Compatibility and Safety Implications Associated with Interfacing Medical Devices in Neonatal Respiratory Care: A Case Example Using the Inhaled Nitric Oxide Delivery System

Introduction

Safety and regulatory standards for medical devices have evolved during recent decades.^1,2 The goal of these standards is 3-fold: (1) increased accountability; (2) assurance that the devices perform as the manufacturers intended; and (3) compliance with operational standards of international safety organizations such as the International Organization for Standardization (ISO), and regulatory requirements of the US Food and Drug Administration (FDA).^1,2 Importantly, these standards encompass devices that have been modified for unapproved uses, applying even when a medical device is interfaced or connected with another device or system that has not been tested and validated for this use.

The international Medical Device Single Audit Program (MDSAP) allows for a single regulatory audit of medical device manufacturers’ quality management systems that satisfies multiple regulatory authorities participating in the program (including those in Australia, Japan, Brazil, Canada, and the United States), and in some countries, MDSAP certification can serve as evidence for compliance with ISO standards.^3,4 The ISO is an independent, nongovernmental, international body with a membership of 164 national standard organizations. The ISO has developed standards (ISO 13485:2016) for quality management systems designed to provide manufacturing specifications for products, services, and systems to ensure their safety, efficacy, and quality. These standards also apply to connected medical devices to ensure that these devices consistently meet regulatory and customer requirements.¹ ISO 13485:2016 mandates that if the intended use of a medical device requires it to be connected or interfaced with other medical devices, a validation process must confirm that each device performs as it should and that all necessary requirements have been met when the devices are connected. This validation process must be completed before the device is released to the public.¹

The ISO standard places the full legal responsibility on the manufacturer to ensure that medical devices comply with regulations. Any person who modifies a device (without acting on the behalf of the original manufacturer) assumes the role of the manufacturer and the liability that goes with it.^1,5–7 Innovative solutions can sometimes be born of nonstandard use of routine medical equipment. However, if these solutions are not thoroughly and completely tested to the rigorous specifications of validation processes required by current regulatory authorities and safety standards, patients may be at serious risk of adverse consequences and health care providers may expose themselves to liability risks. In the United States, medical devices are classified by the FDA into 1 of 3 risk-based categories that determine the extent of regulatory control.⁸ Medical devices with low risk are assigned to the “class I” category, and those with moderate and high risk are assigned to “class II” and “class III”, respectively.

There are numerous potential reasons why health care providers modify medical devices. Device modifications may be related to clinicians’ need to fix technical problems that arise during treatment, to facilitate the efficiency of treatment, or due to limited resources or shortages of approved devices, among other reasons. In some cases, the use of on-hand items such as gauze, extra tubing, and/or tape for a “quick repair” of leaks in a respiratory apparatus may be perceived as a more efficient and/or easier solution than replacing the dysfunctional device or device component.⁹ For example, endotracheal tube leaks are common in intensive care unit settings;¹⁰ attachment of an intravenous (IV) catheter with a stopcock valve or packing the tube with gauze to mitigate the leak may be employed to restore pressure within the tube to avoid or delay reintubation. Sometimes medical devices are adapted for applications outside of their intended use to facilitate patient care. For example, polyethylene glycol oral solutions may be inserted into an IV bag and delivered into a patient’s feeding tube via an IV pump to help promote bowel movements. As another example, Heimlich valves are one-way portable devices designed to prevent retrograde airflow in patients requiring respiratory support.¹¹ These valves may sometimes be attached to urine collection bags or colostomy bags to facilitate fluid drainage in mobile patients. Assembly of “home-made” continuous positive airway pressure systems and other respiratory devices is often implemented in institutions with limited resources and in areas where there are shortages of approved devices.^12,13 Finally, sometimes medical devices are created spontaneously without preparation or testing (in other words, they are improvised) to meet an unmet need in the absence of an approved device. For example, the modified circle ventilatory support system was developed to reduce oxygen requirements during long-distance transportation of ventilated patients.¹⁴

Using the inhaled nitric oxide (iNO) delivery system (an FDA class II medical device) in neonatal critical care as an example, this paper aims to raise awareness of dangers associated with unapproved modification and interfacing medical devices and to highlight the rationale for stringent validation processes that ensure interfaced medical devices perform as intended.

Potential Risks Associated with Improvised Use of Connected Medical Devices

Regulatory standards for the correct use of connected medical devices ensure that these devices are safely and effectively interfaced or connected in the clinical setting.^1,2 Nonstandard, improvised connections have been described as fixes that are not rigorously tested in the laboratory or clinic over long periods of time to ensure that the modified medical devices function correctly and meet the original manufacturer’s specifications and regulatory standards.¹⁵ Furthermore, as a consequence of introducing an unknown set of variables into the operation of the medical device system, improvised connections may hide a design flaw, or delay needed repair or replacement.⁹

Improvised connections between devices have been shown to lead to potentially catastrophic safety events for patients, as well as liability concerns for health care providers and institutions.^15,16 The Joint Commission (formerly the Joint Commission on Accreditation of Healthcare Organizations) has reported tubing misconnections to be a major cause of severe patient injury and death, particularly in cases where universal luer connectors (designed to connect unrelated delivery systems) and improvised adapters (eg, using tubing or catheters) are used to make on-site modifications to medical device equipment.^16,17

Ensuring proper tubing connections between devices is particularly important in neonatal settings.^18,19 In 2006, The Joint Commission reported more than 300 cases of tubing misconnections: IV infusions connected to epidural lines (or vice versa); bladder irrigation solutions and enteral feeding solutions connected to peripheral or central IV catheters; IV infusions connected to indwelling bladder catheters and nasogastric tubes; IV solutions administered via tracheostomy cuff inflation tubes, pulmonary artery catheters, dialysis catheters, and others; and IV blood products transfused with primary IV tubing.^18,19 Results of a literature review found 116 published case studies related to misconnections of feeding tubes intended for enteral lines to IV lines, many of which ultimately led to death (n=21), sepsis (n=16), renal impairment (n=8), respiratory arrest/distress (n=2), and neurologic damage (n=2).²⁰ In these reports, the ease of interchangeable couplings was considered the key driver of the misconnections resulting in a “fundamental failure to protect patients.”^19,20

The consequences of connection errors and improvised systems can also extend to respiratory devices. Until recently, the lack of an approved delivery system for the helium-oxygen mixture heliox required modification of devices that were not designed for the delivery of heliox.¹⁵ These modified systems increased the risk of anoxia and delivery of abnormally large tidal volume because of incompatible flow meters that were not designed to measure heliox.¹⁵ Delivery of inhaled epoprostenol through a non-standardized device has also been associated with a serious adverse event, resulting from a diluent reaction whereby the aerosol became sticky, causing the exhaust valve on the device to stick and malfunction and lead to substantial auto-positive end-expiratory pressure and hypotension.^21,22 In fact, a recent report by the ECRI (formerly known as the Emergency Care Research Institute) alerted healthcare providers to potential harms to patients associated with off-label administration of epoprostenol via an IV infusion pump connected to a nebulizer for inhalation of epoprostenol.²³ The report emphasized that this improper connection could lead to numerous sources of error and potential patient harms, including those associated with lack of device alarms or monitors to alert clinicians if therapy is interrupted, the potential for inadvertent connection of the infusion pump to the patient’s IV line (which could cause overdose and catastrophic hypotension), potential ventilator malfunction due to the sticky properties of epoprostenol (potential for pneumothorax or other patient injuries), to name a few. Mislabeling of connections on interfaced devices can also result in device malfunctions. For example, in one reported case, mislabeling of the inspiratory limb of an anesthesia machine interfaced with an iNO delivery device caused the abrupt cessation of iNO therapy in a postsurgical cardiac patient; the expiratory and inspiratory limb labels on the anesthesia machine were transposed, and the iNO system was attached to the expiratory limb rather than the inspiratory limb.²⁴ In this case, the source of the error was quickly identified and corrected before rebound pulmonary hypertension associated with the abrupt discontinuation of iNO^25–27 could occur.

In some cases, an improvised system can jeopardize a patient’s health because established safety protocols are not followed. For example, A. L. DeWitt observed a case where a binder clip and string ties were used to secure a patient’s endotracheal tube, rather than tape (as was the requirement). High pressure from the clip caused the endotracheal tube to move into the patient’s right mainstem bronchus compromising the patient’s respiration, which required the endotracheal tube to be removed. In another case, a ventilated patient’s respiratory therapist used a pocketknife to puncture a hole in the bottom of a water trap that had been installed to drain the ventilator tubing. This improvisation caused air and water to leak out of the punctured hole, and the patient developed hypoxia and hypercarbia.

For the fragile, critically ill patients in this setting, ventilator alarms play an important role in the safe administration of respiratory agents. However, intensive care units (ICUs) are often inundated with alarms, many of which may be false alarms, to the point that clinicians experience alarm fatigue.²⁸ A recent prospective observational study evaluated the number of ventilator alarms occurring in three adult ICUs at a tertiary care university teaching hospital and showed that ventilator alarms were triggered 10,933 times over 1555 ventilator-hours during an 18-day study period, with an average of seven alarms per ventilator-hour.²⁹ Each alarm triggered up to 8 notifications, and initial alarms that were not resolved within 15 seconds triggered additional alarms to alert more personnel. Another study investigated the frequency and cause of neonatal ventilator alarms recorded for 46 ventilated infants over a mean of 60 hours per infant.³⁰ In this study, 27,751 alarms occurred over the course of 116 days, averaging 603 alarms per infant and about 10 alarms per patient per hour. In this study, alarms were most frequently caused by physiologic variability in respiratory rate or minute volume, inappropriate alarm limits, or maximum peak inflating pressure being too low during volume-targeted ventilation. Most alarms were very short in duration, but some were ignored for many minutes or hours.³⁰ Results from another study of alarm frequency in the neonatal ICU of a university children’s hospital found that 2176 alarms sounded over 7 days, but only 5.5% (n=119) were deemed clinically important.³¹

The impact of this overabundance of clinically insignificant or nuisance alarms can result in alarm fatigue or even ignoring or turning off alarms because trust in the alarm as a valid warning system has been lost.^28,32 The percentage of these alarms that can be attributed to improvised systems is unclear. However, it can be surmised that any actions taken to circumvent the intended functioning of medical devices can increase the risk of adverse events, particularly in high-risk neonatal patients. Only devices and delivery systems that have been designed and validated to work together safely and effectively should be used.³³ Furthermore, despite the good intentions and innovative potential of some improvised devices, the legal and financial liability for the modified device or delivery system rests with the person or institution that implemented the modification.¹⁵

Case Example: iNO Delivery System

INOmax Delivery System Efficacy and Safety

Inhaled nitric oxide (iNO; INOmax^®, Mallinckrodt Pharmaceuticals, Bedminster, NJ, USA) is a selective pulmonary vasodilator indicated to improve oxygenation and reduce the need for extracorporeal membrane oxygenation (ECMO) in term and near-term (>34 weeks’ gestation) neonates with hypoxic respiratory failure associated with pulmonary hypertension.³⁴ Several randomized, prospective, multicenter clinical studies in term and near-term neonates showed that iNO was safe and efficacious, significantly improving oxygenation and reducing the risk of death or the need for ECMO.^35–37

INOmax Delivery System Safety Measures

The complexity of safely administering iNO involves the synchronization of several key components of the nitric oxide (NO) delivery system, including the delivery apparatus and the continuous integrated monitoring of NO, nitrogen dioxide (NO₂), and oxygen (O₂), in addition to a ventilator. Failure of any of these connected components to operate as intended increases the risk of device error or failure and can lead to loss of or incorrect concentration of iNO, inadequate or excessive ventilation or oxygenation, NO₂ toxicity, and/or iNO and NO₂ measurement error.²

Given the instability and critical condition of neonates with hypoxic respiratory failure and persistent pulmonary hypertension of the newborn, the iNO delivery systems (INOmax DS_IR^® Delivery Systems, Mallinckrodt Pharmaceuticals, Bedminster, NJ, USA; Figure 1)³⁸ were intentionally engineered and tested with numerous built-in safety features and multiple backup systems. These features include a specially designed injector module that enables tracking of the ventilator inspiratory flow-time waveform and the delivery of a synchronized and proportional dose of iNO, continuous integrated monitoring of inspired gases (O₂, NO₂, and NO), a comprehensive alarm system that allows clinicians to adjust alarm thresholds and limits so they can differentiate between low-, medium-, and high-priority alarms (can mitigate alarm fatigue), a backup battery to maintain power for iNO delivery in the absence of an external power source, backup NO delivery capability, and dual-channel delivery to ensure constant, accurate gas delivery with the ability to shut down if monitored concentrations approach unsafe levels.³⁸

Figure 1 Schematic diagram of the iNO delivery system. The schematic of the iNO delivery device (INOmax DSIR® Plus) is contained within the gray border. Nitric oxide from iNO cylinder (upper right of the diagram) enters the back of the iNO delivery device and passes through a filter and various safety valves within the iNO delivery device before entering an injector module located between the ventilator and the humidifier. Based on the ventilator flow and the set iNO dose, the injector module mixes the appropriate gas mixture flowing into the humidifier and the inspiratory limb of the ventilator circuit. The sample tee located in the inspiratory limb allows gas samples to be monitored by the iNO delivery device for NO, NO2, and O2 levels being inspired by the patient. Reproduced with permission from INOmax DSIR® Plus Operation Manual, Mallinckrodt Manufacturing, Madison, WI, USA; 2014.38 Abbreviations: CPU, central processing unit; DSIR, inhaled nitric oxide delivery system; iNO, inhaled nitric oxide; NO, nitric oxide; ppm, parts per million.

Use of the INOmax delivery system with validated mechanical ventilators and other devices is required to ensure that both devices safely operate as designed. Inappropriate connection of an iNO delivery system to unvalidated devices (eg, nebulizers, anesthesia machines, continuous positive airway pressure devices, life support systems) increases the risk of unreliable dosing, unreliable monitoring, alarm malfunction, or a complete system failure that can result in potentially serious health consequences. Safe discontinuation of iNO therapy requires a slow, gradual down-titration.³⁹ Administration of iNO induces rapid, selective pulmonary vasodilation by increasing cyclic guanosine monophosphate concentrations in smooth muscle cells of the pulmonary vasculature.²⁵ The exposure to exogenous NO during iNO administration inhibits endogenous endothelial production of NO.^25,27 Gradual down-titration of iNO therapy allows the patient’s endothelial system to re-engage the production of endogenous NO. Several case studies of children and adults with hypoxic respiratory failure have shown that abrupt discontinuation of iNO therapy can lead to rapid deterioration in oxygenation, rebound pulmonary hypertension, hemodynamic instability^26,40 and in some cases fatal cardiopulmonary failure.⁴⁰ The risk for potentially life-threatening rebound pulmonary hypertension associated with abrupt and/or unplanned cessation of iNO is well documented^{25–27,40–42} and is a critical safety consideration that should not be underestimated.³⁹ Rebound pulmonary hypertension syndrome can occur rapidly, after only a few hours of administration, and is independent of iNO therapy response.⁴² The risk of rebound pulmonary hypertension syndrome can be mitigated by vigilant monitoring and adherence to strict protocols for weaning patients from iNO therapy.

Another important safety consideration during the use of iNO is the avoidance of toxicity associated with the conversion of NO to NO_2, which occurs when NO reacts with O₂, particularly in high O₂ concentrations within the ventilator circuit and airways. This could lead to pulmonary injury;⁴³ methemoglobin levels also need to be carefully monitored during treatment with iNO to avoid tissue hypoxemia.^35,36,44 One further safety consideration is that the iNO delivery system does not adversely impact ventilator performance.

In the clinical trial setting, safety risks were mitigated largely owing to the use of delivery systems that provided constant delivery of iNO and careful monitoring for toxicity.^35,36,43,44 However, in everyday clinical practice, any unintended discontinuation or disruption on iNO therapy could increase the risk for a severe cardiopulmonary event or death.⁴⁰ In improvised systems, the devices may be modified to function under a specific set of clinical circumstances but can fail when patient status changes and/or when clinical adjustments are needed, particularly in critically ill neonates. Also, given the precarious condition of these patients, timely and complete testing allowing for safe and effective adjustments may not be feasible and may place the patient’s safety at risk. For these reasons, therapeutic delivery systems must be validated to ensure safe and effective functioning across all approved clinical scenarios and patient populations.

The Validation Process

Given that the safety and effectiveness of iNO therapy depends on the compatibility of the ventilatory support device and the INOmax delivery systems, the manufacturer has established a validation process, which meets FDA requirements, to ensure that the INOmax delivery systems operate within established parameters and specifications when connected to other devices.⁴⁵ Relevant operational parameters are evaluated during the validation process to ensure that the device, backup systems, and alarms function as intended, the iNO set dose and measured dose remain within a prespecified range of each other at all times under all tested conditions, the fraction of inspired O₂ (FiO₂) is maintained within acceptable limits, NO₂ generation is minimal, and any additional user instructions required for compatibility are identified. The validation process also ensures that there is no adverse effect on ventilator performance (eg, ventilation delivery performance and alarms).

Validation testing is conducted by trained respiratory therapists and device engineers, and the process involves a multistep evaluation to guarantee the compatibility of the mechanical ventilation system and iNO delivery system. During the first step in the validation process, mandatory and spontaneous ventilator modes are tested to affirm appropriate functionality of the iNO system across the full range of patients (ie, neonatal, pediatric, and adult) and ventilator modes for each ventilator. The iNO delivery device and mechanical ventilator are tested under clinically relevant normal and non–steady-state (ie, “worst case”) conditions in each corresponding patient category (ie, neonate, pediatric, and adult) and with accessories (eg, humidifiers). In order to achieve validation, the following acceptance criteria must be met during pass/fail testing: 1) Oxygen dilution – all measured O₂ values must be within the ventilator’s specifications when compared with baseline O₂ measured value before iNO is introduced into the gas delivery system. This is important because the addition of iNO dilutes the O₂ concentration. 2) Effect on iNO on the ventilator device – no unexpected alarm conditions or anomalies can occur for either the ventilator or the iNO delivery system when the ventilator and iNO system are interfaced. Both devices must perform according to performance specifications for each. 3) Delivery accuracy – all measured NO values must remain within accuracy specifications for the iNO delivery system. 4) NO₂ generation – NO₂ levels cannot exceed 1 ppm during the administration of 40 ppm of iNO in 60% O₂ and cannot exceed 5 ppm during the administration of iNO at any dose setting in 100% O₂. If an issue emerges during the initial testing, secondary testing involves the manufacturer of the iNO delivery system (Mallinckrodt) working in conjunction with the ventilator manufacturer to resolve the issue. For example, in cases in which a ventilator fails to pass validation testing, the manufacturer may make updates to the iNO delivery system technology and/or collaborate with the ventilator manufacturer to rectify the issues observed during testing.

Once validation testing for each mechanical ventilator is complete (“pass” result is achieved for all parameters tested), results are reviewed by the iNO system manufacturer and submitted to the FDA for review and clearance before validation labeling is released to the public. Currently, iNO delivery systems have been ISO and MDSAP certified and validated for use with 63 different mechanical ventilators and gas delivery systems available in the United States and 44 different mechanical ventilators and gas delivery systems available outside the United States. The iNO delivery system complies with all FDA delivery device requirements and includes multiple alarms that monitor iNO delivery (including an abrupt discontinuation alarm), dosage (including an incorrect drug concentration alarm), and system functions; backup systems that include a backup drug cylinder and battery to provide uninterrupted iNO delivery; and constant monitoring of NO, NO₂, and O₂ deliveries. A new iNO delivery system (DS_IR Plus MRI) has also recently received ISO 13485:2016 and MDSAP certifications for the administration of iNO in the magnetic resonance imaging suite.⁴⁶

Summary and Conclusions

Some clinicians use common medical devices in nonstandard ways and/or improvise workarounds to mitigate pragmatic challenges to the efficient delivery of patient care.^9–14 Despite being well intended, unapproved modification of medical devices, such as the iNO delivery system, can increase the risk of life-threatening complications for patients. Underreporting and non-detection (eg, “near-misses”) of medical errors are major barriers to patient safety. The true prevalence of device-related events caused by improvised devices is unknown because health care providers are not required (and may be reluctant) to report them to the FDA, especially if no harm has come to the patient. However, the person(s) modifying a given medical device assume the role of “manufacturer” and may bear legal and financial responsibility should any harm come to a patient as a result of the modified equipment.^1,5–7 In some cases, professional malpractice insurance companies may exclude coverage for product design and manufacture or may have an “unlawful acts” exclusion that prevents them from providing coverage. Regulatory requirements set by safety organizations (eg, ISO 13485:2016, MDSAP) are evolving to mitigate these risks, and have put mechanisms in place to improve reporting of device-related incidents and to identify potential hazards.

The efficacy and safety of iNO has been established in several prospective clinical trials. However, safety parameters (eg, methemoglobin and NO₂ concentrations) associated with the administration of iNO must be carefully monitored to avoid toxicity.^35,36,44 To minimize the risk of device-related malfunctions or errors, strict validation processes and procedures, such as those enforced by the iNO manufacturer, are required to ensure patient safety when interfaced medical devices are used in the critical care setting.

Medical devices and systems should always be used according to their intended purpose, and according to the regulatory and safety standards for which they have been approved. Clinicians are responsible for verifying that interfaced medical devices have been validated for the intended use according to the manufacturers’ safety standards for each device. Unapproved modification or interfacing of medical devices can prevent the devices from working as intended across the full range of functionality and carries an unacceptable risk for device-related errors and adverse events for patients and professionals and a liability risk for clinicians.