A PCA Oversedation Event the Team Wants to Close as Nurse Error
A 72-year-old man on postoperative day one is found at 06:10 unresponsive to voice with a respiratory rate of 6 and SpO2 of 84%. Naloxone is given and he recovers. He was on morphine by PCA with a demand dose, a basal rate, and a four-hour limit. The pump history shows the basal rate was set at 4 mg/hour instead of 0.4 mg/hour and the four-hour limit was bypassed with an override. The drug library contains six morphine entries, two of which differ only by concentration, and overrides are permitted for morphine. The barcode scanner at the bedside is not in use on the unit. Your bench test shows delivery accuracy within 2.1% and no device fault. The RCA draft circulating for signature concludes "nurse programming error" and recommends re-education of the nurse. The nurse, a two-year employee, says the screen looked like the one she always uses and she thought the decimal was already placed.
1. What device and documentary evidence do you secure, and what tests do you run before signing anything?
Read the worked answer
The pump is evidence and does not get cleaned, cleared, or returned to the fleet.
- Device: sequester the pump in biomed under a chain-of-custody log, then download the full event history: programming entries, library entry selected, override events, rate changes, alarms and alarm silencing, volume delivered, and timestamps. Capture which drug library version was installed and compare it to the pharmacy-approved version and to a sample of other pumps on the unit, because configuration drift across a fleet is common and is itself a finding.
- Consumables and setup: the bag with its label and concentration, the tubing, the pump module, and photographs of the bedside arrangement.
- Clinical record: eMAR/MAR, the original order, pharmacy admixture records, BCMA scan history, and the monitor data.
- People and context: staffing and assignment sheets for the shift, the unit's double-check practice for high-alert medications, and prompt, separate interviews with the nurse and the pharmacy staff who prepared the infusion.
- Device testing: delivery accuracy, occlusion alarm, free-flow protection, battery, alarm audibility, and keypad or touchscreen response. Document that the device met specification, which rules out device malfunction but not device contribution.
I would not sign an RCA that names a person as the cause before the event log and the library configuration have been analyzed. The pump may be functioning perfectly and still have been designed or configured in a way that made the error easy and the detection hard.
2. How do you challenge the "nurse programming error" conclusion, and what framework do you use to organize the contributing factors?
Read the worked answer
Human error is where the analysis starts, not where it ends. The useful question is not who typed the wrong number but why the wrong number was plausible, undetected, and able to reach the patient.
I would use a systems framework such as SEIPS, which separates work system factors into person, tasks, tools and technology, organization, and physical environment, and maps them to outcomes. Applying it here:
- Tools and technology: six morphine entries with two near-identical concentrations; a library that permits overrides for a high-alert drug; a four-hour limit that can be bypassed at the point of programming; a display where the decimal place is easy to misread; a barcode scanner installed but not in use.
- Tasks: a high-alert medication given without a feasible independent double-check at 06:00.
- Organization: pharmacy and nursing may hold different assumptions about which concentration is stocked; a concentration change may have been implemented without updating the library or communicating it; staffing at change of shift.
- Person: a two-year nurse working a night shift, whose account of what she saw on the screen is data about the interface, not a confession.
- Environment: alarms and interruptions typical of a postoperative unit.
I would also apply Just Culture: this looks like human error or at-risk behavior in a system that allowed it, not recklessness. The output should be a contributing-factor map with several actionable causes, each with an owner, rather than a single root cause that ends at one employee.
3. What corrective actions would you recommend, and how would you know they worked?
Read the worked answer
Actions should remove the ability to make this error, not just remind people to be careful.
- Redesign the library: reduce to a single morphine PCA concentration where pharmacy can support it, delete or merge near-duplicate entries, apply tall-man lettering, and remove override capability for the highest-risk opioids. Require a documented pharmacy and clinical approval for every library change.
- Force function on limits: make the four-hour limit non-bypassable for PCA opioids so the pump stops the infusion before oversedation, rather than relying on the nurse to notice.
- Restore barcode scanning and treat scan compliance as a measured safety process, not an optional convenience.
- Configuration control: lock library versions, track which pumps carry which version, and require verification of every pump after an update.
- Independent double-check with a defined method for high-alert infusions that is achievable on a night shift.
- Training and simulation that includes the override and concentration traps, plus feedback to the involved nurse and a support process rather than blame.
- Disclosure to the patient and family per policy, with risk management involvement.
Effectiveness measures, tracked monthly for at least six months: percentage of pumps running the current library version, override rate for opioid entries, alert rate and alert response, barcode scan compliance, and a repeat audit of PCA programming observed on the unit. If override rates do not fall, the redesign did not work and the analysis needs another pass. I would report results to the patient safety committee and re-audit rather than declaring closure at the end of training.