Risk management in an anticancer drug preparation unit: use of Preliminary Risk Analysis method and application to the preparation process

Objectives: Preparation of injectable anticancer drugs in hospital pharmacies, in particular of cytotoxics, is a high-risk activity. We used Preliminary Risk Analysis (PRA) to analyse the risks in the different steps of our anticancer drug circuit, including the preparation step (PRA1). Then, to prepare an important change in management of the circuit with the software Chimio ® (pooling of three databases for subcontracting), we repeated the analysis of preparation step (PRA2). PRA is known to be time and resource consuming. To overcome this, we developed a strict organisational framework to perform the analysis within a reasonable amount of time. We present the PRA method including its practical implementation, and its application to the anticancer drug preparation process, before and after pooling of Chimio ® databases. Methods: PRA has two main stages, PRA “ system ” and PRA “ scenario ” . A multidisciplinary working group is created for the entire PRA process. PRA “ system ” is an exploratory and qualitative stage. PRA “ scenario ” requires the creation of risk assessment tools and decision tools before actually developing, analysing and treating scenarios, with risk reduction actions structured in an action plan. For PRA2 we used the same working group, assessment and decision tools as for PRA1 and we only analysed dangerous situations (DS) that appeared or changed towards more risk, requiring a new action plan. The different PRA only required four 2 h meetings thanks to the invest-ment of a coordinator who is expert in the method. Results: In PRA1, the riskiest phase was production while it was the verification and delivery of the finished product in PRA2. The risks were mainly related to management, human and technical dangers in PRA1. Human danger was found to be the main danger in PRA2, followed by organisational danger. Among the 264 scenarios described in PRA1, six of criticality 3 and 69 of criticality 2 have been associated with risk reduction actions. These actions mainly involved managing the risk of human error, with the control system Drugcam ® and the standardisation of the pharmaceutical assistants ’ training program. In PRA2, 11 scenarios were analysed, including three of criticality 3 and 4 of criticality 2 for which risk reduction measures were taken. Conclusions: PRA allowed us to perform an in depth analysis of the highly specific and technical process of anticancer drug preparation. Human danger was one of the most important dangers identified, and it should always be taken into consideration, whatever the measures taken to prevent it. PRA2 was extremely useful to plan the organisation that would result from the new Chimio ® database, while involving the team and winning its commitment. It allowed an exhaustive and structured anticipation of this major change. Practical aspects of PRA method implementation we have adopted facilitate its application and can help to deploy it on many areas in our hospitals. Indeed, besides an exhaustive analysis of the risks, this approach promotes collaboration, develops a quality culture and is an excellent tool for team and project management, as well as communication.


Introduction
Preparation of injectable anticancer drugs in hospital pharmacies, in particular of cytotoxics, is a high-risk activity for staff members, patients and the environment [1][2][3][4][5][6][7][8][9][10][11]. In addition, the organisational restrictions in preparation units are complicated, especially when there is collaboration with outpatient hospitals and potential subcontracting agreements. These risks must be identified and controlled [12][13][14]. In recent years, the activity in our cytotoxic preparation unit (CPU) has significantly increased with two subcontract deployments. The diseases treated, and therefore the preparations prescribed, have diversified. This increase and diversification in activity, as well as the organisation with subcontractors, increases the risk in our process. Initiated during the first subcontract, the risk management approach in our CPU has the goal to evaluate all steps of the anticancer drug circuit.
We decided to use the Preliminary Risk Analysis (PRA) method to analyse and manage the risks. This a priori method has the advantage of being exhaustive and providing a detailed analysis of the risks associated with a process. In return for its exhaustive nature, the PRA method is also known to require significant resources, in particular of time and methodological skills, and therefore to be difficult to implement. To overcome this, we developed a strict organisational framework to perform the risk analysis of the different steps of our anticancer drug circuit.
In 2014, two studies were performed that targeted the new steps of our anticancer drug circuit as a result of the subcontracting activity: "remote" prescription from physicians in ordering hospitals, and delivery of preparations to these hospitals. Then, in 2016, a third study evaluated the risks during anticancer drug administration. Finally, a fourth study was performed in 2017 to manage the risks associated with anticancer drug preparation. In our unit, all of the steps of the anticancer drug process, from prescription to administration, are computerised with the software Chimio ® (Computer Engineering) using a local database that collect all of the specific settings for chemotherapy regimens prescribed in our hospital. At the beginning of our subcontracting activity, three different Chimio ® databases were used to manage production for each hospital. A single shared Chimio ® database was used after September 2019 which optimised and secured the process, but required reorganisation of production. Thus, on the occasion of implementation of the new shared Chimio ® database and to prepare for this reorganisation, we repeated risk analysis of the preparation step in 2019, as an update of the 2017 study.
We present here the PRA method and the way we used it, emphasizing its practical implementation and its application to the anticancer drug preparation process, before and after installation of the new shared Chimio ® software.

Materials and methods
PRA of injectable anticancer drug preparation step (PRA1) and PRA updated in relation to the new shared Chimio ® database (PRA2) were performed in 2017 and 2019 respectively, in the CPU of our university hospital. Our CPU produced approximately 33,600 anticancer drug preparations in 2019, including nearly 19,400 for our hospital and 14,200 for two outside hospitals. Preparations are produced according to an aseptic distribution process in two overpressure isolators with two workstations each (iso 5), installed in a controlled atmosphere area under negative pressure (iso 7) which is accessible via an overpressure airlock (iso 8). A team of seven pharmaceutical assistants, three caregivers and four pharmacists ensures production from Monday to Friday.
PRA includes the PRA "system" and PRA "scenario" stages, after first creating a multidisciplinary working group [15,16]. The PRA "system" is an exploratory and qualitative stage which includes a description of the system, the development of danger mapping and the construction of the dangerous situations (DS) mapping. These DS correspond to the vulnerability of a phase or sub-phase of the system when it interacts with a danger. The PRA "scenario" requires the creation of risks assessment tools and decision tools before actually developing scenarios, analysing them and treating them with risk reduction actions structured in an action plan.

Creation of the working group
The working group of PRA1 included the different actors involved at all levels of the preparation process. There were seven members: three pharmaceutical assistants for their technical expertise, a caregiver for his knowledge of the supporting tasks, the managing pharmacist for her pharmaceutical expertise and supervision, the quality and risk management director for his methodological expertise and the resident pharmacist for practical implementation of the project.

PRA system
Scope of the study definition and system description: The system being studied was precisely and chronologically defined with the delivery of the products and materials necessary for the execution of preparations as the entry point, and their control, release and storage as the exit point.
Danger mapping: Danger mapping corresponds to a structured list with three levels: generic dangers, specific dangers and dangerous events. It was drafted by the working group based on its experience and data from literature.
Dangerous situations mapping: To detect DS, a detailed analysis is made of the interaction between each danger and each phase and subphase of the system. The summary of this analysis is found in the DS mapping. Each interaction is assigned a priority index (PI). The working group manages DS with PI of 1, which correspond to "strong to very strong" system/danger interactions. Each PI 1 DS leads to at least one scenario of an accident to be analysed. If the interaction is a lower grade (PI 2) or if the working group does not have the expertise to manage it (PI 10), then it will be dealt with in a second time. At this stage, the working group brainstorms to answer the question "what could go wrong?". The members' answers foreshadow the scenarios to be analysed.

PRA scenario
Definition of scales of assessment: severity and probability: Each qualitative scale can cover 3-5 classes. The classes of the severity scale represent the level of damage to the system. These can be defined by the consequences to the system's performance and integrity, and range from no impact for minor severity, to severe deterioration of system's integrity and security for catastrophic severity. The classes of the probability scale range from certain to impossible. To facilitate understanding of the scale, time periods can be defined, corresponding to the time separation between two classes.
Definition of decision tools: scale and matrix of criticality, effort scale and matrix to prioritise actions: Criticality is jointly defined by severity and probability. The criticality scale is divided into three levels: acceptable (C1), tolerable under control (C2) and unacceptable (C3). Risks with criticality 2 and 3 are treated by the working group. Criticality 1 risks do not require corrective measures. The criticality matrix corresponds to the graphic representation of criticality as a function of severity and probability. Each severity/probability pair is associated with a level of criticality that can be modulated by the working group during the matrix construction.
The effort scale is graded according to the amount of effort required to reduce or eliminate the risk. Depending on the identified criticalities and efforts, a matrix of three levels is developed to prioritise actions.
Scenarios analysis: Finally, the scenarios can be analysed, evaluated and treated, in three stages: assessment of initial risks, treatment of these risks by defining risk reduction actions, and then the assessment and management of residual risks. Corrective actions that reduce the level of probability are called "preventive". Actions that reduce the level of severity are called "protective".
Data generated by the working group are recorded throughout the study in a specific Excel ® table. After the PRA scenario is completed, this table is processed by the software Statcart APR ® which provides a representation of data analysis in several forms to help interpret and communicate the results. This includes the Farmer's diagram which shows, by danger and phase, whether the level of criticality is due more to severity or probability. The diagram shows three areas that correspond to the three levels of criticality (C1 in green, C2 in yellow and C3 in red).
Drafting and structuring the action plan: Formal risk reduction measures must be drafted as "action forms" for scenarios with an initial criticality 2 or 3. These forms compose the risk reduction action plan. The order of these actions is based on the prioritisation matrix. Finally, the residual risk management plan, or catalogue of security parameters, corresponds to actions to be implemented for scenarios with a residual criticality 2 or 3.

Revision of PRA1 to accommodate a major change in the production organisation
Use of the new shared Chimio ® database will significantly change the production organisation and thus the analysis performed during PRA1. To perform PRA2, the PRA1 working group was reunited except for the caregiver and the quality and risk management director, whose methodological expertise was provided by the managing pharmacist. PRA "system" then involved identifying DS that had become more or less safe as well as those that had not changed, were no longer present, or were new, in order to build a new DS mapping. For PRA "scenario", PRA1 assessment and decision tools were kept and only DS that were new or had become riskier were analysed as scenarios. This analysis was used to draft a new action plan.

Practical implementation of the method
Although the PRA method has the advantage of providing a comprehensive analysis of processes, it is also known to be complicated to implement, to be time-consuming and to require significant expertise. Our goal for the analysis of our anticancer drug circuit was to perform PRA in four 2 h meetings at most to ensure completion of the project within a reasonable amount of time and to optimise the use of staff resources. To meet this fairly strict time limitation, the method coordinator (who in our case was the resident pharmacist) prepared each meeting ahead, which took at least a half day of work except for the preparation of the fourth meeting which is quicker. A provisional schedule was systematically drafted and PRA were performed according to the organisational protocol presented in Table 1.

PRA1 of injectable anticancer drug preparation
The working group divided the system into five phases and 39 sub-phases as described in Table 2. The danger mapping is presented in Table 3. Assessment tools are presented in Figure 1 and decision tools in Figure 2.
One hundred and forty DS were identified including 134 with a PI 1 which required analysis. Phase 3 (production) was the phase with the most DS (n=98) followed by phase 1 (delivery of products, n=55) and phase 2 (preparation of the trays and sterilisation transfer, n=53) ( Figure 3). The 140 DS were mainly related to generic dangers management (n=89), human (n=77) and technical (n=70) (Figure 4).
The working group imagined and analysed 264 scenarios for the 134 priority DS. Figure 5A shows the distribution of these scenarios according to their level of criticality: six scenarios with criticality 3 and 69 with criticality 2 were associated with actions to minimise the risk.
These actions were drafted as 41 "action forms" which were each given a level of priority and which made up the   (Table 4A). This plan was presented as a dashboard and a pilot and a deadline were determined for each action. Thus, it became an essential and structuring tool to perform, coordinate and monitor risk reduction actions. The main project in the actions requiring a level 3 effort, was implementing the digital video control system Drugcam ® (Eurekam) which required significant financial, technical and managerial resources. In addition, the working group decided to formalise the training program for pharmaceutical assistants and to organise their annual requalification, which also required a significant effort (level 3). Reorganisation and precise labelling of the products storage would require a level 2 effort and make the first step of their delivery safe. Finally, the creation or update of certain documents and procedures to support the activities in the unit would prevent risks at all phases of the process and represent a level 1 effort. The goal of documentation management was to formalise and standardise the protocols and preparation techniques and to serve as a reference for staff training.
Management of residual risk must also be considered because seven scenarios had a residual criticality C2 after treatment ( Figure 5B). One of the control actions that was decided was to create a tool to report and monitor adverse events.

PRA2 to prepare implementation of a new software tool
Two DS were removed and the security of 10 DS was improved with the new shared Chimio ® database. Five DS evolved towards less security and six new DS appeared. The shared Chimio ® database affected phases 4 (verification and delivery of the finished product) and 2 (preparation of the trays and sterilisation transfer) the most, with respectively 6 and 4 DS ( Figure 6). The 11 DS described in PRA2 mainly concerned human (n=8) and organisational (n=3) dangers (Figure 7). This led to an analysis of 11 scenarios, including three of criticality 3, four of criticality 2 and four of criticality 1 ( Figure 8A). Among the C2 and C3 scenarios, two were due to the reorganisation of the product storage. The shared Chimio ® database would allow a unique storage location instead of 3, with a risk of accident due to the heavier quantities of products to manage and a risk of error due to practise changes. Two scenarios were about the risk of confusion between patients and hospitals during edition of the production sheets because all the prescriptions would now be on a same screen. Two scenarios were about the risk of waste of expensive remainders and the risk of error in finished preparations' dispatching because production for the three hospitals would be dispatched indifferently between two isolators. Finally, a risk of defective final visual control of finished preparations was noted, due to a lack of luminosity, this control being moved inside the production area. To deal with those C2 and C3 scenarios, the working group identified measures for risk reduction in seven action forms (Table 4B). This mainly involved purchasing small equipment needed for the new organisation, the computer settings and modifying support documents. Residual risk management was still needed for two scenarios with a residual criticality C2 ( Figure 8B).

Discussion
Discussion of the results PRA1 identified a significant number of DS and analysed numerous scenarios, much more than the PRA led on the other steps of our anticancer drug circuit. The activity of anticancer drug preparation is indeed a high-risk activity, and the significant number of scenarios can also be explained by the working group's highly specific knowledge and technical expertise about the process. Thus, the  analysis was extremely detailed. However, among the 264 scenarios analysed, only 75 (28%) had a criticality 2 or 3 and needed to be treated. The production phase was found to be the riskiest phase of the process. Indeed, this phase concerned one third of the DS and one third of the scenarios and was found in the yellow area (tolerable under control) on the Farmer's diagram. This is the most technical and complex part of the process, especially since when the study was performed the only existing control was the double visual verification of products and volumes during preparation. These results are similar to other studies on risk analysis of a process for preparing injectable treatments, including anticancer chemotherapies or parenteral nutrition bags [17][18][19][20][21]. These studies show that preparation is the riskiest step.
The main dangers identified were related to management, human and technical aspects. This shows the importance of pharmaceutical assistants' working conditions, as well as their expertise. Data from the literature confirm this result and human-related dangers definitely    influence the risk [17][18][19][20][21][22]. It is therefore consistent that the main risk reduction measures involved creating a comprehensive training plan and implementing the Drugcam ® control system. However, whatever the level of security of the process, the human factor will always be present and must be considered. In the book To err is human, Linda T. Kohn says that human error is inevitable and must be accepted [23]. The goal is to build systems where the compliant and secure task will be easy to accomplish and, in contrast, the error will be hard to make.
PRA2 shows that overall, the shared Chimio ® database reduces the risks for our process. However, it also generates new risks which were identified and managed upstream. Human danger was once again the most critical source of risk, followed by organisational danger, with organisation of the production being transformed by the use of this new tool.
Those results could be interestingly considered by other teams in their institution. But they cannot be strictly extrapolated, because a detailed analysis requires to   consider the specificities of each organisation. As shown in Table 4, our action plans contain some highly targeted risk reduction actions related to our organisation.

Strengths of the method
PRA is a reference method for process analysis. It allows exhaustive risk identification, as well as brainstorming and teamwork in the working group which results in a learning experience sharing. This approach helps define and clarify the tasks and responsibilities of all actors, and thus their value in the process. Various authors have noted that PRA helps develop a quality culture within teams [17][18][19][20][21], promoting involvement and responsibility, and thus acceptance of change. It then becomes a communication and management tool.
We chose this method at the beginning of our risk management approach because we had to analyse nonexisting processes created by the new subcontracting activity and PRA is the most adapted method in that case. Indeed, other a priori method like Failure Modes, Effects and Criticality Analysis (FMECA) requires working on a well-known process to analyse its failure modes. PRA is also the most exhaustive method available. Then, the team being trained in the method, we kept it for the next studies. However, PRA and FMECA are close, allowing comparison of the results between different studies.

Methodological and practical limits
Subjectivity in risk assessment is regularly identified during PRA [24]. When it comes to health issues, the rating of the scenarios is often based on individual judgement and the experience of the working group members rather than exhaustive data collection [25,26]. Therefore, the members of the group are the cornerstone to successful analysis. The group should include all the actors who are experts in their area of activity for the most precise risk analysis [15,16].
PRA is known to be difficult to perform because it requires methodological expertise and time. In our case the primary difficulty was gathering the working group together, especially when it involved doctors and nurses for studies dealing with the prescription and administration of anticancer drugs. Monitoring the successful implementation of risk reduction actions is also difficult. For although the analysis of residual risk shows that the action plan proposed by the working group reduces the overall risks, the plan must still be carried out successfully. Finally, access to the PRA data processing software can limit its feasibility, but processing the results using Excel ® is also possible.

Our use to the PRA method
The PRA method that we applied allowed in depth risk analysis of the four main steps of our anticancer drug circuit. The time-consuming aspect of the method was overcome by following a strict organisational plan that demanded a reasonable amount of time from participating experts. It is possible to successfully perform the study following this strict organisational plan if a pilot, in our case the pharmacy resident, does substantial preparatory work before each meeting. In this case the working group must essentially validate, revise and improve the pilot's proposals. The pilot, who is the project coordinator, must have a full understanding of the risk management method. All the residents who took this role had received more or less intensive university training in risk management in the healthcare sector. If these requirements can be met, performing risk analysis in our production units, whose activity is sustained, and more generally in the healthcare units or medico-technical services of our hospitals, is feasible and relevant.
Although the method applied for PRA2 was an adaptation of the original methodological framework of PRA, it still respected the essence of the approach described by Alain Desroches [15,16]. It was particularly easy to perform since the working group was already trained in the method and the scales were validated. It permitted an a priori thinking on the coming change, in an exhaustive and structured manner that favoured team commitment. Besides the analysis of the risks associated with the new shared Chimio ® database, it was a powerful tool to project into the new organisation of production, anticipate changes and plan modifications while involving the team. Ideas would therefore emanate from them and would be naturally applied.

Conclusions
The two PRA performed successively about preparation step allowed us to analyse the strengths and weaknesses of our process. This method was also an excellent approach to comprehensively plan the reorganisation of production in a structured manner. Although the results of analysis and the resulting risk reduction actions are specific to each organisation, it is interesting to note that these results are consistent with those published by other teams [17][18][19][20][21].
This emphasises the need to control the main risks identified, including human error [22]. Automated production with robots can be a response to this risk even if the factor of human error will always be present and must be taken into consideration [27]. After those a priori analyses, an a posteriori approach is necessary by collecting adverse events which can then be treated by other risk management methods [11,25,26].
More generally regarding our global anticancer drug circuit, the PRA method allowed an analysis of future organisations, which had to be set up, as we did before starting subcontracts and before implementation of the new Chimio ® database, but also of ongoing processes such as preparation and administration of chemotherapies. To analyse the steps of prescription, administration and delivery, the working groups included prescribers, nurses and logistic units. Discussions within these groups allowed all actors of the circuit to meet and strengthen their collaborative relationship for the purpose of optimal patient care.
Our risk analysis was the starting point for larger projects, and it provided consistency to their implementation within the unit. It is also a solid tool to defend projects at the hospital management and support funding requests. Thus, it becomes a great tool for communication, team management and project management.