^{1}

^{*}

^{2}

^{*}

Hospital facilities use a collection of heterogeneous devices, produced by many different vendors, to monitor the state of patient vital signs. The limited interoperability of current devices makes it difficult to synthesize multivariate monitoring data into a unified array of real-time information regarding the patients state. Without an infrastructure for the integrated evaluation, display, and storage of vital sign data, one cannot adequately ensure that the assignment of caregivers to patients reflects the relative urgency of patient needs. This is an especially serious issue in critical care units (CCUs). We present a formal mathematical model of an operational critical care unit, together with metrics for evaluating the systematic impact of caregiver scheduling decisions on patient care. The model is rich enough to capture the essential features of device and patient diversity, and so enables us to test the hypothesis that integration of vital sign data could realistically yield a significant positive impact on the efficacy of critical care delivery outcome. To test the hypothesis, we employ the model within a computer simulation. The simulation enables us to compare the current scheduling processes in widespread use within CCUs, against a new scheduling algorithm that makes use of an integrated array of patient information collected by an (anticipated) vital sign data integration infrastructure. The simulation study provides clear evidence that such an infrastructure reduces risk to patients and lowers operational costs, and in so doing reveals the inherent costs of medical device non-interoperability.

Preventable, in-hospital medical errors account for between 100,000 and 200,000 deaths in the United States each year [

The extent to which we can mitigate patient risks caused by delayed responses and insufficient staffing, rests on addressing the problem of effective caregiver scheduling. Notable prior work, including that of McManus et al. [

Hospitals use sophisticated equipment to monitor the state of patient vital signs such as body temperature, pulse rate, blood pressure, and respiratory rate [

Certainly there are ongoing efforts to standardize medical device interfaces, thereby allowing for easier integration in both critical care and operating rooms. Most of these approaches (e.g. COSMOS [

Outline. In this paper, we develop a formal mathematical model of a critical care facility. The model is rich enough to capture the essential features: An infinitely replenishable finite set of patients whose vital signs are monitored; a smaller set of caregivers capable of addressing alarm conditions. Patients who experience an alarm accumulate injury exponentially during the time that they are without a caregiver; the time it takes the caregiver to treat the underlying causes of the alarm is proportional to the accumulated injury prior to care. If a patient accumulates more than a threshold level of injury before a caregiver arrives to treat them, a fatality occurs. Fatalities (or “Code-Blue” events) require the execution of close out procedures, which take a specified period of time (and must be given precedence over handling alarms from current living patients). This model, suitably formalized, specifies six constraints (I-VI) which a valid scheduling system must satisfy. Using the formalisms of the model, we are able to express concrete performance metrics by which any caregiver scheduling algorithm may be evaluated. We then consider two caregiver scheduling algorithms which operate within the proposed model. The first represents the current defacto standard scheduling procedure carried out in most critical care facilities today. The second algorithm is one which could only be instrumented if a vital sign data integration infrastructure was available. The algorithms and performance metrics are instrumented as a computer simulation. Analysis of large numbers of simulations allows us to verify and quantify the expected benefits of a vital sign data integration infrastructure on critical care delivery.

The system model consists of three mechanisms: the patient, the caregiver, and the facility. Each of these is described separately in the subsections that follow.

A vital sign is a real-time measurement of a patient, modeled as a function v: from time to a real vector space^{1}. Many classes of vital signs arise in practice, because of biological and vendor diversity.

A patient p, then, is a collection of k(p) vital signs^{2},. The range space of each vital sign is typically partitioned into regions, based on the semantics of v. These disjoint regions are labeled with qualitative labels, such as: “normal”, “fatal”, etc. We can view the range of vital sign v, as the state space of a dynamical system, wherein vital sign v traces a trajectory (over time). The set of all points with the label “fatal” form a limit set within the dynamical system, and associated with this limit set is a basin of attraction. When the vital sign trajectory is determined to have entered the basin of attraction, an alarm is raised. An alarm is thus a triple (p, i, t) consisting of a patient p, a vital sign, and a time t ≥ 0. The occurrence of alarm (p, i, t) is an assertion that the state of vital sign i in patient p has attained a value, which if left unattended, is expected to lead to increasing patient injury (and ultimately death). We will often think of alarm a = (p_{a}, i_{a}, t_{a}) as an incident concerning the state of vital sign i_{a} of patient p_{a} at time t_{a}. The process of defining the limit sets (corresponding to fatal states) and their basins of attraction, is outside the scope of what we seek to model here. We assume basins of attraction are defined by medical practitioners, in coordination with manufacturers of health monitoring devices. The set of all alarms raised for vital sign i of patient p in the half-open time interval [t_{1}, t_{2}) is denoted A (p, i, t_{1}, t_{2}); we take A (p, i, t_{1}, t_{2}) = Æ when t_{2} ≤ t_{1}.

Post-alarm, a patient accumulates injury as they move in a trajectory through the state space, towards the fatal limit set. In this work, we model the injury as exponential in elapsed time, as has also been adopted in prior research [21-23]. Thus, after alarm a = (p_{a}, i_{a}, t_{a}) occurs, patient p_{a} who remains unattended until time t accumulates injury given by:

If the patient remains unattended for longer than D_{a} = ln(100)/α_{a} post-alarm a, injury reaches 100, signifying death. Each alarm a must therefore specify α_{a} (or equivalently, its time until death D_{a}). In our simulation experiments, we model all alarms involving vital sign i (regardless of patient), as sharing the same time until death, and so denote the common value as D_{i}.

In this work, we model the alarms events for each vital sign at each patient as an independent Poisson process. More precisely, let (p, i, t_{1}) and (p, i, t_{2}) be two success-

sive alarms, that is t_{1} < t_{2} and there is no alarm (p, i, t') for patient p’s vital sign i, where t_{1 }< t' < t_{2}: Then we assume that the alarm inter-arrival time t_{2} − t_{1} is a random variable that is distributed according to a Poisson distribution of intensity λ_{p,i}. In our experiments, we further assume that each of the patients exhibits the same alarm inter-arrival times for vital sign i, and thus, we will denote the common intensity as λ_{i}, and consider this number to be a characteristic property of the vital sign i itself, rather than the patient.

A caregiver is an individual capable of attending to the conditions underlying patient vital sign alarms. Associated with every patient p and caregiver c there is a caregiver assignment function h(p,c,t) {0,1}, where h(p,c,t) = 1 if and only if a caregiver c is attending to patient p at time t. The design of caregiver specific assignment functions h will be addressed in later sections. Here, we seek only to formally describe the constraints on h (and closely related functions), thereby specifying the requirements for valid assignment algorithms.

First, a caregiver c cannot be assigned to two distinct patients at the same time t; this is Condition I.

The set of times when patient p is being attended to by caregiver c, defined as, is uniquely expressible as a disjoint union of maximal half open intervals; this is Condition II.

where. The arrivals of caregiver c at patient p are a sequence; the departures are. The jth arrival time of caregiver c at patient p is denoted T^{a}(p,c)_{j}; the jth departure is denoted T^{d}(p,c)_{j}. We make a simplifying assumption, which at all times, at most one caregiver is assigned to patient p; this is Condition III.

It follows that each patient p witnesses an interleaved sequence of caregiver arrivals and departures, allowing us to define the function f(p, t) as:

The times (prior to sometime t_{0}) when patient p was served by (any) caregiver is denoted:

This permits us to define, which informally, is the last time (not later than t_{0}) when patient p was serviced by any caregiver. At time t, each patient p has an associated (possibly empty) set of unresolved alarms We emphasize that the definition of X is dependent on the caregiver assignment function by listing f it as a parameter; we will follow this convention in later definitions as well.

Having defined X, we can now turn to the process by which patient treatment occurs. If no caregiver is assigned to p at time t, then X(p,i,t;f) may be nonempty. Each alarm contributes to the cumulative injury experienced by patient p_{a}. Suppose that c is the first caregiver assigned to patient p at a time t_{0} > t_{a}. We model the time required for c to address alarm a as being linearly proportional to the patient’s injury level. Formally

where T_{max} is the maximum time required to resolve an alarm (as patient injury approaches 100). We model the treatment time as linearly additive for multiple alarms; the total time required for the caregiver c to handle all the alarms at patient p present at time t0 is then given by

For simplicity, we assume no preemption; that is, once a caregiver c has been assigned to patient p at time t_{0}, the caregiver must remain with the patient for entire recovery period R(t_{0},p), regardless of other new (potentially more serious) alarms at other patients during that interval. Thus,

Once assigned, a caregiver stays with the patient until all alarms have been resolved, and the time required for treatment is linearly additive in injury level across all vital signs; this is Condition IV: for all time t between T^{a}(p,c)_{j} and T^{a}(p,c)_{j} + R(T^{a}(p,c)_{j}, p; f ), g(c, t) = p.

The model described so far admits fatalities; these occur whenever caregivers fail to be present at patient p_{a} in the interval between t_{a} and t_{a} + D_{a}. In this section, we will formally describe the impact of fatalities on the scheduling of caregivers in a medical facility. When a fatality occurs, the expired patient is removed from the bed immediately, and placed in “Code-Blue” (CB) state which requires special close out procedures taking time T_{fatal}. To facilitate assignment of caregivers to the processing of Code-Blue cases, we introduce the caregiver-centric assignment function g, written as:

which associates each caregiver c and time t, with either a patient p Î P, or a special sentinel value CB indicating that caregiver is assigned to Code-Blue. We define s(c,j;g) to be the starting time of caregiver c’s jth assignment, defined by taking s(c,0;g) = 0, and then s(c, j+1;g) inductively, ta king it as

when g(c, s(c, j)) ≠ CB, and as s(c, j) + T_{fatal} otherwise.

If a caregiver is assigned to CB, they must complete the close out procedures (which require time T_{fatal}) before handling any new alarms. This is formalized in Condition V: If (j > 0) we have g(c, s(c, j)) = CB then for all t in between s(c, j) and s(c, j) + T_{fatal}, f (c; t) = CB.

When a fatality occurs, the model semantics are to transfer the expired patient to Code-Blue, and to populate the now-vacant bed with a new critical care patient. This new patient is the source of future alarms that are attributed to “patient p”.

Towards accounting for fatalities, we define K(p, j; f) as the time of the jth fatality in bed p. K is defined inductively: As a base case, we take K(p, 0; f ) = 0. To express K(p, j+1; f ), recall that X(p, i, t; f ) is the set of unaddressed alarms which occurred for vital sign i (in bed p) at time t. Of these, we can describe the subset which induced a fatality.

Inductively then,

We define a monotonic integer valued function CB^{+}(t;g) whose value is the size of the population admitted to the hospital Code-Blue. This can be expressed as

where H is the Heaviside step function. The number of times prior to t, when caregiver c was assigned to CB, denoted CB^{－}(c,t;g), is given by

The number of times prior to t, when any caregiver was assigned to Code-Blue is

Thus, while CB^{+} (t) is the number of patients admitted to Code-Blue (prior to t), CB^{－}(t) is the number caregivers assigned to Code-Blue (prior to t). Whenever the former quantity exceeds the latter, there is an unprocessed patient in Code-Blue. If caregiver, upon completing an assignment, determines that there is there is an unprocessed patient in Code-Blue (i.e. CB^{+} > CB^{－}), they must be assigned to CB. This formalizes the fact that close out procedures for unprocessed fatalities must take precedence over the handling of existing critical care patients. Formally stated, this is Condition VI:

VIa If c is assigned to p at T^{a}(p,c)_{j} (for some j), then c completes the assignment at.. Thus, if CB^{+} (ξ;g) > CB^{－}(ξ;g) then it is required that g(c; ξ) =CB.

VIb If c is assigned to CB at time t_{0}, then c completes the assignment at time ξ^{*} = t_{0} + T_{fatal}. Thus, if CB^{+} (ξ^{*};g) > CB^{－}(ξ^{*};g) then it is required that g(c; ξ^{*}) = CB.

We now turn to the problem of evaluating a caregiver assignment algorithm. The jth assignment of caregiver c can either be (A) to a living patient, or (B) to the CB. Let us considered the incurred costs of each:

(A) If c is assigned to (living) patient p, then the cost C(c, j;g) incurred by the caregiver is linearly additive in injuries due to unhandled vital sign alarms at p, and represented by a multiset of real valued tokens

where is interpreted as a disjoint set union. While a caregiver is currently assigned to a patient p, alarms may continue to be generated at p. These alarms result in unit injury (via the exponential injury function, since e^{0} = 1), and hence unit tokens. Thus, the set (1) is augmented with a multiset of tokens each having value 1; these correspond to the costs of handling alarms which arose at p while c was at p. The augmented multiuset is denoted T (c, j).

(B) If c was assigned to the Code-Blue, then the cost C(c, j;g) incurred by the caregiver is taken as C_{fatal}, and T (c, j) is taken to be {C_{fatal}}.

Over the lifetime of the simulation, and the operation of the caregiver assignment algorithm A, each caregiver c collects a multiset of tokens, while the algorithm as a whole collects .

In general, we evaluate an algorithm A by analyzing properties of the tokens T_{A} accumulated by the end simulations. One very crude measure of A’s performance is the total injury. In conducting multiple simulations, we will draw error bars around each curve to show the mean/variance of each algorithm’s performance over sets of trials. In comparing two algorithms A_{0} and A_{1}, if we find that the mean curve of one algorithm lies within the error bars of another, then it is inconclusive which algorithm is superior (if any). What is needed in such settings it to understand the correlations (if any) between the two algorithms performance on specific input sequences. We assess this by considering the relative costs of the two algorithms over each of the trials.

An algorithm which exhibits a large number of small injuries is not equivalent to one which exhibits a single fatality, though under the cost metric of the previous section, the two may be indistinguishable. Clearly, we need a fine grained scheme that allows us to keep track of the numbers of injury events (of various severity), rather than collapsing all injuries into a single uniform scalar value. To do this, we define a 5-band injury model, based on the injury curve:

• A Minimum Injury occurs if caregiver reaches patient before time post-alarm a.

• A Medium Injury occurs if caregiver reaches patient between time and post-alarm a.

• A Critical Injury occurs if caregiver reaches patient between time and post-alarm a.

• A Major Injury occurs if caregiver reaches patient between time and D_{a} post-alarm a.

• A Fatal Injury occurs when caregiver reaches patient after time D_{a} post-alarm a.

The first set of inputs to each assignment algorithm is a set of static configuration parameters. These include, the patients P, the caregivers C, the uniform time to death D_{i} for each vital sign i=1,...,k; the maximum time to process an injury T_{max}; the time (resp. cost) to process a fatality T_{fatal} (resp. C_{fatal}). The second set of inputs is dynamically generated, and consists of the entire sequence Â of vital sign alarms that will be raised (for all vital signs, and all patients) in the course of the simulation. To generate Â, the simulator needs to be informed of the patients P, the number of patient vital signs k, the intensity of the Poisson process governing alarms for each vital sign λ_{i}, and the duration of the simulation T_{sim}. It then generates the alarms set A(p,i,0,T_{sim}) by sampling an independent Poisson processes of intensity λ_{i}. The cumulative set of alarms is:

The operation of the simulation software is depicted in

Caregiver scheduling is a real-time problem which shares some common ground with on-line algorithms, and the

generalizes paging and caching problems, and can be viewed as an on-line vehicle routing problem [24,25]. In contrast with the k-server problem, we do not require immediate handling of on-line requests (i.e. alarms). Our focus is not on competing against alarm sequences that have been crafted by a malicious adversary, but rather to analyze and quantify our system performance on an input sequences generated from specific probability distributions. In our comparative analyses we are designing algorithms which are able to leverage emerging vital sign integration infrastructures in order to outperform the defacto caregiver scheduling algorithms that are in use today.

The Cyclic Scan algorithm (CS) represents a formalization of the defacto modus operandi of the majority of critical care units today. First, it reflects the absence of interoperability between vital sign monitoring devices: each device produces data in its own proprietary format, and data from heterogeneous devices cannot be integrated. Second, it reflects the absent of a wireless data communication infrastructure. These two features are the dominant norm in the healthcare industry today, and taken together, they reduce the task of monitoring patient vital signs to a process in which caregivers “can” among the patients’ monitoring devices to collect the presented data and status information.

The Greedy algorithm is made possible by a vital sign integration infrastructure. Alarm data is consolidated wirelessly at a central location, and each caregiver is, as they become available, dispatched to the alarm which reports the highest injury level at that moment. It is designed to prioritize (triage) handling of alarms based on instantaneous patient injury levels.^{3}

Objective. We seek to determine the maximum number of patients |P| that can be satisfactorily served by a single caregiver, and the dependency of this value on the alarm frequency λ and the maximum service time T_{max}. We seek to quantify the impact of integrated vital sign data on the efficiency of a single caregiver.

Parameters. Thirty simulations were conducted for each system configuration. Each simulation was for 480 minutes (a standard work shift) in a facility with |C| = 1

caregiver. All patients had k =1 vital sign, whose alarms time to fatality was D_{1} = 6 minutes.

Experiment 1 has three parts. In Part 1, we varied |P|, the number of patients, while fixing the Poisson alarm process intensity λ_{1} = 20 minutes, and the maximum service time T_{max} = 25 minutes and Code-Blue processing time T_{fatal} = 25 minutes. The results of Part 1 are considered the “baseline”. In Part 2 of the experiment, we varied the intensity λ_{1} = 7.5,15,40,80 minutes and studied the effects on performance against the baseline. In Part 3 of the experiment, we varied T_{max} = T_{fatal} = 6.25, 12.5, 50, 100 minutes, and studied the effects on performance against the baseline.

Part 1: Here, we seek to quantify how increasing the workload of a caregiver (i.e. the number of patient beds) impacts the emergence of injury within the critical care unit.

The reader may note that the Cyclic Scan algorithm experiences the start of a “phase transition” at 4 beds, while the Greedy algorithm begins the same phase transition at 9 beds. The algorithms complete their phase transition at 13 beds, at which point they re-merge with the performance curve of the naive Cyclic Scan.

The error bars (across multiple trials) tend to be small outside of the phase transition, but grow during phase transitions. This may lead the reader to question whether, the Greedy algorithm really outperforms the Cyclic Scan (for example in the 11 bed scenario), since the curves lie within a standard deviation of each other. The graph of

We see that each algorithm experiences a phase transition a critical number of beds at which the cost begins to rise. The question remains as to the nature of the underlying injuries? Are there many minor injuries, or a single Code-Blue, for example? The histograms in

It is clear from the prior fine-grained analysis, that both Greedy and Cyclic Scan keep cost low by uniformly keeping all injury levels low, but at some load threshold (i.e. when |P| becomes too large), both fail to be able to continue to achieve this, and are forced to trade off minimal level injuries for higher level injuries. The trade off phenomenon is made apparent in graph of

Part 2: Now we seek to quantify the influence of alarm frequency on the emergence of injuries within the critical care unit. In effect, we seek to quantify the impact of varying λ_{1} on the conclusions of Part 1.

We consider alarm sequences in which the mean interarrival time is varied between 7.5 min, 15 min, 40 min and 80 min; graphs for extreme values 7.5 min and 80 min are provided in

in an injury-free manner. The conclusion is further supported by considering the upper boundaries of the phase transition where the performance of two algorithms once again coincides. This occurs at bed counts 10, 11, 15, and 19 for the four respective scenarios. Thus, the size of the interval (in terms of bed count) for which the Greedy algorithm maintains an advantage over Cyclic Scan, increases as alarm events become more scarce. The graphs in

Part 3: Here, we seek to quantify how varying the treatment times (for injured patients) and processing times (for patients in Code-Blue), impacts the emergence of injuries within the critical care unit. We seek to quantify how varying T_{max} and T_{fatal} (which we take to be equal), impacts conclusions of Part 1.

We consider alarm sequences in which T_{max} = T_{fatal} is varied between 6.25 min, 12.5 min, 50 min, and 100 min; graphs for the extreme values 6.25 min, 100 min are provided in

incurs injuries when the bed count exceeds 32, 10, 5, 3, for each of the scenarios. By comparison, the Cyclic Scan consistently incurs injuries whenever the bed count exceeds 8, 5, 3, 2. The ratios of these values are 4, 2, 1.6, 1.5. The experiment demonstrates that using the Greedy algorithm is able to leverage reductions in alarm treat

ment/processing time towards an increased ability to handle more patients in an injury-free manner. The conclusion is further supported by considering the upper boundaries of the phase transition where the performance of two algorithms once again coincides. This occurs at bed counts 41, 22, 7, and 3, for the four respective scenarios. The range of bed counts for which the Greedy algorithm outperforms Cyclic Scan are respectively 8 - 41, 5 - 22, 3 - 7, and 2 - 3. This shows that the Greedy algorithm’s advantage over Cyclic Scan increases in settings where treatment/processing times are lower. The graphs in _{max} and T_{fatal}.

Objective. Now we determine how the system performance curves determined in Experiment 1 are influenced by the presence of multiple caregivers. In particular, we quantify the extent to which each algorithm is able to effectively leverage the availability of additional caregivers towards healthcare delivery.

Parameters. In this experiment, we used the “baseline” configuration of Experiment 1 Part 1, but we vary the number of caregivers |C| = 1, 2, 4, 8, and we varied the bed count |P| from |C| up to 100. The graph for the 1 caregiver scenario was shown previously in

The Greedy algorithm incurs injuries when the bed count exceeds 8, 18, 38, 80, for each of the respective scenarios. Normalized by the number of caregivers, this sequence is 8/1 = 8, 18/2 = 9, 38/4 = 9.5, 80/8 = 10. In the Greedy scheduling system, as the number of caregivers grows, each caregiver’s contribution to the threshold value at which injuries will appear it. Informally, it pays to get more caregivers, because each new caregiver increases the effectiveness of existing caregivers. By comparison, the Cyclic Scan consistently incurs injuries whenever the bed count exceeds 4, 7, 11, 19, for each of the respective scenarios. Normalized by the number of caregivers, this sequence is 4/1 = 4, 7/2 = 3.5, 11/4 =

2.75, 19/8 = 2.35. In the Cyclic Scan system, as the number of caregivers grows, each caregiver’s contribution to the threshold value at which injuries decreases as well. Informally, adding more caregivers, decreases the effectiveness of existing caregivers.

We can also consider the upper boundaries of the phase transition, where the performance of two algorithms once again coincides. This occurs at bed counts 12, 24, 48, 95, for each of the respective scenarios. The intervals in which the Greedy algorithm outperforms Cyclic Scan is then 8 - 12, 18 - 24, 38 - 48, and 80 - 95 beds. The widths of these intervals are thus 4, 6, 10, and 15, for each of the respective scenarios. This in turn, indicates that the width of the interval (in terms of bed count) for which the Greedy algorithm maintains an advantage over Cyclic Scan, increases by a factor that is linear in caregiver population; doubling the number of caregivers increases the width of the interval by at least 3/2.

The current scheduling process in use in CCUs was

compared to a new scheduling algorithm that makes use of an (anticipated) system that integrates monitoring information (and alarms). Our simulation study provides clear evidence that such an infrastructure reduces risk to patients, and lowers operational costs. We have, through simulation, compared the defacto Cyclic Scan algorithm which caregivers follow today, against a Greedy algorithm that is only feasible at medical institutions where a vital sign data integration infrastructure is available. We have seen that such an infrastructure has the potential to yield a considerable reduction to systemic risks for patients, and significant cost reductions for healthcare providers in the number of caregivers required to adequately staff critical care facilities. These conclusions are based on compelling evidence from simulations grounded in a precise formal model: A facility that uses Greedy scheduling will make more effective use of its caregivers than the Cyclic Scan (Exp. 1, Part 1). This advantage becomes more pronounced whenever alarm frequencies drop (Exp. 1, Part 2), or treatment time decreases (Exp. 1, Part 3). In a facility using Greedy Scheduling, it pays to get more caregivers, because each new caregiver increases the

effectiveness of existing caregivers. By comparison, in a facility using Cyclic Scan, getting more caregivers, decreases the effectiveness of existing caregivers (Exp. 2). In future work, the authors intend to extend the simulation to consider algorithms which will take into account multiple vital signs with disparate injury accumulation curves. In addition, we plan to incorporate more realistic models of alarm sequences, generated by mining real historical data from vital sign streams.