Incident Investigation and Failure Analysis
This domain tests a defensible method: make the situation safe, preserve evidence, separate device failure from use error, and close the loop with verified corrective action and required reporting.
Sequence of an investigation
First make the patient and area safe, then preserve the device exactly as found. Do not clean it, power-cycle it or attempt repair before documenting, because volatile logs can be lost and configuration changes destroy evidence. Record chain of custody, photographs, settings, alarm and error logs, accessories and consumable lot numbers. Build a timeline from the medical record, staff interviews and maintenance history. Then analyze: 5 Whys or a fishbone for local issues, fault tree analysis for complex failures, root cause analysis for sentinel events.
Failure classification
Sort the cause into component, software, design, environment, maintenance or use. Human error is a symptom of system design, including labeling, staffing, workflow and interface; concluding 'user error' too early ends the investigation before anything changes.
Reporting
Use the internal safety event system, FDA MedWatch for user facilities, and the manufacturer. A Joint Commission sentinel event requires a root cause analysis and action plan within 45 calendar days of the event or of becoming aware of it.
Worked example
An infusion pump alarms for occlusion while the line is open. Logs show 120 mL/h programmed against an order of 12 mL/h, with look-alike keys and a decimal entry step. Calibration passes. The cause is a use-related design hazard aggravated by workload, so the action is keypad design review plus an independent double-check, not retraining alone.
Traps
- Powering the device on to reproduce the fault before downloading logs.
- Concluding no device fault means no device contribution.
- Missing the 45-day sentinel event deadline.