When Software Kills: What Happened At Panama's National Cancer Institute Victor Garcia feels lucky to be alive. He was one of 28 patients at the National Cancer Institute of Panama who received excessive gamma-ray radiation doses for cancer treatments in November 2000. Since then, 21 of these patients have died. The International Atomic Energy Agency (IAEA) believes at least five of these deaths were caused by radiation poisoning. The three Panamanian medical physicists who used the software to figure out the dose of radiation for these patients were charged with second-degree murder. Under Panamanian law, they may be held responsible because they introduced changes in the software that guided the radiation therapy machine used on these patients. How could this tragedy have happened? Before administering radiation treatment, a physician devises a treatment plan that determines what dose of radiation can be safely targeted at a cancerous tumor. The plan also specifies where to place metal shields known as "blocks" to protect noncancerous areas. Using this plan, a medical physicist inputs information on the blocks' size, shape, and location into software for guiding radiation machines. The software creates a three-dimensional picture of how the dose will be distributed and calculates how long the radiation treatment should last. The Panamanian medical physicists followed a doctor's instructions to be more protective of pelvic organs by adding a fifth block to the four blocks ordinarily used on cancer patients. However, the radiation machine software, which was created by Multidata Systems International of St. Louis, Missouri, was designed for treatments only when four or fewer blocks are prescribed. Olivia Saldana, one of the Panamanian physicists, tried to make the software work for a fifth block. She entered the dimensions of all five blocks as a single composite shape. Although it looked like the system could work with this composite shape, the software miscalculated appropriate doses. Patients were subjected to 20 to 50 percent more radiation than they should have received. Multidata insists that it did nothing wrong. Multidata's software manual stated it is "the user's responsibility" to verify the results of the software's calculations. Had the hospital verified the radiation doses by manually checking the software's calculations or by testing the dosages in water before radiating patients, the staff would have found out about the overdoses before they were administered. Unfortunately, the National Cancer Institute physicists did not always manually verify the results of the software calculations. Three radiation physicists worked overtime to treat more than 100 patients per day because the hospital was understaffed. The IAEA found that the hospital examined only the functioning of the hardware. It had no quality assurance program for the software or its results. Consequently, physicists were not required to tell anyone they had changed how they entered data into the system. No one questioned the software's results.

By 1997, the hospital staff was so worried about radiation overdoses that it reported to the Panamanian Ministry of Health that "overexposure of radiation therapy patients due to human error" would be a risk unless conditions at the hospital improved. Independent experts not associated with the case assert that the software that controls medical equipment and other life-critical devices should be designed to pause or shut down if told to execute a task it is not programmed to perform. When the IAEA investigated the National Cancer Institute incident in May 2001, it found other ways to get the software to miscalculate treatment times. Every time investigators treated one, two, or four blocks of varying shapes as a single block, and the software miscalculated the treatment times. The IAEA investigating team and a team from the M. D. Anderson Cancer Center in Houston found Multidata's manual did not describe precisely how to digitize the coordinates of shielding blocks. The report also noted that the manual did not provide specific warnings against data entry approaches that are different from the standard procedure described. Examiners from the U.S. Food and Drug Administration (FDA) who inspected Multidata in May 2001 found that Multidata had received at least six complaints about calculation errors related to the software's inability to handle certain types of blocks correctly. The examiners reported that Multidata had been aware of this failure since at least September 1992 but had not taken any corrective action. In 2003, Multidata signed a consent decree with the FDA to not make or sell software for radiation therapy devices in the United States. However, it can sell its products abroad. i. Who was responsible for the malfunctioning of the system? ii. Was an adequate solution developed for this problem? Explain your answer.