Victor Garcia feels lucky to be alive. He was one of 28 patients at the National Cancer Institute of Panama who received excessive doses of gamma ray radiation for cancer treatments in November 2000. Since then, 21 of these patients have died, and the International Atomic Energy Agency (IAEA) believes at least five of these deaths were caused by radiation poisoning.

The three Panamanian medical physicists who used the software to figure out the dose of radiation for these patients were charged with second-degree murder. Under Panamanian law, they may be held responsible because they introduced changes in the software that guided the radiation therapy machine used on these patients. How could this tragedy have happened?

Before administering radiation treatment, a physician devises a treatment plan that determines what dose of radiation can be safely targeted at a cancerous tumor. The plan also specifies where to place metal shields known as blocks to protect noncancerous areas. Using this plan, a medical physicist inputs information on the size, shape, and location of the blocks into software for guiding radiation machines. The software creates a three-dimensional picture of how the dose will be distributed and calculates how long the radiation treatment should last.

The Panamanian medical physicists were following a doctors instructions to be more protective of pelvic organs by adding a fifth block to the four blocks ordinarily used on cancer patients. However, the radiation machine software, which was created by Multidata Systems International of St. Louis, Missouri, was designed for treatments only when four or fewer blocks are prescribed.

Olivia Saldana, one of the Panamanian physicists, tried to make the software work for a fifth block. She entered the dimensions of all five blocks as a single composite shape. Although it looked like the system could work with this composite shape, the software miscalculated appropriate doses. Patients were subjected to 20 to 50 percent more radiation than they should have received.

Multidata insists that it did nothing wrong. Multidatas software manual stated it is the responsibility of the user to verify the results of the softwares calculations. Had the hospital verified the radiation doses by manually checking the softwares calculations or by testing the dosages in water before radiating patients, the staff would have found out about the overdoses before they were administered.

Unfortunately, National Cancer Institute physicists did not always manually verify the results of the software calculations. Three radiation physicists were working overtime to treat more than 100 patients per day because the hospital was understaffed. The IAEA found that the hospital examined only the functioning of the hardware. It had no quality assurance program for the software or for its results. Consequently, physicists were not required to tell anyone they had changed the way they entered data into the system and no one questioned the softwares results.

By 1997, the hospital staff was so worried about radiation overdoses that it reported to the Panamanian Ministry of Health that overexposure of radiation therapy patients due to human error would be a risk unless conditions at the hospital improved.

Independent experts not associated with the case assert that the software that controls medical equipment and other lifecritical devices should be designed to pause or shut down if told to execute a task it is not programmed to perform. When the IAEA investigated the National Cancer Institute incident in May 2001, it found other ways to get the software to miscalculate treatment times. Every time investigators treated one, two, or four blocks of varying shapes as a single block, the software miscalculated the treatment times.

The IAEA investigating team and a team from the M. D. Anderson Cancer Center in Houston found Multidatas manual did not describe precisely how to digitize coordinates of shielding blocks. The report also noted that the manual did not provide specific warnings against data entry approaches that are different from the standard procedure described.

Examiners from the U.S. Food and Drug Administration (FDA) who inspected Multidata in May 2001 found that Multidata had received at least six complaints about calculation errors related to the softwares inability to handle certain types of blocks correctly. The examiners reported that Multidata had been aware of this failure since at least September 1992, but had not taken any corrective action. In 2003, Multidata signed a consent decree with the FDA that it would not make or sell software for radiation therapy devices in the United States, although it can sell its products abroad.

Who was responsible for the malfunctioning of the system?