A.1 General guidance

A.1.1 Overview

This annex provides a rationale for the important requirements of this collateral standard. Its purpose is to promote effective application of the standard by explaining the reasons for the requirements, providing examples of how they address certain alarm-related HAZARDS and providing additional guidance where appropriate.

From the standpoint of PATIENT safety, ALARM SYSTEMS can be hazardous for PATIENTS or OPERATORS if they fail to effectively warn of potential or actual HAZARDS, cause inappropriate responses, reduce vigilance or interfere with the performance of the OPERATOR, RESPONSIBLE ORGANIZATION, or other persons.

In addition, in this annex text in italics indicates guidance that describes means to achieve the safety objectives of this collateral standard.

A.1.2 ALARM SYSTEMS

As part of the RISK MANAGEMENT PROCESS, the MANUFACTURER identifies RISK CONTROL measure(s) that are appropriate for reducing the RISK(S) to an acceptable level.

Risk control consists of an integrated approach in which the MANUFACTURER uses one or more of the following in the priority order listed.

a) inherent safety by design;

b) protective measures in the equipment;

c) information for safety, e.g., warnings and instructions for use, values of monitored variables.

ALARM SYSTEMS as described in this collateral standard, address b) and c) above by communicating information that requires a response or awareness by the OPERATOR. The following general principles apply.

d) The ALARM SYSTEM should result in a greater probability that the OPERATOR will correctly detect and appropriately respond to the condition that requires their awareness or action than would be the case in the absence of the ALARM SIGNALS. NOTE Causing too many ALARM SIGNALS from FALSE POSITIVE ALARM CONDITIONS can reduce the effectiveness of an ALARM SYSTEM.

e) ALARM SIGNALS should indicate the onset and continuing presence of an ALARM CONDITION.

f) ALARM CONDITIONS should be prioritized based on the urgency of the required OPERATOR response (or awareness).

g) Alarm signals should help the operator:

– determine the urgency of the response required;

– locate the room or part of the room where a response or awareness is required;

– locate the specific PATIENT or equipment where a response or awareness is required;

– determine or categorize the cause of the ALARM CONDITION; and

– determine or categorize the nature of the response or awareness that is required.

h) The algorithms that determine ALARM CONDITIONS should be designed to minimize the number of FALSE NEGATIVE and FALSE POSITIVE ALARM CONDITIONS. Both FALSE NEGATIVE and FALSE POSITIVE ALARM CONDITIONS are potentially hazardous. Too many true positive but unhelpful ALARM SIGNALS can result in inappropriate OPERATOR action or reduce vigilance. Algorithms that determine ALARM CONDITIONS should be carefully optimized to provide, on balance, an overall benefit to PATIENT care.

i) ALARM SYSTEMS that are continuously attended by an OPERATOR in NORMAL USE should have different characteristics from ALARM SYSTEMS that are unattended by the OPERATOR in NORMAL USE.

j) The design of an ALARM SYSTEM should be based on the TRAINING and skill of the OPERATOR who is intended to use it.

k) The ALARM SYSTEM should reflect the problems and needs of the intended environment of use.

l) ALARM SIGNALS should not be excessively intrusive or degrade the performance of the OPERATOR.

A.1.3 Algorithm quality and performance

ALARM SYSTEM algorithms should aim at approaching 100 % sensitivity and 100 % specificity. [7],[8],[9],[10] The leading reason for disabling ALARM SIGNALS is the large number of ALARM SIGNALS associated with FALSE POSITIVE ALARM CONDITIONS, unhelpful ALARM CONDITIONS, or nuisance ALARM CONDITIONS. Nuisance ALARM CONDITIONS are true positives that are unhelpful because they indicate states that the OPERATOR is already aware of or does not need to know about. [11] They commonly occur when the ALARM LIMITS have been set inappropriately close to an acceptable value but also occur when multiple redundant ALARM CONDITIONS occur in response to a single underlying problem. Often, ALARM SIGNALS are more confusing than enlightening. Many OPERATORS respond to ALARM SIGNALS by disabling the ALARM SYSTEM or by adjusting an ALARM LIMIT to such an extreme value that the ALARM SYSTEM is effectively disabled. [12]

Where practical, MANUFACTURERS or writers of particular standards are encouraged to utilize standardized physiological databases to validate the algorithms used to determine ALARM CONDITIONS. Determining and reporting the FALSE POSITIVE and FALSE NEGATIVE ALARM CONDITION accuracy in a standardized format allows OPERATORS and RESPONSIBLE ORGANIZATIONS to understand the performance of equipment.

EXAMPLE ANSI/AAMI EC57:1998, Testing and reporting performance results of cardiac rhythm and ST segment measurement algorithms.[5]

Other techniques to reduce the number of FALSE POSITIVE and FALSE NEGATIVE ALARM CONDITIONS include:

a) marking the ALARM SYSTEM with symbol ISO 7000-0435 when an algorithm cannot classify or resolve the available data; or

b) using an ALARM CONDITION DELAY to delay the generation ALARM SIGNALS for an ALARM CONDITION to ensure that it remains valid.