SEMANTIC PROCESS MINING FOR THE VERIFICATION OF

MEDICAL RECOMMENDATIONS

M. A. Grando

School of Informatics, Edinburgh University, 10 Crichton street, Edinburgh, U.K.

M. H. Schonenberg, W. van der Aalst

Department of Mathematics and Computer Science, Technische Universiteit Eindhoven, Eindhoven, Netherlands

Keywords:

Medical guidelines, Computer interpretable guidelines, Workﬂow languages, Process mining, Semantic con-

formance checking, Declarative speciﬁcation.

Abstract:

The dissemination of best medical practices should contribute to a higher quality of care. Because natural

language speciﬁcations can be ambiguous, their miss interpretation can lead to all kinds of errors. Here we

propose a declarative approach for precisely deﬁning medical recommendations. We also propose an approach

based on semantic process mining to verify that an arbitrary Computer Interpretable Guideline (CIG) complies

with the medical recommendations. Taking into account that some medical recommendations are critical, our

work can be seen as a contribution to the design of safer CIGs.

Moreover, we introduce some novel strategies to take full advantage of the information provided by the se-

mantic conformance checker in order to: 1) suggest scenarios than could lead to violations of the medical

constraints in the CIG and, 2) estimate how ﬂexible is the CIG with respect to the medical recommendations

used as starting point.

1 INTRODUCTION

Medical guidelines are used to disseminate the con-

sensus reached on best medical practices. They are

paper-based and expressed in natural language, there-

fore they can be ambiguously interpreted if the med-

ical evidence provided in the guideline is not care-

fully considered. Some medical guidelines are de-

tailed enough to suggest possible care paths. For

such guidelines a general practice is to provide work-

ﬂow diagrams that model the care paths explained in

the natural language description. The provided work-

ﬂows are generally speciﬁed as networks of tasks and

states connected by relational constraints of succes-

sion. In (Mulyar et al., 2007) the declarative language

CIGDec has been proposed to precisely specify medi-

cal recommendations. The CIGDec speciﬁcation lan-

guage is supported by DECLARE, a constraint-based

Workﬂow Management System. DECLARE (Pesic

and van der Aalst, 2006; van der Aalst and Pesic,

2006) offers a graphical notation for its constraints

that have precise semantics in Linear Temporal Logic

(LTL). This provides a platform for the veriﬁca-

tion of constraint-based models. Furthermore, DE-

CLARE supports the execution of constraint-based

models. Constraint-based models do not explicitly

deﬁne the possible execution paths, but rather spec-

ify the boundaries of execution, i.e. any executionthat

does not violate the constraints is allowed. The advan-

tages of using the CIGDdec language for specifying

medical recommendations (Mulyar et al., 2007) are

(1) its ﬂexibility, i.e. many care paths can be speciﬁed

with relative few constraints, and (2) its extendabil-

ity, i.e. it is possible to deﬁne additional constraints

speciﬁed in LTL to the default language to express

situation speciﬁc constraints.

Unfortunately, the translation of medical recom-

mendations into Computer Interpretable Guidelines

(CIGs) is not automatic and therefore not necessarily

error free. However, some languages for the speciﬁ-

cation of CIGs, like Asbru (Shahar et al., 1998), have

been provided with formal techniques based on theo-

rem proving for verifying the satisfaction of proper-

ties (Teije et al., 2006) (Gendt et al., 2005). More-

over, the area of business process mining has con-

tributed with techniques to analyze processes based

on their execution history (event logs). Process min-

ing can amongst others be applied to automatically

A. Grando M., H. Schonenberg M. and van der Aalst W..

SEMANTIC PROCESS MINING FOR THE VERIFICATION OF MEDICAL RECOMMENDATIONS.

DOI: 10.5220/0003112600050016

In Proceedings of the International Conference on Health Informatics (HEALTHINF-2011), pages 5-16

ISBN: 978-989-8425-34-8

 2011 SCITEPRESS (Science and Technology Publications, Lda.)

derive process models from the event logs, to check

the conformance of the actual execution with a pre-

sumed model of the process and to check properties

on the execution traces in the log.

More recently more accurate and robust process

mining techniques, known as semantic conformance

checking, were introduced in (Casati and Shan, 2002)

(Kharbili and Stein, 2008) to analyze processes by

adding semantics to the event logs. Here our aim is to

explore the use of semantic conformance checking for

verifying if a CIG satisﬁes/violates the recommenda-

tions from the medical guideline on which it is based.

We propose a novel strategy for a further analysis

and interpretation of the results generated during se-

mantic conformance checking. The strategy is based

on 1) generating the classes of unexplored scenarios

that could expose untested cases of violation of med-

ical recommendations with the DECLARE model of

medical recommendations, and 2) reusing the scenar-

ios from (1) exposing modeling decisions that reduce

the ﬂexibility of the CIG with respect to the medical

recommendations on which it is based.

In Section 2 we take as starting point two natural

language recommendations from the chronic cough

guideline from (Irwin et al., 1998) and we disam-

biguate them by considering the medical evidence

provided in the guideline. Then in Section 3 we ex-

plain how to specify the chosen recommendationsas a

set of declarativeconstraints in the DECLARE frame-

work. While the analysis presented in sections 2 and

3 can not be automatized, the methodology presented

in sections 4 and 5 has been implemented in the DE-

CLARE tool and the ProM framework. In Section 4

we explain how to use the ProM framework(vanDon-

gen et al., 2005) for checking semantic conformance

of a CIG with respect to the DECLARE constraints

from Section 3. The CIG used in Section 4 is speci-

ﬁed using the PROforma (Fox et al., 1997) language

and it has been taken from the Open Clinical reposi-

tory (http://www.openclinical.org) where other CIGs

for the same medical recommendations are available.

Every CIG from the repository is speciﬁed in a dif-

ferent language: Asbru (Shahar et al., 1998), EON,

GLIF and GUIDE. The PROforma CIG has been se-

lected for pragmatic reasons and the explained tech-

nique is generic and independent of the language and

decision-support system used for the speciﬁcation of

the CIG. In Section 5 we explain some techniques

for allowing further analysis of the results obtained

from the DECLARE tool and the ProM framework

after performing the semantic conformance checking.

After mentioning related approaches in Section 6 we

ﬁnish the conclusions in Section 7.

2 CHRONIC COUGH GUIDELINE

RECOMMENDATIONs

In the chronic cough guideline (Irwin et al., 1998)

the eligibility criterion is that a patient has a cough

that lasts at least 3 weeks. Here we only consider the

case of immunocompetentadult patients. The chronic

cough guideline combines a strategy of diagnosis with

empirical treatment, it guides the physician to make

an assumption regarding the most likely cause of

cough and start treating it with the intention of con-

ﬁrming the diagnosis by resolving the cough. There-

fore, the guideline’s main goal is diagnosing chronic

cough for inmunocompetent patients and stopping it

by treating the most likely cause of cough.

Through out this paper we will consider the fol-

lowing medical recommendations from the chronic

cough guideline for inmunocompetent adult patients:

R1) ”chest radiographs should be ordered before any

therapy is prescribed in nearly all patients with

chronic cough. Chest radiographs do not have to

be routinely obtained before beginning treatment

for presumed PNDS [post nasal drip syndrome]

in young nonsmoker, or in pregnant women, or

before observing the result of discontinuation

of an ACEI [angiotensin-converting enzyme in-

hibitor].”

R2) ”When the chest X-ray is normal, PNDS, Asthma,

and GERD [Gastroesophageal reﬂux disease] are

the likely causes of chronic cough.”

Figure 1 shows the graphical representation of the

recommendations R1) and R2) explained above. This

simpliﬁed diagram has been extracted from a more

extended diagram that provides a workﬂow-like ex-

planation of the main medical recommendations in

the chronic cough medical guideline (Irwin et al.,

1998).

The analysis and interpretation of natural lan-

guage medical recommendations constitutes a time-

consuming, non-error free task that requires in most

of the cases medical expertise in order to disam-

biguate statements and to make explicit implicit

knowledge hidden in the guidelines. So far this pro-

cess has to be manually performed. In the rest of

this section we summarize our conclusions during the

disambiguation of the natural language medical rec-

ommendations from the chronic cough guideline after

analyzing in detail the provided medical evidence. In

the case of the chronic cough guideline the follow-

ing evidence grading scale has been provided with

the guideline’s speciﬁcation, ordered from high to low

quality:

HEALTHINF 2011 - International Conference on Health Informatics

Cough persists

chest radiograph

Evaluate for three most common conditions

simply in the following order, or in

combination: 1. PNDS 2. Asthma 3. GERD

Cough gone

Cough persists

Cough gone

Cough persists

normal

Figure 1: Diagram providing a workﬂow-based view of

the recommendations R1) and R2) from the chronic cough

guideline for immunocompetent adult patients (Irwin et al.,

1998).

I: Evidence obtained from at least one properly

randomized controlled trial.

II: Evidence obtained from well-designed con-

trolled trials without randomization.

II-2: Evidence obtained from well-designed co-

hort or case-control analytic studies, preferably from

more than one center or research group.

II-3: Evidence obtained from multiple time series

with or without the intervention.

III: Opinions of respected authorities, based on

clinical experience.

We start by explaining our interpretation of rec-

ommendations R1) and R2):

R1)(a) Pregnant Patient or Young Non Smoker

with Presumed PNDS: behind the recommendation

of not routinely obtaining chest radiographs for preg-

nant women there is the implicit knowledge that the

X-ray exposes the embryo to radiation. It is known

that this desirability criterion (value) is intrinsic to

any X-ray based plan, although this is not explic-

itly explained in the chronic cough guideline. There-

fore for pregnant women this is a critical recom-

mendation supported by evidence of grade II-2. Be-

hind the recommendation of not routinely obtaining

chest radiographs before beginning treatment for pre-

sumed PNDS in young nonsmoker, or before observ-

ing the result of discontinuation of an ACEI there is

medical evidence also of grade II-2 which promotes

the value of maximizing the likelihood of diagnosis.

Behind this recommendation there is also the medi-

cal evidence of grade II-2 that for young nonsmok-

ers the probability of PNDS/Asthma/GERD is higher

than the average population, therefore it is more cost-

effective and less time consuming to skip Chest X-ray.

R1) (b) Patients forwhom Recommendation R1)(a)

does Not Apply (Not Pregnant and Not Young Non

Smokers with Presumed PNDS): therefore for this

class of patients obtaining a Chest X-ray is strongly

recommended based on evidence of grade II-2, pro-

moting the values of maximizing likelihood of diag-

nosis and maximizing cost-effectiveness because the

X-ray may contain results that can aid in making a

correct diagnosis.

R2) For the same reasons the opposite

recommendations apply to the treatment of

PNDS/Asthma/GERD with the same grade II-2.

This plan is recommended without necessarily doing

a Chest X-ray ﬁrst, for pregnant women and for young

non-smokers with presumed PNDS. Quoting (Irwin

et al., 1998) ” PNDS either singly or in combination

with other conditions, is the most common cause

of chronic cough, followed by asthma and GERD”

(grade II-2), therefore the multi-treatment is recom-

mended to any patient to maximize the likelihood of

diagnosis. The treatment of PNDS/Asthma/GERD

should consider the following generic candidate

plans:

1) Sequentially treating PNDS, followed by treat-

ing asthma and ﬁnally treating GERD;

2) Sequentially treating two conditions while con-

currently treating the third condition (6 possible com-

binations);

3) Concurrently treating PNDS, asthma and

GERD: quoting (Irwin et al., 1998) ”Properly chosen

empiric therapy for PNDS should start to yield a fa-

vorable response within 1 week; for asthma within

1 week; for GERD within 1 week to 3 months”

(grade III). From this and the previous quote from the

chronic cough guideline that indicates that PNDS is

the most common cause of chronic cough we can de-

duce that to minimize the cost of the treatment PNDS

should not be preceded by the other treatments. The

reason is that if it is discovered that the chronic cough

is related to PNDS then all the other treatments can

be dropped.

Some of the beneﬁts that can be obtained by incor-

porating value-based decision making in healthcare

have been considered in (McCartney, 2005) (Black

et al., 2009). Here we suggest simple questions that

can help to determine the level of compliance of a

medical recommendation based on its attached val-

ues:

• Which properties are related to the patient’s safe-

ness and therefore are critical to verify?

For the case of pregnant women the recommenda-

SEMANTIC PROCESS MINING FOR THE VERIFICATION OF MEDICAL RECOMMENDATIONS

tion R1)(a) of not performinga chest X-ray has as-

sociated the value of minimizing the risk of dam-

aging the embryo. This value is critical and there-

fore this property should be satisﬁed in every CIG

that models the chronic cough guideline from (Ir-

win et al., 1998).

• Which properties are not critical but are provided

with a high medical evidence and therefore should

be mandatorily enforced?

A good example of this type of criterion are the

following recommendations supported by medi-

cal evidence of grade II-2:

1) performing multi-treatment for pregnant

women in recommendation R1) (a); 2) per-

forming a chest X-ray and a multi-treatment for

asthma/GERD/PNDS for the case of young non

smoker with presumed PNDS in recommendation

R1) (a) and 3) performing a chest X-ray and

a multi-treatment to patients for whom the

recommendation R1) (a) does not apply.

• Which properties are related to the efﬁcient use

of resources (time, money, medical staff, etcetera)

and can mainly suggest optional improvements in

the quality of medical treatment?

This is the case of the recommendation R2) sup-

ported with medical evidence of grade III that sug-

gests that the treatment of PNDS should not be

preceded by the treatment of Asthma and GERD

in order to minimize the cost of the treatment.

3 DECLARE MODEL

In this section we present the medical cough guide-

line (cf. Section 2) expressed in CIGDec (Mul-

yar et al., 2007) constraints. CIGDec is one of the

languages offered by the constraint-based Workﬂow

Management System DECLARE (van der Aalst and

Pesic, 2006; Pesic and van der Aalst, 2006) that can

be used to deﬁne constraint-based models. A lan-

guage in DECLARE is deﬁned by a set of constraint

templates, each template having a name, a graphical

representation and an LTL expression. This allows

users to interpret DECLARE models without requir-

ing LTL knowledge while having precise semantics at

the same time.

Table 1 summarizes the CIGDec constraint tem-

plates used in the rest of this paper. From now on

we write DECLARE model when we refer to a DE-

CLARE CIGDec model. The state formulas of the

LTL expressions are tuples (A, t) where A is the task

parameter and t refers to the state of the task, i.e.

started (t

), executed (t

) or completed (t

). A con-

straint between tasks in the model is expressed by as-

sociating the parameters of the template for that con-

straint to the tasks in the model. For example, con-

sider the ﬁfth template from the table. The response

constraint is used to express that every time activity

A executes, activity B has to be executed after it. B

does not have to execute straight after A, and another

A can be executed between the ﬁrst A and the sub-

sequent B. To specify that task multitreatment is a

response to task xray, parameters A and B of the re-

sponse constraint are associated to the tasks xray and

multitreatment respectively. To avoid task xray to be

enacted more than once before task multitreatment is

enacted additional conditional mandatory constraints

exactly1 and absence2 are speciﬁed for task xray,

each applying to different conditions. The graphical

representation of the constraint contains the associ-

ated task instead of the parameters as can be seen in

Figure 2.

Veriﬁcation of models is essential to detect mod-

eling errors. DECLARE offers veriﬁcation to check

constraint-models for (1) conﬂicts, i.e. constraints

that can never be satisﬁed and (2) dead activities, i.e.

activities that can never be executed. An error mes-

sage about the problem and the cause helps the mod-

eler to understand and to resolvethe cause of the error.

The data perspective of DECLARE speciﬁes how

data is handled throughout the executionof the model.

Data attributes can be speciﬁed and associated to rel-

evant tasks, e.g. the X-ray task reads the pregnancy

status of a patient. While executing a task, its data

attributes can be read or written, as speciﬁed for

that task at design-time. DECLARE also offers a

resource-perspective that speciﬁes which tasks should

be executed by whom. An organization of roles and

people can be speciﬁed and associated with tasks.

Constraints that should only hold under some con-

dition can be speciﬁed as conditional constraints. A

condition is a boolean expression that can involvedata

attributes from the model. At any point during execu-

tion the condition evaluates to true of false, depending

on current the value of data attributes. When the con-

dition evaluates to true, the constraint is active, other-

wise the constraint is inactive. For instance, the preg-

nancy status of a patient can be used as condition for

constraints that should only be active for this group of

patients. In the graphical representation of a condi-

tional constraint the condition is displayed next to the

constraint.

By default constraints are mandatory (hard) con-

straints and DECLARE does not allow the execution

of tasks that violate one or more active constraint in

the model. In DECLARE it is also possible to specify

HEALTHINF 2011 - International Conference on Health Informatics

Table 1: Relevant CIGDec constraints.

Name LTL expression Graphical

init(A) ((A, t

) ∨ (A, t

))W (A, t

)

init

existence(A) ♦(A, t

)

1..*

exactly1(A) existence(c, A)∧!(♦((A, t

) ∧ °(existence(A))))

exactly1(A)

absence2(A) !(♦((A, t

) ∧ °(existence(A))))

absence2(A)

0..1

precedence(A,B) (!((B, t

) ∨ (B, t

)))W (A, t

)

A B

response(A,B) ¤((A, t

) ⇒ ♦(B, t

))

A B

succession(A,B) response(A, B) ∧ precedence(A, B)

A B

not succession(A,B) not response(A, B) ∧ not precedence(A, B)

A B

optional (soft) constraints that can be violated. Vio-

lations of mandatory constraints trigger warnings that

are speciﬁed for the violation of that constraint, ex-

plaining the violation and the consequence of the vi-

olation. Graphically, mandatory constraints are de-

picted as solid lines and optional constraint as dashed

lines.

Next, we explain how to model the recommenda-

tions from the chronic cough guideline (cf. Section

2) in DECLARE. The model contains the following

tasks that correspond to the activities from the cough

guideline depicted in Figure 1:

(1) choice has no equivalent in Figure 1 because

the case of pregnant patient or young non smoker with

presumed PNDS has not been modeled in (Irwin et al.,

1998) in order to simplify the diagram; we have added

it into the DECLARE model to differentiate between

the care path recommended for patients with the men-

tioned medical conditions (R1) (a)) and other patients

(R1)(b));

(2) xray that corresponds to acquiring an chest X-

ray;

(3) multitreatment that corresponds to the evalua-

tion of Asthma, GERD and PNDS;

(4) asthma that corresponds to the treatment of

Asthma;

(5) pnds that corresponds to the treatment of

PNDS;

(6) gerd that corresponds to the treatment of

GERD.

For clariﬁcation, constraints in Figure 2 are an-

notated with the corresponding guideline fragments.

The following general recommendations should al-

ways be satisﬁed:

RG1) The choice of ordering a chest X-ray is

made once (constraint exactly1 over task choice);

RG2) Performing the treatment of asthma, GERD

or PNDS more than once will not change the diagno-

sis therefore the constraint exactly1 is associated to

the tasks multitreatment, asthma, GERD and PNDS.

This restriction is related to the value of maximizing

the likelihood of diagnosis.

The general constraints are independent of the

patient’s medical condition, so these constraints do

not have conditions. The following boolean data at-

tributes (in italics) have been introduced to capture

the different conditions in the guideline. (1) cough is

true if the cough is persistent, (2) normalXray is true

if the result of the X-ray is normal, (3) pregnant is

true if the patient is pregnant, (4) young is true if the

patient is less than 18 years old, (5) smoking is true

if the patient is a smoker, (6) pnds is true if PNDS is

presumed. These six boolean data attributes are used

in the conditions of the next constraints.

The recommendation concerning the X-ray (R1)

is captured using mandatory conditional constraints.

For the case of pregnant patient or young non smoker

with presumed PNDS (R1 (a)) we consider condition

c which returns true when the patient belongs to the

mentioned class. When we consider recommendation

R1) (b) we use the negation of c denoted as !(c).

R1) (a) Pregnant Patient or Young Smoker with

SEMANTIC PROCESS MINING FOR THE VERIFICATION OF MEDICAL RECOMMENDATIONS

pnds

gerd

succession

cough

not succession

R2)ii.

R2)i.

asthma

succession

cough

succession

cough

R2)iii.

not succession

choice

xray

multitreatment

init

response

cough &&

normalXray

succession

c && cough

succession

!(c) && cough

absecen2 c&& cough

exactly1 !(c)&& cough

R1)(a)iv.

R1)(a)i.

R1)(a)ii.

R1)(b)ii.

R1)(a)iii.

R1)(b)iii.

R1)(b)i.

Figure 2: DECLARE model for the considered recommendations from the chronic cough guideline.

Presumed PNDS: according to the recommendation

R1 the care path for this class of patients corresponds

to ﬁrst optionally performing a chest X-ray and then

if the cough persists treat for PNDS/Asthma/GERD.

Therefore, for patients who are pregnant or are young

smokers with presumed PNDS and have chronic

cough (c && cough) the following care path is rec-

ommended:

i. ﬁrst the decision of performing a X-ray has to be

taken (init constraint over task choice);

ii. performing a X-ray is optional (conditional ab-

sence2 constraint in task xray);

iii. in the case that after the X-ray the patient has

persistent cough and the result of the X-ray is

normal (cough && normalXray) then eventually

the treatment for PNDS/Asthma/GERD has to

be started (conditional response relation between

tasks xray and multitreatment);

iv. it is possible to decide not to perform the Chest

X-ray and to immediately start the treatment

of PNDS/Asthma/GERD (conditional succession

between tasks choice and multitreatment). In this

case the enactment of xray task is not possible

anymore because it would violate the precedence

constraint between tasks choice and xray.

R1)(b) Patients for whom Recommendation R1)(a)

does Not Apply: according to the recommendation

R1 if cough persists the correct decision is to perform

the Chest X-ray and then in case of normal X-ray

avoid irritants. If after avoiding irritants the cough

persist then treat for PNDS/Asthma/GERD. There-

fore for patients with chronic cough who are not preg-

nant or are not young smokers with presumed PNDS

(!(c) && cough):

i. the result of the choice is to perform a chest X-ray

(conditional succession constraint between tasks

choice and xray).

ii. exactly one chest X-ray has to be done (condi-

tional exactly1 constraint on task xray);

iii. similarly to R1) (a) iii. if the result of the

X-ray is normal and the patient still has a

cough (cough && normalXray) then the multi-

treatment of PNDS/Asthma/GERD has to be

started (conditional response constraint between

tasks xray and multitreatment).

R2) Instead of specifying all possible combina-

tions of treatments, for PNDS, asthma and GERD

where the treatment of PNDS should not preceded by

the other treatments, it is enough to deﬁne the pre-

ferred scenarios by conditional constraints, that hold

in case condition cough is true:

i. a mandatory relation of conditional succession

between the task multitreatment and each of the

treatments, where the condition is that the patient

still has a cough (cough). This constraint has as-

sociated the value of maximizing the likelihood of

diagnosis;

ii. an optional negativerelationship of succession be-

tween asthma treatment and PNDS treatment, so

before treating PNDS the patient cannot be treated

for asthma and after treating for asthma the pa-

tient cannot be treated for PNDS. This constraint

has associated the value of minimizing the cost of

treatment;

iii. similarly to R2)ii. deﬁne an optional negativesuc-

cession constraint between GERD and PNDS.

Note that the translation of the preferred treatment

plan from recommendation (R2) to a declarative lan-

guage is straightforward.

HEALTHINF 2011 - International Conference on Health Informatics

4 SEMANTIC MODEL

CHECKING

The analysis and interpretation of natural language

medical recommendations can not be automated and

therefore can be error prone. In Section 2 we disam-

biguated the recommendations R1) and R2) from the

chronic cough guideline based on our interpretation

of the medical evidence provided in the guideline. In

this section we explain that once the medical recom-

mendations are modeled in a formalism that provides

a precise semantic, as CIGDec, it is possible to use the

formal model to automatically check if an arbitrary

CIG complies with the medical recommendations.

ontologies

CIGs

LTL constraints

Event logs

Declarative

constraints

medical

guidelines

DECLARE

ProMTallis

link to

3) link to

2) generate

4) discover

5) check

conformance

1) generate

Specified

Implemented

Figure 3: Steps required by the methodology proposed here:

1) Generate LTL constraints from the DECLARE model,

2) Generate logs by enacting the CIG in the Tallis engine,

3) Link ontologies, 4) Discover the model mined from the

event logs using ProM, 5) Check conformance using ProM.

The methodology proposed here to check the con-

formance in a CIG of the DECLARE speciﬁcation of

medical recommendations is illustrated by Figure 3

and explained in detail below:

1) Generate LTL properties from the DECLARE

model: the DECLARE tool automatically generates

the LTL properties from the constraint model of the

medical recommendations explained in Section 3.

2) Enact the CIG to generate event logs: in Mor

Peleg et al. work (Peleg et al., 2003) the develop-

ers of Asbru (Shahar et al., 1998), GLIF, GUIDE,

EON and PROforma (Fox et al., 1997) languages

were asked to specify CIGs for similar recommenda-

tions to the ones we explained in Section 3. But the

developers of the CIGs did not have any access to the

chronic cough medical guideline from (Irwin et al.,

1998). The recommendations on which the study (Pe-

leg et al., 2003) was based on and the repository of

the resulting CIGs is available at the Open Clinical

repository (http://www.openclinical.org). None of the

CIGs from the repository have been used in any real

medical environment. Therefore, we decided to ex-

plain the methodology with the PROforma CIG from

the Open Clinical repository which has been enacted

using the Tallis engine (http://www.cossac.org/tallis).

But the strategy explained here requires the execution

history (event logs) of the CIG and therefore it is in-

dependent of the language used for the speciﬁcation

of the CIG. An event log contains the executions of

one or more processes. To construct such log is the

required that each event in the log (e.g. an X-ray)

can be mapped to a single case or process instance

(e.g. a patient treated for cough) and that each pro-

cess instance can be mapped to a single process (e.g.

the process for treating chronical cough). The more

information is available in the log, the better the qual-

ity of the results and the larger the number of ques-

tions that can be answered. For instance, event time

stamps can be used to do performance analysis. Simi-

larly, every process instance has zero or more tasks.

Every task or audit trail entry must have at least a

name and an event type. The event type determines

the state of the tasks. Timestamps can be used for

capturing timing information and to analyze perfor-

mance related aspect. The originator element records

the person/system that performs the task. Because the

Tallis CIG speciﬁed for the chronic cough recommen-

dations has not been used in a real medical environ-

ment, the event logs have to be generated considering

generic patient cases. According to the DECLARE

constraints from Section 3 six different patient medi-

cal conditions are signiﬁcant: (1) if the cough is per-

sistent, (2) if the result of the X-ray is normal, (3) if

the patient is pregnant, (4) if the patient is less than

18 years old, (5) if the patient is a smoker, (6) if

PNDS is presumed. But the enactment of the Tallis

CIG showed that the developers of the CIG also con-

sidered two additional medical conditions: (7) if the

patient has ACE-related cough and (8) if the cough

is productive. Therefore ﬁrstly generic patient cases

were created based on all the possible combinations

of the eight mentioned medical conditions. Secondly

the generic patient cases were used to enact the Tallis

CIG. This is a standard practice in software engineer-

ing when system’s correctness needs to be tested be-

fore the system’s release. Finally the events generated

during the CIG enactment were recorded as event logs

using the MXML (Mining eXtensible Markup Lan-

guage) format. The schema for the MXML format

is available at www.processmining.org. If the con-

sidered Tallis CIG would have be running in a real

medical context then so-called Process-Aware Infor-

mation Systems (PAISs) (Dumas et al., 2005) could

have been used to automatically generate the corre-

sponding event logs from anonymized real patient’s

data.

SEMANTIC PROCESS MINING FOR THE VERIFICATION OF MEDICAL RECOMMENDATIONS

file:///C:/Documents%20and%20Settings/Adela/Desktop/CoughActivities#

xray

task

pndsnonspecifictreatmentmultitreatmentgerddiscontinueaceichoiceasthma

CoughActivities

Cxr_reportPNDS_evaluationNon_specific_initial_treatmentInvestigationsGERD_evaluationDiscontinue_ACEIScheduling_decisionAsthma_evaluation

Figure 4: Ontology of activities, where the leafs are the annotated Tallis activities.

3) Link ontologies by semantically annotating the

event logs generated by the CIG: this requires map-

ping the concepts used in the CIG with the concepts

from the DECLARE speciﬁcation. For instance as

Figure 4 shows the tasks Scheduling decision and

Cxr report from the Tallis implementation presented

here can be mapped into the semantically equiva-

lent concepts choice, xray from the DECLARE model

from Section 3.

Only after mapping concepts it is possible to ver-

ify if the DECLARE constraints are satisﬁed in the

mined model. For example the DECLARE constraint

that speciﬁes that task choice has to be enacted ex-

actly once is veriﬁed in the model mined from the

Tallis implementation as the constraint that the Tallis

task Scheduling decision has to be enacted exactly

once.

The same DECLARE model used to perform the

conformance checking of the Tallis implementation

can be reused to check the conformance of any other

implementation from the Open Clinical repository on

which Mor Peleg et al. work (Peleg et al., 2003) is

based on. The only requirement is that previously

the corresponding mapping between the DECLARE

model and the new implementation has been done.

In particular from the DECLARE model from

Section 3 we can create ontologies for data, activities,

event types, process instances and originators (actors

who enact activities). We have called the ontologies

of data and activities CoughData and CoughActivi-

ties respectively. Figure 4 shows the graphical repre-

sentation of the ontology CoughActivites, where the

leafs correspond to the annotated activity instances

from the Tallis CIG. To perform the ontology link-

ing the MXML ﬁle generated in 2) is annotated with

concepts from these created ontologies. The resulting

semantic annotation is expressed in the SA-MXML

(Semantically Annotated MXML) format used by the

ProM framework. The SA-MXML format is avail-

able at www.processmining.org and it is an extension

of the MXML formant where all elements (except for

audit trail entries and time stamps) have an optional

extra attribute that links to a list of concepts in the on-

tologies. For instance in the SA-MXML log shown

in Figure 5 for the process instance with identiﬁer

”Case0100a” the variables young and old from the

DECLARE ontology CoughData are linked by an at-

tribute to the variables younger and older from the

data ontology in the Tallis CIG.

4) Discover the PROforma model from the seman-

tically annotated event logs: using the alpha ++ algo-

rithm that is provided as a plug-in of the ProM frame-

work it is possible to extract (mine) the PROforma

model based on the dependency relations that could

be inferred among the activities in the Tallis event

logs from the SA-MXML ﬁle generated in 3). Fig-

ure 6 shows the resulting mined PROforma process

for generated event logs for the 64 combinations of

medical conditions.

5) Perform semantic conformance checking of the

discovered PROforma model: using the semantic LTL

checker plug-in from the ProM framework it is possi-

ble to perform semantic conformance checking of the

PROforma semantically annotated model discovered

in 4) and the DECLARE model from Section 3.

In Section 3 we explained that it is possible to dif-

ferentiate in DECLARE between medical recommen-

dations that are mandatory or optional.

Only if a DECLARE constraint is mandatory and

it is not satisﬁed in all the event logs generated from

the CIG, a warning should be given during confor-

mance checking. Otherwise if the DECLARE con-

straint is optional and not satisﬁed in all the generated

event logs it is considered that the CIG complies with

the recommendation though it is not optimal. The

level of satisfaction of a property can be seen as the

percentage of eventlogs that satisfy the property. This

information is provided by the semantic LTL checker

as two lists: the ﬁrst list corresponds to the event logs

that satisfy the property and the second list contains

the event logs that do not satisfy that property.

In Table 2 we show the results of performing se-

HEALTHINF 2011 - International Conference on Health Informatics



Figure 5: SA-MXML ﬁle of annotated event logs from the Tallis CIG for chronic cough.

Figure 6: Model of the PROforma CIG discovered by the ProM framework from the Tallis event logs.

mantic conformance checking as explained in Section

4 over the Tallis CIG.

For instance the recommendations R1)(a)ii. and

R1)(a)vi. for the case of pregnant women are re-

lated to the decision of performing a chest X-ray and

they have associated the value of minimizing the risk

of damaging the embryo. This value is critical and

therefore was modeled in Section 4 as mandatory DE-

CLARE constraints. We have shown that all the event

logs that we generated with the Tallis CIG satisfy

these properties.

We did not ﬁnd any property that is fully unsatis-

ﬁed by the generated event logs. For fully unsatisﬁed

properties the semantic LTL model checker returns an

empty list of event logs satisfying the property.

For the rest of the properties we showed that they

are partially satisﬁed by the Tallis CIG, it means that

some of the generated traces of the event logs are in

the ﬁrst list generated by the semantic LTL checker

(traces satisfying the property) and some others are in

the second list (traces not satisfying the property). For

example this was the case of the non critical manda-

tory chronic cough medical recommendations R2)i.

which speciﬁes that the diagnosis by multi-treatment

consists on evaluating for Asthma, GERD and PNDS.

Therefore a notiﬁcation should be given in order to

inform that this recommendation has been violated

though it was mandatory. From the partial satisfaction

of this property and from the observation of the event

logs contained in each list computed by the semantic

LTL model checker we can infer that the PROforma

CIG was designed to ask the user to choose to evaluate

only one of the mentioned possible causes of chronic

cough.

SEMANTIC PROCESS MINING FOR THE VERIFICATION OF MEDICAL RECOMMENDATIONS

Table 2: Results of the semantic conformance checking of the medical constraints from the chronic cough guideline in the

Tallis CIG. A property can be unsatisﬁed (-), fully satisﬁed (+) or partially satisﬁed (+/-).

Medical DECLARE Natural Language Semantic

recommendation constraint checking

RG1) Non critical Only once it is possible to decide +

exactly1(choice) mandatory if a X-ray is performed

RG2) Non critical The diagnosis of asthma as cause of cough +/-

exactly1(asthma) mandatory is evaluated only once

RG2) Non critical The diagnosis of gerd as cause of cough +/-

exactly1(GERD) mandatory is evaluated only once

RG2) Non critical The diagnosis of PNDS as cause of cough +/-

exactly1(PNDS) mandatory is evaluated only once

RG2) Non critical The diagnosis by multi-treatment +

exactly1(multitreatment) mandatory is evaluated only once

R1)(a)i. Non critical Initially for any patient +

init(choice) mandatory decide if X-ray should be made

R1) (a)ii. Critical For pregnant women or young non smoker +

absence2(xray) mandatory with presumed PNDS X-ray is optional

R1) (a)iii. Non critical After X-ray multi-treatment should +

response(xray, multitreatment) mandatory be started

R1) (a)iv. Non critical For pregnant women or young non smoker +

response(xray, multitreatment) mandatory X-ray can be skipped

R 2)i. Non critical The muti-treatment consists on the +/-

succession(mutitreatment, asthma) mandatory treatment of asthma, GERD

succession(mutitreatment, PNDS) and PNDS

succession(mutitreatment, GERD)

R 2) ii. Non critical PNDS can not be preceded by +

not succession(asthma, PNDS) optional Asthma or GERD

not succession(GERD, PNDS)

5 SCENARIO-BASED ANALYSIS

Semantic conformance checking allows to automati-

cally show that certain properties are not satisﬁed by

a CIG. Here we propose a novel methodology to al-

low further automatic analysis over a CIG once the

semantic conformance checking was performedas ex-

plained in Section 4. Our methodology takes advan-

tage of: 1) the DECLARE speciﬁcation of the medical

recommendation on which the semantic conformance

checking is based on, and 2) results computed by the

semantic LTL checker enacted in the ProM frame-

work.

The methodology is based on the scenarios gener-

ated by the DECLARE model which can be used to 1)

suggest event logs corresponding to unexplored criti-

cal behaviors of the CIGs, and 2) analyze if the CIG

is more or less restricted than the medical recommen-

dations that were used as starting point.

DECLARE models can be used to suggest signiﬁ-

cant testing scenarios because they are provided with

algorithms to generate: the ﬁnite automata that cor-

responds to the scenarios that do not violate any con-

straint, and the ﬁnite automata that represents all the

possible scenarios that violate same of the model con-

straints (see (Pesic, 2008)).

The information provided by the automaton could

be used to:

1. Suggest classes of scenarios that comply

with/violate the medical recommendations. For

instance these scenarios can be used to generate

test cases to verify properties that are satisﬁed

because no event log could be use to check its

satisfaction.

2. Provide classes of scenarios that are generated by

the DECLARE model and therefore comply with

the medical recommendations but can not be gen-

erated by the CIG. The generated scenarios can be

used to verify if the CIG is more restricted than the

medical recommendations on which it is based.

For instance we can construct the automata that

generates all the scenarios which do not vio-

late the constraints deﬁned by the DECLARE

model from Figure 2. According to this automata

there is a direct transition between the activities

choice and multitreatment for the class of pa-

tients corresponding to pregnant women or non-

smokers with presumed PNDS. This means that

it is possible to chose to start the muti-treatment

of asthma/PNDS/GERD without need to perform

before a chest X-ray. So in the mined PROforma

HEALTHINF 2011 - International Conference on Health Informatics

model (Figure 6) there should be a direct transi-

tion between the semantically equivalent activi-

ties Scheduling decision and Investigations. But

this is not the case, the enactment of activity

Scheduling decision is only possible if the activ-

ity Cxr report has been enacted before. From

this analysis we deduce that the mined PROforma

model is more restricted that the medical recom-

mendations from the DECLARE model: for the

class of pregnant women or non-smokers with

presumed PNDS the mined PROforma model

obliges to perform a X-ray, instead of offering it

as an option.

6 RELATED WORK

In this paper, we focussed on the problem of check-

ing a posteriori whether a CIG satisﬁes a set of medi-

cal recommendations speciﬁed in a declarative formal

notation. While in (Mans et al., 2009) they have ad-

dressed this problem a priori by ﬁrst specifying the

medical recommendations as a Coloured Petri Net

(CPN) and then mapping the CPN into CIGs speci-

ﬁed in different workﬂow-based language. It seems

that using this mechanism it should be possible to ob-

tain CIGs that are closer to the behavior described by

the medical recommendations modeled by the CPN,

but there is no claim in (Mans et al., 2009) that the

obtained CIG preserves all the behavior from the CPN

used as starting point.

An approach close to ours has been proposed in

(Stegers et al., 2006) as a strategy to identify and for-

malize in the Asbru (Shahar et al., 1998) language

goals (intentions) identiﬁed in clinical guidelines de-

scribed in natural language. Once the intentions are

formalized in the Asbru language they are suscepti-

ble of veriﬁcation. Veriﬁcation by theorem proving

has been proposed in (Teije et al., 2006) (Gendt et al.,

2005) to prove that protocols deﬁned in the Asbru lan-

guage satisfy a set of desirable properties (medical

goals and quality indicators) and to ﬁnd out ambigui-

ties, incompleteness (gasp in the information or insuf-

ﬁcient information), inconsistencies or redundancies.

By theorem proving it is possible to guaranty the ab-

sence of errors, though this strategy is highly costly

because it requires to provide a mapping of the lan-

guage on which the CIG is implement into a theorem

prover. So far from the available languages for spec-

iﬁcation of CIG only the Asbru language provides

a mapping to a theorem prover. In contrast an ad-

vantage of the semantic conformance checking based

approach presented here is that it only requires the

process history and therefore it can be applied over

any CIG independently of the language used for its

implementation. This feature is very important, con-

sidering that currently there are numerous incompat-

ible languages available for the speciﬁcation of med-

ical guidelines (Peleg et al., 2003). Nevertheless, us-

ing the LTL constraints that can be generated by DE-

CLARE also conventional model checking could be

used without needing event logs.

Semantic process mining techniques have been

successfully applied in the area of business process

managing (Casati and Shan, 2002) (Kharbili and

Stein, 2008) for all kinds of analysis of event logs,

like auditing, performance analysis, process discov-

ery, etc. In (Kharbili and Stein, 2008) a theoreti-

cal framework (not yet a detailed technical architec-

ture) has been proposed for verifying that a company

complies with with external and internal regulations

and policies. While more sophisticated than our ap-

proach, their work remains as a theoretical proposal.

The idea of using semantic process mining techniques

to analyze healthcare processes is not new. In (Mans

et al., 2008a) (Mans et al., 2008b) they extract rele-

vant event logs from real applications running in hos-

pitals’ information systems and they analyze these

logs using the ProM framework. Their results show

that process mining can be used to provide new in-

sights that facilitate the improvement of existing care-

ﬂows. Their work differs from us on the fact that they

do not use semantic conformance checking to verify if

the medical recommendations on which the care pro-

cess is based are satisﬁed/violated.

7 CONCLUSIONS

In this paper we propose a technique for checking

the compliance of CIGs with respect to medical rec-

ommendations speciﬁed using a precise declarative

language. The technique is based on the execution

history of the CIGs and therefore can be applied at

post-execution time. Because the Tallis CIG that

we used as case study has not been used in a real

medical environmentwe have manually generated the

event logs by: 1) creating signiﬁcant classes of patient

cases, 2) enacting the CIG with the classes from (1),

3) recording the resulting events as event logs. But

the event logs could be automatically generated from

real medical applications by using available PAISs

(Dumas et al., 2005). PAIs have been successfully

used before for analyzing non-trivial careﬂow pro-

cesses, where the patient’s real data has been pre-

viously anonymised. For instance in (Mans et al.,

2008b) they have analyzed a group of 267 gyneco-

logical oncology patients treated in 2005 and 2006 in

SEMANTIC PROCESS MINING FOR THE VERIFICATION OF MEDICAL RECOMMENDATIONS

the AMC hospital in Amsterdam, covering diagnostic

and treatment activities.

Taking in to account that existing medical recom-

mendations are periodically revised/updated and new

medical recommendations can be added, the run-time

prevention and detection of violations to medical rec-

ommendations and policies is an important problem

to consider. Some formal frameworks like (Grando

et al., 2010) are available in the ﬁeld of health in-

formatics for specifying exception managers to de-

tect and recover from undesirable states happening

during the enactment of CIGs. But so far no strat-

egy has been proposed to automatically suggest the

scenarios or states that violate the medical policies

and recommendations. As we explained in Section

5, from DECLARE models it is possible to automat-

ically generate the automaton that describes all the

scenarios that violate the model constraints. In the

future we are interested on considering the incorpo-

ration of the scenario-based information provided by

the DECLARE models into exception manager sys-

tems like (Grando et al., 2010).

ACKNOWLEDGEMENTS

The authors would like to thank the LOIS initiative

at TU/e and the NWO project ”MinAdept” for their

support.

REFERENCES

Black, E., Glasspool, D., Grando, M. A., Patkar, V., and

Fox, J. (2009). Goal-based decisions for dynamic

planning. In AIME, pages 96–100.

Casati, F. and Shan, M. C. (2002). Semantic analysis of

business process executions. In EDBT, pages 287–

296.

Dumas, M., van der Aalst, W., and ter Hofstede, A. H.

(2005). Process-Aware Information systems: Bridg-

ing People and Software Through Process Technology.

Wiley.

Fox, J., Johns, N., Lyons, C., Rahmanzadeh, A., Thomson,

R., and Wilson, P. (1997). PROforma: a general tech-

nology for clinical decision support systems. Com-

puter Methods and Programs in Biomedicine, 54(1-

2):59–67.

Gendt, M. V., Teije, A. T., Serban, R., and Harmelen, F. V.

(2005). Formalising medical quality indicator to im-

prove guideline. In LNAI, editor, Proceedings AIME

conference, volume 3581, pages 201–220.

Grando, M. A., Peleg, M., and Glasspool, D. (2010). A

goal-oriented framework for specifying clinical guide-

lines and handling medical errors. J Biomed Inform,

43(2):287–299.

Irwin, R. S., Boulet, L. S., Cloutier, M. M., and et al (1998).

Managing cough as a defense mechanism and as a

symptom, a consensus panel report of the american

college of chest physicians. Chest, 114(2):133–181.

Kharbili, M. E. and Stein, S. (2008). Policy-based seman-

tic compliance checking for business process manage-

ment. In MobIS Workshops, pages 178–192.

Mans, R., Schonenberg, H., Leonardi, G., Panzarasa, S.,

Cavallini, A., Quaglini, S., and van der Aalst, W. M. P.

(2008a). Process mining techniques: an application to

stroke care. In MIE, pages 573–578.

Mans, R. S., Schonenberg, H., Song, M., van der Aalst, W.

M. P., and Bakker, P. J. M. (2008b). Application of

process mining in healthcare - a case study in a dutch

hospital. In BIOSTEC (Selected Papers), pages 425–

438.

Mans, R. S., van der Aalst, W. M. P., Russell, N. C., Bakker,

P. J. M., Moleman, A. J., and et al (2009). From re-

quirements via colored workﬂow nets to an implemen-

tation in several workﬂow systems. Transactions on

Petri Nets and Other Models of Concurrency, 3:25–

49.

McCartney, J. J. (2005). Values based decision making

in helathcare: Introduction. Journal HEC Forum,

17(1):1–5.

Mulyar, N., Pesic, M., van der Aalst, W., and Peleg, M.

(2007). Declarative and Procedural Approaches for

Modelling Clinical Guidelines: Addressing Flexibil-

ity Issues. In Informal Proceedings of the Interna-

tional Workshop ProHealth 2007, pages 17–28. QUT,

Brisbane, Australia.

Peleg, M., Tu, S. W., Bury, J.,Ciccarese, P., Fox, J., and et al

(2003). Comparing computer-interpretable guideline

models: A case-study approach. J Am Med Inform

Assoc, 10(1):52–68.

Pesic, M. (2008). Constraint-based workﬂow management

systems: Shifting controls to users. PhD thesis, Beta

Research School for Operations Management and Lo-

gistics, Eindhoven.

Pesic, M. and van der Aalst, W. M. P. (2006). A declarative

approach for ﬂexible business processes management.

In Business Process Management Workshops, pages

169–180.

Shahar, Y., Miksch, S., and Johnson, P. (1998). The Asgaard

Project: A task-speciﬁc framework for the application

and critiquing of time-oriented clinical guidelines. Ar-

tiﬁcial Intelligence in Medicine, 14(1-2):29–51.

Stegers, R., Teije, A. T., and van Harmelen, F. (2006). From

natural language to formal proof goal, structured goal

formalisation applied to medical guidelines. In Proc

Int Conf on Knowledge Engineering and Knowledge

Management, volume 4248, pages 51–58. LNCS.

Teije, A. T., Marcos, M., Blaser, M., and et al (2006). Im-

proving medical protocols by formal methods. AI in

Medicine.

van der Aalst, W. and Pesic, M. (2006). DecSerFlow: To-

wards a truly declarative service ﬂow language. In In-

ternational Conference on Web Services and Formal

Methods 2006, volume 4184 of LNCS, pages 1–23.

springer.

van Dongen, B. F., de Medeiros, A. K. A. A., Verbeek, H.

M. W., Weijters, A. J. M. M., and van der Aalst, W.

M. P. (2005). The ProM framework: a new era in

process mining tool support. volume 3536. LNCS.

HEALTHINF 2011 - International Conference on Health Informatics