcome.

3.1 Referral and decision to investigate

3.1.1 The HSIB was contacted by a large teaching hospital regarding several safety issues the Trust was experiencing related to the safe delivery of portable oxygen. The referral outlined three incidents involving death that, while different, were all linked to the delivery of oxygen using a portable system. Following collection of further information and evaluation against the HSIB’s investigation criteria, a decision was made to initiate an investigation to understand any associated patient safety risks and what system-wide learning could be obtained.

3.2 Evaluation of patient safety risk against HSIB criteria

Outcome Impact – What is the impact of the safety risk on people and services across the healthcare system?

3.2.1 Portable oxygen systems of different designs are used extensively throughout the NHS. Evidence suggests that issues with portable oxygen systems are widespread, with the severity and scale of physical harm to patients ranging from death or severe brain injury, to low or no harm.

3.2.2 In January 2018, NHS Improvement (NHSI) released a Patient Safety Alert highlighting patient safety risks associated with the use of portable oxygen systems (NHS Improvement, 2018). The NHSI alert is designed to encourage improvements at Trust level, however, much work remains to be done at the system level. NHSI and HSIB were aware of each other’s interest in this issue.

Systemic Risk - How widespread and how common a safety risk is this across the healthcare system?

3.2.3 Portable oxygen systems are used in a variety of care settings across the NHS. While the event that was referred to the HSIB took place within an acute setting, similar systems are used within the ambulance service, general practices, mental health units, care homes and in patients’ own homes. Data gathered from national reporting systems showed similar incidents occurring in different Trusts (NHS Improvement, 2018). The data also suggests that the risks are persistent, with multiple instances occurring in single Trusts.

Learning Potential – What is the potential for an HSIB investigation to lead to positive changes and improvements to patient safety across the healthcare system?

3.2.4 The investigation took a systems approach by reviewing the regulation of portable oxygen systems. It is anticipated that the output of this investigation will impact not only on the regulation of portable oxygen systems, but other medical devices that require human interaction.

3.3 Investigation aims

3.3.1 The aims of the investigation were to:

1 establish the factual circumstance leading up to the incident

2 identify key contributory factors that may have occurred

3 define lines of enquiry for further investigation

4 make recommendations where necessary so that risk of future harm arising from the contributory factors is eliminated, or if this is not possible, is reduced as far as reasonably possible

3.4 HSIB investigation methods

Evidence

3.4.1 The sources of information reviewed by the investigation team were as follows:

• patient medical records
• staff rotas
• Trust incident report
• staff statement from anaesthetist – member of the resuscitation team
• staff statement from the porter called to replace the cylinder
• local and national policies and guidance documents
• collection of data from national and academic literature

3.4.2 The investigation team visited the following areas:

• accident and emergency department
• acute medical unit
• diabetes and endocrinology ward (where the patient was cared for)
• general internal medicine
• cardiology areas

3.4.3 The extended period (seven months) between the date of the incident and the HSIB investigation meant that not all members of staff involved in the incident were available for interview. The members of staff interviewed were:

• Patient Safety Manager
• Associate Medical Director
• Governance/Risk Lead for Emergency Care
• Nurse Director, Emergency Care
• Governance/Risk Lead for Medicines and Pharmacy Services
• Chief Pharmacist
• Pharmacy Operations Manager
• Medical Gases Co-ordinator
• Pharmacy Stores Operative (porter)
• Estates managers
• Staff Nurse involved in reference event
• Deputy Resuscitation Services Manager
• Matron for Medicine and Pharmacy Services

3.4.4 Interviews were conducted to understand the chronology and details of the reference event. The interviews also created an opportunity for staff to provide additional information from their perspective about wider systemic factors that affected the reference event.

Analysis

3.4.5 A systems analysis approach was used that involved the collection of data from academic and national literature, patient records, and interviews. The goal of the analysis was to identify key contributory factors that influenced the eventual adverse outcome.

4.1 Overview

4.1.1 A contributory factor is defined by the Australian Transport Safety Bureau (ATSB) (Australian Transport Safety Bureau, 2007) as a factor that:

“If it had not occurred or existed at the relevant time, then either:

• The occurrence would probably not have occurred, or
• Adverse consequences associated with the occurrence would probably not have occurred or have been as serious, or
• Another contributing safety factor would probably not have occurred or existed.”

4.1.2 The HSIB investigation team identified five contributory factors:

• Contributory Factor 1: Lack of standardisation of portable oxygen systems
• Contributory Factor 2: Lack of clear and timely feedback that oxygen is flowing to the patient
• Contributory Factor 3: Release of residual oxygen may give a false impression of continuous flow
• Contributory Factor 4. Variability in valve configuration after use introduces risk
• Contributory Factor 5: Lack of clear visual indicator that valve is open or closed

4.1.3 The investigation team also identified three incidental findings or ‘other safety factors’; these are defined by the ATSB as:

“… safety factors identified during the investigation which did not meet the definition of contributing safety factor but were still considered to be important.”

• Incidental Finding 1: Integral valve design does not offer a clear indicator of current state of the valve
• Incidental Finding 2: The valve cover on an integral valve cylinder is not easily distinguished from the tamper proof seal
• Incidental Finding 3: No piped (wall) oxygen available in the patient bay

4.2 Contributory Factor 1: Lack of standardisation of portable oxygen systems

4.2.1 All clinical areas of hospitals are normally served by a portable resuscitation trolley, which can be brought to the bedside or patient location. It contains all the equipment necessary for a medical team to provide advanced life support and other measures. Trolleys are usually standardised across each organisation in their design, equipment and layout, although there may be variants, for example, in paediatric areas.

4.2.2 The type of oxygen cylinder available on resuscitation trolleys throughout the Trust in which the reference event occurred was a size E cylinder with a standard valve (Fig 2). This contrasts with other cylinders available throughout the Trust, such as lightweight CD cylinders (460 litres), and larger HX cylinders (2,300 litres – these are commonly found beneath patient beds), both of which are fitted with integral valves (Fig 3). Information on different cylinder sizes, capacity and associated duration in minutes from full is available in the Appendix.

4.2.3 There are significant differences in the operation of standard and integral valve cylinders. For example, cylinders with standard valves do not offer a ‘live’ view of the oxygen contained within the cylinder but cylinders with integral valves do. Standard valves often require users to open the valve using a key (sometimes connected to the cylinder by a chain to prevent it going missing) or a handwheel; integral valves have a built-in valve control found in a consistent location.

4.2.4 During interviews, staff noted that cylinders on resuscitation trolleys (i.e. standard valve cylinders) were rarely used. Standard practice is to go directly to the wall pipeline outlet for oxygen supply, with the cylinder used as a backup. As such, staff were not as familiar with the less commonly used standard valve cylinders. Cylinders used during patient transfers would normally be either the smaller CD or larger HX cylinders (i.e. integral valve cylinders).

Perception that larger cylinder is required on resuscitation trolley

4.2.5 Cylinders with integral valves are not available in size E. Size E cylinders contain 680 litres of oxygen, which will last up to 45 minutes at 15 litres per minute (maximum flow rate). Hospital staff were unsure whether a smaller CD cylinder with a maximum capacity of 460 litres and a duration of 31 minutes flow at maximum flow rate, would be sufficient in a resuscitation situation.

Requirement to purchase new cages

4.2.6 Smaller CD cylinders would not fit in the storage cages on the resuscitation trolley that are currently used to hold E cylinders available on the resuscitation trolley (Fig 4). Changing all cylinders to integral valves would require new cages to be fitted.

Integral cylinders are more expensive

4.2.7 The Trust and oxygen manufacturers have described integral cylinders as being more expensive than cylinders with standard valves, such as the E cylinders found on resuscitation trolleys. The investigation did not explore the difference in cost.

4.3 Contributory Factor 2: Lack of clear and timely feedback that oxygen is flowing to the patient

4.3.1 In the reference event, the patient’s breathing was supported during the resuscitation by a bag-valve-mask with a reservoir bag attached, connected to a portable oxygen supply. Fig 5 shows the bag-valve-mask (blue and oval-shaped) with a deflated reservoir bag. The bag-valve-mask is commonly used in emergency situations, in hospitals and elsewhere, to provide ventilation to patients who are not breathing spontaneously, or who may need support with their breathing.

4.3.2 The patient can breathe independently through the system, or the self-inflating (blue) bag can be squeezed to inflate the lungs with its contents (air, or a mixture of oxygen and air when oxygen is connected).

4.3.3 Between breaths, the bag self inflates drawing in ambient air (or the contents of the reservoir bag, if attached) while the patient’s exhaled breath passes out through the valve. Oxygen also flows into the bag and into the reservoir bag, which will gradually inflate until the next breath is taken.

4.3.4 When oxygen is flowing to the patient from the cylinder it must travel through the self-inflating bag to reach the patient, with residual oxygen entering the reservoir bag beneath it. The resuscitation team reported seeing the reservoir bag inflating, which led them to believe that oxygen was being delivered to the patient. However, after approximately 10 minutes of CPR, it was recognised that the reservoir bag was no longer inflating between breaths. The resuscitation team interpreted this as an indication that the patient was not receiving supplementary oxygen.

Reservoir bag is an unreliable visual indicator of flow in the system

4.3.5 There is no unambiguous indication that oxygen is flowing to the patient. Although much of the equipment is transparent, oxygen is a colourless gas. Inflation of the reservoir bag is a visual cue, but it is an unreliable indication of oxygen flow into the system, which will vary depending on the rate of inflation and the integrity of the seal between the mask and the patient’s face. The only visual cue that oxygen is not being delivered might be clinical signs, such as cyanosis (bluish cast to the skin) or pulse oximetry readings[4].

4.3.6 The flow of oxygen can be felt or heard if the oxygen tubing is disconnected and held close to the ear or skin. However, in a highly energised situation such as a resuscitation attempt, this would be time consuming and the sound made by the gas flow might not be heard above other ambient noise.

4.3.7 Sight is the dominant human sense for processing information and will often override conflicting evidence from other senses. The lack of a reliable visual cue within the bag-valve-mask or the portable oxygen system introduces risk.

4.4 Contributory Factor 3: Release of residual oxygen may give a false impression of continuous flow

4.4.1 Depending on the steps taken to close the oxygen supply from the cylinder, residual oxygen can become trapped within the pressure regulator (Fig 6). If the valve is closed first, residual oxygen is released. However, if the flow selector is closed first, followed by the valve, residual oxygen is trapped.

4.4.2 If oxygen becomes trapped within the pressure regulator, and then released during the next use, the short-duration release of residual oxygen may be sufficient to partially inflate the reservoir bag, despite the valve being closed. Cylinders with integral valves may release a smaller amount of oxygen, as they typically have a smaller space between the flow selector and the gauge (Fig 7).

4.4.3 If the flow rate is selected without opening the valve, the amount of residual oxygen in standard valve cylinders may be enough to partially inflate a reservoir bag when using a full oxygen cylinder[5]. This was tested by the investigation team and was observed to be a sufficiently compelling visual cue that oxygen is being delivered. The release of residual oxygen also produces an audible hiss, providing a false cue that oxygen is continuously being delivered from the cylinder. Although these cues were only evident for about two seconds when full flow (15 litres per minute) was selected, this is likely to be sufficient to lead users to believe that oxygen is being delivered before they move on to their next task (i.e. focusing on resuscitating the patient).

4.5 Contributory Factor 4. Variability in valve configuration after use introduces risk

4.5.1 National guidance (O’Driscoll, 2017) recommends that cylinders “must be turned off/fully closed” when not in use. This is to reduce the potential for a leak, which would create an oxygen-rich environment and increase the risk of fire, and deplete the contents of the cylinder. However, informal reports from other Trusts revealed that this rule is not always complied with. In most cases, valves are left open, particularly on cylinders with integral valves. Such workarounds or deviations from standard procedures are not uncommon when workflow hindrances are ‘fixed’ using shortcuts to enable staff to achieve a goal more easily. The presence of workarounds is often an indication of a workflow design problem (Carayon, 2007). During a visit to the Trust involved in the reference event, the HSIB investigation team conducted a short audit of 10 standard valve cylinders on resuscitation trolleys across six care areas (Table 1). Variation was found in the configuration/residual state of standard valve cylinders both between and within care areas.

4.5.2 With regards to variability between wards, Table 1 shows that while valves were left open and regulators pressurised in medical wards, in the frailty assessment wards the valves were closed. In both cases the gauges showed positive readings, indicating the contents of the cylinder at the end of the previous use.

4.5.3 With regards to variability within wards, in one cardiology ward the investigation team found two resuscitation trolley cylinders, both with valves closed. However, only one cylinder’s pressure regulator had been purged of residual oxygen, meaning that one gauge displayed the cylinder as being empty, while the gauge on the second cylinder displayed the contents of the cylinder at the end of the last use.

4.5.4 Variability in the configuration of the cylinder valve after use may introduce unnecessary risk, particularly if clinical staff move between wards that adopt different practices.

4.6 Contributory Factor 5: Lack of clear visual indicator that valve is open or closed

4.6.1 There are no clear visual indicators that a cylinder valve is open or closed (Fig 8). Without a clear visual indicator, it is possible that a user might confuse the open and closed states.

Fig 8 Opening a standard valve

Top: to open the valve, the user must attach the key to the valve and turn it to the left. Middle: Directions on the valve show which way the key must be turned to open/close it, however, they become unclear after multiple uses. Bottom: Directions are covered with a plastic coating prior to first use.

4.6.2 The lack of a visual indicator of the valve state may be compounded by the fact that the direction in which a user must turn the control differs depending on whether they are opening the valve or increasing the flow. The valve must be turned anticlockwise to open; the flow selector is turned clockwise to increase the flow. Turning two different knobs in two different directions to successfully operate the equipment has the potential to cause confusion.

4.7 Incidental Finding 1: Integral valve design does not offer a clear indicator of current state of the valve

4.7.1 A second event referred to the HSIB concerned the safe delivery of portable oxygen using an integral valve cylinder. This second event provides some evidence that users can be confused regarding the operation of integral valves (Fig 9).

Instructions on the knob show which way to turn it to open or close the valve. However, these instructions are covered by the user’s hand when turning the knob. In addition, it is not clear what current state the valve is in. In this picture the valve is open.

4.7.2 The evidence cited in the local Trust investigation suggested that during an attempt to start oxygen flow to a patient whose condition was deteriorating, a nurse and a porter recalled the oxygen cylinder valve as being tight. Although it is impossible to determine exactly why the valve was perceived to be tight (or whether it was in fact tight), it is possible that both users were attempting to turn the valve the wrong way, and the design of the valve provided insufficient guidance. For example, the text that shows which way the user should turn the valve to open or close it is covered by the user’s hand when in use, and there is no final ‘state’ feedback once the valve is fully open or closed.

4.7.3 Other valve designs exist that make it easier to see whether the valve is open or closed (Fig 10).

4.7.4 When an oxygen cylinder is found to be faulty, the system is sent back to the oxygen manufacturer to evaluate. Academic research (Flewwelling, et al., 2014) suggests that it is not uncommon for reviewers to find an absence of issues or ‘No Fault Found’ for equipment that has been sent for repair. The literature also suggests that such No Fault Found reporting is illustrative of latent usability design faults, that is, product design features that lead a user to an undesirable outcome.

4.7.5 The HSIB conducted a review of complaint data supplied by a leading oxygen manufacturer covering the period July 2017 to June 2018. Although there were only a small number of complaints compared to the number of cylinders supplied (approximately 0.03% across the healthcare sector in the UK), No Fault Found was the second most common output of the manufacturers investigation. For approximately 21% of all complaints, the manufacturer was unable to find a fault in the equipment.

4.7.6 Of the 240 complaints that resulted in No Fault Found, 94 were related to the use of a valve, 84 of which related specifically to cylinders with integral valves.

4.8 Incidental Finding 2: The valve cover on an integral valve cylinder is not easily distinguished from the tamper proof seal

4.8.1 The ‘head’ on integral valve cylinders available from a leading oxygen manufacturer has three components that are covered by a grey plastic seal (Fig 11); 1) a cover for the valve that must be removed to gain access to the valve to turn the cylinder on, 2) a hinged cover to protect an oxygen-coded quick access Schrader outlet, and 3) a grey tamper proof seal with a batch label that covers a refill port. The latter is only for use by the oxygen manufacturer when refilling the cylinder; the other grey covers are used by frontline staff.

1 Valve cover must be removed to gain access to the valve.

2 Schrader quick access outlet.

3 Refill port (tamper proof seal, not to be removed).

4.8.2 The similarities between the three covers, together with an absence of visual clues as to how to operate the equipment, provide scope for confusion for users who are not familiar with the operation of the integral valve. The flow selector has no cover, which could lead a user to deduce that oxygen flow is provided by turning the selector rather than removing the grey cover to operate the valve, especially as there is no visual indicator provided to confirm that oxygen is flowing.

4.9 Incidental Finding 3: No piped (wall) oxygen available in the patient bay

4.9.1 Upon admission to the ward, the patient involved in the reference event was positioned in bed D4 (Fig 12).

Fig 12 Plan view of the diabetes and endocrinology ward

4.9.2 Only one bay in the five-bay ward had all beds supplied by piped medical gases at the patient bedside (bay B). Bay E had the least access to piped oxygen; this bay was not in use.

4.9.3 The location in which the patient was placed meant that piped oxygen was only available from an additional flowmeter provided at the neighbouring bed (D5, Fig 12). See Fig 13 for an image of the double flowmeter available at the neighbouring bedside.

A double flowmeter enables oxygen to be delivered to a patient in a neighbouring bed, via extended tubing, where piped wall oxygen is not available.

4.9.4 Many factors may have contributed to the decision to place the patient in a bay without piped oxygen. Firstly, during the time spent on the ward, the patient did not require oxygen therapy. As such, the lack of piped oxygen available directly in the patient bay was deemed to be a low risk, and an extension was available should oxygen therapy be required. However, although the extension was available during the resuscitation attempt it was not used. Secondly, bay E was closed and with both male and female patients on the ward, it was likely that the number of available beds was limited due to the requirement for single-sex bays.

4.9.5 The reasons why all patient bays were not served with piped oxygen was unclear. During an interview with the Trust’s Estates team it was learned that the ward was refurbished over 20 years ago. Ward layouts change over time for a variety of reasons, including the need to accommodate more beds, so it is possible that the capacity on the ward was increased and the original medical gas piping was not adapted. However, the Estates team was only able to speculate that this may have been the case.

4.9.6. The Estates team noted that while it would be possible to improve the current infrastructure to ensure that pipeline oxygen was available at every bed, this would involve significant cost and disruption to services.

5.1 Lines of enquiry

5.1.1 Based on the design risks identified in the analysis of the reference event, the wider investigation focused on:

• reviewing how the design of portable oxygen systems is regulated by the Medicines and Healthcare products Regulatory Agency (MHRA)
• reviewing the design of portable oxygen systems used in other industries to determine if there are appropriate lessons for healthcare

5.2 Overview of the regulation of portable oxygen systems

5.2.1 The production of a portable oxygen system is a complex process, involving multiple manufacturers, various divisions of regulation (including both medical devices and pharmaceuticals) and international standards for manufacturing.

5.2.2 The regulation of portable oxygen systems can be divided into two parts:

1 Pre-market approval. This is a process that manufacturers must follow to enable them to license their product for sale on the market within the UK.

2 Post-market surveillance. Once a product is released on the market, manufacturers must monitor the safety of their product while it is in use by gathering and analysing safety information. Information must be collected and analysed about serious incidents and trends must be reported to the relevant Competent Authority (the MHRA in the UK). The process that manufacturers must follow differs depending on whether the product is a medical device or a medicinal product (medicine).

5.2.3 The MHRA is the Designating Authority for UK Notified Bodies. It is also the Competent Authority overseeing both pre-market assessments and post-market surveillance for medicinal products, medical devices, and blood components for transfusion in the UK. Competent authorities must enforce several European Union (EU) directives and regulations related to medical devices and medicinal products.

5.2.4 The MHRA ensures compliance with regulations through the provision of advice and guidance, audits of UK Notified Bodies and a market surveillance programme to determine levels of compliance.

5.3 Pre-market approval

5.3.1 Pre-market approval is a process of scientific and regulatory review to evaluate the safety and efficacy or usefulness of medicinal products and medical devices prior to releasing them on the market.

5.3.2 The pre-market approval process for portable oxygen systems varies according to the component under review. For example, the therapeutically active component (oxygen) is regulated as a medicine, but pressure regulators and flow selectors are regulated as medical devices. Fig 14 provides an overview of the various standards and directives that apply to both standard valve and integral valve cylinders. More detail is provided in the following sections.

Oxygen

5.3.3 Oxygen manufacturers must apply for a licence for oxygen to be used as a compressed gas within a cylinder. The requirements and procedures for marketing authorisation, as well as the rules for monitoring authorised products (pharmacovigilance[6]) are primarily outlined in Directive 2001/83/EC (European Parliament, 2001) and in Regulation (EC) No 726/2004 (European parliament, 2004). The applicant must demonstrate conformance with the requirements set out in this EU legislation, which includes submitting a dossier demonstrating the quality of the medicinal product and that its manufacture, distribution and supply meet required safety and quality standards. Once the MHRA is satisfied that the medicine is acceptably safe, it is given a marketing authorisation (product licence). The manufacturer is then able to market its product within the UK.

Valve

5.3.4 Standard cylinder valves are not classed as medical devices. However, as valves form the seal for the oxygen container (a transportable piece of pressurised equipment), valve manufacturers must demonstrate compliance with the Essential Requirements as outlined in the Transportable Pressure Equipment Directive (TPED) (European Parliament, 2010). Similarly, to demonstrate conformity with health, safety, and environmental protection standards for products sold within the European Economic Area, cylinder valves must be CE marked to TPED, but do not require a review by a Notified Body (see below). A CE mark indicates conformity with the requirements of applicable European directives. The international standard ISO 10297: 2014 specifies design, testing and marking requirements for cylinder valves.

5.3.5 In contrast, because integral valves combine the valve, pressure regulator, and flow selector into the cylinder head, they are regulated as a medical device.

Gas cylinder

5.3.6 Cylinders are the casing for the medicinal product (oxygen). Cylinders must be CE marked to TPED to indicate conformity to other European standards, not within the remit of the MHRA. They do not require a review by a Notified Body (see below) since they are not regulated as medical devices.

Pressure regulators and flow selectors

5.3.7 Pressure regulators and flow selectors are designated as medical devices because they are designed to operate at very high pressures that pose a higher risk of harm. This designation is the same regardless of whether the device is added on to a standard valve or built into the integral valve ‘head’.

EU medical device regulations

5.3.8 Prior to 2017, to legally place a device on the European market, medical device manufacturers were required to demonstrate that they met the requirements of the Medical Devices Directive (MDD) (European Parliament, 2007).

5.3.9 The MDD was first introduced in 1993 (Official Journal of the European Communities, 1993). Since then, the Directive has gone through several revisions, most recently in 2007, before becoming the Medical Device Regulation (MDR) in 2017 (European Parliament, 2017). The most recent revision was introduced as a regulation instead of a directive to impose clear and detailed rules to reduce the potential for different interpretations of the document by member states. To demonstrate compliance with the MDR, medical device manufacturers must update their technical documentation and processes before the MDR becomes a requirement in May 2020.

5.3.10 Products conforming with the MDR must have a CE mark applied, which indicates that the device meets the relevant regulatory requirements and, when used as intended, works properly and is acceptably safe. A medical device cannot be marketed in Europe without carrying a CE mark.

5.3.11 The MDR (and the MDD) covers a vast range of products from first-aid bandages to CT scanners. It is not reasonable to subject all devices to the same levels of assessment. The level of assessment is matched to the degree of risk inherent in the device. This is judged based on several factors, including whether the intended purpose of the device (as assigned by the manufacturer) is invasive, implantable or active, and how long the device is intended to be in continuous use.

5.3.12 Medical devices are grouped into four classes, as follows:

• Class I, Is and Im[7] – low risk (e.g. unmedicated bandages, conductive gels, corrective glasses)
• Class IIa – low to medium risk (e.g. short-term corrective contact lenses, diagnostic ultrasound)
• Class IIb – medium to high risk (e.g. flow selectors, infusion pumps, ventilators)
• Class III – high risk (e.g. implants, spinal needles)

5.3.13 Oxygen cylinder regulators and flow selectors are classified as Class IIb devices because they are designed to operate at very high gas pressures that pose a higher risk of harm. This is in accordance with Rule 12 (European Parliament, 2017), which states:

“All active devices intended to administer and/or remove medicinal products, body liquids or other substances to or from the body are classified as class IIa, unless this is done in a manner that is potentially hazardous, taking account of the nature of the substances involved, of the part of the body concerned and of the mode of application in which they are in classified as class IIb.”

5.3.14 The MDR differs from the MDD in several ways, including new classification rules for devices and requirements for conformity assessment. The classification of oxygen regulators and flow selectors remains the same (Class IIb).

5.3.15 For all but Class I devices, conformity with the MDR must be verified by an independent certification body called a Notified Body before the CE marking can be affixed. This contrasts with the licensing process for medicines in which all applications are reviewed by the MHRA.

Notified Bodies

5.3.16 A Notified Body is an organisation designated by an EU Designating Authority to assess the conformity of products before they are placed on the market. The MHRA is responsible for appointing Notified Bodies in the UK.

5.3.17 The remit of Notified Bodies is that they can only review Class Is, Class Im, Class IIa, Class IIb and Class III devices. Class I devices are under the remit of the Competent Authority in each European country. There are approximately 60 Notified Bodies across Europe; of these, three are located within the UK.

5.3.19 Notified Bodies review conformity against the directions outlined in the MDD/MDR. All medical device manufacturers must comply with the Essential Requirements outlined in Annex I. Annexes II to VII outline different types of conformity assessments that manufacturers can follow. The classification of the medical device will determine the different conformity assessment routes that the manufacturer can follow. All conformity assessments require the manufacturer to submit technical documentation about the device, that shows how the device conforms to the Essential Requirements outlined in Annex I to ensure adequate safety and performance. The main difference between the six conformity assessment options is the quality management system requirements. Manufacturers of oxygen cylinder regulators and flow selectors must conform with Annex II – Full Quality Assurance. When assessing compliance with Annex II, Notified Bodies must review the manufacturer’s entire quality management system including design and manufacturing components, in addition to a final inspection. This contrasts with Annex V, for example, which stipulates that Notified Bodies must only review the manufacturing aspects of the quality management system only.

5.3.20 The new MDR strengthens the position of Notified Bodies in relation to manufacturers, with Notified Bodies being granted the power to conduct physical or laboratory tests on devices.

MHRA oversight of Notified Bodies

5.3.21 The MHRA monitors UK Notified Bodies by undertaking regular audits and by witnessing their compliance assessment of manufacturers. Depending on the size of the Notified Body, audits occur between every nine months to one year.

5.3.22 The purpose of an MHRA audit is to determine whether the Notified Body meets the requirements outlined in Annex VII of the MDD, ‘Requirements to be met by Notified Bodies’. The audit ensures that the Notified Body has the required legal status and organisation structure, meets the process requirements for quality management, and that Notified Body personnel are suitably qualified to conduct reviews and/or audits of manufacturers.

5.3.23 With regards to the competence of Notified Bodies’ personnel, the MDD specifies that:

“The personnel responsible for carrying out product-related reviews (product reviewers), such as technical documentation reviews or type examination … shall have all of the following proven qualifications:

• Successful completion of a university or a technical college degree or equivalent qualification in relevant studies, e.g., medicine, pharmacy, engineering or other relevant sciences;
• Four years’ professional experience in the field of healthcare products or related activities, such as in manufacturing, auditing, or research, of which two years shall be in the design, manufacture, testing or use of the device or technology to be assessed or related to the scientific aspects to be assessed;
• Knowledge of device legislation, including the general safety and performance requirements set out in Annex I; …
• Appropriate knowledge and experience of risk management and related device standards and guidance documents; …”

Applying Human Factors evaluation to the regulation of medical devices

5.3.24 According to the International Ergonomics Association, Human Factors (also known as ergonomics) is:

“… the scientific discipline concerned with the understanding of interactions among humans and other elements of the system, and the profession that applies theory, principles, data and methods to design in order to optimise human well-being and overall system performance.” (International Ergonomics Association, n.d.)

5.3.25 Many medical devices are used for critical patient monitoring or delivering therapy. The potential for use errors leading to patient harm have progressively become a main cause for concern. The cause of such errors can be traced to poorly designed user interfaces, particularly where a more complex user system is involved. Medical devices have become more diverse in their capabilities and are used in environments that are frequently busy and full of distractions. This is relevant to current developments in the design of portable oxygen systems, which are becoming increasingly complex with the introduction of new valves that include digital displays and several alarms to alert the user to different states of the system.

5.3.26 As the healthcare workforce becomes more transient and use of temporary staff continues to rise, the likelihood that staff are unfamiliar with some of the devices they are required to use increases. Under these circumstances, good design informed by Human Factors becomes important. In addition, as patient care evolves and is transferred to homes or public environments, less skilled or even unskilled users, including patients and carers will be using complex devices.

5.3.27 Applying Human Factors to the design and development of medical devices is thus of great importance to ensure safe and effective use of medical devices. Without this, the completion of tasks may be slower and more error prone.

5.3.28 The 2007 version of the MDD includes specific requirements regarding the inclusion of Human Factors (ergonomics) into the design process for medical devices. This was an amendment made to the previous version published in 2001 (European Parliament, 2001). Specifically, Essential Requirement I in Annex I (the annex that applies to all devices) was amended to note that manufacturers:

“[should reduce] as far as possible, the risk of use error due to the ergonomic features of the device and the environment in which the device is intended to be used.”

5.3.29 In addition, the more recently published MDR further mandates the need to incorporate Human Factors. For example, Chapter 1 of Annex 1 of the Regulation outlines the risk management processes required of manufacturers throughout the lifecycle of their medical devices. It explicitly states that manufacturers:

“[must document] the results and critical analysis of all verifications and validation tests and/or studies undertaken to demonstrate conformity of the device with the requirements of this Regulation.”

5.3.30 Although the requirements included in the MDD and MDR explicitly state the important role of Human Factors, they do not clearly define how Human Factors should be incorporated into the medical device design and development process (i.e. what methods manufacturers are expected to use).

5.3.31 In September 2017 the MHRA published its first guidance document on Human Factors and usability engineering (MHRA, 2017) to clarify the regulatory expectations with regards to the role of Human Factors in the design of medical devices marketed in the UK. The document was aimed at manufacturers of all device classes, developers of medical devices and drug-combination products and Notified Bodies responsible for assuring the quality of devices.

5.3.32 The guidance developed by the MHRA in collaboration with key stakeholders (such as academia, industry, NHSI, the National Institute for Health and Care Excellence, and Notified Bodies), highlights the important influence of design on patient safety and provides a guide for manufacturers on how to incorporate Human Factors methods into their design process. The guidance suggests that manufacturers should subject their devices to formative usability testing during the development stages of their design process. This testing helps to inform device design in an iterative fashion by identifying use-related risk and whether design mitigations are effective. According to the guidance, formative testing should be followed by a final summative test to demonstrate that intended users can perform representative tasks with the device under expected use conditions without serious use errors or problems.

5.3.33 The MHRA’s guidance is in line with the Food and Drug Administration’s (FDA) Applying Human Factors and Usability Engineering to Medical Devices guidance document (FDA, 2016). The FDA is a federal agency of the United States Department of Health and Human Services that, like the MHRA in the UK, is the regulator for medical devices, medicines and several other products (including tobacco products and cosmetics) within the United States. The FDA published its original guidance as a draft in 2010 and finalised the document in 2016.

5.3.34 The MHRA and FDA guidance documents apply both to new products being introduced to the market and to design changes made to existing products on the market. The guidance does not apply to medical devices (such as pressure regulators and flow selectors) that are already available on the market. However, if a manufacturer makes a design change and/or intends to release a new product, it should demonstrate how it has incorporated the guidance as part of its submission to a Notified Body.

5.3.35 Although the MHRA’s publication suggests that a usability engineering process should be applied by device manufacturers in both the pre-market and post-market surveillance phases, the document is not a compliance requirement, it is simply guidance. Alternative approaches to demonstrating safe and effective use can be proposed by manufacturers. In addition, although the MHRA’s guidance highlights relevant harmonised standards[8] that focus on Human Factors integration into the product design process (IEC 62366-1, 2015) (IEC/TR 62366-2, 2016), these standards are also not compulsory, and manufacturers can use other methods for demonstrating conformance with the Essential Requirements of the MDD/MDR.

Notified Bodies and Human Factors

5.3.36 It is the responsibility of Notified Bodies to review documentation submitted by manufacturers for pre-market approval (this contrasts with the pre-market requirements for medicines in which the MHRA reviews the dossiers submitted by medicine manufacturers). The MHRA’s Human Factors guidance was drafted with the specific aim of clarifying Human Factors requirements to help Notified Bodies to assure the quality of devices. However, the investigation learned through interviews with Notified Bodies and independent consultants that Notified Bodies do not always assess conformance with the guidance outlined by the MHRA.

5.3.37 There are various guidelines that Notified Bodies must assess conformity against, including those set by the EU in addition to guidelines that individual competent authorities might develop. A single harmonised document does not exist. The only legal requirement is that manufacturers meet the Essential Requirements of Annex I of the MDD/MDR. Everything else is guidance. However, although aspects of the Essential Requirements in Annex I cover ‘ergonomic features’ of devices as described above, the requirement is non-specific and as such open to interpretation. It thus leaves open the potential that medical devices can be approved for CE marking without sufficient testing with end users, both during the design phase as well as in a summative fashion.

5.3.38 Personnel employed by Notified Bodies are required to have knowledge of the performance requirements set out in Annex I (Essential Requirements), which makes two references to reducing risk related to ergonomic features. However, there is no specific mention of requirements for product reviewers to have competencies in Human Factors. The MHRA noted that training plans, including the procedures in place to ensure that personnel maintain their competencies, are reviewed as part of their regular audits, but reference to Human Factors competencies is not an explicit part of this. In addition, during correspondence with a Notified Body, the HSIB learned that while Notified Body reviewers might have some Human Factors knowledge, they are unlikely to specialise in this area of expertise.

5.3.39 As discussed above, in 2010, the FDA also published guidance on how to apply Human Factors and usability engineering to medical devices. However, regulation in the United States is different from that in the EU. For example, the FDA has an internal team of experts that includes Human Factors reviewers dedicated to assessing Human Factors elements of manufacturers’ design process. Notified Bodies are not required in the United States. This gives the FDA greater oversight of medical devices currently under review.

5.3.40 In summary, incorporating Human Factors in the design and development process for medical devices is important, yet evidence suggests that the guidance document provided by the MHRA is currently not being followed (although it is not a requirement).

HSIB makes the following Safety Recommendation:

HSIB makes the following Safety Observation:

Observation 1:

Staff working within Notified Bodies should have relevant competencies to review Human Factors Engineering reports submitted during the pre-market approval process.

Differences in regulation of standard and integral valves

5.3.41 As described earlier, CE marked regulators and flow selectors for use on standard valve cylinders are procured as separate (add-on) devices at hospital level to create a complete system. In contrast, CE marked integral cylinder ‘heads’ (including valve, pressure regulator and flow selectors) are attached (on behalf of the oxygen company) to cylinders following a Pi marked process[9].

5.3.42 Oxygen manufacturers finalise the manufacturing process by adding additional packaging requirements such as instructions for use, fill the cylinder with gas and market the product as a complete package. While the cylinder head has been separately CE marked by a Notified Body and approved as a medical device, the integral system is regulated as a ‘drug-device combination’ or a ‘pharmaceutical package’. Therefore, oxygen manufacturers must apply for a licensing authorisation through the medicines licensing division of the MHRA to market their integral valve cylinders within the UK.

5.3.43 This process is similar for other medical devices that are sold pre-filled. For example, a syringe is classed as a medical device, yet a pre-filled syringe is classified differently. Although the empty syringe itself must be CE marked, the complete package, including syringe, pre-filled medication and any additional labelling, is classed as a pharmaceutical package. Inhalers also fall into this similar area in which drug-device combination products are regulated as medicines and not medical devices.

5.3.44 Subsequent additions made to the complete system, for example, the addition of instructions for use and/or labels, might pose problems for device usability, and, as a result, problems for patient safety. However, such materials might not be reviewed from a usability perspective as part of the application for licence authorisation.

HSIB makes the following Safety Recommendation:

5.4 Post-market surveillance: Medical devices

5.4.1 In paragraph 60 of Article 2, ‘Definitions’, the MDR states:

“… ‘post-market surveillance’ means all activities carried out by manufacturers … to proactively collect and review experience gained from devices they place on the market … for the purpose of identifying any need to immediately apply any necessary corrective or preventive actions.”

5.4.2 The post-market surveillance system should enable manufacturers to monitor the ongoing safety and usability of their devices and react to issues that are brought to their attention through their own reporting system or through the MHRA’s Yellow Card reporting system.

Yellow Card reporting system

5.4.3 The MHRA’s Yellow Card system collects information submitted by members of the public, as well as healthcare, industry and other professionals, regarding suspected problems or incidents involving both medicines and medical devices. The MHRA also has a data sharing agreement with NHSI. The agreement allows NHSI to send data from the National Reporting and Learning System (NRLS) to the MHRA about incidents involving medical devices and medicines that might not have been reported through the Yellow Card system. To comply with data protection regulations, the MHRA does not pass on wholesale information to manufacturers unless it has consent from the patient to forward their details to the manufacturer.

5.4.4 Unlike other similar reporting systems, such as the FDA’s MAUDE (Manufacturer and User Facility Device Experience) system, the information regarding medical devices submitted through the Yellow Card system remains confidential. In contrast, medicines information is summarised and made available through the MHRA Yellow Card website (see section 5.6).

5.4.5 To inform this investigation, the HSIB requested data from the MHRA devices division regarding incidents reported through the Yellow Card system specifically relating to oxygen. The MHRA provided an overview of reports that mention a cylinder and/or cylinder component potentially being the ‘root cause’ of a reported problem. From 2006 to October 2018, when the HSIB received the data, there were a total of 174 reported incidents. Twenty-four of the reports were categorised as ‘use error’, five were categorised as ‘mechanical jam’, 16 reports noted ‘no flow’, one was categorised as ‘no flow’ and ‘mechanical jam’, and 27 were categorised as ‘other’. Additional categories included ‘markings issue’ with the instructions for use, and ‘fire’, with the most frequently reported issue being a leak.

5.4.6 Although the investigation found it difficult to use the overview data provided by the MHRA to draw conclusions regarding the types of issues Trusts experience when using portable oxygen systems, it is clear that the number of reports made through the Yellow Card system (provided over a 12-year period) is significantly lower than the number of incidents being reported through the NRLS (400+ over a three-year period) (NHS Improvement, 2018).

Manufacturer’s reporting system

5.4.7 The manufacturer’s vigilance system is reviewed by Notified Bodies during pre-market assessment. The new MDR specifies that serious incidents must be reported to the Competent Authority (i.e. the MHRA in the UK) within 15 days; death or any unanticipated serious health deterioration must be reported within 10 days; for serious public health threats the timeframe is limited to two days. Timelines were not explicitly outlined in previous iterations of the MDD.

5.4.8 Non-serious events directly reported to the manufacturer do not have to be reported to the MHRA. They become reportable if there is an aggregate suggesting a statistically significant increase in the number of non-reportable events. For Yellow Card reports forwarded by the MHRA to manufacturers only, the manufacturer is asked to evaluate whether that event is reportable and provide a justification.

5.4.9 The MDR requires manufacturers to investigate serious incidents and, where appropriate, act to eliminate, or reduce the risk of, the hazards identified. There is little guidance provided on how to effectively investigate serious incidents. In paragraph 1 of Article 89 ‘Analysis of Serious Incidents and Field Safety Corrective Actions’, the MDR states:

“… following the reporting of a serious incident … the manufacturer shall, without delay, perform the necessary investigations in relation to the serious incident and the devices concerned. This shall include a risk assessment of the incident and field safety corrective action.”

5.4.10 While providing limited guidance on how to investigate serious incidents allows manufacturers to be flexible in their approach, it also opens the possibility that important factors, such as usability issues, might be overlooked as part of the investigation. Overlooking design as an issue is highlighted in the types of risk mitigation strategies adopted by manufacturers and approved by the MHRA (see section 5.5. for more evidence).

HSIB makes the following Safety Recommendation:

HSIB makes the following Safety Observation

5.5 Evaluating the risks arising from serious incident reports

5.5.1 With regards to the role of the MHRA, paragraph 3 of Article 89 in the MDR states:

“… the competent authority shall evaluate the risks arising from the reported serious incident and evaluate any related field safety corrective actions, taking into account the protection of public health and criteria such as causality, detectability and probability of recurrence of the problem, frequency of the use of the device, probability of occurrence of direct or indirect harm, the severity of that harm, the clinical benefit of the device, intended and potential users, and population affected. The competent authority shall also evaluate the adequacy of the field safety corrective action.”

5.5.2 It is thus up to experts within the relevant Competent Authority (i.e. MHRA in the UK) to approve or reject the corrective actions outlined by manufacturers. There is little guidance within the MDR with regards to what an effective corrective action looks like; however, the international standard ISO 14971 – Medical devices: Application of risk management to medical devices (ISO 14971, 2007) outlines a hierarchy of risk controls that manufacturers can follow to reduce risk when making corrective actions. According to ISO 14971, risk controls should be focused on the specific design features first according to the following hierarchy:

1 inherent safety by design (high).

2 protective measures in the actual medical device and/or manufacturing process (medium).

3 information for safety, such as labelling and instructions for use (low).

5.5.3 The HSIB investigation team conducted a short review of recently published alerts to determine what risk controls are used to mitigate known usability issues.

Review of post-market surveillance alerts for medical devices

5.5.4 A Field Safety Corrective Action (FSCA) is the action that a medical device manufacturer takes to reduce the risk of death and serious deterioration of health associated with the use of devices already on the market.

5.5.5 All FSCAs must be distributed to the competent authorities in the member states where the device is marketed as well as the Competent Authority where the manufacturer is located. This information is published on the MHRA’s website in the form of a Field Safety Notification (FSN). The manufacturer is obliged to send the FSN to all customers, not just NHS Trusts. This might include independent hospitals, pharmacies, GP surgeries and others.

5.5.6 The MHRA also publishes Medical Device Alerts (MDA); MDAs are in addition to FSNs issued by manufacturers. The MDAs are distributed to Trusts via email through the NHS’s Central Alerting System (CAS), an email system for issuing patient safety alerts, important public health messages, other safety-critical information and guidance to the NHS and others, including independent providers of health and social care. The MDAs do not necessarily cover the most serious issues, but instead are created to raise awareness of issues that manufacturers have struggled to engage with Trusts on independently.

5.5.7 There are many patient safety related messages, instructions, guidance documents, clinical and managerial standards, letters, frameworks and other forms of communication directed at healthcare providers through the CAS system. Information provided include NHSI Patient Safety Alerts and Estates Alerts, MHRA Dear Doctor letters, Medical Device Alerts and Drug Alerts, Chief Medical Officer Alerts and Department of Health and Social Care (DHSC) Supply Disruption alerts. The investigation identified that healthcare providers are often unable to determine the relative importance of some of the notifications. The NHS Director of Patient Safety was recently asked to lead the development of systems to ensure the NHS can clearly recognise alerts requiring action to protect patients from the most serious risks, regardless of which safety body issues them (Health Service Journal, 2018). The work is being taken forward through a new National Patient Safety Alert Committee (NaPSAC) that will agree common standards, thresholds, and formats for National Patient Safety Alerts issued by bodies including the Chief Medical Officer, DHSC Supply Disruption, the MHRA, NHS Digital, NHS England, NHS Improvement Estates & Facilities, NHS Improvement Patient Safety, and Public Health England.

5.5.8 To understand the types of incidents published in alerts the HSIB investigation team reviewed all FSNs published on the MHRA’s website from 4 to 15 June 2018 (34 in total), and all MDAs published on the MHRA’s website from 1 January to 21 June 2018 (20 in total). Most of the notifications included manufacturing, mechanical, software or supply issues (approximately 95% of MDAs and 90% of FSNs reviewed). The risks varied; examples of common risks included compromised sterility due to inappropriate or damaged packaging, and potential for false or delayed patient test results. Risks of this nature often lead to a manufacturing recall, repair, replacement of mechanical parts, or software updates. Risks and actions were similar in MDAs, 17 of which were directly related to issues identified in FSNs.

5.5.9 There were few examples of issues that related directly to the usability of devices. This is unlikely to be due to an absence of issues, since evidence suggests that poor design and lack of usability is pervasive within healthcare devices and directly facilitates medical error (Fairbanks & Caplan, 2004). Instead, the limited number of reports is likely to be due to an absence of reporting, weak reporting mechanisms, or potentially, usability issues not being perceived as serious enough to warrant a notification. Examples of issues that, from the information provided in the notification, appear to be usability issues, are presented in Table 2 alongside the actions required by manufacturers. The actions are compared against the three levels of risk controls as outlined in ISO 14971. In all the alerts reviewed, none of the manufacturers made design changes (the highest possible risk control) to their product. All four examples applied weak risk controls.

5.5.10 A further example of a ‘low’ effective risk mitigation (as defined by ISO 14971) can be found in the June 2018 update of NHSI’s January 2018 safety alert (NHS Improvement, 2018). In the update, it is noted that:

“Oxygen cylinder manufacturer BOC, will be printing a message on the tamper proof seal advising users that the plastic pull tag must be pulled and the cap removed before the cylinder is used … These modifications are being discussed with the MHRA.”

5.5.11 When deciding which risk control is most appropriate, manufacturers may consider time and cost. In cases where there has been a death (as was highlighted in NHSI’s 2018 alert) the aim can be to respond as quickly as possible, in which case, labels may appear to be an appropriate solution. Changing labels and instructions for use are typically the fastest way to respond to incidents. However, unless evidence suggests otherwise, such changes should only be made as part of an incremental approach, with a longer-term goal of improving the overall design of a product. Wider design issues should also be considered.

5.5.12 Additionally, the Trust that referred the reference event to HSIB wrote to its oxygen supplier to make it aware of the design issues associated with the use of integral cylinders (in particular, larger cylinders placed beneath patient beds). In the letter, the Trust states:

“Following a number of incidents within the XXX Trust relating to failed administration of oxygen, I [Deputy Chief Pharmacist] am writing to XXX in order to formally request review of the integral cylinder design … In order to safely administer oxygen to patients, staff are required to ensure that the cylinder is turned on, that the contents gauge displays sufficient gas, that the flow dial is set to the correct, prescribed rate and that tubing used is not kinked or disconnected. Due to the current cylinder design staff are unable to gain ready access (physically or visually) to all four parts of the cylinder in order to safely administer oxygen.”

5.5.13 An excerpt of the response letter from the oxygen manufacturer is as follows:

“Although there isn’t any current development scheduled for the redesign of this specific cylinder package type, I think it would be beneficial if we could arrange a convenient time in which we could meet with the Trust to understand your ideas and thoughts on future cylinder package design. As part of our meeting we can provide you with some reasoning to why the valve of the cylinder is designed the way it is … You may not be aware that we have just recently designed and launched a new oxygen cylinder package …”

5.5.14 Although the response from the manufacturer is positive, it highlights a reluctance to consider design as an issue.

HSIB makes the following Safety Recommendation:

5.6 Post-market surveillance: Medicines

5.6.1 The process described for medical devices (section 5.4) applies only to pressure regulators and flowmeters attached separately to standard valve cylinders. Integral valve cylinders are drug-device combination products, regulated as a medicine, and as such once on the market undergo a process of pharmacovigilance and not one of medical device vigilance.

5.6.2. Like medical device vigilance, the pharmacovigilance process receives input directly from manufacturers (manufacturers have a legal obligation to report any issues to the MHRA) as well as through reports submitted via the MHRA’s voluntary Yellow Card reporting system. Information regarding medicines submitted to the MHRA Yellow Card system is summarised and made publicly available in the form of interactive Drug Analysis Profiles (iDAPs). A profile exists for oxygen, although all reports focus on reactions to the medication. Such data is not available publicly for submissions regarding medical devices.

5.6.3 The MHRA described having a good working relationship and data sharing agreement with NHSI through which relevant data relating to medication errors from the National Reporting and Learning System is shared.

5.6.4 Alongside passive surveillance, manufacturers of newly licensed substances must submit periodic safety updates at various agreed intervals during the first five years post marketing, initially at six-month intervals, then increasing from six months to once a year up to the end of a five-year period, and at agreed longer intervals thereafter. The interval for periodic safety updates for oxygen is significantly longer since the product has been on the market for many years.

5.6.5 In the case of drug-device combination products, vigilance reports might be submitted to the MHRA via the medical device route or medicines route. This requires strong communication links between the separate arms of the MHRA. For oxygen this might involve contacting both valve manufacturers and oxygen manufacturers (a ‘grey area’ for post-market surveillance of portable oxygen systems in that the manufacturer marketing the drug-device combination product does not manufacturer the device).

HSIB makes the following Safety Observation:

5.7 Portable oxygen systems in other industries

5.7.1 Analysis of the reference event revealed that oxygen systems do not give clear and timely feedback that oxygen is flowing to the patient. This does not seem to be the case in other safety-critical industries, such as aviation.

5.7.2 Flow indicators are common in oxygen systems in other industries, and some solutions are available within healthcare internationally. Flow indicators usually consist of a lightweight object, or apparatus, that is moved by the oxygen stream (Fig 15) providing a quick visual verification that oxygen is flowing within the system.

Left: SureflO2 flow indicator in patient mask. Right: Fluid Power flow indicator in tubing.

5.7.3 Various designs of flow indicator are available; however, to the HSIB’s knowledge, they are currently not in use within the NHS, and there are no known oxygen flow indicator devices that are CE marked as a medical device[10]. The investigation found one empirical study demonstrating the potential for flow indicators to improve patient safety (Matusik & Smith, In press). However, standards do not exist outlining the design requirements for optimal effectiveness of flow indicators within healthcare. Multiple factors must be taken into consideration, including context, position of the indicator (i.e. within the tubing/mask), colour, compatibility with MRI and viability of working at different flow rates, in addition to cost.

HSIB makes the following Safety Observation:

5.8 Comments on procurement

5.8.1 Procurement in the NHS is complex. In most cases centralised procurement hubs such as the London Procurement Partnership or the North of England Commercial Procurement Partnership will create a ‘procurement framework’ to collate relevant information from all suppliers, including products available and cost. This information is then provided to individual Trusts to select a supplier that works best for their individual needs.

5.8.2 Unlike other products, choices of oxygen suppliers are limited. In addition, the procurement of oxygen is further complicated by the logistics surrounding the supply and maintenance of oxygen and its container. Changing oxygen systems is a complicated process, but not impossible.

5.8.3 Current procurement frameworks do not include information on the use-safety of oxygen packaging, that is, usability ratings/safe use scores are not included to help Trusts make an informed decision about the safest product to procure. Although safety and design should be reviewed at the regulatory level, there is also merit in conducting a comparative review at the procurement stage.

5.8.4 Evaluations of use safety prior to procurement may be achieved in multiple ways. For example, the procurement lead could consider using Human Factors methods (e.g. usability testing) to compare products, or request summative Human Factors reports from the manufacturer of the proposed product. Alternatively, centralised hubs for performing comparative usability studies of products for procurement could be created, and the outcome of the studies included in the final assessment. Such evaluations would not only provide details on the safest option, they would also advise Trusts on potential usability issues with a product prior to implementing it within their hospitals. As such, mitigation strategies to overcome known risks could be designed ahead of implementation, and in turn, potentially improve the likelihood of adoption of a new technology from frontline staff.

HSIB makes the following Safety Observation:

5.8.5 Market share plays a significant role in dictating the type of devices available for Trusts to procure. For example, some portable oxygen systems available for therapeutic use in patients’ homes, care homes and hospices differ significantly from those available within the healthcare sector. That is, in healthcare only ‘dual action’ portable oxygen systems are used (i.e. portable oxygen systems that are operated by opening a valve with one knob and then adjusting the flow rate with a second knob). In contrast, ‘single action’ portable oxygen systems are available within the homecare market, which is serviced by a wider array of suppliers.

5.8.6 Single action systems include only one knob to both open a valve and adjust flow (Fig 16). As such, they have the potential to overcome some of the risks highlighted in the incidental finding sections (4.7 and 4.8) regarding the lack of feedback on the current state of an integral valve (i.e. whether it is open or closed).

Design includes only one knob to both open the valve and adjust the flow rate.

HSIB makes the following Safety Observation:

6.1 Findings

• Portable oxygen systems currently used across the NHS in England do not provide clear and timely feedback that oxygen is flowing to the patient.
• There are various design issues with current portable oxygen systems that may lead users to interpret that oxygen is flowing when it is not.
• It is unclear how the MHRA’s Human Factors guidance document, published in 2017 (MHRA, 2017), is used in practice.
• Devices that contain a medicinal product (such as portable oxygen systems and pre-filled syringes) are regulated as medicines as defined in Article 1 (European Parliament, 2001), and not as medical devices.
• Evidence suggests that design changes, such as updating labelling and instructions for use, are most likely to be made following post-market adverse event investigations. These are weak solutions for preventing error but can be used to address an issue while long-term solutions are being sought.
• Products used in other industries might improve patient safety and the delivery of portable oxygen but are yet to be tested and implemented.
• Traditional NHS procurement processes thoroughly evaluate the utility and financial feasibility of products to be purchased. There is potential to reduce errors and improve effectiveness and user satisfaction if Human Factors evaluation methods are incorporated into procurement methodology.

6.2 Safety Recommendations

6.3 Safety Observations

6.4 Conclusions

6.4.1 Products available outside the healthcare market (such as flow indicators and single action systems) have been designed to make it easier for the user to avoid making mistakes. In contrast, evidence suggests that devices created for use by frontline healthcare practitioners do not appear to have undergone the same sort of design thinking.

6.4.2 There is an emphasis from industry on providing more detailed training for frontline staff as a mitigation strategy for overcoming the issues associated with the safe use of portable oxygen. Training is not a substitute for good design. The responsibility for ensuring the design of portable oxygen equipment is appropriate rests with the MHRA. Accordingly, recommendations made in this report are directed towards that organisation. Future HSIB investigations will look in detail at different parts of the healthcare system that can also help to address the risks highlighted in this investigation.

Australian Transport Safety Bureau. (2007). Analysis, causality and proof in safety investigations. Retrieved September 2018, from: https://www.atsb.gov.au/media/27767/ar2007053.pdf

Carayon, P. (2007). Handbook of Human factors and Ergonomics in Health care and Patient Safety. Mahwah: Lawrence Erlbraum Associates.

European Parliament. (2001). Directive 2001/104/EC of the European Parliament and of the Council of 7 December 2001 amending Council Directive 93/42/EEC concerning medical devices. Retrieved September 2018, from: https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32001L0104&from=en

European Parliament. (2001). Directive 2001/83/EC of the European Parliament and of the council of 6 November 2001 on the Community code relating to medicinal products for human use. Retrieved September 2018, from: https://ec.europa.eu/health/sites/health/files/files/eudralex/vol-1/dir_2001_83_consol_2012/dir_2001_83_cons_2012_en.pdf

European Parliament. (2004). Regulation (EC) No 726/2004 of the European Parliament and of the council of 31 March 2004 laying down Community procedures for the authorisation and supervision of medicinal products for human and veterinary use and establishing a European Medicines Agency. Retrieved September 2018, from: https://ec.europa.eu/health/sites/health/files/files/eudralex/vol-1/reg_2004_726/reg_2004_726_en.pdf

European Parliament. (2007). Directive 2007/47/EC of the European Parliament and of the Council of 5 September 2007 amending Council Directive 90/385/EEC on the approximation of the laws of the Member States relating to active implantable medical devices, Council Directive 93/42/EEC. Retrieved September 2018, from: https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:L:2007:247:0021:0055:en:PDF

European Parliament. (2010). Directive 2010/35/EU of the European Parliament and of the council of 16 June 2010 on transportable pressure equipment. Retrieved September 2018, from: https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32010L0035&from=EN

European Parliament. (2017). Regulation (EU) 2017/745 of the European Parliament and of the Council of 5 April 2017 on medical devices, amending Directive 2001/83/EC, Regulation (EC) No 178/2002 and Regulation (EC) No 1223/2009 and repealing Council Directives 90/385/EEC and 93/42/EE. Retrieved September 2018, from: https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32017R0745&from=EN

Fairbanks, R. J. & Caplan, M. S. (2004). Poor interface design and lack of usability testing facilitate medical error. The Joint Commission Journal on Quality and Safety, 30(10): 579-584.

Food and Drug Administration. (2016). Applying Human Factors and Usability Engineering to Medical Devices: Guidance for Industry and Food and Drug Administration Staff. Retrieved September 2018, from: https://www.fda.gov/downloads/MedicalDevices/DeviceRegulationandGuidance/GuidanceDocuments/ucm259760.pdf

Flewwelling, C. J., Easty, A. C., Vicente, K. J. & Cafazzo, J. A. (2014). The use of fault reporting of medical equipment to identify latent design flaws. Journal of Biomedical Informatics, 51: 80-85.

Health Service Journal. (2018). National patient safety alerts to be prioritised. Retrieved November 2018, from: https://www.hsj.co.uk/policy-and-regulation/national-patient-safety-alerts-to-be-prioritised-/7023081.article

IEC 62366-1: 2015. Medical devices -- Part 1: Application of usability engineering to medical devices. Retrieved September 2018, from: https://www.iso.org/standard/63179.html

IEC/TR 62366-2: 2016. Medical devices -- Part 2: Guidance on the application of usability engineering to medical devices. Retrieved September 2018, from: https://www.iso.org/standard/69126.html

International Ergonomics Association. (n.d.). Definitions and Domains of Ergonomics. Retrieved September 2018, from: https://www.iea.cc/whats/

ISO 14971: 2007. Medical devices -- Application of risk management to medical devices. Retrieved September 2018, from: https://www.iso.org/standard/38193.html

Manitoba Health, Seniors and Active Living. (2017). Failure to provide high flow oxygen during intra-facility transfer. Retrieved September 2018, from: https://www.gov.mb.ca/health/patientsafety/docs/psla39.pdf

Matusik, M. & Smith, P. D. (In press). A cross sectional study to ascertain the incidence and causes of failure of oxygen delivery via Hudson Mask during recovery after anaesthesia. Anaesthesia and Intensive Care.

Medicines and Healthcare products Regulatory Agency (MHRA). (2017). Human factors and Usability Engineering – Guidance for Medical Devices Including Drug-device Combination Products. Retrieved September 2018, from: https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/645862/HumanFactors_Medical-Devices_v1.0.pdf

National Patient Safety Agency. (2009). Rapid Response Report NPSA/2009/RRR2006. Oxygen safety in hospitals. Retrieved September 2018, from: https://www.sps.nhs.uk/wp-content/uploads/2011/08/RRR-Oxygen-safety-2009120092029_v1.pdf

NHS Improvement. (2016). Patient Safety Alert. Reducing the risk of oxygen tubing being connected to air flowmeters. Retrieved September 2018, from: https://improvement.nhs.uk/documents/408/Patient_Safety_Alert_-_Reducing_the_risk_of_oxygen_tubing_being_connected_to_a_bDUb2KY.pdf

NHS Improvement. (2018). Risk of death and severe harm from failure to obtain and continue flow from oxygen cylinders. Retrieved September 2018, from: https://improvement.nhs.uk/news-alerts/failure-to-obtain-and-continue-flow-from-oxygen-cylinders/

O’Driscoll, B. R. et al. (2017). BTS guideline for oxygen use in adults in healthcare and emergency settings. Thorax, 72(S1); i1-i89.

Official Journal of the European Communities. (1993). Council Directive 93/42/EEC of 14 June 1993 concerning medical devices OJ L 169 of 12 July 1993. Retrieved September 2018, from: https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:31993L0042&from=EN

Royal College of Anaesthetists. (2013). Fire safety on intensive care and in theatre. Retrieved September 2018, from: https://www.aagbi.org/sites/default/files/SALG-FIRE-SAFETY.PDF

The table shows cylinder capacity in minutes for medical gases in cylinders at various flow rates. The information is for BOC cylinders – other manufacturers label their cylinders differently.

We welcome feedback on our investigation reports. Please complete our online feedback form or email enquiries@hssib.org.uk.

We aim to provide a response to all correspondence within five working days.

This document, or parts of it, can be copied without specific permission providing that the source is duly acknowledged, the material is reproduced accurately, and it is not used in a derogatory manner or in a misleading context.