Interested in licensing this patent?
MTEC can help explore whether this patent might be available for licensing for your application.
Publication Number
US-9729554-B2
Publication Date
2017-08-08
Expiration Date
Abstract
A system may include a first network in which user device(s) and a HIP server are communicably coupled. The first network may include a secure data administrator, such as a medical data system, that stores secure data. In some implementations, at least one of the user devices may include a web module and communicate with a web server through a second network. At least one of the user device may be restricted from communicating with the secure data administrator, so the user device may request data stored in the secure data administrator through the HIP server. The user device may base the requests for the data on information received from the web server.
Core Innovation
The invention relates to securely transmitting access to protected data, including secure medical data such as diagnostic images and electronic medical record (EMR) content, using web-based diagnostic interfaces. An application device generates one or more web-based diagnostic interfaces to be presented on a first user device, based on user requests received from the first user device. One or more of the web-based diagnostic interfaces are related to patient test results.
The system uses a HIP (proxy) server residing on a secure network to mediate communication between a first user device on a first network and one or more endpoints on a distinct second network, including a second user device and a secure data administrator (SDA) that stores the secure medical data. The first user device is restricted from communicating directly with the second user device and the secure data administrator. Additionally, the second network is distinct from the first network, and the second user device and the secure data administrator are restricted from accepting incoming communication initiated by the application device based at least partially on the application device having access to the second network.
Access is validated at the HIP using security associations such as keys, and the HIP relays instructions or requests so that secure medical data can be retrieved or pushed for presentation on the second user device. The application device generates and provides instructions to the first user device to allow presentation of at least a portion of the requested secure medical data, and the first user device transmits at least a portion of the received instructions to the HIP server. The HIP server transmits at least a portion of the received instructions to at least one of the second user device or the secure data administrator to allow presentation of at least a portion of the secure medical data, while the HIP server is restricted from accepting incoming communication initiated by the application device.
In some flows, the document describes web-based (HTTP) diagnostic interfaces in which the HIP mediates non-HTTP/HIP communications, and it describes secure medical data use with medical systems including RIS/BRIS/PACS/HIS/EHR and formats such as HL7. It also describes additional functionality such as automatically generating a diagnosis report using anatomical locations and selected diagnostic image icons, and retrieving reference information from a database indexed according to relationships to the selected image icons. The document further emphasizes motivations and advantages relative to VPN, including reduced setup/maintenance and performance overhead through reduced proxy configuration and polling proxy approaches.
Claims Coverage
The partial set includes three independent claims: method claim 1, method claim 8, and system claim 15. Across these independent claims, the core inventive coverage is supported by the same principal inventive themes: web-based diagnostic interfaces generated by an application device on a distinct network, communication restrictions enforced between the first user device and the second user device/SDA, and a HIP server on the first network that mediates and restricts incoming communications initiated by the application device.
Network-segregated web-based diagnostic interfaces for secure data access
A first user device on a first network requests access to one or more web-based diagnostic interfaces generated by an application device on a second network, wherein one or more of the web-based diagnostic interfaces are related to patient test results.
Restricted direct communication with secure data administrator and second user device
The first user device is restricted from communicating directly with the second user device and the secure data administrator, and the second network is distinct from the first network; the second user device and the secure data administrator are restricted from accepting incoming communication initiated by the application device based at least partially on the application device having access to the second network.
HIP-mediated instructions transmission to present secure medical data
The first user device transmits instructions generated and provided by the application device to a HIP server residing on the first network, wherein the HIP server transmits at least a portion of the received instructions to at least one of the second user device or the secure data administrator to allow at least a portion of the secure medical data to be presented on the second user device.
HIP server restricted from accepting incoming communication initiated by application device
The HIP server is restricted from accepting incoming communication initiated by the application device.
System architecture with application device, first user device, HIP server, and second user device presentation
A system comprising an application device on a second network that generates diagnostic interfaces, a first user device that presents one or more of the generated diagnostic interfaces while being restricted from direct communication with the second user device and the secure data administrator, a HIP server on the first network that receives instructions and is restricted from accepting incoming communications initiated by the application device, and a second user device that presents requested secure medical data based on instructions.
The independent claims collectively cover a secure, network-segregated access workflow in which web-based diagnostic interfaces are generated on a distinct network, direct communication is restricted between the first user device and the second user device/SDA, and a HIP server on the first network mediates instructions to present secure medical data while being restricted from accepting incoming communications initiated by the application device.
Stated Advantages
Reduced setup/maintenance and performance overhead (including polling proxy approaches) relative to VPN.
Documented Applications
Accessing and presenting secure medical data including diagnostic images and electronic medical record (EMR) content using web-based diagnostic interfaces.
Integration with medical systems including RIS/BRIS/PACS/HIS/EHR and formats such as HL7 for secure data presentation via the described architecture.
Automatically generating a diagnosis report using anatomical locations and selected diagnostic image icons, including retrieving reference information from a database indexed according to relationships to the icons.
Interested in licensing this patent?