Applying System Engineering to Pharmaceutical Safety

While engineering techniques are used in the development of medical devices and have been applied to individual healthcare processes, such as the use of checklists in surgery and ICUs, the application of system engineering techniques to larger healthcare systems is less common. System safety is the part of system engineering that uses modeling and analysis to identify hazards and to design the system to eliminate or control them. In this paper, we demonstrate how to apply a new, safety engineering static and dynamic modeling and analysis approach to healthcare systems. Pharmaceutical safety is used as the example in the paper, but the same approach is potentially applicable to other complex healthcare systems. System engineering techniques can be used in re-engineering the system as a whole to achieve the system goals, including both enhancing the safety of current drugs while, at the same time, encouraging the development of new drugs


INTRODUCTION
Since the publication in 1999 of the Institute of Medicine report, "To Err is Human: Building a Safer Health System", safety issues and concerns have been front and center in the healthcare and pharmaceutical sectors [1,2,3,4,5].Problems in drug safety can be viewed as a classic system engineering problem, where optimizing each individual component does not necessarily result in optimal system behavior.Our underlying premise is that each stakeholder group is striving to optimize its performance and goals within the existing incentive structure around them.The drug safety control system, however, has evolved to the point where some of the individual best interests (i.e.incentives) do not necessarily add up to or align with the best interests of society as a whole.
Our ultimate goal is to determine how to "re-engineer" (redesign) the overall pharmaceutical safety control structure in a way that aligns incentives for the achievement of societal goals.A well-designed system would make it easier for all stakeholders to do the right thing, both scientifically and ethically, while achieving their own goals as much as possible.By first identifying the overall system objectives and providing the decision-makers with information about ways to achieve them and the trade-offs involved, we believe that better decision-making can result.
One use for such modeling and analysis is to provide a rigorous way to evaluate the efficacy of potential policy changes as a whole.Less than effective changes may be made when they are created piecemeal to fix a current set of adverse events.Existing pressures and influences, not changed by the new procedures, can defeat the intent of the changes by leading to unintended and counterbalancing actions by system stakeholders.The information derived from our engineering modeling and analysis process includes both (1) evaluation of potential improvement initiatives and changes, and (2) identification of potential tradeoffs and unintended consequences.These tools could potentially be used for analysis and communication by Congress, the pharmaceutical industry, the U.S. Food and Drug Administration (FDA), and other stakeholders in the pharmaceutical safety realm.
We accomplish this goal using a new, expanded model of accident causation called STAMP (Systems-Theoretic Accident Model and Processes) [6].STAMP is based on systems thinking and systems theory rather than reliability theory, which enhances its ability to deal with the complex social factors in safety.STAMP augments the traditional event-oriented, reductionist worldview underlying much science and technology and by which most people have been trained to view the world, with a process-oriented, holistic approach that incorporates complex non-linear relationships (including feedback) among socio-technical system components.In contrast to most system engineering approaches to safety and risk management, which focus on preventing failures, the emphasis in STAMP is on control or enforcing constraints on system behavior.Losses are treated as resulting from inadequate controls on the behavior of and interactions among the system components.
In this view of the world, safety is treated as a control problem.System safety goals are achieved by a safety control structure that enforces constraints on the behavior of the system components.Accidents and losses occur when the safety control structure does not operate in such a way as to enforce the required constraints on behavior."Control" is considered broadly: Safety may be controlled through design, through process (manufacturing, maintenance, operations), or through social controls.Social controls, in turn, need not necessarily be governmental or regulatory; they may also be cultural, company or professional association policy and standards, or individual selfinterest.The goal is to design a socio-technical system where the responsibilities and controls are distributed and designed in such a way that the system as a whole achieves its objectives while allowing as much flexibility as possible for each component of the system to achieve its own goals.
In this paper, we illustrate our approach to engineering healthcare safety by applying it to the experience with Vioxx, a pain reliever that acts via a Cox-2 inhibition mechanism that was voluntarily withdrawn from the market, the largest prescription drug withdrawal in history, after many reports of adverse events years after the drug's introduction to the market.Our goal is to identify the flaws in the safety control structure that allowed the events to occur and to evaluate potential fixes that have been suggested to avoid similar problems in the future.We show a conceptual model of the process that led to the losses and evaluate whether the fixes that have since been implemented will be effective as well as identify potential unintended consequences of these changes and additional changes that may be needed to prevent a reoccurrence of such events in the future.Vioxx was chosen because it involved so many of the factors that have been criticized in the pharmaceutical sector today and has prompted many changes and proposed changes.The general process illustrated in this paper, however, can be applied beyond this case and to many complex healthcare problems.

THE GENERAL APPROACH
System engineering starts with identifying a system goal to be achieved.In this case, we define the goal as: Provide safe and effective pharmaceuticals in a timely manner to enhance and maintain the near-and long-term health of the population.One of the system engineering challenges is to determine how to "engineer" or redesign the pharmaceutical safety management system in such a way that individual goals or incentives align more closely with the global goal.A well-designed system would make it easier for all stakeholders to do the right thing-scientifically, financially and ethically-while achieving their own goals.Engineering modeling and analysis using STAMP can provide decision-makers with better information about the trade-offs and potential unintended consequences involved.
Applying system engineering to a healthcare context is a somewhat different task than in other complex systems.In most engineered systems, not doing something (e.g., not inadvertently launching the missile) is usually safe and the problem revolves around preventing the hazardous event (e.g., inadvertent launch)-a risk/no risk situation.The classic engineering approach is to identify and evaluate the costs and potential effectiveness of different ways to eliminate or control the hazards involved.Tradeoffs require comparing the costs of various solutions, including costs that involve reduction in desirable system functions or system reliability.
The problem in pharmaceutical safety is different: there is risk in prescribing a potentially unsafe drug (e.g., an adverse event where treatment adversely impacts the patient's health) but there is also risk in not prescribing the drug or not having one available (e.g., the patient faces increase morbidity or mortality from their untreated or inadequately treated medical condition)-a risk/risk situation.
The risks and benefits in a risk/risk situation conflict in ways that greatly increase the complexity of decision-making and the information needed to make good decisions.Conflicting pressures must be balanced to maintain a fragile equilibrium.Here the question is "Do the benefits of the drug outweigh the risks?"That is, of course, the same question that Institutional Review Boards must address prior to giving the green light to conducting a proposed clinical trial.It is also a question that doctors have to deal with when prescribing a drug and that the FDA needs to address when it decides to approve, change the labeling of, or recall a drug.New system engineering techniques, as described in this paper, aim to provide a framework for describing, analyzing and structuring decision making around these types of complex risk/risk questions.
We use formal modeling and analysis to understand the potential hazardous interactions among system components in order to: • Find vulnerabilities in the existing system safety controls and determine how to fix them.

•
Understand "failures" of the existing controls and determine how such adverse events can best be prevented in the future.

•
Evaluate potential policy or system design changes and their potential intended or unintended consequences.

•
Evaluate new risk management paradigms.Our approach incorporates static models to understand the safety control structure (safety management system) as it currently exists and dynamic models to examine the consequences of changes in the structure and controls over time.
In this analysis, our aim is not to place blame but to understand "why" the system and those in it behave the way they do.We do not assume that anyone is malevolent; poor decisions often occur when people experience conflicting pressures or lack information about the impact of their decisions.When we understand and incorporate factors like these, we can construct more effective protection against future adverse occurrences.
The rest of this paper describes the steps in performing the modeling and analysis using STAMP.First, the hazards and safety requirements related to them as well as the safety control structure used to enforce safe behavior are identified.To evaluate potential changes to the safety control structure, the first step is to model what exists today using both static and dynamic models.The environment of the control structure as well as the controls themselves are continually adapting and changing.
To identify what needs to be changed to prevent future losses and potential unintended consequences from "fixes" to the system, the static and dynamic behavior underlying the safety control structure and its environment must be carefully examined.

IDENTIFYING HAZARDS, REQUIREMENTS, AND CONSTRAINTS
To engineer or re-engineer a system, the first step is to agree on a set of societal requirements (objectives).As stated above, we chose the following objective: System goal: To provide safe and effective pharmaceuticals and biological products to enhance the long-term health of the American people."1Important loss events (accidents or adverse events) we are trying to avoid are: 1.
Patients get a drug treatment that negatively impacts their health. 2

2.
Patients do not get the treatment they need.Each of these may occur for a variety of reasons.A patient's health can be negatively impacted, for example, if medication is not properly prescribed, drug treatments are taken without proper medical supervision, or the drug is not properly manufactured.Examples of the ways patients may not get the treatment they need include not being able to afford the treatment, not having access to medical professionals who can prescribe it, or no treatment has been developed for their condition.
Hazards are events or states of the system that could lead to an accident (loss event) and thus need to be avoided.We use the word "safe" in the following in the way that it is used in safety engineering and common language: freedom from danger or harm.There is nothing in the world that is totally safe under all conditions.The goal in safety engineering is to reduce the hazards as much as possible-they act as goals for our efforts.In medicine, "safe" might be interpreted as having an acceptable risk/benefit profile for the drug or treatment.We can sometimes completely eliminate some specific hazards but, for the most part, we can only reduce them.The hazards specify where we want to direct our efforts in reducing "undesirable consequences."Three general hazards in the pharmaceutical system are: System Hazards: H1: The public is exposed to an unsafe drug 1.
Drug is released with a label that does not correctly specify the conditions for its safe use.

2.
Approved drug is found to be unsafe and appropriate responses not taken (warnings, withdrawals from market, etc.).

3.
Patients are subjected to unacceptable risk during clinical trials.
Wrong drug prescribed for indication.

3.
Drugs are taken in an unsafe combination.4.
Drugs are not taken according to directions (dosage, timing).
H3: Patients do not get an effective treatment they require 1.
Safe and effective drugs are not developed, are not approved for use, or are withdrawn from the market.2.
Safe and effective drugs are not affordable by those who need them.

3.
Unnecessary delays are introduced into development and marketing.4.
Physicians do not prescribe needed drugs or patients have no access to those who could provide the drugs to them.

5.
Patients stop taking a prescribed drug due to perceived ineffectiveness or intolerable side effects.
From the goals and hazards, we derive a set of system requirements or goals.If we cannot agree on where we are going, then we will never know if we have arrived or how to take the next steps to get closer.Explicitly stating goals, in addition, ensures that disagreements about goals and tradeoffs about conflicting goals can be brought out into the open.In system engineering, the goals may not be totally achievable in any practical design.For one thing, they may be conflicting among themselves or with other system (non-safety) goals or constraints.The objective is to design a system, or to evaluate and improve an existing system, that achieves the goals as much as possible today and to continually improve the design over time using feedback and new scientific and engineering advances.Tradeoffs that must be made in the design process are carefully evaluated and considered and revisited when necessary.e. Marketed drugs are monitored for adverse events, side effects, and potential negative interactions.f.Marketed drugs found to be unsafe after they are approved are removed, recalled, restricted, or appropriate risk/benefit information is provided.

3.
Patients get and use the drugs they need for good health a. Drugs are obtainable by patients 3 .b. Information is available to support decision-making about risks and benefits.c.Patients get the best intervention possible, practical, and reasonable for their health needs.d.Patients get drugs with the required dosage and purity.

MODELING THE STATIC SAFETY CONTROL STRUCTURE
The next step is to construct a model of the static safety control structure.The dynamic aspects of the structure are considered later.The purpose of the safety control structure is to ensure that the system safety goals are achieved.If the goals are not being achieved, then changes to the safety controls and control structure may be necessary.
Figure 1 shows the basic pharmaceutical safety control structure in the United States relevant to the Vioxx events.The structure can be envisioned as a hierarchical set of control and feedback relationships.The FDA, for example, is partially controlled by Congress (e.g., through budgetary decisions and oversight of FDA operations), but in turn controls the approval of drugs developed and marketed by pharmaceutical companies.Controllers use feedback to learn and to make better control decisions.Accidents or unacceptable losses result from inadequate controls on the behavior of and interactions among the system components.
Pharmaceutical safety is enforced by a very complex and interconnected system.The major components of the safety control structure are: 1.
The pharmaceutical companies that develop the drugs, evaluate or study them in pre-clinical trials (e.g., bench and animal studies) and sponsor subsequent clinical trials; 2.
Other researchers who, often on behalf of the sponsoring pharmaceutical company, evaluate or study the drugs in clinical trials or, on behalf of professional societies, participate in expert panels to produce consensus guidelines on treatment; 3.
Journals that peer review and publish study findings; 4.
The FDA that reviews and evaluates the evidence generated in the pre-clinical and clinical trials and subsequently approves (or does not approve) them; 5.
Clinicians who adopt and prescribe them; 6.
Patients who take them; 7.
Third-party insurers who cover some of the costs of prescription drugs (including the Centers for Medicare and Medicaid Services, which administers the Federal Medicare insurance programs and funds or partially administers the State Medicaid insurance programs).The components of the static drug safety control structure playing a role in decision making for after-market adverse events as occurred with Vioxx and other medications.We have omitted parts of the delivery system that played no important role in the decision making, such as pharmacies, to reduce complexity.Other aspects of the structure, such as treatment guidelines, are omitted because they played no role in the Vioxx events.
Figure 1 shows our model of the static pharmaceutical safety control structure at the time of the Vioxx events and prior to any changes implemented later to try to prevent such events.The changes will be considered later.The figure focuses on the drug approval control structure.Post-approval safety is enforced by a similar control structure with slightly different interconnections (not shown for practical reasons).
The interactions among the components of the control structure are of two types: control and information.The control channels allow one group to affect the behavior of another.For example, healthcare providers control patients' access to drugs through prescribing.The information channel serves as a feedback mechanism.In this case, patients can, for example, report to their prescribing clinician side effects that they experience after taking the drug.
A complete model of the static safety control structure includes an analysis of each of the controllers and specifies the safety requirements that are enforced by the controller, the context in which the controller operates (including the mental and process models that influence their decisions) and the unsafe control actions that can lead to an accident.

1.
Safety Requirements and Constraints: A controller has specific responsibilities regarding the safety of the system and has to operate within certain safety boundaries.For example, the FDA is in charge of ensuring that the drugs that are approved are safe and efficacious.When a loss occurs, either the assignment of responsibilities is flawed or the responsibilities were not adequately carried out.Again, assigning blame is not the goal.Instead, we want to determine what to change in order to prevent future reoccurrences.

2.
Decision Context: Decisions and behavior are always influenced by the context in which they occur.Understanding why decisions are made or people behave the way they do requires understanding this context.Examples include financial pressures, time pressures or the information available (or not available) to the controller at the time.We include an English description of this context, but use system dynamics models to provide an executable and analyzable model of the dynamics of the environment in which this control component operates.

3.
Process or Mental Models: Control decisions are only as good as the assumptions and information on which they are based.If the controller's model of the state of the process is flawed, control decisions are likely to be flawed.As an example, if a doctor believes that a drug is safer than it really is, he or she might prescribe it less conservatively.This part of the description includes the information the controller needs in order to make safe decisions.When the model is used to analyze an accident that has occurred, it includes any flawed information that might have contributed to any unsafe control provided by this system component.

4.
Unsafe Control Actions: This is where the first three steps come together to explain accidents.The unsafe control actions are the actions (or lack of actions) of the controller that led to or could lead to the hazard.Those actions can be broadly classified in one of the following four categories [6]: a.A control action required for safety is not provided or is inadequately executed.b.An unsafe action is provided.c.A potentially safe control action is provided too late or at the wrong time.d.A potentially safe control action is stopped too soon or continued too long.
In the current U.S. pharmaceutical safety control structure, for example, healthcare providers have responsibility to make treatment decisions based on the best interests of the patient, to weigh the risks of treatment and non-treatment, to prescribe drugs according to the indications and intended use described in the product labeling, to maintain an up-todate understanding of the risk/benefit profile of the drugs they are prescribing, to monitor their patients under treatment for adverse events and negative interactions, and to report adverse effects potentially linked to the use of the drugs being prescribed.To carry out these responsibilities they have control over the prescriptions given.
Ideally, when clinicians make decisions about prescribing drugs, they assess their knowledge of the drug and the clinical condition for which it may be prescribed, seek additional information if necessary, evaluate alternatives (e.g., other drugs within the same class, non-pharmaceutical therapies or no therapy at all) and carefully weigh the patientspecific risk-benefit profile prior to prescribing.In reality, several other factors may influence the decision making.For example, healthcare providers may be influenced by frequent direct interactions with pharmaceutical sales personnel or heavy exposure to marketing material distributed by these representatives.Time pressures may limit the ability of clinicians to review, in detail, original clinical data relating to the drug's intended use or safety profile or to review, in detail, alternative treatments.Finally, prescribing clinicians may be influenced by patient pressures to prescribe.Patient pressure may take the form of patients specifically requesting certain drugs (e.g., as a result of direct-toconsumer advertising) or because alternative therapies have been ineffective or poorly tolerated by the patient (i.e., the clinician has exhausted all other options).Potential unsafe healthcare provider control actions include prescribing a drug, both on and off-label, for patients for whom it was not indicated or for whom the risks outweigh the benefits.The complete description of this static control structure can be found in [7].
In analyzing such a static model, one of the first steps is to determine where the responsibility for implementing each requirement rests in the safety control structure and to perform a "gap analysis" to identify holes in the current design, i.e., requirements that are not being implemented (enforced) anywhere.To accomplish this, the goals of the system (shown above) are traced to the components of the safety control structure.Is there at least one controller responsible for achieving each of the goals?Is there more than one component responsible for enforcing a particular goal?Often, losses result when responsibilities overlap in a way that leads to inadequate combined behavior.Finally, each of the controllers must be analyzed independently to verify whether they are capable of enforcing the controls assigned to them and whether the control structure as a whole is effective in achieving the system goals.Weak "leadership" or inability to enforce the constraints by those assigned that responsibility can lead to losses as can assuming that one component, such as the FDA, can be responsible for achieving goals when that component can be undermined, overruled, or have inadequate controls over the behavior of components critical to preventing losses.The design of the system as a whole has to be evaluated for unintended interactions.For example, pharmaceutical companies are legally required to report all adverse event information to the FDA.However, this requirement simultaneously creates an incentive for companies to avoid running potentially negative studies that might find its drugs to be dangerous.

MODELING THE DYNAMIC SAFETY CONTROLS
In STAMP, systems are viewed as interrelated components that are kept in a state of dynamic equilibrium by feedback loops of information and control.Systems are composed not simply of static structures, but are also dynamic processes that are continually adapting to achieve their ends and to react to changes in themselves and their environment.The original system design must not only enforce appropriate constraints on behavior to ensure achievement of the safety goals, but also continue to operate safely (the safety constraints must continue to be enforced) as changes and adaptations occur over time.For example, doctors may change their prescribing behavior or pharmaceutical companies may change their marketing strategies to adapt to changes elsewhere in the system.We use dynamic models to show how processes use feedback loops of information and control to push the system towards a state of dynamic equilibrium.
To show how the safety controls evolve over time requires augmenting our static hierarchical safety control structure model to study system changes and the physical and social influences that can lead to these changes.For these models, we use a system dynamic modeling formalism [8] that provides a framework for dealing with dynamic complexity where the relationship between cause and effect may not be obvious.System dynamics modeling is grounded in the theory of non-linear dynamics and feedback control, but also draws on cognitive and social psychology, organization theory, economics, and other social sciences.Although only the graphical form of the models is shown here, the models have a mathematical basis and can be simulated and analyzed.The strength of the pressures can be varied to change relative relationships.
The full models are too large to include in this manuscript, but we provide samples to explain the analysis performed.The full models can be found in [7].An example of a simple system dynamics model is illustrated in Figure 2. The arrows represent direct causal relationships within the system.A (+) is used to indicate a positive relationship; e.g. as the pressure on doctors to prescribe a particular drug increases, the greater the likelihood that the doctor will prescribe it.A (-) indicates a negative relationship; e.g., as the incident of side effects increases, the likelihood of a doctor prescribing the drug decreases.Delays can also be included.They introduce potential instability to the system and make human understanding much more difficult.
These relationships can form two basic types of loops: positive feedback loops and negative feedback loops.Positive feedback loops are also known as reinforcing loops because they tend to promote change in a single direction, like an unused bank account that accrues interest and increases exponentially.The reinforcing (R) loop on the right in Figure 2 shows how more drug prescriptions mean higher earnings for the drug manufacturer, which in turn may be used to pay for more advertisement and marketing efforts to get doctors to continue to prescribe the drug (see Figure 3).On the other hand, negative feedback loops are known as balancing (B) loops because they tend to counteract change.The balancing loop on the left in Figure 2 shows how increased drug prescriptions can increase the number of observed side effects, which helps balance the pressures from the pharmaceutical companies to prescribe more.
Figure 3 shows a more complete version with additional factors included such as the quality of collected data, the market size, and patient drug requests.The two basic loops remain: the one on the left describes influences based on drug studies and adverse event reporting, while the loop on the right shows influences based on pharmaceutical company earnings and marketing efforts to increase the number of prescriptions.
For a typical pharmaceutical product, more drug prescriptions lead to higher earnings for the drug manufacturer.In order to maintain or increase prescription/drug sales volume, pharmaceutical companies often use part of these earnings to maintain or increase marketing/advertising to both clinicians and consumers.This reinforcing loop is usually balanced by clinician and patient adverse experiences with the drug.In the simplified model, we have represented the adverse experiences as 'side effects.'   A simplified model of the dynamics of drug prescription.R denotes a reinforcing loop while B denotes a balancing loop.

Figure 3.
A more complete model of the dynamics of drug prescription shown in Figure 2.
is prescribed, the more likely that associated negative side effects will be observed.This experience serves to balance pressures that could come from patients or the drug companies to increase prescriptions.The two loops then theoretically reach a dynamic equilibrium where drugs are prescribed only when their benefits outweigh the risks.Delays can destabilize dynamic equilibriums.By the time the first severe side effects of Vioxx were recognized and acknowledged, for example, millions of prescriptions had been issued.Another delay was experienced in the information flow: there were significant delays between when data became available about serious adverse events and when these data were published.Delays can diminish the effects of the balancing loop on the left to the point where it cannot effectively control the reinforcing pressures coming from the loop on the right.Figure 4 provides another example, which is a model of the dynamics in drug regulation.The top of the figure shows the overall structure of the major reinforcing and balancing loops.In the lower part of Figure 4, the balancing loop on the left shows the  factors involved in the likelihood of a company voluntarily recalling a drug, including potential liability concerns.Once a drug has been approved, a pharmaceutical company, which typically has invested a large amount of money in developing, testing, and marketing the drug, has incentives to maximize revenue.This is achieved typically by increasing market share for original indications and expanding the indications for use.These types of pressure are accentuated in the case of so-called 'blockbuster' drugs where the revenue from a single drug becomes a substantial component of a company's overall financial well-being.This goal creates a reinforcing loop within the company to try to keep the drug on the market.The loop on the right shows factors that affect the FDA's likelihood of recalling the drug or requiring major changes to the drug labeling.The company may seek approval from the FDA to expand indications or intended use of the drug, and may request 'softening' of label warnings, to resist negative label changes, and to prevent drug recalls.If the company is successful at preventing these events, the expected earnings from the drug increase, which serves to strengthen the reinforcing loop on the left.The pressures in the balancing loop on the left limit the reinforcing dynamics, but they have a lot of inertia to overcome.
The model on the bottom of Figure 4 includes more complex feedback loops and more outside pressures such as the availability of a replacement drug, the time left on the drug's patent, and the amount of resources spent on a drug's development.Pressures on the FDA from the pharmaceutical companies are elaborated, including the pressures on a specific office, the FDA Office of New Drugs (OND) through the legislated user fees.Such fees create an OND incentive to keep drugs on the market because a significant part of their funding is provided by the pharmaceutical companies themselves.The OND must keep enough profitable drugs on the market in order to preserve the amount of funding they receive.The model also incorporates pressures from advocacy groups, doctors, the public, pharmaceutical companies (directly and indirectly through promotional efforts) to keep the drug on the market as well as competing pressures from the FDA Office of Surveillance and Epidemiology (OSE) and negative studies to recall the drug.This model includes a variable that represents the potential pressure that the FDA's Office of New Drugs (the entity responsible for reviewing and making recommendations to approve a new drug) may have to keep a drug on the market.This might occur, for example, when the evidence about safety remains equivocal, when there are clear benefits to a subset of the population, or when there are no alternative therapies available.
The system models were created first by building a model of the behavior for each of the individual components of the system using the information and control inputs coming in from above, the control procedures within the component, the information/control instructions going to lower level components, and feedback from the controlled (lower-level) components.The outputs from one component can then be used as inputs for another component and the component models connected.Note that much of the information within the individual component system dynamics models is the same information provided in the "context in which decisions are made" section of the static control structure models.
The models above are, of course, oversimplifications, but they illustrate how system dynamics can be used to model complex and time-dependent systems and include some of the basic underlying pressures that influence the industry and regulatory activities.The models also can be used to explain or illustrate the complex interactions that can lead to a drug (e.g., like Vioxx), remaining on the market even as its safety profile begins to decline and to be prescribed at levels much higher than would have been predicted by their approved indications.When enough data are available, they can be used to simulate how a system tips from a safe to an unsafe state or test the effects of different policies and study their system-wide repercussions.The complete models we created can be found in [7].

VALIDATING THE MODELS
One way of validating these types of models is through peer review.The static and dynamic models were reviewed by experts individually and also in two group review sessions.These sessions included representatives from each of the major groups: pharmaceutical companies (and PhRMA, the pharmaceutical industry association), healthcare providers, the FDA, and academic researchers.The group review sessions were coordinated by the Center for Biological Innovation at MIT. System dynamics models are executable and, if adequate data can be obtained, validation can take a quantitative form including reasonableness testing, sensitivity analysis, and comparison with historical data.We were able to validate parts of the models for which data were available or for which we could do reasonableness testing given relative values for the parameters.The models, as a whole, however, could not be validated in this way because much of the data needed are proprietary and, because of Vioxx litigation issues, were never released or the data just do not exist.For this reason, we used the models qualitatively and not quantitatively.

USING THE MODELS
This section provides an example of the type of analysis and the results that might be obtained from using these new system engineering tools in healthcare.Three types of analyses were performed: a causal analysis of the Vioxx events, a gap analysis on the pharmaceutical safety control structure (Figure 1), and an analysis of the effect of potential policy changes recommended and sometimes implemented in the wake of the Vioxx recall.

Causal Analysis
The first analysis was a "root cause" analysis of the Vioxx events using the static safety control structure model.The static control structure was augmented with specific information related to the Vioxx loss.The goal of such a causal analysis is not to affix blame.Blame is anathema to safety [6].Instead, a complete analysis should point to the contribution of all the players, and most important, to the unsafe interactions among the components and gaps in the safety control structure.While it is necessary to determine how each person contributed to the untoward events, the analysis continues from that point to determine why it made sense to that person to act in the way they did.Nobody intentionally wanted people to be injured.Sometimes the problem was an inconsistency between the controller's process model and the state of the real world and in others the reason can be found in the context in which the decisions were made.
Once the causal analysis was completed, a set of recommendations was generated to strengthen the entire safety control structure.

Gap Analysis
The gap analysis, which traced the system-level goals to the responsibilities of the individual safety control structure components, not surprisingly found no obvious gaps in terms of the safety goals being assigned to at least one component of the structure.Potential problems identified were related to more subtle problems.For example, multiple components were often in charge of enforcing the same safety responsibility.For example, the FDA, the pharmaceutical companies, and physicians are all responsible for monitoring drugs for adverse events.Having multiple system components assigned the same responsibility is not an issue if they work together and share the information they have.However, if they each rely on the others to perform the monitoring, problems can go unnoticed for periods of time.
In addition, the assignment of responsibilities does not mean they are effectively carried out.Contextual factors must be considered such as external or internal pressures working against effective implementation or application of the safety controls designed into the system.For example, given the financial incentives to maintain a 'blockbuster' drug on the market, it may be unreasonable to expect pharmaceutical companies to be responsible for safety of their drugs without strong independent oversight and controls.It has even been suggested that responsibility for drug development and testing be separated from pharmaceutical manufacturing and marketing [9].
Controllers must also have the resources and information necessary to enforce the safety requirements (constraints) they have been assigned.Physicians need up-to-date and independent information about drug safety and efficacy in order to adequately protect their patients.One of the first steps in performing an analysis of the drug safety control structure is to identify the contextual factors that can influence whether each component's responsibilities are carried out and the information required to support informed decision making in exercising the controls the components have available to carry out their responsibilities.
The analysis of adverse events, such as those related to Vioxx, can provide additional important clues as to whether the safety control structure is effective in achieving the safety goals.Part of the analysis of a loss event (or events) involves determining whether responsibilities were fulfilled and, if not, why not and what changes are necessary for improvement of the overall design of the safety control structure.Losses like Vioxx are a precious resource for improvement and learning.

Analyzing Potential Efficacy of Policy Changes after the Vioxx Recall
The first step here was to combine the different component system dynamics models into two larger models of the healthcare system, each centered on a key process: 1) the prescription of Vioxx by doctors and 2) the recall of Vioxx by the FDA or pharmaceutical companies.These two processes are critical because they represent key gate-keeping points: Without a prescription from doctors, patients do not have access to the drug and if the drug is recalled from the market, doctors simply cannot prescribe it.The two new systems can be studied as separate system dynamics models, each with its own set of pressures driving the gate-keeping decisions.
Our goal for these models was to use them to investigate the potential effectiveness and unintended side effects of the changes proposed and implemented after the events that led to the voluntary withdrawal of Vioxx from the market.For example, the FDA Amendments Act (FDAAA) of 2007 increased the responsibilities of the FDA and provided it with new authority.Additional recommendations were proposed by an independent Institute of Medicine (IOM) report [10], but were not included in the 2007 legislation that was enacted.We also considered our own recommended changes from the causal analysis we performed of the Vioxx events noted above [7].

Efficacy of the FDAAA Provisions
In the first part of the analysis, we studied the effects of the FDAAA changes.We first studied the effects component by component, by studying how the changes would affect the context of each component in the control structure using the system dynamics models.As an example, a more detailed FDA model is shown in Figure 5 below.The complete model can be found in [7].We then assembled the individual component models to create a system model that can be used to analyze the dynamic effects of the FDAAA recommendations.Adding the changes to the system dynamics models and tracing the repercussions throughout the system illustrates how those changes affect the context in which the controllers operate and what control and communication channels More detailed system dynamics model of the FDA.might be affected.For example, FDAAA gives the FDA the authority to update drug labels, changing the regulatory environment in which the agency operates and affecting the dynamics between the agency and the pharmaceutical companies.This mapping however only illustrates the local effects of the changes and not their systemic repercussions.Those repercussions were studied using a new set of system-wide models.
Using the augmented models, we were able to trace the dynamic effects of the changes, better understand their short and long term effects, and outline their potential weaknesses.Returning to drug label example, the system dynamic models illustrate how the FDA's new authority will have repercussions on the pharmaceutical company's likelihood to recall drugs and the doctor's willingness to prescribe the drug.This first step of the analysis allowed us to identify the most potentially effective parts of the FDAAA.
Based on our analysis, we concluded that most of the regulatory changes that were enacted in the 2007 FDAAA legislation will produce the intended effects.For most of the changes, the analysis suggests that the recommendations will help to either limit or counterbalance the pressures on doctors or create incentives for faster and more accurate reporting of adverse events, leading to better information available to doctors (and others).Again, this was not very surprising although the analysis does describe in detail the mechanisms behind these improvements.For example, two initiatives in particular should have a positive safety impact: the development of an improved information system and increased authority for the FDA to monitor post-approval drug safety.
Our dynamic models of the way drugs are prescribed confirm that being able to detect adverse events early and accurately is necessary to balance marketing and promotion efforts by the pharmaceutical companies.A modern information system of interconnected databases and other electronic health record systems, including information about past and ongoing trials, is necessary for monitoring and early detection of new adverse events.The current Adverse Event Reporting System (AERS) does not provide all the necessary information.FDA's risk management initiative is intended to remedy these shortcomings, in part.The agency is learning how difficult it is to implement such efforts without accounting for, and gaining the cooperation of all major stakeholders [11].These limitations were made clear in the Vioxx case when FDA scientists could not depend on the AERS data and turned to an external database provided by Kaiser Permanente to establish that Vioxx use was associated with the risk of serious coronary heart disease [12].
Considering the system dynamics model in Figure 3, the changes essentially strengthen the balancing loop on the left.Strengthening the balancing loop serves to counteract the reinforcing loops on the right.
More encompassing and accurate information will shorten the system's response time to adverse events and reduce reporting delays in the left balancing loop in Figure 6.Ultimately, the limiting factor will be the delay before the first negative side effects appear, but even a "perfect" reporting system is bound by this constraint.Sentinel [13] is, of course, an important initiative aimed at correcting this problem.
Our models also support recommendations to increase the FDA's ability to regulate advertising and promotion as well as foster greater transparency in clinical trials.The parts of the system dynamics model in Figure 3 that are directly affected by increased FDA authority include their ability to control advertising, foster transparency in clinical trials, and control drug prescriptions.In addition to strengthening the balancing loop on the left, the increased FDA authority directly affects two of the four reinforcing loops on the right by controlling the amount of feedback they can provide.
Such regulatory oversight would serve to counterbalance the influence of pharmaceutical companies over doctors.Similarly, giving the FDA the authority to change drug labels without approval from the drug manufacturer and the authority to require additional safety studies provide the FDA with new leverage to act faster and would be in the public interest.

Limitations of the FDAAA
The FDAAA legislation has limitations, and some provisions may even be counterproductive.In the second part of the analysis, we proposed changes that went beyond those in FDAAA.The changes were the result of a three-step process: first, we created a new safety control structure and system dynamics models that included all the FDAAA recommendations (controls); second, we mapped all the safety requirements on the control structure and the system dynamics models and identified the ones that could not be appropriately enforced, even with the new FDAAA controls; third, we added to the models new controls to fill the "safety gaps", both in the static control structure and in the system dynamics models.
Congress increased the targets for the amounts of user fees to be raised from the drug industry and directed a larger part, about ten percent of those user fees, to be used for post-approval safety, including $25 million per year to develop active surveillance.This increase in funding for post-approval safety is important and was recommended in the IOM report.More resources would help the FDA to hire appropriate staff and conduct more post-approval safety studies.Of course, additional resources by themselves are not enough-there are also issues about the right type of staff and studies/research.Figure 4 shows part of our dynamic model directly affected by these Prescription Drug User Fee Act (PDUFA) fees.Although the additional revenue may provide some positive benefits, it also introduces a new reinforcing feedback loop that could lead to new pressures on OSE and FDA management, by creating a sense that the agency's budget depends on the pharmaceutical companies.Those pressures could potentially offset and negate the positive effects of the increase in post-approval safety resources and erode the effectiveness of one of the few balancing loops that exist currently within the FDA.
A second potential limitation is that many of the changes in the enacted legislation are resource-intensive.For example, the agency is expected to review the more detailed adverse events reports and conduct analyses of the data acquired through the new electronic health reports databases, monitor direct-to-consumer advertisements more closely, and review and approve comprehensive risk mitigation plans for new drugs.Will the FDA have the resources needed to meet this increased workload?Without an adequate long term increase in funds and qualified personnel, it is possible that the FDA will not be able to meet all its requirements and will have to work under resource constraints, meaning that some of the tasks might not be given the time and attention they deserve.These constraints will affect the context in which FDA staff involved in new drug approvals and safety monitoring work and can affect the agency's ability to resist pressures from the pharmaceutical companies and others.Ultimately this increase in responsibilities might have perverse side effects because it forces the agency to stretch its resources and can lead to a decrease in overall safety.
A final potential limitation of the FDAAA legislation is that it requires gradual reduction of permitted conflict of interest waivers for advisory committee members.This requirement responds, in part, to criticisms in the Vioxx case that some of the members of the FDA's advisory board in charge of the pre-and post-market regulatory actions had direct financial ties to the drug's manufacturer.The FDA's external advisory panel model operates on the premise that decisions and input are as free from bias as possible.However, increasingly, the clinical and research experts who are most qualified to review a specific drug application have some type of direct or indirect financial ties to the pharmaceutical industry.Finding reviewers who are both qualified and completely free from potential conflicts of interest may be challenging.To overcome this problem, the FDA may not only need to apply new strict waiver enforcement rules (new controls), but also establish balancing influences, for example, make it more rewarding financially, professionally or academically to be selected for an FDA committee.Without those balancing pressures, it will be difficult to offset inherent influences of the pharmaceutical companies on FDA advisory boards.

Additional Changes Needed
Another result of the modeling was that some of the recommendations that were included in the IOM report, but not incorporated in the enacted legislation, could be beneficial and should be considered in further legislation.We also identified potentially important changes that are not in either current legislation or the IOM report.
The FDAAA safety changes are mainly based on the "Future of Drug Safety" published by the Institute of Medicine (IOM) and the 25 recommendations that came out of this report [10].Most of the suggested changes were implemented by Congress but a few of the key recommendations were not.For example, most of the funds allocated toward post-market surveillance activities are derived from user fees and not, as suggested by the IOM, from general appropriations.This introduces a new feedback loop that reinforces existing pressures to avoid drug recalls.As an alternative, Congress could use general appropriations to fund the drug safety monitoring efforts (the OSE), which would lessen some of the industry influences shown in Figure 4.
Even without the influences introduced by user fees, the FDAAA still leaves the safety monitoring function in an advisory position to the new drug approval process and fails to allow decisions to change labels or recall drugs to be made independently.Although it is normal practice for industry to change the label when asked by the FDA, the speed with which such changes are made is also important.By not making OSE a completely independent office, FDAAA limits OSE's ability to reverse OND decisions and severely limits the effects of the controls that are imposed on the post-approval system as a whole.This limitation is significant, especially if, as has been suggested before [14,15,16], OND is not sufficiently independent of pharmaceutical company interests.
Similarly, the analysis suggests that the FDAAA changes do little to strengthen the potential management, oversight and leadership issues at the FDA outlined in the IOM report.The model in Figure 3 highlights the effect FDA leadership can have on pressures to recall a drug or keep it on the market.For example, the IOM report recommended that the FDA Commissioner be appointed for a six-year term to help stabilize the leadership of the FDA, but FDAAA leaves the problem of high turnover of senior officials unaddressed.Without stable and consistent leadership, there are few pressures to drive the agency to reform itself and follow through on its long term post-approval safety commitments.It is important for Congress to support senior officials in the agency who are committed to solving the difficult organizational problems facing the agency.
Even if all the IOM recommendations had been implemented by Congress, the safety effects would be limited because the changes focus on a single component of the system, the FDA, and Congress's interaction with the FDA.The FDA does not operate in a vacuum: The proposed changes do not take into account the safety role played by the other components of the pharmaceutical safety structure (Figure 1), particularly physicians, and the role that the interactions among the system components play in pharmaceutical safety.As a result, the pressures that led to the erosion of the overall system safety controls were left unaddressed and are likely to lead to changes in the system static and dynamic safety controls that undermine the improvements implemented by FDAAA.If we do not address the broader tensions and dysfunctional interactions in the overall U.S. pharmaceutical safety control structure, risk to the American public may be unnecessarily elevated.
Two important issues that were omitted from both FDAAA and the IOM report are the use of comparative studies and the level of certainty required for a drug recall.
Clinicians, patients, and payers must have access to comprehensive and relevant evidence about the safety, effectiveness, intended uses and risk/benefit profiles of drugs in order to make more informed decisions about the best course of treatment.Alternatives to wholly industry sponsored clinical trials may be needed.The FDA might consider (1) encouraging comparative effectiveness studies both as part of the approval and post-approval process, and (2) defining best-practices and protocols to make sure that the studies are conducted in an effective and unbiased manner.These measures would both serve to strengthen the balancing loop on the left in Figure 3.Some measures have been taken to address these issues.
Researchers and journals play an important role in safety; they provide the information doctors need to better understand how drugs work, when they should be prescribed, and what their side effects are.However, journals have to deal with ghostwriting, guest authorship and non-disclosure issues that lead to a biased representation of the risks and benefits of a specific product.Although in the wake of the Vioxx events, additional controls have been added, our models suggest that more controls are needed to deal with this problem.Examples of possible new controls include greater transparency and tracking of financial relationships between industry and clinicians who conduct research on drug safety and efficacy.
Finally, clinicians are the last drug safety gatekeepers.It is their responsibility to be informed about new treatments and their risk-benefit profiles.Those tasks become more difficult to perform adequately when a substantial source of information about marketed drugs comes from marketing materials prepared by the pharmaceutical companies.It is therefore important that balancing loops be strengthened such as limiting private industry influence on medical education and drug promotion and providing alternative, independent channels for information dissemination.Many such steps have already been taken at the State level.In Massachusetts, for example, the state Board of Registration in Medicine maintains a database of financial payments to licensed clinicians and many hospitals have strictly limited direct access of pharmaceutical representatives to clinicians.While some progress has been made in this area, more is needed.New communication channels to doctors about the risks and benefits of specific drugs are an important feature of an improved drug safety control structure.

CONCLUSION
In this paper, new systems engineering modeling and analytical processes applicable to complex healthcare systems were described and then illustrated by using them to evaluate the prospective and actual changes to the FDA's post-approval safety policies after the Vioxx events.The contribution of our modeling and analysis is a rigorous way to evaluate the efficacy of potential policy changes within the overall safety control structure and to understand the behavior and interactions among the components.
The illustration showed how the approach can assist in policy making.Most of the FDAAA changes were found to be useful, for example, and will, according to the analysis, have the intended effects.A few may be counterproductive.Our findings also suggest that additional controls beyond those that were incorporated as part of the FDAAA legislation may need to be implemented to achieve stated public safety goals.The changes called for in the legislation do not resolve some potential conflicts of interest.In addition, the FDA is granted new responsibilities, but may need to accomplish them without additional resources.The legislation does nothing to alter the FDA's internal organizational structure, which at times competes for jurisdiction in safety-related decision-making.
Many other policy recommendations, beyond those identified in this paper, need to be considered.Change also needs to come from within the organizationsgovernmental, public, or commercial-through organizational learning or training.And any interventions that may be selected may not be meaningful unless adequate resources are provided to carry them out.
Another potential contribution of such analysis is the ability to evaluate the impact of multiple changes within the entire safety control structure.Most of the FDAAA changes were imposed on the FDA and not the other important components of the safety control structure.Less than effective controls may be implemented when they are created piecemeal to fix a current set of adverse events.Existing pressures and influences, not changed by the new procedures, can defeat the intent of the changes by leading to unintended and counterbalancing actions in the components of the industry safety control structure.System engineering techniques suggest how to re-engineer the safety control structure as a whole to achieve the system goals, including both enhancing the safety of current drugs while at the same time encouraging the development of new drugs.

Figure 1 .
Figure 1.The components of the static drug safety control structure playing a role in decision making for after-market adverse events as occurred with Vioxx and other medications.We have omitted parts of the delivery system that played no important role in the decision making, such as pharmacies, to reduce complexity.Other aspects of the structure, such as treatment guidelines, are omitted because they played no role in the Vioxx events.
Figure 2.A simplified model of the dynamics of drug prescription.R denotes a reinforcing loop while B denotes a balancing loop.
keeping drug on the market (lawsuits, loss of reputation if recalled, etc.)

Figure 4 .
Figure 4.A model of the dynamics in regulating drug prescriptions.The top shows the structure of the more complete model on the bottom.
Figure 5.More detailed system dynamics model of the FDA.