JP2018092463A - Personal medical information management method, personal medical information management server and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a personal medical information management method, a personal medical information management server and a program that allow a user to flexibly specify the range of disclosure of medical information.SOLUTION: A personal medical information management server 10 receives disclosure range information specifying a disclosure range related to personal medical information from a user terminal 20, generates a permission ID in response to reception of the disclosure range information, and stores the disclosure range information and the permission ID in association with the personal medical information. The personal medical information management server transmits the permission ID to the user terminal 20, receives a permission ID from a health care professional's terminal 30, and, in response to the reception of the permission ID, transmits personal medical information associated with the permission ID and belonging to the disclosure range to the health care professional's terminal 30.SELECTED DRAWING: Figure 3

Description

  The present invention relates to a personal medical information management method, a personal medical information management server, and a program.

  Medical personnel may electronically record patient data. Recorded data cannot be freely released by medical professionals, and their consent (opt-in) is required for disclosure to third parties. For example, when a user receives a medical examination at a certain hospital, a family doctor different from the hospital cannot refer to the medical examination data freely.

  For this reason, a system capable of recording information representing the consent of the user is known. Patent Document 1 describes an example of such a system.

JP 2003-0667506 A

  However, the conventional technology has a problem that the user cannot flexibly specify the disclosure range.

  For example, in the system of Patent Document 1, since only one disclosure range can be set, the disclosure range cannot be changed for each medical staff and lacks flexibility.

  The present invention has been made to solve such problems, and allows a user to flexibly specify the disclosure range of medical information, a personal medical information management method, a personal medical information management server, and a program The purpose is to provide.

In order to solve the above-described problems, the personal medical information management method according to the present invention includes:
Receiving disclosure range information for specifying a disclosure range related to personal medical information from a user terminal;
Generating permission identification information in response to reception of the disclosure range information, and storing the disclosure range information and the permission identification information in association with the personal medical information;
Transmitting the permission identification information to the user terminal;
Receiving the permission identification information from a medical staff terminal;
In response to receiving the permission identification information, transmitting to the medical staff terminal personal medical information belonging to a disclosure range associated with the permission identification information.
According to a specific aspect, the method further includes a step of performing a user authentication process and a step of performing a medical worker authentication process based on the HPKI.
According to a specific aspect, the method further includes a step of transmitting a URL related to the personal medical information management server to the user terminal together with the permission identification information.
According to a specific aspect, after transmitting the personal medical information belonging to the disclosure range to the medical staff terminal, the corresponding disclosure range information and permission identification information are deleted in response to a predetermined deletion condition being satisfied. Further comprising the step of:
According to a specific aspect, the method further includes the step of transmitting a message prompting the medical staff to convey the permission identification information to the user terminal.
The personal medical information management server according to the present invention manages personal medical information using the above-described method.
The program according to the present invention causes a computer to execute the above-described method.

  According to the personal medical information management method, personal medical information management server, and program according to the present invention, permission identification information is generated each time a disclosure range is designated, and a medical worker uses the permission identification information to disclose the disclosure range. Therefore, the user can control the disclosure range more flexibly.

It is a figure which shows the structure containing the personal medical information management server which concerns on Embodiment 1 of this invention. It is a figure which shows the example of a structure of health management DB of FIG. It is a flowchart explaining the example of operation | movement of the personal medical information management server of FIG. 1, a user terminal, and a medical worker terminal.

Embodiments of the present invention will be described below with reference to the accompanying drawings.
Embodiment 1 FIG.
FIG. 1 shows a configuration including a management server 10 according to the present invention. The management server 10 is a personal medical information management server that manages personal medical information using the method described in this specification. The management server 10 is connected to the user terminal 20, the medical worker terminal 30, and the HPKI authentication server 40 through a communication network N so as to be communicable. The communication network N is, for example, the Internet.

  The management server 10 has a configuration as a known computer, and includes a calculation unit 11 that performs a calculation and a storage unit 12 that stores information. The computing means 11 includes, for example, a CPU (central processing unit), and the storage means 12 includes, for example, a semiconductor memory and an HDD (hard disk drive). The storage unit 12 stores a health management DB 13.

  Although not particularly illustrated, the management server 10 may include an input unit used by the administrator to input information and an output unit that outputs information to the administrator. The input means is, for example, a mouse, a keyboard, a touch panel, and the like, and the output means is, for example, a liquid crystal display and a printer. Furthermore, the management server 10 includes a network interface serving as both an input device and an output device for the communication network N.

  FIG. 2 shows an example of the configuration of the health management DB 13. The health management DB 13 associates the user's personal medical information with the user ID (user identification information) for identifying the user and the disclosure control information for controlling the disclosure status of the personal medical information.

  The personal medical information may be, for example, what is called PHR (Personal Health Records). The configuration of the personal medical information is arbitrary, but as an example, the personal medical information includes common health information, unique health information, and lifetime health information.

  The common health information is data created by an insurer, for example. The common health information includes, for example, billing data and medical examination data. The billing data includes receipt data, dispensing fee data, and medical fee data. The medical examination data includes medical examination result data. Further, the medical examination data may be further classified, and may include, for example, general medical examination data, specific medical examination data, and special medical examination data.

  The unique health information is, for example, data created by the business owner. The unique health information includes, for example, work status data, health survey data, and industrial insurance staff data. The work status data includes job system information, attendance information, and work status information. The health survey data includes health plan data and stress check data. The industrial insurance staff data includes interview result data, inspection result data, employment determination result data, and doctor's opinion data.

  Lifetime health information is data created by an individual (for example, the user himself / herself). The lifetime health information includes, for example, lifetime management data. The lifetime management data includes medicine notebook data, disease management notebook data, vital data, and mother and child notebook data.

  The disclosure control information is information for controlling the disclosure status for a specific medical worker. The disclosure control information is a set including disclosure range information, a permission ID, and a deletion reference time.

  The disclosure range information is information for specifying a range in which personal information is permitted to be disclosed by a user to a specific medical worker. In the example of FIG. 2, the user with the user ID “1234” permits a specific medical worker to disclose the health check result, but allows other medical personnel to disclose other information. Indicates not. For convenience of explanation, the disclosure range information is expressed using a character string such as “health checkup information” in FIG. 2, but the expression format can be appropriately determined by those skilled in the art, and is managed using, for example, a flag. May be.

  The permission ID is information (permit identification information) for identifying a medical worker who has been given disclosure permission. It may be called a password.

  The deletion reference time represents a time (not limited to the time to be deleted) that is a reference for determining the timing at which the disclosure control information should be deleted from the health management DB 13. For example, in this embodiment, as will be described in detail later with reference to FIG. 3, the time when the medical worker logs off from the management server 10 becomes the deletion reference time, and when a certain time elapses from the deletion reference time, the disclosure control information Is deleted.

  The storage unit 12 of the management server 10 further stores a program (not shown). When the calculation unit 11 executes this program, the management server 10 realizes other functions described in this specification. That is, this program causes a computer to execute the method described in this specification, thereby causing the computer to function as the management server 10.

  The user terminal 20 and the medical staff terminal 30 also have a configuration as a known computer. For example, calculation means for performing calculation, storage means for storing information, input means used by a user (user or medical worker) to input information, and information output to the user An output unit and a network interface serving as both an input device and an output device for the communication network N are provided. More specifically, for example, the user terminal 20 may be a PC, a mobile phone, or a smartphone, and the medical worker terminal 30 may be a PC. Further, the medical worker terminal 30 may include a device (HPKI card reader or the like) for performing authentication of the medical worker.

  The HPKI authentication server 40 is a well-known HPKI authentication server, and has a configuration necessary for operating as an HPKI authentication server.

The operations of the management server 10, the user terminal 20, and the medical staff terminal 30 configured as described above will be described below.
FIG. 3 is a flowchart for explaining an example of these operations. The process of FIG. 3 is started in response to an operation for the user to access the management server 10. For example, a user who visits a medical institution receives a request for disclosure of personal medical information from a medical worker. The user receives an instruction of a required disclosure range from a medical worker, and accesses the management server 10 using the user terminal 20 in order to permit the medical worker to disclose the disclosure range.

  The management server 10 and the user terminal 20 cooperate to execute user authentication processing (steps S101 and S201). Although this process may be designed in any way, for example, a known logon process can be used. As a more specific example, the user operates the user terminal 20 to access the management server 10, and the management server 10 requests a personal ID and password from the user terminal 20, and the user responds accordingly. The user name and password are transmitted to the management server 10 by operating the user terminal 20.

  Next, the user terminal 20 receives input of disclosure range information related to the personal medical information of the user (step S202). The method for inputting the disclosure range information can be arbitrarily designed. For example, the user terminal 20 may display a screen that prompts input of disclosure range information. This screen may list, for example, classification items of information included in personal medical information and associate a check box with each classification item. In that case, the classification item selected by the user may be accepted as the classification item to be disclosed. For example, if there are three classification items, “checkup information”, “employment information”, and “stress check information”, and the user selects only “checkup information”, the disclosure range is “checkup information”. It becomes only. The management server 10 may transmit data (HTML data or the like) for displaying such a screen to the user terminal 20.

  Next, the user terminal 20 transmits the input disclosure range information to the management server 10 (step S203), and the management server 10 receives this from the user terminal 20 (step S103).

  The management server 10 generates a permission ID in response to receiving the disclosure range information (step S104). The method for generating the permission ID is arbitrary, but for example, a character string in which a predetermined number of characters randomly selected from a predetermined character group are combined may be used.

  Next, the management server 10 stores the received disclosure range information and the generated permission ID in the health management DB 13 in association with the personal medical information of the user (step S105). At this time, the deletion reference time may be blank.

  Next, the management server 10 transmits a permission ID to the user terminal 20 (step S106), and the user terminal 20 receives the permission ID from the management server 10 (step S206). The user terminal 20 displays the received permission ID (step S207). Although the specific format of transmission / reception can be designed arbitrarily, for example, the management server 10 may transmit data (HTML data or the like) for displaying a screen including a permission ID to the user terminal 20. Good. Alternatively, for example, the management server 10 may transmit an e-mail including a permission ID to the user terminal 20 (or an e-mail address accessible via the user terminal 20).

  The screen or the e-mail or the like including the permission ID may include a message that prompts the health care worker to transmit the permission ID. That is, the management server 10 may transmit such a message to the user terminal 20 in step S106 and the like.

  Furthermore, the screen including the permission ID, the e-mail, or the like may include a URL representing the management server 10 (or a specific Web page managed by the management server 10). That is, the management server 10 may transmit the URL related to the management server 10 to the user terminal 20 together with the permission ID.

  Here, the user transmits the permission ID to the medical staff. For example, the screen of a smartphone on which the permission ID is displayed may be shown to the medical staff. Or you may transmit the email containing permission ID to the mail address which the medical worker terminal 30 or a medical worker can access. In this way, the medical worker knows the permission ID.

  The medical staff performs an operation for accessing the management server 10. For example, you may access URL (it may be memorize | stored in the medical worker terminal 30 as what is called a bookmark etc.) known to a medical worker. Alternatively, when the URL is transmitted together with the permission ID, the URL may be accessed.

  In response to this, the management server 10 and the medical staff terminal 30 cooperate to execute a user authentication process (steps S111 and S311). The management server 10 may perform this process based on HPKI (Healthcare Public Key Infrastructure). A specific example is as follows. The medical worker accesses the management server 10 through the medical worker terminal 30, and the management server 10 requests the HPKI authentication from the medical worker terminal 30. In response to this, the medical worker causes the HPKI card reader of the medical worker terminal 30 to read his / her own HPKI card. The medical staff terminal 30 transmits the authentication data including the read data to the management server 10, and the management server 10 receives the data and transfers it to the HPKI authentication server 40 to request authentication. The HPKI authentication server 40 transmits an authentication result to the management server 10, and the management server 10 receives the authentication result. In this way, authentication processing is performed.

  If HPKI authentication fails, known error processing may be performed. In that case, the management server 10 stops the process of FIG. In this case, no personal medical information is disclosed (that is, it is not transmitted to the medical staff terminal 30).

  Next, the medical worker terminal 30 receives an input of a permission ID (step S312). The management server 10 may transmit data (HTML data or the like) for displaying a screen that prompts input of a permission ID to the medical staff terminal 30.

  The medical worker terminal 30 transmits the input permission ID to the management server 10 (step S313), and the management server 10 receives the permission ID from the medical worker terminal 30 (step S113).

  Next, the management server 10 acquires disclosure range information associated with the received permission ID (step S114), and further acquires personal medical information belonging to the disclosure range represented by the disclosure range information (step S115). ). For example, in the example of FIG. 2, when the permission ID “b66jXy” is received, the disclosure range information that the disclosure range is “checkup result” is acquired, and belongs to the “checkup result” in the personal medical information. Obtain parts (eg, height, weight, blood test results, x-ray results, etc.).

  Next, the management server 10 transmits the acquired portion of personal medical information to the medical worker terminal 30 (step S116), and the medical worker terminal 30 receives this from the management server 10 (step S316). Here, the management server 10 may transmit data (HTML data or the like) for displaying a screen including the personal medical information to the medical staff terminal 30.

  Thus, in steps S113 to S116, the management server 10 transmits personal medical information belonging to the disclosure range associated with the permission ID to the medical staff terminal 30 in response to reception of the permission ID. it can.

  The medical staff terminal 30 displays the received personal medical information (step S317). In this way, the medical staff can browse information on the user. Here, personal medical information that does not belong to the disclosure range is not transmitted and cannot be browsed.

  Thereafter, in response to the predetermined deletion condition being satisfied, the management server 10 deletes the disclosure range information and permission ID corresponding to the disclosure range (step S118). In the present embodiment, as shown in FIG. 2, as the disclosure control information, a deletion reference time is further stored in association with the disclosure range information and the permission ID, and a certain time has elapsed from the deletion reference time. The disclosure control information is deleted.

  The deletion reference time can be, for example, a time when a medical worker performs a logoff process from the management server 10. If it does in this way, a medical worker will finish referring to necessary personal medical information, perform a logoff operation, and after a certain time (for example, 10 minutes), the permission ID is deleted, and the disclosure corresponding to the disclosure range is disclosed. Is stopped.

  Thus, according to the management server 10 which concerns on Embodiment 1 of this invention, the user can designate flexibly the range which should be disclosed among own personal medical information. In addition, the user can freely designate a medical worker as a disclosure destination by transmitting the permission ID only to a specific medical worker.

  Moreover, since the disclosure range information and the permission ID are set every time the process of FIG. 3 is executed even for the same user, different disclosure ranges can be set simultaneously for a plurality of medical workers. More flexibility. In such a case, a plurality of disclosure control information is associated with one personal medical information.

  Further, since the permission ID is transmitted to the user terminal 20, but the personal medical information itself is not transmitted, the user cannot freely browse the personal medical information. For this reason, even if the personal medical information includes information that is prohibited from being viewed by the person (results of stress check, etc.), appropriate management is possible.

  In addition, since the disclosure control information is deleted after the medical worker browses, relatively high security is maintained.

In the first embodiment described above, the following modifications can be made.
Authentication is not limited to that in the first embodiment. For example, although the HPKI authentication using the HPKI authentication server 40 is performed in the first embodiment, a medical worker authentication process may be performed using a mechanism other than the HPKI. Further, the personal ID and password of a medical worker may be stored in the management server 10 and authentication may be performed by logon processing. In addition, when security is sufficiently secured by another configuration or the like, the authentication of the user and the medical staff may be omitted.

  In the first embodiment, a medical worker is an individual, and authentication is performed using an HPKI card issued to the individual. As a modification, authentication of a medical worker may be performed on a facility basis.

  The criterion (deletion condition) for deleting the disclosure range information and the permission ID can be arbitrarily designed. For example, the time when personal medical information was last browsed (for example, the time when step S116 was executed) may be used as the deletion reference time, not the time when the healthcare worker logs off. Also, the disclosure range information and the permission ID may be deleted as soon as the medical staff logs off without using the deletion reference time. Furthermore, when security is possible, the process of deleting the disclosure range information and the permission ID may be omitted.

  In the first embodiment, a single health management DB 13 includes personal medical information and disclosure control information, but these may be stored separately in different DBs. Even in that case, the association through the user ID or the like can be realized.

  The configuration of personal medical information can be arbitrarily designed. For example, the type of information included, the classification method, the classification hierarchy, the name, and the like may be freely set in accordance with laws and other standards.

  The exception handling not shown in FIG. 3 can be designed as appropriate. For example, when user authentication fails in step S101, medical worker authentication fails in step S311, or when the corresponding permission ID does not exist in the health management DB 13 in step S114, etc. A predetermined error process may be performed and the subsequent process may be stopped.

  10 management server (personal medical information management server), 13 health management DB (personal medical information, disclosure range information, permission identification information), 20 user terminal, 30 medical worker terminal.

In order to solve the above-described problems, the personal medical information management method according to the present invention includes:
Receiving disclosure range information for specifying a disclosure range related to personal medical information from a user terminal;
Generating permission identification information in response to reception of the disclosure range information, and storing the disclosure range information and the permission identification information in association with the personal medical information;
Transmitting the permission identification information to the user terminal;
Receiving the permission identification information from a medical staff terminal;
In response to receiving the permission identification information, transmitting to the medical staff terminal personal medical information belonging to a disclosure range associated with the permission identification information.
Moreover, the personal medical information management method according to the present invention is as follows:
Receiving, from a user terminal, first disclosure range information for specifying a first disclosure range related to personal medical information;
Receiving, from the user terminal, second disclosure range information specifying a second disclosure range related to the personal medical information;
Generating first permission identification information in response to reception of the first disclosure range information, and storing the first disclosure range information and the first permission identification information in association with the personal medical information; ,
Generating second permission identification information in response to reception of the second disclosure range information, and storing the second disclosure range information and the second permission identification information in association with the personal medical information; ,
Transmitting the first permission identification information to the user terminal;
Transmitting the second permission identification information to the user terminal;
Receiving the first permission identification information from a first medical staff terminal;
Receiving the second permission identification information from a second medical staff terminal;
In response to receiving the first permission identification information, transmitting personal medical information belonging to the first disclosure range to the first medical staff terminal;
Transmitting personal medical information belonging to the second disclosure range to the second medical staff terminal in response to receiving the second permission identification information;
Is provided.
According to a specific aspect, the method further includes a step of performing a user authentication process and a step of performing a medical worker authentication process based on the HPKI.
According to a particular embodiment, the URL of the personal medical information management server, further comprising the step of transmitting to the user terminal together with the permission ID.
According to a specific aspect, after transmitting the personal medical information belonging to the disclosure range to the medical staff terminal, the corresponding disclosure range information and permission identification information are deleted in response to a predetermined deletion condition being satisfied. Further comprising the step of:
According to a specific aspect, the method further includes the step of transmitting a message prompting the medical staff to convey the permission identification information to the user terminal.
The personal medical information management server according to the present invention manages personal medical information using the above-described method.
The program according to the present invention causes a computer to execute the above-described method.

Claims (7)

Receiving disclosure range information for specifying a disclosure range related to personal medical information from a user terminal;
Generating permission identification information in response to reception of the disclosure range information, and storing the disclosure range information and the permission identification information in association with the personal medical information;
Transmitting the permission identification information to the user terminal;
Receiving the permission identification information from a medical staff terminal;
A method for managing personal medical information, comprising: receiving personal medical information belonging to a disclosure range associated with the permission identification information in response to reception of the permission identification information, to the medical staff terminal. Performing user authentication process;
Performing a medical worker authentication process based on HPKI;
The method of claim 1, further comprising:   The method according to claim 1, further comprising a step of transmitting a URL related to the personal medical information management server to the user terminal together with the permission identification information.   The method further comprises the step of deleting corresponding disclosure range information and permission identification information in response to a predetermined deletion condition being satisfied after transmitting the personal medical information belonging to the disclosure range to the medical staff terminal. Item 4. The method according to any one of Items 1 to 3.   The method according to any one of claims 1 to 4, further comprising a step of transmitting to the user terminal a message prompting the medical staff to convey the permission identification information.   The personal medical information management server which manages personal medical information using the method as described in any one of Claims 1-5.   The program which makes a computer perform the method as described in any one of Claims 1-5.

Images