Declarative Process Mining in Healthcare Marcella Rovania, Fabrizio M. Maggib, Massimiliano de Leonic,d, Wil M.P. van der Aalstd, Ronny S. Mansd, Alessandro Pepinoa aUniversity of Naples Federico II, Naples, Italy bUniversity of Tartu, Tartu, Estonia cUniversity of Padua, Padua, Italy dEindhoven University of Technology, Eindhoven, The Netherlands Abstract Clinical guidelines aim at improving the quality of care processes based on evidence-based insights. However, there may be good reasons to deviate from such guidelines or the guidelines may provide insufficient support as they are not tailored towards a particular setting (e.g., hospital policy or patient group characteristics). Therefore, we propose an approach to mediate between event data reflecting the clinical reality and clinical guidelines describing best-practices in medicine. Concretely, we repair and enrich declarative process models based on event logs. Initial models based on clinical guidelines are improved by observing the real process. Declarative models are used as they allow for more flexibility. Process mining techniques are used to check conformance, analyze deviations, and enrich models with conformance-related diagnostics. The approach has been applied in the urology department of the Isala hospital in the Netherlands. The results demonstrate that the approach is feasible and that our toolset based on ProM and Declare is indeed able to provide valuable insights related to process conformance. Keywords: Healthcare Processes, Process Mining, Declarative Modeling Languages 1. Introduction Healthcare processes can be classified either as medical treatment processes – concerning diagnostic and therapeutic activities performed to treat a patient – or as generic organizational processes – more related to administrative aspects [1]. The latter are generally handled according to well-established procedures; conversely, medical treatment processes must be flexible enough to be adapted to the variability of the healthcare environment and to the doctors’ freedom in their execution. Medical treatment processes are universally performed according to clinical guidelines, thus translating the evidence-based insights into actions [2, 3] that have proven to be effective [4]. Email addresses: marcella.rovani@unina.it (Marcella Rovani), f.m.maggi@ut.ee (Fabrizio M. Maggi), m.d.leoni@tue.nl (Massimiliano de Leoni), w.m.p.v.d.aalst@tue.nl (Wil M.P. van der Aalst), R.S.Mans@tue.nl (Ronny S. Mans), pepino@unina.it (Alessandro Pepino) Preprint submitted to Elsevier October 29, 2014 Guidelines are expected to be followed as they formalize the best practices [2]. Nonetheless, it is often observed, by monitoring process executions, that a ’gap’ exists between these recommendations and the actual clinical practice [5, 6, 3], i.e., there are differences between the executed activities and the activities recommended in the guidelines. Therefore, a crucial challenge for the healthcare management sector is to address the gap between the actual clinical processes and the recommendations given in guidelines. There is an urgent need for methods that • can measure the adherence of the actual process behavior with respect to the expected behavior, • pinpoint where deviations happen most frequently, • produce results that can easily be understood by doctors to highlight the most common causes of the identified deviations. This is the realm of process mining (see [7] for examples), which emerged a little over a decade ago. Process mining aims at extracting process knowledge from event logs. These logs may originate from different types of systems such as generic enterprise information systems as well as from Hospital Information Systems (HIS). Typically, event logs contain information about the start/completion of process tasks together with related context data (e.g., actors and resources) and timestamps. In a relatively short timespan, process mining has proven to be capable of providing deep insight into process-related problems that contemporary institutions face, including hospitals. Through the application of process mining, institutions can discover the processes as they are conducted in reality, check whether certain practices and regulations were really followed and gain insight into bottlenecks, resource utilization, and other performance-related aspects of processes. Most of the process mining techniques, both for process discovery and checking the conformance to regulations, rely on the idea that processes are described by procedural languages where the completion of a task may enable the execution of other tasks. While such a high degree of support and guidance is certainly an advantage when processes are repeatedly executed in the same way, in healthcare settings, this is considered to be too restrictive. As illustrated, e.g., in Rebuge et el. [8], medical treatment processes are, in fact, highly dynamic, highly complex, increasingly multidisciplinary and often ad hoc. Moreover, due to the complexity of the environment in which they are executed, they usually involve several variables that can be handled differently depending on the specific patient being treated [9]. Therefore, these process models need to provide more freedom and should not restrict users in taking appropriate actions. As suggested by Mulyar et al. [10], declarative process modeling languages provide more flexibility with respect to imperative languages when describing process behavior. Imperative languages can lead to unreadable and complex models in turbulent and variable 2 environments. Conversely, declarative languages do not model the allowed behavior, but rather what is disallowed. In this way, they offer more possibilities for executions since everything is allowed unless explicitly forbidden [11]. This is achieved by representing the process as a set of rules so that it can be executed in all possible ways as long as these rules are respected. In this paper, we present a methodology for analyzing medical treatment processes based on declarative languages and process mining techniques. The aim of this methodology is to investigate the discrepancies between expected and actual process behaviors of clinical processes. The identification of these discrepancies can be used to adapt the expected process behavior to the current practice or to find information about how the actual process execution can be modified to better fit the expected behavior. In order to demonstrate the applicability of our methodology, we show how the declarative modeling language Declare1 and the process mining tool ProM 2 can be used for acquiring insights about processes handled in the urology department of the Isala hospital. The hospital is one of the top-clinical hospitals in the Netherlands treating more than half a million patients per year distributed over five locations in and around Zwolle. The paper is structured as follows. Section 2 motivates the work and compares it with the state of the art. The proposed methodology is described in Section 3. Section 4 shows how recently developed plug-ins of the process mining tool ProM support our methodology. Section 5 illustrates the case study. Section 6 discusses the results obtained and concludes the paper. 2. Motivation and Related Work The gap between evidence-based guideline approaches and the actual execution of the guidelines is one of the key concerns of healthcare management [12, 5, 13, 14]. This gap has been highlighted for fields, such as dermatology [15], psychology [16], urology [17], etc. In [18], the authors investigate the reasons why clinicians do not always implement the best evidence. Through structured interviews, they found that personal experiences, backgrounds, relations with individual patients, logistic and practical aspects usually influence clinical decisions: as consequence, the actual practice deviates from the prescriptions. Sometimes, clinical decisions can also be influenced by the cost of a treatment and by the patients’ socioeconomic status [19]. Furthermore, as reported in [20], clinical guidelines may not adequately address issues relevant to everyday’s patient care. For example, patients can exhibit allergies that do not allow for the prescribed way of treating the pathology from which they are affected. Surgery, even if prescribed by the clinical guidelines, can be sometimes critical for patients having coagulation defects, diabetes, or heart problems. The coexistence of many pathologies can require further examinations or treatments not listed by the guideline. Hence, the expected treatment can be delayed or even avoided in some cases. Therefore, 1http://www.win.tue.nl/declare/ 2http://www.processmining.org 3 in many circumstances this gap is patient-related, since the doctors have to deal with the particular patient conditions which may require specific and exceptional treatments. In addition, there are some deviations that can be attributed to the difficulties of translating research findings into practice. As reported in [21], sometimes, patients cannot benefit of treatments of proven validity because of the time needed to incorporate research results into practice. This is the case, for example, of some experimental treatments tested in advanced medical centers responsible of the clinical trials execution. Although in those centers the effectiveness of a particular treatment has been demonstrated, and it is well recognized by the medical community, it requires time to transfer the adoption of the same technique to other contexts, so that misalignments can exist in the treatment of the same pathology in different realities. To alleviate this issue, the ‘Knowledge Translation’ approach [22] has been introduced. It has the specific aim of translating scientific knowledge into practical guidelines in the healthcare sector. However, the knowledge translation approach does not quantitatively investigate whether such guidelines, once formalized, are then applied in the actual context. In this paper, we approach the issue by suggesting a novel methodology to verify the correspondence of the guidelines statements to the reality and to highlight any possible deviations. Indeed, if some deviations can positively affect the patient process care, others represent errors that can compromise the patient recovery. Therefore, it is crucial to detect these deviations and to investigate the corresponding reasons in order to assess which of them can be classified as positive - and therefore can be taken into account to update the clinical guidelines statements - and which ones should be avoided and corrected in the clinical practice. As reported in [23], safety can be improved by learning from incidents and near misses. The need of monitoring the patient safety has becoming even more widespread in the healthcare sector, both in order to protect patients from adverse events [24] and to avoid the related costs in terms of money [25]. Moreover, one would like to learn from “positive deviants”. As shown in this paper, process mining techniques can be used to address all these issues. According to [16], our goal should be to address this gap with data rather then with debates or subjective arguments. Chart abstractions, observational studies, chart audits, results of clinical trials, structured interviews have proven to be useful instruments to investigate this gap in various clinical fields [15, 13, 26, 16, 3]. Furthermore, in [27], the authors highlight how the frequency and consequences of errors in medical care can be reduced by monitoring the activities through Hospital Information Systems. In general, as summarized by Lenz et al. [28], various studies have reported positive effects when using process-oriented IT systems in healthcare to support and monitor the processes execution [29]. In addition, several case studies have proven the usefulness of process mining in healthcare [8, 30, 31]. De Weerdt et al. [32] stressed the importance of process mining to acquire knowledge about past clinical experiences in order to avoid medical errors in the future. However, these techniques are based on ad hoc workflow models. In this paper we propose a new approach in order to investigate how to deal with the turbulence in healthcare environments. The approach is based on declarative process models. Conformance checking based on such models helps 4 to pinpoint deviations and learn from them. Moreover, we show that our declarative models can be used to better mediate between practice and guidelines. The resulting more balanced models can be used for understanding deviations and analyzing performance. 3. Methodology In this section, we describe a methodology for the analysis of medical treatment processes. In short, we first create a reference model representing the expected behavior of the process. Then, we compare the actual behavior of the process as recorded in a log with the expected one. The discrepancies can be used to highlight errors in the process execution or to adapt expected model to better reflect the reality expressed in the event log. The proposed methodology is outlined in Figure 1 and described below in detail. Event Log Test Log Training Log Clinical Guidelines Model Design (Hand made) Model Repair De Jure Model De Facto Model Split Event Log for Cross Validation Conformance Checking Record Event Data Healthcare Information System Conformance Analysis Report HIS Figure 1: Methodology for the analysis of medical treatment processes. 3.1. Model Design Based on Clinical Guidelines In the model design phase, a process model is created. The aim of this phase is to obtain a standard representation of a medical treatment process as described by the corresponding clinical guidelines. Since this representation is based on theoretical statements established by the scientific literature, we will refer to it as de jure model. In recent years, many different approaches aiming at representing clinical guidelines through formal models have been proposed, e.g., in the context of simulations for medical decision-support systems [10, 33, 34]. One of the crucial points of these representations concerns how to deal with the variability characterizing healthcare processes: as reported in [10] and motivated in Section 1, we use a declarative process modeling language to represent healthcare processes based on guidelines statements. As shown in Figure 1, the actual behavior of a medical treatment process can be analyzed using the information recorded by process oriented IT Systems recently introduced in the healthcare sector [1]. These 5 systems typically log the activities performed during the process execution in an event log. An event log contains information about activities and cases (process instances); it can also contain time information (timestamps) and indications about the actors involved in a specific case. Process mining techniques [7] use event logs to investigate the actual behavior of a process. Model repair, conformance checking, performance analysis and (unsupervised) process discovery, all belong to this family of techniques. 3.2. Model Repair and Cross Validation Medical treatment processes have some basic characteristics (as stated in the clinical guidelines) but also some characteristics that can differently be interpreted and handled according to the background and the experience of the end-users as discussed in Section 2. The model repair phase aims at revising some aspects of the de jure model based on information derived from the actual execution of the process as recorded in the logs. Of course, these modifications must be justified from a medical point of view and still be consistent with the intent of the guidelines. The model derived from the repair procedure, called de facto model, represents how the process should be executed in the clinical practice, according to both the guideline and everyday reality. Once the de facto model has been created, conformance checking techniques [7] can be applied to measure the adherence of future executions of the process with respect to this model. As shown in Figure 1 the event data are split into a large training set for repairing the model and a smaller test set for validating the result. The de facto model is confronted with process executions that have not been used for model repair. 3.3. Using the Model for Detecting Deviations The declarative process model based on the guidelines and event data is subsequently used for contin- uously monitoring deviations. Conformance checking techniques make it possible to detect violations in the process executions. Starting from the identified violations, these techniques also define how the process should be executed to perfectly fit the modeled behavior (using so-called trace alignments [35]). Confor- mance checking can be applied both in offline and in online modality. The offline analysis is performed post mortem for process instances that have completed. It is used to verify if cases comply with the de facto model and to determine how processes can be improved. For example, whenever a clinical trial is performed to test the effects of a particular medicine or treatment, the validation of the results requires to check whether the rules provided for the experimentation have been respected. Online conformance checking can be used during the execution of processes that need to be continuously monitored, like in the context of critical care. For example, within an intensive care unit, the detection of deviations may be crucial to allow for interventions when needed [36]. In this study, in particular, we focused on the offline analysis. The methodology described in Figure 1 is supported by various ProM plug-ins as described in the next section. 6 4. Operationalization This section describes the tools that have been used to perform each phase of the methodology proposed in Section 3. A combination of Declare3 and ProM 4 is used. Declare is used for the manipulation and enactment for declarative process models. ProM is a “pluggable” open-source framework for process mining. ProM can be used to discover declarative process models from event logs, check the conformance of such models, and enhance declarative models. 4.1. Model Design To perform the model design, we use Declare. Declare is an LTL-based declarative language [37, 38] supported by a toolset that includes a designer, a workflow engine, a worklist handler, and various analysis tools [39]. The designer can be used to support this study, since it allows us to obtain a formal representation of clinical processes by designing the activities and the rules characterizing the process behavior. Declare is based on an extensible set of templates, i.e., abstract entities defining parameterized classes of rules specified through Linear Temporal Logic (LTL) with semantics based on finite traces5 and each one equipped with its own graphical representation. Templates can be classified according to four groups: ex- istence, relation, negative relation and choice. Existence templates involve only one activity and define the allowed cardinality or position of an activity in a process instance. Relation/negative relation templates de- fine a dependency/negative dependency between two activities. Choice templates define alternative relations between activities. Constraints are concrete instantiations of templates and inherit the graphical represen- tation and LTL semantics from the corresponding templates [37]. A Declare model is a set of constraints that should hold in conjunction during the process execution. Figure 2 shows an example of Declare model. The model describes a process for gastric cancer surgical treatments. The first hospital admission requires the registration of the patient’s data when he/she is admit- ted to the hospital. Usually, this activity precedes all diagnostic/therapeutic treatments. The preoperative screening, according to the World Health Organization Guidelines for Safe Surgery, 6 is usually performed before any surgical treatment in order to assess whether the patient’s conditions are good enough for the surgery to be performed and to estimate potential risks. As far as the surgical technique is concerned, nowa- days, the gastric resection for malignant diseases can be performed by using either a laparoscopic surgery or a traditional open approach [40]. Furthermore, according to the clinical guidelines, in both cases a nursing period is needed to monitor the patient after the operation. 3http://www.win.tue.nl/declare/ 4http://www.promtools.org 5For compactness, we simply write LTL to refer to LTL on finite traces. 6http://apps.who.int/iris/bitstream/10665/44185/1/9789241598552_eng.pdf 7 Figure 2: An example of a Declare model modeling the surgical treatment of gastric cancer. The Declare model for this process involves five activities: First Hospital Admission, Preoperative Screen- ing, Open Gastrectomy, Laparoscopic Gastrectomy and Nursing, and seven constraints: three derived from the precedence template, one from the not succession template, one from the exclusive choice template and two from the response template. A precedence constraint between two activities A and B indicates that B can only be executed after that A has been executed at least once. In the model shown in Figure 2, a precedence constraint is used to indicate that activity Preoperative Screening can be executed only after that First Hospital Admission has occurred before. Also, precedence constraints are used to specify that the surgical treatment, either performed by using the open or the laparoscopic technique, can occur only if the Preoperative Screening has been performed before. A not succession constraint between two activities A and B indicates that whenever A occurs, B cannot follow. In the model shown in Figure 2, a not succession constraint specifies that after Preoperative Screening, First Hospital Admission cannot occur again, since the patient has already been registered through a univocal ID. An exclusive choice constraint between two activities A and B indicates that one of them must be ex- ecuted, but not both. In the model shown in Figure 2, an exclusive choice constraint indicates that the surgical intervention can be executed either by using the Laparoscopic Gastrectomy or the Open Gastrec- tomy; these techniques cannot be both applied to the same patient (unless emergent conditions require the conversion from the laparoscopic to the open approach [40]). A response constraint between two activities A and B states that B has to be executed at least once after that A has been executed. In the model shown in Figure 2, response constraints are used to indicate that both activities Laparoscopic Gastrectomy and Open Gastrectomy must be followed by a Nursing period. Referring to the example above, Table 1 shows the semantics for each constraint involved in the model. Each constraint is defined in terms of an LTL formula (here, First Hospital Admission is indicated as FHA, Preoperative Screening as PS, Laparoscopic Gastrectomy as LG, Open Gastrectomy as OG, Nursing as N). �(LG ⇒ ♦N) is the LTL constraint stating that every occurrence of LG should eventually be followed by 8 Table 1: Semantics of the Declare constraints from Figure 2 and their “activating” activities (� means “always”, ♦ means “eventually”, X t Y means “X should hold until Y ” (strong until). Constraint LTL semantics Activation response(LG, N) �(LG ⇒ ♦N) LG response(OG, N) �(OG ⇒ ♦N) OG precedence(F HA, P S) (¬P S t F HA) ∨ �(¬P S) P S precedence(P S, LG) (¬LG t P S) ∨ �(¬LG) LG precedence(P S, OG) (¬OG t P S) ∨ �(¬OG) OG not succession(F HA, P S) �(F HA ⇒ ¬(♦P S)) F HA, P S N. (¬PS tFHA) ∨�(¬PS) models that PS should be preceded by FHA. �(FHA ⇒¬(♦PS)) specifies that FHA cannot be eventually followed by PS. Table 1 also shows the activities activating a constraint. Note that, for example, a response constraint between two activities X and Y is satisfied in a trivial way in a process instance if X never occurs. In this case, we say that the constraint is vacuously satisfied [41]. In [42], the authors introduce the notion of behavioral vacuity detection according to which a constraint is non-vacuously satisfied in a process instance when it is activated in that process instance. An activation of a constraint in a process instance is an event whose occurrence imposes, because of that constraint, some obligations on other events in the same process instance. For example, if we consider the model shown in Figure 2, the occurrence of activity Laparoscopic Gastrectomy is an activation for the response between Laparoscopic Gastrectomy and Nursing, because the execution of Laparoscopic Gastrectomy forces Nursing to be also executed eventually. An activation of a constraint can be a fulfillment or a violation for that constraint. For example, the execution of Laparoscopic Gastrectomy is a fulfillment for the response between Laparoscopic Gastrectomy and Nursing if Laparoscopic Gastrectomy is followed by Nursing. The execution of Laparoscopic Gastrectomy is a violation for the response between Laparoscopic Gastrectomy and Nursing if Laparoscopic Gastrectomy is not followed by Nursing. Table 1 also shows activities that activate each constraint listed in the table. The example presented in Figure 2 shows that, using Declare, it is possible to design formal models that are easily understandable due to its simple graphical representation. Moreover, since Declare models are based on formal LTL semantics, they are verifiable and executable [37]. If events referring to activity executions are stored in an event log, it is possible to apply process mining techniques [7] for further analysis on the process. Table 2 shows an example of event log related to the surgical treatment of gastric cancer. Each line refers to the occurrence of an event with a unique id, a corresponding activity, a resource, a cost, and a timestamp. Events are grouped per process instance, where each instance represents an individual patient. An event log can be used to apply three types process mining techniques like process discovery, model repair and conformance checking. Each one of these techniques is supported by a ProM plug-in as shown below. 9 Table 2: Fragment of event log including for each case: case ID, event ID, timestamp, activity, resource, cost. Case ID Event ID Timestamp Activity Resource Cost 1 7785621 30-11-2011:08.27 First Hospital Admission Carol 90 1 7785624 2-12-2011:13.24 Preoperative Screening Susanne 350 1 7785625 4-12-2011:8.30 Laparoscopic Gastrectomy Andrew 500 1 7785631 4-12-2011:13.30 Nursing Paul 250 2 7785631 1-12-2011:11.00 Preoperative Screening Giuseppe 350 2 7785634 2-12-2011:15.28 Laparoscopic Gastrectomy Simon 500 2 7785638 2-12-2011:16.35 Nursing Clare 250 2 7785640 3-12-2011:13.00 Laparoscopic Gastrectomy Paul 500 2 7785641 3-12-2011:15.00 Nursing Andrew 250 2 7785661 4-12-2011:9.00 First Hospital Admission Victor 90 3 7785654 7-12-2011:10.00 First Hospital Admission Jane 90 3 7785624 8-12-2011:13.24 Laparoscopic Gastrectomy Giulia 500 3 7785625 9-12-2011:16.35 Nursing Paul 250 4 7785640 6-12-2011:14.00 First Hospital Admission Gianluca 90 4 7785667 8-12-2011:13.24 Preoperative Screening Robert 350 4 7785671 10-12-2011:16.35 Preoperative Screening Giuseppe 350 4 7785685 13-12-2011:11.00 Laparoscopic Gastrectomy Simon 500 4 7785698 13-12-2011:16.00 First Hospital Admission Jane 90 5 7785701 7-12-2011:15.00 First Hospital Admission Carol 90 5 7785711 9-12-2011:7.30 Preoperative Screening Susanne 350 5 7785723 13-12-2011:11.00 Laparoscopic Gastrectomy Simon 500 5 7785728 13-12-2011:13.50 Nursing Clare 250 5 7785732 13-12-2011:19.50 Nursing Vivianne 250 6 7785701 7-12-2011:15.00 First Hospital Admission Gianluca 90 6 7785711 9-12-2011:7.30 Preoperative Screening Susanne 350 6 7785723 13-12-2011:11.00 Laparoscopic Gastrectomy Andrew 500 7 7785744 11-12-2011:7.00 First Hospital Admission Jane 90 7 7785754 12-12-2011:9.30 Preoperative Screening Susanne 350 7 7785757 13-12-2011:16.00 Laparoscopic Gastrectomy Andrew 500 7 7785761 13-12-2011:18.50 Nursing Vivianne 250 7 7785763 14-12-2011:8.30 Laparoscopic Gastrectomy Gabriel 500 8 7785765 11-12-2011:7.00 Preoperative Screening Gianluca 350 8 7785766 12-12-2011:9.00 Preoperative Screening Susanne 350 8 7785768 13-12-2011:7.40 Preoperative Screening Gianluca 350 8 7785771 14-12-2011:9.30 Laparoscopic Gastrectomy Giulia 500 8 7785777 14-12-2011:16.00 Nursing Viviana 250 9 7785785 16-12-2011:12.00 Preoperative Screening Robert 350 9 7785795 17-12-2011:9.00 Preoperative Screening Susanne 350 9 7785797 19-12-2011:9.30 Laparoscopic Gastrectomy Andrew 500 9 7785891 19-12-2011:18.50 First Hospital Admission Carol 90 9 7785893 20-12-2011:18.00 Nursing Paul 250 10 7786185 19-12-2011:13.00 First Hospital Admission Jane 90 10 7786189 20-12-2011:9.30 Preoperative Screening Robert 350 10 7786193 22-12-2011:8.50 Laparoscopic Gastrectomy Andrew 500 10 7786198 22-12-2011:10.30 Nursing Clare 250 10 7786223 23-12-2011:14.30 Nursing Vivian 250 4.2. Model Repair In the model repair phase the de jure model is adjusted and repaired based on the information extracted from an event log. The result is a de facto model, which represents, in fact, how the process should be executed in the daily clinical practice. To repair the model, the Declare Miner plug-in in ProM can be used. It takes as input a Declare model and an event log and produces a new Declare model that better reflects how the process is executed in the reality [7]. Model repair can be performed through the Declare Miner. 10 Three possible modalities can be used to repair the model using event data: 1. The first modality generates a Declare model that includes constraints defined starting from only those templates that have been used in the input Declare model but over all the activities contained in the event log. 2. The second modality generates a Declare model that includes constraints defined starting from only those templates and activities that have been used in the input Declare model. 3. The third modality replaces a constraint in the input Declare model with a stronger constraint if this constraint holds in the event log (for example, a response constraint between A and B could be replaced by a chain response constraint indicating that B must immediately follow A). Figure 3: Surgical treatment of gastric cancer: repaired model. A minimum support can be specified as input of the repair algorithm [43]. Through this parameter, it is possible to leave out those constraints that are rarely activated in the log (i.e., constraints with a low support). Using different combinations of configuration options, the input Declare model can be modified by removing or changing existing constraints or adding new constraints, so that several variants of the original model can be generated. To select the most appropriate one, doctors as expert in the specific field should be consulted. Consider the Declare model shown in Figure 2 and the event log in Table 2. The Declare model shows that, according to the clinical guidelines, only one of activities Laparoscopic Gastrectomy and Open Gastrectomy should be applied for each patient. However, in the event log in Table 2, we can observe that Open Gastrectomy is never executed. Therefore, the model repair algorithm would generate a new Declare model in which activity Open Gastrectomy and all the constraints connected to it are removed, as shown in Figure 3. Indeed, these constraints are trivially satisfied, i.e., they are never really activated being the frequency of open gastrectomy equal to zero. This result could be justified with the fact that, due to the specific clinical environment (e.g., doctors’ expertise, type of patients treated, medical instruments available), the doctors prefer to apply the laparoscopic approach. Note that, if in a different department the open technique is preferred, the same Declare model would be repaired by removing activity Laparoscopic Gastrectomy. These differences are related to particular aspects of the real clinical environment and can be included in the de 11 facto models, since they do not violate the clinical guidelines. The de facto models can be used to perform further investigations through other process mining techniques as described below. 4.3. Conformance Checking Once the de facto model has been identified, conformance checking techniques [7] can be applied to investigate the deviations between the modeled behavior and the process execution [44]. Conformance checking can be applied both in an offline mode (i.e., when the process has been terminated) and in an online mode (i.e., when the process is still running). In this paper, we focus on the offline analysis of constraints. Two ProM plug-ins, the Declare Analyzer and the Declare Checker, provide concrete tool support for offline conformance checking. The Declare Analyzer takes a Declare model and an event log as input and pinpoints the deviations between the actual behavior as recorded in the event log, and the admissible one as described in the Declare model. In particular, it shows activations, fulfillments and violations of each constraint involved in the model. Note that when a process instance is compliant with respect to a constraint, every activation of that Figure 4: Surgical treatment of gastric cancer: the response constraint between Laparoscopic Gastrectomy and Nursing is fulfilled twice for case 2. Figure 5: Surgical treatment of gastric cancer: the response constraint between Laparoscopic Gastrectomy and Nursing is fulfilled once for case 1. 12 Figure 6: Surgical treatment of gastric cancer: the response constraint between Laparoscopic Gastrectomy and Nursing is violated for case 7. constraint leads to a fulfillment. Consider the model shown in Figure 2 and the event log in Table 2. In case 2 of the event log, the response constraint between Laparoscopic Gastrectomy and Nursing is activated and fulfilled twice (see Figure 4), whereas, in case 1, the same constraint is activated and fulfilled only once (see Figure 5). When a process instance is non-compliant with respect to a constraint, an activation of a constraint can lead to a fulfillment but also to a violation (and at least one activation leads to a violation). See, for example, the response constraint between Laparoscopic Gastrectomy and Nursing in the model in Figure 2 and case 7 in the event log in Table 2 (Figure 6). In this case, the constraint is activated twice, but the first activation leads to a fulfillment (eventually Nursing occurs) and the second activation leads to a violation (Nursing does not occur eventually). Another example of violation can be found in the event log if we consider the precedence constraint between First Hospital Admission and Preoperative Screening. Indeed, for cases 2, 8, and 9 we can find respectively one, three and two violations of this precedence constraint. Since each process instance is referred to an individual patient treatment process, using the information provided by the Declare Analyzer at the case level, it is possible to investigate the deviations based on the characteristic of the specific patient. For example, when First Hospital Admission is missing in a process instance, it is possible that the patient has already been registered in a different department of the same hospital for a different pathology. For each constraint in the de facto model, the Declare Analyzer also provides the total number of fulfillments and violations on the entire log. In the considered event log, for example, for the response constraint between Laparoscopic Gastrectomy and Nursing, there are 9 fulfillments and 3 violations. As already mentioned, the conformance of an event log with respect to a de facto model can also be checked using the Declare Checker. In particular, the Declare Checker estimates the fitness [7] between the model and the log, and, also, shows how non-compliant process instances should be modified to be aligned 13 with the desired behavior, leading to the identification of reparative actions. The Declare Checker is composed of two different plug-ins: the Declare Replayer and the Declare Diag- noser. The Declare Replayer takes as input a Declare model and an event log and measures for each process instance in the log the fitness of the process instance with respect to the model in a range from 0 (worst fitness) to 1 (best fitness) [35, 44]. If, for some process instance, the corresponding fitness value is less than 1, an alignment between the process instance and the model is created to show how the process instance should be modified to perfectly fit the model. To establish an alignment between a process model and an event log we need to relate “moves” in the log to “moves” in the model. In case of deviations, there are moves in the log cannot be mimicked by the model or vice versa. We explicitly denote a “no move” by �. Consider, for example, case 9 of the event log in Table 2 and the model in Figure 2. To align this process instance with the model, activity First Hospital Admission should be moved to the first position. Table 3 shows the alignment. The first line denotes a move on model only (see �) due to the missing First Hospital Admission event before Preoperative Screening. The fifth line denotes a move on log only: the � symbol in the last column shows that First Hospital Admission cannot follow Preoperative Screening. Starting from the results derived from the Declare Replayer, the Declare Diagnoser generates a map to give a helicopter view of the discrepancies between the log and the model. In particular, constraints and activities in the reference Declare model are annotated with numbers (ranging from 0 to 1) representing their degree of conformance [44]. The degree of conformance of an activity in the model is an indication of the number of times the activity has been removed or added to compute the alignments between all the process instances in the log and the reference model [35]. The degree of conformance of a constraint in the model is an indication of the number of times the constraint has been violated in the event log. In the map, activities and constrains of the reference model are colored with colors ranging from red to green to indicate a degree of conformance varying from 0 (red) to 1 (green). 5. Case Study In this section, we describe the outcomes of a case study in order to demonstrate the applicability of our approach in practice. In particular, we apply our methodology for processes handled in the urology Table 3: Example of a trace alignment: There is one move on model and one move on log due to the wrong position of the First Hospital Admission event in case 9. Case ID Event ID Timestamp Activity in Log Activity in Model 9 - - � First Hospital Admission 9 7785785 16-12-2011:12.00 Preoperative Screening Preoperative Screening 9 7785795 17-12-2011:9.00 Preoperative Screening Preoperative Screening 9 7785797 19-12-2011:9.30 Laparoscopic Gastrectomy Laparoscopic Gastrectomy 9 7785891 19-12-2011:18.50 First Hospital Admission � 9 7785893 20-12-2011:18.00 Nursing Nursing 14 department of the Isala hospital. The Isala hospital consists of multiple clinics and is the largest top-clinical hospital in the Netherlands. Isala aims at providing efficient and safe care to their patients. Therefore, they are looking for innovative ways to analyze and improve their care processes. Within Isala, the urology department is involved with diagnosing and treating patients suffering from illnesses on the male and female urinary tract, and on the male reproductive system. We have applied our methodology to the process for diagnosis and treatment of a particular urogenital disease: the cryptorchidism. The first step of our study focused on the case study investigation, in order to find the information required to perform the model design. We carried out a literature analysis aimed at finding the main scientific evidences about the process: we examined some of the main articles related to the topic stored in the Database PubMed 7, as [45, 46, 47, 48, 49, 50, 51, 52] and also the Guidelines of the European Association of Urology (EAU).8 Based on this information, we designed the corresponding Declare model. Then, we performed conformance checking in offline mode –as described in the previous section, through the Declare Analyzer and the Declare Checker plug-ins in ProM– to verify how the de jure model based on the literature instructions complies with the actual execution of the process. Information about the actual execution of the process came from event logs registered in the urology department of the Isala hospital. We performed the model repair by using the Declare Miner plug-in in ProM. Using the repaired the model, we applied again the conformance checking to verify whether the repaired model has a better fitness with respect to the log. The steps of the study and the results obtained are described in the following subsections. 5.1. Case Study Investigation Cryptorchidism is the absence of one or both testis in the scrotum caused by a deficient or irregular testicular descent; it is one of the most common disorders of childhood, affecting 0.8 – 1.8 percent of infants at 1 year of age, 3 percent of full-term newborns, and 21 percent of premature babies [45]. It has been assessed that it can also lead to an increasing risk of infertility and cancer [46]. Thus, early diagnosis and treatment of undescended testis are needed to preserve fertility and to prevent testicular malignancy. According to the European guidelines, although 15 – 20 of retained testes descend during hormonal treatment, the intake of such substances may be harmful to future spermatogenesis by increasing the apoptosis of germ cells; it was also assessed that the descended testes, when pharmacologically treated, often reascend later. Thus, the hormonal treatment is no longer recommended. On the other hand, the success rate of surgical treatment for undescended testes, named ’Orchidopexy’ is 70 – 90 percent [47]. Also Gapany et Al. [50] state that the surgery is the cornerstone of treatment. To surgically treat the cryptorchidism, either the open or the laparoscopic approach can be applied, even if it 7http://www.ncbi.nlm.nih.gov/pubmed 8http://www.urology-textbook.com 15 is still open the debate related to which one of them should be preferred [48]. The laparoscopic approach is more used because, according to Gapany et al. [50], to date, no imaging technique for non-palpable testes has proven to be superior to laparoscopy, which allows both the diagnosis and the surgical treatment if there is a pathology affecting testes. Whenever the operation cannot be completed through the laparoscopic approach, a switching to the open technique can be applied. This decision can be made by surgeons either before or during the actual operation, in those cases in which it is retained opportune for patients safety, for example in case of inability to visualize structures [53, 54]. Generally, as reported in the guidelines, a staged orchidopexy (Fowler-Stephenson) procedure can be performed, using the open surgery, or the mini-invasive approach as laparoscopy or microsurgery. A biopsy at the time of orchidopexy can be performed to reveal intratubular germ cell neoplasia of unclassified type, which can be removed thereby preventing development of a malignant tumor. 9 An association between cryptorchidism and testis cancer has been known for more than one century [55]. As reported by [52] and [51], when unilateral cryptorchidism with postpubertal male is identified through diagnostic procedures, the orchiectomy – a surgical procedure to remove a testicle and the full spermatic cord through an incision in the lower lateral abdomen – should be performed instead of the orchidopexy. 5.2. Declare Model Design The model of the process has been designed through the Declare Designer, mentioned in Section 4. Information derived from the European guidelines and from some scientific articles found in PubMed [45, 46, 47, 48, 49, 50, 51, 52], has been used to define activities and constraints characterizing the process. It has been payed attention on considering, among the activities characterizing the process, only those that appeared at least once in the event log extracted from the information system of the urology department of the Isala hospital in Zwolle. The model is shown in Figure 7. The model is composed of 10 activities and 13 constraints using 4 different templates. The LTL semantics of some Declare templates have been provided in Section 4. Hereby, the particular meaning of each constraint in the context of the process of interest will be illustrated. • Precedence between Radiological Examination and First Hospital Admission and between Lab Tests and First Hospital Admission: the hospital admission should be usually preceded by the examinations required to assess the presence of the pathology. Among these, radiological examination and lab tests are the most common ones needed for cryptorchidism. • Precedence between First Hospital Admission and Preoperative Screening: to undergo the preoperative screening, the patient must be first admitted to the hospital. 9http://www.uroweb.org/fileadmin/guidelines/EAU_GO_Manual_November_28th_2012.pdf 16 Figure 7: The cryptorchidism treatment according to scientific literature: representation through a Declare model. • Precedence between Preoperative Screening and Open Surgery, Preoperative Screening and Orchi- dopexy, Preoperative Screening and Inguinal Hernia Treatment: according to the World Health Or- ganization clinical guidelines for surgery, every surgical treatment cannot be executed without pre- liminary examinations required in order to prevent risks for patients. It is important to outline that, according to the Isala Hospital denomination of the activities, the word orchidopexy is refer to the testes treatment carried out through the laparoscopic approach, while the open surgery indicates those treatments performed through the open one. • Response between Orchidopexy and Nursing, Inguinal Hernia Treatment and Nursing and between Open Surgery and Nursing: according to the World Health Organization Guidelines mentioned above, a nursing period must follow every surgical treatment, in order to monitor the patient conditions after the operation. • Responded Existence between Histologic Examination and Orchidopexy: according to the European Guidelines of Urology, 10 the biopsy with the histologic examination can be performed when the orchidopexy is performed whenever it is retained recommendable to analyze the nature of the tissue. Therefore, if the histologic examination occurs, the orchidopexy should occur as well in the process execution. • Succession between Nursing and Follow Up: after the nursing period, patients must undergo the follow up check in order to define whether the treatment has been effective and the patient can be discharged, 10http://www.uroweb.org/fileadmin/guidelines/EAU_GO_Manual_November_28th_2012.pdf 17 or further examinations and interventions are required. Also, the follow up is usually preceded by a nursing period. • Responded Existence between Inguinal Hernia Treatment and Orchidopexy: according to the European Guidelines of Urology, the inguinal hernia treatment can be performed at the time of the orchidopexy; therefore, if the inguinal hernia treatment is performed, the orchidopexy is also performed. • Exclusive Choice between Orchidopexy and Open Surgery: as explained above, to surgically treat the cryptorchidism, it is possible to choose either the open or the laparoscopic approach, but not both [48]. 5.3. Conformance Checking (First Iteration) Once the de jure model has been designed based on the information derived from the scientific literature, conformance checking has been applied in order to measure the adherence of such model with the actual behavior of the process. To do so, part of event log was extracted from the information system of the Isala Hospital (the training set mentioned in Figure 1). The selected event log was analyzed in conjunction with the Declare model. For this we used the Declare Checker and the Declare Analyzer plug-ins of ProM (see Section 4). The results obtained with the Declare Replayer and the Declare Diagnoser are shown in Figures 8 and 9. Figure 8: Conformance checking between the de jure model and a fragment of event log: the Declare Replayer. As shown in Figure 8, the average fitness between the de jure model and the actual behavior of the process is approx. 0.831. Figure 9 shows that the most severe conformance problems between the theoretical model and actual practice are related to the diagnostic activities preceding the first hospital admission. This 18 Figure 9: Conformance checking between the de jure model and a fragment of event log: the Declare Diagnoser. can be explained by considering that patients can undergo diagnostic examinations outside the hospital and then they can be admitted to the hospital if these examinations highlight pathologies as cryptorchidism that may require surgical treatments. A low degree of conformance is also observed with reference to the open surgery that is performed only four times in the entire event log. Through the Declare Analyzer plug-in it has been possible to gather a global overview about fulfillments, violations and conflicts for each constraint in the model. The results are outlined in Table 4 (here, First Hos- pital Admission is indicated as FHA, Preoperative Screening as PS, Laparoscopic Gastrectomy as LG, Open Gastrectomy as OG, Nursing as N, Orchidopexy as OR, Inguinal Hernia Treatment as IHT, Radiological Examination as RE, Lab Tests as LB, Follow Up as FU). The Declare Analyzer confirmed that, in most of cases, the First Hospital Admission is not preceded by Lab Tests and Radiological Examinations (a screenshot of the Declare Analyzer showing this violation in one of the traces in the log is shown in Figure 8. Indeed, when patients have already undergone the exams required for the diagnosis - and the surgical treatment has been recommended from the doctor - the repetition of the diagnostic examination is not required at the time of the admission to the Hospital. Therefore, in these cases, the process starts with the First Hospital Admission, and the Lab Tests and Radiological Examination are not present. It is also interesting to observe that there are some traces in which the precedence between First Hospital Admission and Preoperative Screening is not respected. To investigate this anomaly, the doctors of the Isala Hospital were consulted. The case IDs (i.e., the patients) for which such violations were observed were discussed. According to the doctors, the observed violations correspond to patients admitted to different departments of the hospital and then transferred to the urology department because urinary pathologies such as cryptorchidism were suspected. The same considerations hold for the cases in which the precedence between Preoperative Screening and Orchidopexy is violated. It 19 Table 4: The cryptorchidism treatment: conformance checking between the de jure model and the event log through the Declare Analyzer. Constraint Activations Violations Fulfillments Precedence [PS - OR] 197 7 190 Precedence [PS - OS] 4 0 4 Precedence [PS - IHT] 7 0 7 Precedence [RE - FHA] 172 162 10 Precedence [FHA - PS] 264 86 178 Precedence [LT - FHA] 172 168 4 Responded Existence [HE, OR] 3 2 1 Responded Existence [IHT, OR] 7 6 1 Exclusive Choice [OR-OS] 201 0 201 Succession [N-FU] 667 150 517 Response [OS-N] 4 0 4 Response [OR-N] 197 9 188 Response [IHT-N] 7 1 6 Figure 10: Conformance checking between the de jure model and a fragment of event log: the Declare Analyzer. is indeed possible that patients have already undergone different surgical treatments in other departments of the hospital and the data of the preoperative examinations were transferred to the urology department. In these cases, the orchidopexy was directly performed, without repeating the exams. Patients can move from one department to another of the hospital. This also explains the violations of the succession constraint between nursing and follow up and between orchidopexy and nursing, since, after the treatment within the urology department, patients can be moved to other departments if other pathologies arise, and monitored 20 there. The obtained results also show that the responded existence between Orchidopexy and Inguinal Hernia Treatment is violated in some cases. This can be explained by considering that, based to the clinical guidelines, the inguinal hernia treatment can be performed at the time of the orchidopexy. 11 According to the doctors there are cases in which inguinal hernia treatment is performed either in association with other treatments or alone, without performing an orchidopexy. 5.4. Model Repair In order to obtain a model that takes into account also the actual aspects of the process execution, the de jure Declare model has been matched with the event log through the function Repair a Declare Model of the Declare Miner plug-in in ProM, described in Section 4. Different combinations of configuration options have been set to generate different models. All these models have been shown to the doctors in order to choose the one that better reflects the cryptorchidism treatment process in the Isala Hospital. The chosen repaired model is shown in Figure 11. By comparing this model with the original one, important insights can be derived. First, the repaired model does not show the diagnostic activities performed before the First Hospital Admission, i.e., Lab Tests and Radiological Examination. This can be explained by considering that, as already mentioned before, there are several cases in which the patients undergo diagnostic examinations outside the hospital: therefore, if the diagnosis is established, it is not mandatory to repeat the examinations when the patients are admitted to the hospital, and they are directly prepared for surgical treatments. Moreover, the precedence constraint indicating that Preoperative Screening must be preceded by First Hospital Admission, is removed. This can be due to the fact that, when patients are admitted to different departments of the hospital, and then moved to the urology department for the testis treatment, they undergo directly the screening for the surgical treatment, without a new registration. However, the precedence is replaced by a response. This indicates that in the actual process, if the First Hospital Admission occurs, the preoperative screening must happen afterwards. For what concerns the surgical activities, the responded existence between Inguinal Hernia Treatment and Orchidopexy is removed. This can be justified by considering that hernia treatment can either be performed in the actual practice or not according to the specificity of the cases treated. Such a situation represents a typical example of those aspects of the clinical guidelines that are strongly dependent on the specific cases to be treated: in the considered event log, indeed, it is possible that most of the patients were not affected from inguinal hernia, so that the treatment was not performed. The same considerations hold for activity Histologic Examination, removed in the repaired model. Since the Open Surgery is performed only in three traces in the event log, it does not appear in the repaired model. This is in accordance to [50], in which it is stated that the laparoscopic approach represents 11http://www.uroweb.org/fileadmin/guidelines/EAU_GO_Manual_November_28th_2012.pdf 21 Figure 11: The cryptorchidism treatment: the repaired model. the best method to treat cryptorchidism, since, with this approach, the zone to be treated becomes more visible; in addition, nowadays, the mini-invasive approaches are likely to replace the traditional open surgery in several medical sectors. Nonetheless, there are still particular cases, less frequent, in which sometime the open approach may be preferred, or switching from the laparoscopy to the open surgery becomes necessary [53]. In the repaired model it is also shown that the precedence relation between Preoperative Screening and Orchidopexy is respected, in line with the clinical guidelines statements. There is also a response that has been added between them, indicating that usually, if preoperative screening is carried out, the orchidopexy occurs afterwards. Furthermore, the response relation between Orchidopexy and Nursing appears to be reinforced in the actual practice: in the repaired model, indeed, it is replaced by a succession constraint, which indicates that not only after the surgery the nursing must be provided, as stated by the clinical guidelines, but also that in the actual process Nursing is always preceded by Orchidopexy. Finally, a response constraint between Nursing and Follow Up is shown instead of succession: it indicates that after the nursing period, the follow up is needed for patients, but it is not mandatory that the nursing occurs before the follow up. A responded existence links Follow Up to Orchidopexy, meaning that, in the actual process, if Follow Up occurs, Orchidopexy occurs as well. 5.5. Conformance Checking (Second Iteration) In this step of the study, the repaired model has been matched with the actual process by applying conformance checking between this (de facto) model and the event log, with the aim of verifying whether it really better fits the reality with respect to the de jure model. As shown in Figure 12, the Declare Replayer indicates a fitness value between the repaired and the actual model of 0.884, which is higher, as expected, than the one obtained by applying conformance checking between the de jure model and the event log. 22 Figure 12: The cryptorchidism treatment: conformance checking between the repaired model and the event log (Declare Replayer). Figure 13: The cryptorchidism treatment: conformance checking between the repaired model and the event log (Declare Diagnoser). The results returned by the Declare Diagnoser are shown in Figure 13. It is possible to notice that all the activities are represented in green, indicating a good degree of conformance. The results obtained with the Declare Analyzer are represented in Table 5 (here, First Hospital Admission is indicated as FHA, Preoperative Screening as PS, Laparoscopic Gastrectomy as LG, Open Gastrectomy as OG, Nursing as N, Orchidopexy as OR, Follow Up as FU). It is interesting to notice that there are 14 cases in which Nursing is not followed by Follow Up and 43 cases in which the succession between Orchidopexy and Nursing is violated. According to the doctors’ opinion, these violations are due to the fact that there are cases in which, after the testis treatment, patients are moved to different departments. The same consideration holds for the precedence between Preoperative Screening and Orchidopexy, which was violated in 7 cases. 23 There are also cases in which the responded existence between Follow Up and Orchidopexy is not respected, indicating that Follow up is performed whereas Orchidopexy is not. Examples of violations detected from the Declare Analyzer are shown in Figure 14. Figure 14: Conformance checking between the repaired model and a fragment of event log: the Declare Analyzer. Table 5: The cryptorchidism treatment: conformance checking between the repaired and the event log through the Declare Analyzer. Constraint Activations Violations Fulfillments Succession [OR-N] 446 43 403 Precedence [PS - N] 513 48 465 Responded Existence [FU - OR] 418 80 338 Response [PS - OR] 264 58 206 Response [FHA - PS] 172 16 156 Precedence [PS - OR] 197 7 190 Response [N - FU] 249 14 235 In summary, the obtained results allow us to demonstrate that through the repair procedure, it is possible to obtain a model of the clinical process of interest that takes into account not only the guidelines statements, but also the actual process execution. Conformance checking, indeed, shows that the repaired model better complies with the actual process. 6. Conclusion In this paper we presented a novel methodology to analyze medical treatment processes thereby mediating between guidelines and reality. The methodology aims at: 24 1. discovering and pinpointing the deviations between the de jure model, i.e., the model that complies with existing medical protocols, and the actual behavior as observed in the event log extracted from the hospital’s system, and 2. creating a de facto model, i.e., the model that represent the right compromise between the de jure model and what practically observed. The methodology is made possible by recent developments in process mining. Process mining is gaining more and more interest since companies and institutions are interested to improve the processes that they are executing. Of course, hospitals also share the same interests since they want to treat patients efficiently while making them satisfied. The difference between health-care processes and more business-oriented processes is related to the fact that the former are characterized by being much more dynamic and turbulent. Often, similar patients need to be treated quite differently, and variability is the norm. Traditionally, process mining relies on the fact that models are modeled with procedural languages, such as BPMN. Procedural languages are very good when the process instances tends to be repetitive, whereas they fail miserably when processes exhibit a high degree of flexibility. As such, existing process-mining methodologies have problems when applied in the context of health-care processes, as discussed in Section 2. Our methodology is based on a declarative language, namely Declare, where models are simply sets of constraints. As discussed, this guarantees a higher degree of flexibility when defining the prescribed process’ behavior in a procedural way. As reported on in Section 5, the methodology has been validated through a real health-care case study in the Isala hospital. The results have shown to be quite insightful, thus being helpful for the process analysts to improve how patients are treated. We provided a way to measure the adherence of the actual process to the guidelines statements and propose a solution to improve it, by suggesting a model that could be the right compromise between theory and practice. In particular, we addressed this aspect by creating models in which both the de jure knowledge and the practice-based evidence (i.e., event logs) are taken into account in the clinical process design. To this aim, repair techniques have been developed to match the modeled behavior with logs in order to include in the model design also behaviors that are not mentioned in the guidelines but that are still allowed in practice. A typical example is related to the possibility to prescribe biopsy or not whenever the surgical treatment for the cryptorchidism is performed [46]. The clinical guidelines indeed state that a biopsy at the time of orchidopexy can reveal intratubular germ cell neoplasia of an unclassified type, which can be removed thus preventing the development of a malignant tumor.12 Surgeons, therefore, can decide to either require or not the biopsy based on what they observe during the operation. The same considerations hold for surgical hernia treatment. The clinical guidelines state that hernia treatment “can” be performed at the time of orchidopexy. This means that surgeons can as 12http://www.uroweb.org/fileadmin/guidelines/EAU_GO_Manual_November_28th_2012.pdf 25 well postpone this treatment based on the patient conditions. Based on the most frequent actual executions of the process, model repair helps to decide on the required trade-off. After the model repair, all deviations detected through the conformance checking can be monitored systematically without many “false alarms” due to contract between clinical practice and guidelines. The interaction with doctors and nurses also provided valuable input for future work. Doctors, nurses and process analysts are familiar with procedural modeling languages, even though these models tend to be large and barely readable. In the case study, we had to make the stakeholders acquainted with Declare. Although Declare has a simple graphical notation and succinct semantics, quite some time is required to fully grasp the notation. Therefore, it is good to investigate how to tailor the notation to the domain. The main input for our methodology is an event log that records the executions of process instances. Healthcare information systems are typically poorly integrated: many systems coexist within the same hos- pital, thus returning different event logs that cannot be easily merged and that often contain inconsistencies. As future work, we aim to come up with a technique to merge several event logs, containing inconsistencies. Some genetic approaches exist, such as [56], but they seem to not properly scale with logs of increasing size. Finally, we aim to apply the same technique in additional case studies in other hospitals. References [1] R. Lenz, M. Reichert, It support for healthcare processes - premises, challenges, perspectives, Data & Knowledge Engi- neering 61 (1) (2007) 39–58. [2] J. N. Lavis, E. J. Paulsen, A. D. Oxman, R. Moynihan, Evidence-informed health policy 2: Survey of organizations that support the use of research evidence, Implementation Science 3 (2008) 54. [3] W. Y. Lew, A. N. DeMaria, The divergence between clinical guidelines and practice, Journal of the American College of Cardiology 61 (1) (2013) 41–43. [4] D. M. Eddy, Evidence-based medicine: a unified approach, Health Affair 24 (1) (2005) 9–17. [5] M. C. Hay, T. S. Weisner, S. Subramanian, N. Duan, E. J. Niedzinski, R. L. Kravitz, Harnessing experience: exploring the gap between evidence-based medicine and clinical practice, Journal of evaluation in clinical practice 14 (2008) 707–713. [6] L. J. Cochrane, C. A. Olson, S. Murray, M. Dupuis, T. Tooman, S. Hayes, Gaps between knowing and doing: Understanding and assessing the barriers to optimal health care, Journal of Continuing Education in the Health Professions 27 (2) (2007) 94–102. [7] W. van der Aalst, Process Mining: Discovery, Conformance and Enhancement of Business Processes, Springer, 2011. [8] A. Rebuge, D. R. Ferreira, Business process analysis in healthcare environments: A methodology based on process mining, Information System 37 (2) (2012) 99–116. [9] K. Anyanwu, A. Sheth, J. Cardoso, J. Miller, K. Kochut, et al., Healthcare enterprise process development and integration, Journal of research and practice in information technology 35 (2) (2003) 83–98. [10] N. Mulyar, M. Pesic, W. van der Aalst, M. Peleg, Declarative and procedural approaches for modelling clinical guidelines: addressing flexibility issues, in: Business Process Management Workshops, Springer, 2008, pp. 335–346. [11] F. M. Maggi, A. J. Mooij, W. van der Aalst, User-guided discovery of declarative process models, in: Computational Intelligence and Data Mining (CIDM), 2011 IEEE Symposium on, IEEE, 2011, pp. 192–199. 26 [12] P. Bansal, S. Bertels, T. Ewart, P. MacConnachie, J. O’Brien, Bridging the research-practice gap, Academic of Management Perspective 26 (1) (2012) 73–92. [13] T. R. Dresselhaus, J. W. Peabody, M. Lee, M. M. Wang, J. Luck, Measuring compliance with preventive care guidelines, Journal of General Internal Medicine 15 (2000) 782–788. [14] N. E. Cahill, D. K. Heyland, Bridging the guideline practice gap in critical care nutrition: A review of guideline imple- mentation studies, Journal of Parenteral and Enteral Nutrition 34 (6) (2010) 653–659. [15] F. Hajjaj, M. Salek, M. Basra, A. Finlay, Nonclinical influences, beyond diagnosis and severity, on clinical decision making in dermatology: understanding the gap between guidelines and practice, British Journal of Dermatology 163 (2010) 789–799. [16] E. A. Newnham, A. C. Page, Bridging the gap between best evidence and best practice in mental health, Clinical Psy- chology Review 30 (1) (2010) 127–142. [17] J.-N. Cornu, O. Cussenot, F. Haab, B. Lukas, A widespread population study of actual medical management of lower urinary tract symptoms related to benign prostatic hyperplasia across europe and beyond official clinical guidelines, European Urology 58 (2010) 450–456. [18] A. Freeman, K. Sweeney, Why general practitioners do not implement evidence: qualitative study, BMJ 323 (2001) 1–5. [19] S. M. B. Bernheim, J. S. Ross, H. M. Krumholz, E. H. Bradley, Influence of patients’’ socioeconomic status on clinical management decisions: a qualitative study, Annals of Family Medicine 6 (2008) 53–59. [20] R. Grol, Has guideline development gone astray? yes, BMJ 340 (2010) 394–395. [21] I. D. Graham, J. Logan, M. B. Harrison, S. E. Straus, J. Tetroe, W. Caswell, N. Robinson, Lost in knowledge translation: Time for a map?, Journal of Continuing Education in the Health Professions 26 (1) (2006) 13–24. [22] J. N. Lavis, Research, public policymaking, and knowledge-translation processes: Canadian efforts to build bridges, Journal of Continuing Education in the Health Professions 26 (2006) 37–45. [23] R. Mahajan, Critical incident reporting and learning, Br J Anaesth 105 (2010) 69–75. [24] S. M. Berenholtz, P. J. Pronovost, Monitoring patient safety, Critical Care Clinics 23 (3) (2007) 659–673. [25] S. Bolsin, A. Patrick, M. Colson, B. Creatie, L. Freestone, New technology to enable personal monitoring and incident reporting can transform professional culture: the potential to favourably impact the future of health care, Journal of Evaluation in Clinical Practice 11 (2005) 499–506. [26] A. Petzold, N. Korner-Bitensky, A. Menon, Using the knowledge to action process model to incite clinical change, Journal of Continuing Education in the Health Professions 30 (3) (2010) 167–171. [27] D. Bates, M. Cohen, L. Leape, J. M. Overhage, M. M. Shabot, T. Sheridan, Reducing the frequency of errors in medicine using information technology, Journal of the American Medical Informatics Association 8 (4) (2001) 299–308. [28] R. Lenz, M. Reichert, It support for healthcare processes: Premises, challenges, perspectives, Data & Knowledge Engi- neering 61 (1) (2007) 39–58. [29] R. Fichman, R. Kohli, R. Krishnan, The role of information systems in healthcare: Current research and future trends, Information Systems Research 22 (3) (2011) 419–428. [30] R. Mans, M. Schonenberg, M. Song, W. van der Aalst, P. Bakker, Application of process mining in healthcare: A case study in a dutch hospital, in: A. Fred, J. Filipe, H. Gamboa (Eds.), Biomedical Engineering Systems and Technologies, Vol. 25 of Communications in Computer and Information Science, Springer, 2009, pp. 425–438. [31] R. Mans, H. Schonenberg, G. Leonardi, S. Panzarasa, A. Cavallini, S. Quaglini, W. van der Aalst, Process mining techniques: an application to stroke care (2008). [32] J. Weerdt, F. Caron, J. Vanthienen, B. Baesens, Getting a grasp on clinical pathway data: An approach based on process mining, in: Emerging Trends in Knowledge Discovery and Data Mining, Vol. 7769 of Lecture Notes in Computer Science, Springer Berlin Heidelberg, 2013, pp. 22–35. 27 [33] M. A. Grando, D. W. Glasspool, J. Fox, Petri nets as a formalism for comparing expressiveness of workflow-based clinical guideline languages, in: Business Process Management Workshops, Springer, 2009, pp. 348–360. [34] A. Seyfang, B. Mart́ınez-Salvador, R. Serban, J. Wittenberg, S. Miksch, M. Marcos, A. Ten Teije, K. Rosenbrand, Maintaining formal models of living guidelines efficiently, Artificial Intelligence in Medicine (2007) 441–445. [35] W. van der Aalst, A. A., van Dongen B., Replaying History on Process Models for Conformance Checking and Performance Analysis, WIREs Data Mining and Knowledge Discovery 2 (2) (2012) 182–192. [36] Z. Tang, L. Weavind, J. Mazabob, E. J. Thomas, M. Y. L. Chu-Weininger, T. R. Johnson, Workflow in intensive care unit remote monitoring: A time-and-motion study, Critical care medicine 35 (9) (2007) 2057–2063. [37] W. van der Aalst, M. Pesic, H. Schonenberg, Declarative workflows: Balancing between flexibility and support, Computer Science-Research and Development 23 (2) (2009) 99–113. [38] M. Pesic, W. van der Aalst, A declarative approach for flexible business processes management, in: Business Process Management Workshops, Springer-Verlag, Berlin, Heidelberg, 2006, pp. 169–180. [39] M. Westergaard, F. M. Maggi, Declare: A tool suite for declarative workflow modeling and enactment, in: BPM (Demos), 2011. [40] J. Qiu, P. Pankaj, H. Jiang, Y. Zeng, H. Wu, Laparoscopy versus open distal gastrectomy for advanced gastric cancer: a systematic review and meta-analysis, Surgical Laparoscopy, Endoscopy & Percutaneous Techniques 23 (1) (2013) 1–7. [41] O. Kupferman, M. Y. Vardi, Vacuity detection in temporal model checking, International Journal on Software Tools for Technology Transfer (2003) 224–233. [42] A. Burattin, F. M. Maggi, W. van der Aalst, A. Sperduti, Techniques for a posteriori analysis of declarative processes, in: Enterprise Distributed Object Computing Conference (EDOC), 2012 IEEE 16th International, 2012, pp. 41–50. [43] F. M. Maggi, R. Bose, W. van der Aalst, Efficient discovery of understandable declarative process models from event logs, in: Advanced Information Systems Engineering, Springer, 2012, pp. 270–285. [44] M. de Leoni, F. M. Maggi, W. van der Aalst, Aligning event logs and declarative process models for conformance checking, in: Business Process Management, Vol. 7481 of Lecture Notes in Computer Science, Springer Berlin Heidelberg, 2012, pp. 82–97. [45] M. Smolko, G. Kaplan, W. Brock, Location and fate of the nonpalpable testis in children, The Journal of Urology 129 (6) (1983) 1204–1206. [46] F. Ferro, A. Lais, L. Gonzalez-Serva, Benefits and afterthoughts of laparoscopy for the nonpalpable testis, The Journal of Urology 156 (6) (1996) 795–798. [47] P. Jones, Approaches to orchidopexy, British Journal of Urology 75 (6) (1995) 693–696. [48] J. Guo, Z. Liang, H. Zhang, C. Yang, J. Pu, H. Mei, L. Zheng, F. Zeng, Q. Tong, Laparoscopic versus open orchidopexy for non-palpable undescended testes in children: a systemic review and meta-analysis, Pediatric Surgery International 27 (9) (2011) 943–952. [49] F. T. Denes, F. J. Saito, F. A. Silva, A. M. Giron, M. Machado, M. Srougi, Laparoscopic diagnosis and treatment of nonpalpable testis, International braz j urol 34 (3) (2008) 329–335. [50] C. Gapanya, P. Freya, F. Cachatb, F. Gudinchetc, P. Jichlinskie, B.-J. Meyrata, P. Ramseyera, G. Theintzd, B. Burnandf, Management of cryptorchidism in children:guidelines, Risk 16 (33-34) (2008) 19. [51] E. Rogers, S. Teahan, G. Hugh, B. M. R., R. Grainger, T. McDermott, T. J. A., The role of orchiectomy in the management of postpubertal cryptorchidism, The Journal of Urology 159 (1998) 851–854. [52] E. Rogers, S. Teahan, H. Gallacher, M. R. Butler, R. Grainer, T. McDermott, J. A. Thornill, The role of orchiectomy in the management of postpubertal cryptorchidism, The Journal of urology 159 (3) (1998) 851–854. [53] C. O. Dominguez, Expertise in laparoscopic surgery: anticipation and affordances, Linking expertise and naturalistic decision making (2001) 287–301. 28 [54] M. J. Mathers, H. Sperling, H. R̈ı¿ 1 2 bben, S. Roth, The undescended testis: Diagnosis, treatment and long-term conse- quences, Dtsch Arztebl Int 106 (33) (2009) 527–532. [55] H. M. Wood, J. S. Elder, Cryptorchidism and testicular cancer: separating fact from fiction, The Journal of urology 181 (2) (2009) 452–461. [56] J. Claes, G. Poels, Merging computer log files for process mining: An artificial immune system technique, in: Business Process Management Workshops, Vol. 99 of Lecture Notes in Business Information Processing, Springer Berlin Heidelberg, 2012, pp. 99–110. 29