Question

Mentcare: A mental health support system

This case study focuses on the requirements for a system called the Mentcare system, which is a real system (although that is not its real name) which was used in a number of UK hospitals, including hospitals in Scotland. The system is designed for use in clinics attended by patients suffering from mental health problems and records details of their consultations and conditions. It is separate from a more general patient records system as more detailed information has to be maintained and the system has to be set up to generate letters and reports of different types and to help ensure that the laws pertaining to mental health are maintained by staff treating patients.

This is a secondary safety-critical system as system failure can lead to decisions that compromise the safety of the patient or the medical staff caring for the patient. There are also significant security and privacy considerations that have to be taken into account in the Mentcare system.

Use this case study to :-

• Identify general issues of around the requirements for information systems where the system dependability is important and security is a significant concern.

• Highlight requirements conflicts as there is a clear conflict between requirements for patient privacy and safety requirements for maintaining the safety of the patient and their carers.

• Identify the software principles that would be needed to make sure the system would be a success.

• Illustrate how requirements documents may be organized and can be used as a basis for discussing the issues and problems in developing requirements documents.

Answer 1

Mentcare system, which was used in a number of UK hospitals, including hospitals in Scotland.The system is designed for use in clinics attended by patients suffering from mental health problems and records details of their consultations and conditions. It is separate from a more general patient records system as more detailed information has to be maintained and the system has to be set up to generate letters and reports of different types and to help ensure that the laws pertaining to mental health are maintained by staff treating patients.

This is a secondary safety-critical system as system failure can lead to decisions that compromise the safety of the patient or the medical staff caring for the patient. There are also significant security and privacy considerations that have to be taken into account in the Mentcare system.

The Mid-Scotland regional health authority wishes to procure an information system to help manage the care of patients suffering from mental health problems. The overall goals of thesystem are two fold:

1. To provide better management information about mental healthcare in the region.

2. To provide an improved records system for clinical staff involved in diagnosis andtreatment.The system is NOT intended to bea complete medical records system where all information about a patients’ medical treatment is maintained. It is solely intended to supportmental health care(e.g.if a patient is suffering from some other unrelated condition,such ashigh blood pressure,this would not be formally recorded in the system).The system must therefore interoperate withand shared information withother patient record systems that are inuse.This document sets out the high-level requirements for this proposed system, knownhere as the Mentcare system.In some areas, these requirements are incomplete and moredetailed requirements must be derived after consultation with the system stakeholders.

The mid-Scotland health-authority has a statutory duty to provide mental healthcare services tocitizens living in the mid-Scotland area.Most mental health patients do not require dedicated hospital treatment but need to attend specialist clinics regularly where they can meet a doctorwho has detailed knowledge of their problems.The health authority has a number of dayclinics that patients may attend in different hospitals and in local health centres. Patients neednot always attend the same clinic and some clinics may support ‘drop in’ as well as pre-arranged appointments.All patients seen at clinicshave been referred to the clinic either by their own doctor, bydoctors in Accident and Emergency when they have attended for treatment or by hospital doctors,when they have completed a course of hospitaltreatment. The nature of mental health problems is such that patients are often disorganised so may miss appointments, deliberately oraccidentally lose prescriptions and medication, forget instructions and make unreason able demands on medical staff. The Mentcare system must therefore be able to cope with patient unpredictability and irregular attendance at clinic sessions.

The patient information system to support mental health care (the Mentcare system) is amedical information system that maintains information about patients suffering from mental health problems and the treatments that they have received.The Mentcare system has to provide both management and clinical information:

1. Management information that allows health service managers to assess performance against local and government targets and to monitor the costs of treatment

>> System Requirements

The Mentcare system is a patient information system that maintains individual patient. This section sets out general requirements that apply to the system as a whole and which are not derivedfrom any specific stakeholder.The system shall be implemented as a client-server system with patient information heldon a server maintained by the mid-Scotland health authority. Client access to the system shall be provided through a standard web browser. In keeping with the heath authorities policy of using open-source software wherever possible, the Firefox web browser shall be the standard browser that is supported. The user interface to the system shall be an interactive forms-based interface. The information that shall be maintained in thesystem is defined in sections 3-6 of this document. As far as possible, all user selections shall be made using menus of allowed items.This avoids certain types of user input errors where invalid information is input. All user inputs that are not selected from a menu shall be validated according to validation rules to be established when the system user interface is designed. If an inputis invalid, the user shall be informed why it has been rejected by the system. The Mentcare system shall include a search feature that allows users to discover there cords for individual patients. Search may be based on patient name or the patient’s national health identifier.

>> Availability requirements

1. The Mentcare system shall be continuously available during ‘normal’ clinic workinghours between 0800 and 1830, Monday to Friday.

2. Periods of scheduled maintenance for the Mentcare system shall normally be arranged during the authority’s ‘systems at risk’ periods i.e. between 2100 and midnight, Mondayto Friday and between 0800 and 1200, Sunday.

>> Response requirements

The response time of the system contributes to both operator satisfaction and operator reliability. If the response time is too long, operators will become frustrated with having to waitfor this system; this frustration can lead to errors being made.

>> Operational Requirements

The following operational constraints shall apply to the Mentcare system:

1. The Mentcare system shall make use of the health authorities drug information system that includes information about the characteristics of drugs and the costs of these drugs.Details of the interface to this system are available in the document Mid-Scot-DrugSys-2011.

2. The Mentcare system shall provide summary information about patients and treatmentsfor the national patient record system. The format of the information required is definedin the documentMid-Scot-NatSysInfo-2010. Interface definition for the NationalPatient Record System.

3. The Mentcare system shallmake use of theMid-Scotlandhealth authority’s single sign-on authentication system. This is a multi-factor authentication system that requires botha login/password and answers to personal questions for each user. Information aboutthis system is available in the documentMid-Scot-AuthSys-2013.

4. The Mentcare system shall run on hardware (Linux servers) that is available in theauthority’s data centre.Note that the maximum server memory available is currently32GB. System administrators in the centerare responsible for system backup.

5. The Mentcare system security shall conform to the standards and provisions for securemedical systemsas set out in Mid-Scot-Security-Requirements-2013.

6. There is an existing system for prescribing medication calledthe PRESCRIPTIONsystem. It is desirable that this system should be used rather than implement newprescribing functionality in the Mentcare system.

>> Privacy requirements

Privacy requirements are designed to ensure that clinical ethical standards are maintained andthat the authority follows the provisions set out in the Data Protection Act.

1. The system shall ensure that access to personal information on patient records is onlypermitted byauthorisedclinicaland management staff.

2The system shall only allow the transmission of personal patient information toaccredited staff and to the patient themselves.

3. The system shall provide a facility for patients to request personal information and torequest changes to that information.

4. A change procedure to accept or reject changes to personal information shall beestablished by the medical records office.

5. The system shall record that information has been deleted or changed according to apatient change request. The patient record shall not be linked to any change requestsmade for that record

6. When notified of the death of a patient, the patient record shall be locked as read-only.Within 3 months of the notification of death, the patient record shall be removed fromtheMentcaresystem and stored in an archive system.

Privacy requirements are made more complex by the fact that medical researchers may require access to treatment details and patient characteristics. The Data Protection Act does not permitresearchers access to individual patient records because they have no need to know of themedical problems and treatment of an individual. However, anonymized access is allowedwhereresearchers may access bulk information in the system to answer questions such as‘How many women over 50 in the EH postcode area were treated with drug X’.It is understood that maintaining anonymity is difficult if (a) there are a small number ofpeoplein any data set and (b) cross-referencing with other data sets is permitted. As aconsequence, there are restrictions on what can be included in an anonymised report.

7. The system shall include a report generation feature that allows for the creation of an onymised reports about patient conditions, treatments prescribed and treatment outcomes.

8. The creation of anonymised lists shall be restricted to a named set of individuals whomust be approved in advance by the health authority.

9. Patient names, dates of birth, places of birth and addresses may not be included in an onymised lists.

10. Geographical information may be included in anonymised list using the regionalpostcode designator only.The regional postcode designator is the first 3 or 4 postcode characters that indicate ageneral area but which does not allow identification of individual street addresses.

11. Anonymised lists with more than 20 entries may be printed on an approved printer but not exported in any electronic format.

12. Anonymised lists with fewer than 20 entries may be viewed on screen but may not be printed.