Introduction
Despite careful verbal and visual patient identification in radiotherapy centres, it is possible to treat a patient with another patient’s beam data. To minimise these events ICRP 86 suggests effective patient identification procedures (i.e., photographs for patient identification).Reference Ortiz, Andreo, Cosset, Dutreix, Landberg, Pinillos, Yin and Biggs1 Based on a quality system of a single institute, the incidence of mistreatment due to misidentification is 1 per 11,000 treatment fractions.Reference Lahtinen and Palmgren2 Evidently, a high patient work load, fast pace of work, staff shift changes and hearing problems of the patients are reasons for these unhappy events. In the work of Hakimzadaa et al.,Reference Hakimzadaa, Greenb, Sayanb, Zhangc and Patel3 patient registration errors in an emergency department were analysed thoroughly. They concluded that causes for these errors are complex and arise mainly for the same reasons as misidentification errors in the radiotherapy department, such as high patient load and a tendency to adopt shortcuts in workflow.
The consequences of treating a single treatment field once erroneously are not usually serious with low fraction doses. However, if the accidental fractionated dose to healthy or critical organs is of the order of 3–10 Gy, the exposure may cause a health problem for the patient. In all cases these events should be reported to patients, hospital administration and local and national radiation safety officials. Since these accidents reduce confidence in the radiotherapy service, zero-tolerance is needed to prevent these events.
To eliminate mistakes and to have a system to assist patient identification, different patient recognition approaches were considered, such as, smartcards and biometrics.Reference Erdley4,Reference Moser5 Although the barcode system was already available from one linear accelerator (linac) vendor, it was not considered to be error-free during the long radiotherapy schedules, since the patients can forget or lose their barcodes. Similarly, a photograph in the patient record was not regarded as sufficient for patient verification. A photograph could easily be ignored or overlooked in a hurried situation. The final choice made in 2004 was between iris or fingerprint recognition, since these methods were commercially available and used commonly in non-medical applications.Reference Corby, Schleyer, Spallek, Hart, Weyant, Corby and Bretz6 Although iris recognition was reported to be more sensitive than the fingerprint method, the iris method was considered to be technically difficult to implement with elderly people. Also, the cancer medication used could change the iris and its vasculature. For example, treatment with prostaglandin analogue causes increased pigmentation in human irises due to histological changes.Reference Arranz-Marquez, Teus, Saornil, Mendez and Gil7 Fingerprint-based recognition method has been used successfully in general patient registration in a hospital with more than 2000 registered patients.Reference Appleby8–Reference Burdine10 The registered thumbprints are stored and linked to patient records. The fingerprint recognition has been described as time saving, convenient and secure. Therefore, a fingerprint method was selected because of its high sensitivity, ease of use and low costs. Subsequent to this, a radiotherapy centre in the Netherlands has applied a fingerprint-based patient recognition system.Reference Appleby8 In Finland two centres have now started to use a similar system as prescribed here.
Technique
A commercial fingerprint recognition system, mainly used for safety and personnel monitoring of banks and offices, was selected and modified for radiotherapy purposes in 2004. The system (Deltamedi, Deltabit Ltd, Tampere, Finland) included two desktop computers with fingerprint software, a reference fingerprint reader and three checkpoint readers for the entrances of each linac (Figure 1). Furthermore, the software for the fingerprint recognition system was developed in co-operation with Varian Medical Systems Finland Ltd to utilise the existing user-defined linac verification interlock system in the treatment workstation.
Figure 1. Fingerprint checkpoint reader at the entrance of the treatment room. The reader is enlarged to illustrate the oval-shaped reader window. The sponge for moisturising the finger can be seen.
The fingerprint reader uses an optical USB-connected device (DigitalPersona, Redwood City, USA) which is able to read the whole fingertip at a single touch. As soon as the fingertip is imaged, the reader calculates a numerical equivalent of the fingerprint using nine separate points from the fingerprint image. The original image from the fingerprint is then deleted and information from the selected points is encrypted with 128 bit encryption before sending the patient code to the computer. It is impossible to create the fingerprint image from the encrypted code in the computer database.
Due to department logistics the reference finger print is taken before the start of the first treatment fraction. That is usually done before or after the CT simulation. If the department workflow is changed, it will be better to obtain the reference finger print in the beginning of the treatment schedule to be able to verify all pre-treatment steps also. That would consequently lead to the need for more scanners. Now the first fingerprint identification checkpoint is at the treatment room door. The reference finger print is obtained from the right index finger by default. It could be taken from any or all of the fingers in case that default finger is not usable because of scars, wounds, skin diseases or a bad-quality fingerprint image. The radiation technologist taking the reference fingerprint can assess the quality of the print by visually from shown fingerprint image and numerically (from a scale of 1–100) during the process. A threshold level for positive identification must be set on the software’s control panel. If the threshold level is adjusted higher, the system becomes more stringent and demands better quality fingerprints for positive identification. It has been noticed that if the threshold level is set higher than 60, it is difficult to identify some patients. On the contrary if the level is set too low the identification becomes unreliable because of false positive identifications. As a precaution in the clinical version of the software, the user cannot lower the threshold value under 40. In this study a threshold level of 40 is used. At this level most of the patients are identified at the first try and no false positives have been noticed. If the patient would have a false positive identification due to poor fingerprint, the situation is noticed by the technologist, because the system indicates that an override situation has occurred. That is because a patient fingerprint is compared only to the selected (from the verification system) patient’s print and to all the technologist’s prints. Therefore it is not possible for patient to mix up with another patient’s information.
Before a patient enters the treatment room, the radiation technologist chooses the corresponding reference data from the record and verify system. A checkpoint reader at the entrance of the treatment room displays the patient ID number on the screen (Figure 1). When the patient touches the reader, the system registers the nine points from the finger image for encryption and compares the encrypted code against the reference information from the database. When the patient is correctly verified as the selected patient, the name of the patient and a green ‘traffic-light’ is displayed on the screen and the interlock of the linac preventing the treatment delivery is cleared. If the patient cannot be identified, the checkpoint indicator light is red and this prompts for another fingerprint reading from the patient. If the second identification also fails, the accompanying radiation technologist will ask the patient to check whether the ID number on the screen belongs to him/her. The radiation technologists have the possibility to override the system with their own finger, especially when the patients cannot do it. The system keeps a record of successful and negative identifications.
Results and discussion
In Kuopio University Hospital the fingerprint identification system has been in clinical use since the summer of 2004. A survey lasting 6 months indicated that 85.7% of the daily treatment fractions were successfully identified. The remaining fractions were overridden by the staff, mainly due to two reasons. First, in 5.5% of the fractions the patient or technologists forgot to identify at the checkpoint reader before entering the treatment room. If the radiation technologists were already setting up the patient, the technologists are not asking the patient to return to the checkpoint reader for identification, but instead override the recognition system. Second, for 8.8% of the fractions the fingerprint was not accepted, although the score for the reference fingerprint image was more than 40. Often this is the case with old patients who have thin skin and poor-quality fingerprints, but also with manual workers who do work with their hands, such as bakers, kitchen workers and builders. Figure 2 (top chart) illustrates the fingerprint scores from all successfully identified patients during the period from July 2006 to January 2007. A calculated trend line indicates changes in the mean value of fingerprint scores. Since the fingerprint system does not record unsuccessfully identifications, the scores that are below the used threshold level 40 are excluded form the top chart. In Figure 2 is also an example of a patient with good-quality fingerprints and a patient with poor-quality fingerprints, whose several treatment fractions have been overridden by the technologist. The large fluctuations seen in the fingerprint scores can be explained with the position of the finger on the reader. If the patient does not put the finger exactly at the same position and at the same angle on the reader’s optical window like it was with reference print, it will affect in the score. The fingerprint may also change with ambient air humidity, especially during a winter season when the heating is on and the hands are dry. Therefore, during the winter season a wet sponge is provided beside the fingerprint reader so that patients can moisturise their finger before registration. In contrast to Poels et al., we have not found that medication makes the identification more difficult.Reference Poels, Hanbeukers, Offerman-Wulms, Mond van de, Velders, Visser, Backes and Lambin11
Figure 2. (a) Fingerprint scores recorded over a period of 6 months illustrate a considerable variation between patients. A trend line has been calculated to the chart to indicate changes over periods. The scores less than 40 are not recorded by the system. Average value of all scores is 70. (b) An example of a patient with good fingerprint. All fractions have been successfully identified, with an average score of 81. (c) An example of a patient with poor fingerprint. Grey bars represent the fractions when the technologists have overridden the system because of unsuccessful registration. The average score of successful registrations (black bars) is 59.
During a 2.5-year period no patients had been incorrectly treated in ∼47,000 treatment sessions. Before the fingerprint recognition system, 10 patients were treated over 5.9 years for whom one or more treatment fields of one fraction were treated with the field parameters from another patient. One patient during the 2.5-year period refused to give his fingerprint for anonymity reasons. All the patients are being informed of the possibility to refuse from giving their fingerprint. Also the fact that the actual fingerprint image would not be stored or analysed is explained thoroughly. As the system only stores the numerical equivalent of a few points of the fingerprint, such information can only be used for this application or purpose. The database is cleared approximately once per year to keep the computer’s memory load small and retrieval times short. During this process all old fingerprint data are deleted. Also the computer where the fingerprint database is stored is protected by password and it is stored behind locked doors to prevent possible theft. This is considered to be an adequate way of protecting patients’ privacy and rights. In the Finnish legislation the role of the biometric identification in healthcare is not yet assessed. Therefore at present it is legal for hospital to take and store a fingerprint if patient gives his/her consent and the record is handled and stored according to legislation for medical records.
The problems of the existing hardware have mainly been related to the checkpoint reader. Due to frequent cleaning and disinfecting the touch screen membrane loses its translucency over time. Changing the reader every second year has minimised the occurrence of these problems.
The identification rate of 85.7% can be regarded as low. We believe that it can be increased by introducing a finger guide to the fingerprint reader. The finger guide will be a U-shaped plastic piece that is fitted on the fingerprint reader. It will centre the finger in the correct position and prevent the finger from going outside the reader. This will help people who have problems in positioning their finger, for example, due to a tremor of the hand. Technologists will help patients with problems in finger positioning by pushing the reader to the finger instead.
In the future, mutual co-operation between the vendors of the fingerprint systems and companies producing linac verification software will be required. After any update from either vendor, it is essential that both systems still work together. However, this is a difficult requirement because vendors have many customers whom all have differing needs for the software. This relates also to forthcoming features of the fingerprint systems during the patient check-in. A fingerprint reader placed in the waiting room can save extra work for the radiation technologists because the system will indicate the arrival of the patient at the linac console. The system can also increase the anonymity of the patient if the system is coupled to a queue number printer and screen.
Since the installation in 2004, the fingerprint identification system has been a part of the routine work in patient identification. The system is easy to operate for both staff and patients and has been well adopted. Due to poor-quality fingerprints from a few people and the possibility of human error in special situations as hardware failures, the system is not however flawless as first expected. But taking into account the low incidence of these events the system can still be considered as very secure and a positive supplement in patient identification in a busy radiotherapy department. In Finland the presented identification system has had positive interest from other hospitals and similar systems have been installed.
