JP6106624B2 - Medical information management system and method - Google Patents

Description

  The present invention relates to a medical information management system and method for storing and managing medical information such as vital data in a database of a medical institution.

  In recent years, medical information of patients is stored in a database of a medical institution, and the stored medical information is viewed under conditions set in advance by the patient himself or his family, a doctor in charge, a doctor introduced by the doctor in charge, etc. Or a system to make it available has been proposed. If this type of system becomes widespread, the viewer can browse or use medical information of a desired patient anywhere and anytime via the network, which is very convenient.

  By the way, one of the things that must be considered when operating this type of system is prevention of falsification of medical information. For example, Non-Patent Document 1 describes guidelines for falsification of medical information. In addition, as a measure for preventing falsification when transferring a patient's referral letter between doctor terminals, a method of performing encryption using public key cryptography has been proposed (see, for example, Patent Document 1).

  On the other hand, as a form in which the above-described medical information management system is further developed, the patient measures his / her vital information such as an electrocardiogram at his / her home, a nursing facility, and a health care spot (station or convenience store) on the go, A system has been proposed in which the measurement data is transferred to a database of a medical institution via a network and stored and used (see, for example, Non-Patent Document 2).

JP 2004-295700 A

“Guidelines for Safety Management of Medical Information Systems 4.1 Edition”, Chapter 7, Ministry of Health, Labor and Welfare, Internet <URL: http://www.mhlw.go.jp/shingi/2010/02/dl/s0202-4b. pdf> Poster session “S-6: Application of ECG transmission to terminal care at home”, Japanese Society of Home Medicine, March 30 and 31, 2013

  However, the falsification prevention measures described in Non-Patent Document 1 are merely descriptions of falsification prevention measures when medical information created by medical personnel in the medical institution is stored in the database in the medical institution. Absent. In addition, the invention described in Patent Document 1 is merely a proposal of a falsification prevention destination for a referral letter, not medical information itself. For this reason, with the conventional anti-tampering measures, as described above, the medical information created and transferred by others at a place other than the medical institution is dispelled by the medical personnel at the medical institution. I couldn't say enough.

  The present invention has been made paying attention to the above circumstances, and its main purpose is to prevent falsification of medical information created and transferred by others at a place other than a medical institution. It is an object of the present invention to provide a medical information management system and method that further enhances the safety of information.

In order to achieve the above object, a first aspect of the present invention includes a client device that acquires user's biological information and a management server device that manages medical information including the user's biological information. The client apparatus converts the acquired biometric information into file data in a preset format, and converts the converted file data together with the user attribute information. A first summary value of the file data is calculated for each of the converted file data, and the calculated first summary value is associated with the identification information of the file data. 1 storage unit. On the other hand, the management server apparatus receives the converted file data and attribute information transmitted from the client apparatus, stores them in the second storage unit in association with the identification information of the file data, and stores the stored data. For each file data, a second summary value of the file data is calculated independently of the calculation of the first summary value by the client device, and the calculated second summary value is calculated for the file data. The information is stored in the second storage unit in association with the identification information. Further, when the client device determines whether or not the file data of the biometric information stored in the management server device has been tampered with, the client device stores the second data stored in the second storage unit from the management server device for each file data. 2 summary values are acquired, and the acquired second summary value is compared with the first summary value stored in the first storage unit.

The first aspect of the present invention is also characterized by comprising the following aspects.
In the first aspect, the client device further includes a biometric information storage control unit that stores the acquired biometric information or the converted file data in the first storage unit in association with the identification information. The converted file data stored in the second storage unit is acquired from the server device, the acquired converted file data and the biometric information stored in the first storage unit or the converted file data Are compared with each other.

  According to a second aspect, in the biological information storage control unit, when a notification signal notifying the user of physical condition abnormality is input to the client device, the biological information storage control unit is acquired within a predetermined time range including the generation time of the notification signal. The biometric information or the converted file data is stored as specific information in the first storage unit.

  In a third aspect, when the biological information storage control means detects the information component defined as an abnormality by analyzing the acquired biological information, a predetermined time range before and after the time when the abnormality is detected The biometric information acquired or the file data after the conversion is stored as specific information in the first storage unit.

  According to a fourth aspect, in the biological information storage control unit, a storage or abnormality flag is assigned to the specific information in the biological information stored in the first storage unit or the file data thereof, and the storage or abnormality is performed. The biometric information or file data to which no flag is assigned is deleted from the first storage unit.

In order to achieve the above object, a second aspect of the present invention includes a client device that acquires user's biological information, a first management server device that manages medical information including the user's biological information, and a third-party organization. 2 is a medical information management system in which these devices are connected via a network, and the client device uses the file data in a preset format for the acquired biometric information. The file data after conversion is transmitted to the first and second management server devices together with the user attribute information. On the other hand, the first management server apparatus receives the converted file data and attribute information transmitted from the client apparatus, and uses the received converted file data and attribute information as identification information of the file data. Associating and storing in the first storage unit, calculating a first summary value of the file data for each stored file data, and using the calculated first summary value as identification information of the file data The data is stored in the first storage unit in association with each other. The second management server device receives the converted file data and attribute information transmitted from the client device, and associates the received converted file data and attribute information with the identification information of the file data. And storing the second summary value of the file data for each of the stored file data independently of the calculation of the first summary value by the first management server device. The calculated second summary value is stored in the second storage unit in association with the identification information of the file data. When determining whether or not the biometric information file data stored in the first management server device is falsified, the first summary value is acquired from the first management server device for each file data. The acquired first summary value is compared with the second summary value stored in the second storage unit.

  According to a second aspect of the present invention, as one aspect thereof, in the second management server apparatus, the converted file data stored in the first storage unit is acquired from the first management server apparatus, The obtained converted file data is also compared with the converted file data stored in the second storage unit.

  According to the first aspect of the present invention, in the client device that acquires the biological information of the user and the management server device that receives and stores the biological information transmitted from the client device, after the format conversion of the biological information, respectively Summary values are calculated and stored for the file data. Then, when determining whether or not the biometric information stored in the management server device has been tampered with, the summary values are compared with each other in the client device. For this reason, even if the biometric information stored in the management server device is falsified, it is possible to easily and reliably determine whether or not falsification has occurred by comparing summary values.

  According to the first aspect, when specifying falsified file data among the biometric information file data stored in the management server device, the file data acquired from the management server device in the client device is the client device. Is compared with the biometric information stored in the file or the file data after the conversion. For this reason, in addition to the presence or absence of falsification, it becomes possible to specify the part of the biometric information that has been falsified.

  According to the second aspect, when a notification signal that informs the user of a physical condition abnormality is input to the client device, the biological information acquired in a predetermined time range before and after the generation time of the notification signal or after the conversion thereof File data is stored as specific information. For this reason, it is possible to store a highly important part without fail when making a diagnosis, and it is possible to reliably identify this part even if the part has been tampered with.

  According to the third aspect, when the acquired biological information is analyzed and an abnormal component is detected, the biological information acquired in a predetermined range before and after the abnormality detection position or the file data after the conversion is specified information. Is stored as For this reason, it is possible to store a highly important part without fail when making a diagnosis, and it is possible to reliably identify this part even if the part has been tampered with.

  According to the fourth aspect, among the biological information stored in the client device or the file data thereof, a storage or abnormality flag is assigned to the specific information, and the biological information or file to which the storage or abnormality flag is not attached Data is deleted. For this reason, compared with the case where all the biometric information is stored, it is possible to greatly reduce the storage capacity of the storage unit of the client device while leaving an important part of the biometric information.

According to the second aspect of the present invention, a second management server device operated by a third party is provided as a management server device that receives and stores biometric information sent from a client device. Then, when determining whether or not the biometric information stored in the first management server device is falsified, the summary values are compared with each other in the second management server device. For this reason, even if the biometric information stored in the first management server device is tampered with, it is possible to easily and reliably determine whether or not the tampering has occurred by a third party organization.
That is, according to the first and second aspects of the present invention, it is possible to prevent falsification of medical information created and transferred by another person at a place other than a medical institution, thereby ensuring the safety of medical information. It is possible to provide a medical information management system and method that further enhances the above.

The figure which shows the structure of the whole medical information management system which concerns on one Embodiment of this invention. The block diagram which shows the function structure of the waveform data transmission client of the system shown in FIG. The block diagram which shows the function structure of the waveform data management server of the system shown in FIG. The block diagram which shows the function structure of the waveform data analysis management server of the system shown in FIG. The flowchart which shows the process sequence and processing content of the waveform data conversion process by the waveform data transmission client shown in FIG. The flowchart which shows the process sequence and processing content of the alarm process by the waveform data transmission client shown in FIG. The flowchart which shows the process sequence and processing content of the waveform data analysis process by the waveform data transmission client shown in FIG. The flowchart which shows the process sequence and processing content of the waveform data analysis process by the waveform data analysis management server shown in FIG. The flowchart which shows the procedure and processing content of the file deletion process by the waveform data transmission client shown in FIG. The figure which shows the data structure of the waveform data converted into the standard format by the waveform data conversion process shown in FIG. The figure which shows an example of the waveform data management table stored in the waveform data storage part in the waveform data transmission client shown in FIG. The figure which shows an example of the comparison process screen of preserve | saved data. The figure which shows an example of the screen which displays the comparison result of preserve | saved data. The sequence diagram which shows the procedure of the preservation | save data comparison process, and the first half part of the processing content. The sequence diagram which shows the second half part of the procedure and processing content of a preservation | save data comparison process.

Embodiments according to the present invention will be described below with reference to the drawings.
[One Embodiment]
(Constitution)
FIG. 1 is a diagram showing an overall configuration of a medical information management system according to an embodiment of the present invention.
The medical information management system according to this embodiment includes a waveform data transmission client (MSC) 3 installed in a patient's home or a care facility US, a waveform data management server (MMS) 4 installed in a hospital or data center HC, Waveform data analysis management server (MAS) 5 installed in a medical cloud CS operated by a third-party organization, user terminal (MDT) 6 installed in a hospital or clinic HB, and maintenance installed in a maintenance center MU Terminal 7 and these servers and terminals are communicably connected via a network NW.

  The network NW is composed of the Internet and an access network for accessing the Internet. As the access network, a mobile communication network such as a wired telephone network, a CATV (Cable Television) network, a wired LAN (Local Area Network), a mobile phone network, WiMAX (registered trademark), or a wireless LAN is used.

  A simple electrocardiograph (ECG) 1 and an alarm button (AB) 2 are installed in the patient's home or care facility US. The simple electrocardiograph 1 is attached to a patient, measures electrocardiogram data, and transmits the measured electrocardiogram data to the waveform data transmission client 3. The alarm button 2 is operated when the patient perceives an abnormality in his / her heart during the electrocardiogram measurement. In response to this operation, an alarm signal is generated and transmitted to the waveform data transmission client 3.

(1) Waveform data transmission client The waveform data transmission client 3 comprises a personal computer and is configured as follows. FIG. 2 is a block diagram showing the functional configuration.
That is, the waveform data transmission client 3 includes a process accepting unit 30, an authentication processing unit 31, a waveform data processing unit 32, a waveform data transmission processing unit 34, and an information storage unit 36.

  The process reception unit 30 includes an input / output interface and receives operation data input by operating a keyboard or a tablet (not shown).

  The authentication processing unit 31 authenticates the patient based on the user information stored in the user information storage unit 361 of the information storage unit 36 when receiving the patient identification information or the name and password by the processing reception unit 30. Do.

  The information storage unit 36 uses a nonvolatile memory that can be written and read, such as an HDD (Hard Disk Drive) or a NAND flash memory, as a storage medium, and includes a user information storage unit 361, a waveform data storage unit 362, and a summary. A value storage unit 363 and a log information storage unit 364 are provided.

  In the user information storage unit 361, attribute information such as name and age and an authentication password are stored in advance in association with the identification information for each patient. The waveform data storage unit 362 is used to store file data obtained by converting the format of the electrocardiogram data measured by the simple electrocardiograph 1 and its management table. The summary value storage unit 363 is used to store the summary value calculated by the summary value calculation unit 323 described later for each file data. The log information storage unit 364 is used to store log information representing various processing histories in the waveform data transmission client 3.

  The waveform data processing unit 32 has a central processing unit (CPU). As control functions necessary for implementing this embodiment, a waveform data reception unit 321, a format conversion unit 322, a summary value calculation unit 323, An alarm data processing unit 324, a log output unit 325, a waveform data analysis unit 326, and a waveform data deletion unit 327 are provided. Each of these control units is realized by causing the CPU to execute an application program stored in a program memory (not shown).

  The waveform data receiving unit 321 receives the electrocardiogram data transmitted from the simple electrocardiograph 1 and stores it in a buffer memory (not shown) in the information storage unit 36. The format conversion unit 322 reads the received electrocardiogram data from the buffer memory by a certain length (for example, 5 seconds) according to the conversion parameter set in the waveform data processing setting file 33, and converts it into file data in a standard format. Then, the converted file data is stored in the waveform data storage unit 362 in association with the identification information (for example, file name). The format conversion unit 322 also creates a table for managing the file data, and correlates the data representing the measurement start time and time length of the corresponding file data in association with the file name in the file data management table. Processing to store in the data storage unit 362 is performed.

  The summary value calculation unit 323 reads the file data from the waveform data storage unit 362 and calculates the summary value of the electrocardiogram data composed of continuous waveform data for each file data. The calculated summary value is stored in the summary value storage unit 363. As the summary value, for example, a hash value is used.

  When an alarm signal is generated from the alarm button 2, the alarm data processing unit 324 gives a save flag to file data corresponding to a predetermined time before and after the time when the alarm signal is generated. The save flag is stored in a file data management table stored in the waveform data storage unit 362.

  The waveform data analysis unit 326 compares the waveform pattern with a preset abnormality pattern for each file data stored in the waveform data storage unit 362, thereby detecting an abnormality in the electrocardiogram data. Then, an abnormality flag is assigned to the file data corresponding to a predetermined time before and after the time when the abnormality is detected. The abnormality flag is stored in a file data management table stored in the waveform data storage unit 362.

  The waveform data deletion unit 327 refers to the file data management table stored in the waveform data storage unit 362 every time a predetermined time or a certain time elapses, and assigns a save flag and an abnormality flag. The other file data is deleted while leaving the file data that has been saved.

  The log output unit 325 generates information representing processing histories by the control units 321 to 327 of the waveform data processing unit 32, and stores the generated information in the log information storage unit 364 as log information. The log output unit 325 also has a function of reading log information stored in the log information storage unit 364 and transmitting it to the maintenance terminal 7 in response to a request from the maintenance terminal 7.

The waveform data transmission processing unit 34 includes a converted waveform data transmission unit 341 and a log output unit 342.
The converted waveform data transmission unit 341 follows the transmission processing parameters set in the waveform data transmission processing setting file 35 every time converted waveform data (file data) for a certain time is stored in the waveform data storage unit 362. The file data is read out and transmitted to the waveform data management server 4 and the waveform data analysis management server 5.

  The log output unit 342 generates log information representing the processing history of the converted waveform data transmission unit 341 and stores it in the log information storage unit 364. The log output unit 342 also has a function of reading log information stored in the log information storage unit 364 and transmitting it to the maintenance terminal 7 in response to a request from the maintenance terminal 7.

(2) Waveform Data Management Server The waveform data management server 4 is composed of a server computer and is configured as follows. FIG. 3 is a block diagram showing the functional configuration.
That is, the waveform data management server 4 includes an authentication processing unit 40, a converted waveform data processing unit 41, a converted waveform data monitoring processing unit 43, and an information storage unit 45.

  Prior to the reception of file data from the waveform data transmission client 3, the authentication processing unit 40 acquires patient identification information and its password from the waveform data transmission client 3, and the acquired identification information and password are stored in the user information storage unit 451. The patient is authenticated by collating with the user information stored in.

  The information storage unit 45 uses a rewritable nonvolatile memory such as an HDD (Hard Disk Drive) or a NAND flash memory as a storage medium. The information storage unit 45 includes a user information storage unit 451, a converted waveform data storage unit 452, and the like. , A summary value storage unit 453 and a log information storage unit 454 are provided.

  In the user information storage unit 451, attribute information such as name and age and an authentication password are stored in advance in association with the identification information for each patient. The converted waveform data storage unit 452 is used to store file data and attribute information sent from the waveform data transmission client 3. The summary value storage unit 453 is used to store the summary value of the file data calculated by the summary value calculation unit 412 of the converted waveform data processing unit 41 described later. The log information storage unit 454 is used for storing information representing the processing history of the waveform data management server 4.

  The converted waveform data processing unit 41 has a central processing unit (CPU). As a control function necessary for carrying out this embodiment, a converted waveform data receiving unit 411, a summary value calculating unit 412, a log An output unit 413 is provided. Each of these control units is realized by causing the CPU to execute an application program stored in a program memory (not shown).

  The converted waveform data receiving unit 411 receives the file data of the patient's electrocardiogram data converted from the waveform data transmission client 3 and the attribute information of the patient, and receives the received file data and attribute information. The waveform data is stored in the converted waveform data storage unit 452 in association with the identification information of the file data. At this time, data representing the measurement start time and time length of the file data is also stored.

  The summary value calculation unit 412 reads the file data from the converted waveform data storage unit 452, calculates the summary value of the electrocardiogram data composed of continuous waveform data for each file data, and uses the calculated summary value as the summary value. Store in the storage unit 453. As the summary value, for example, the same hash value as that of the waveform data transmission client 3 is used.

  The log output unit 413 generates information indicating the processing history of each of the control units 411 and 412 of the converted waveform data processing unit 41, and stores the generated information in the log information storage unit 454 as log information. The log output unit 413 also has a function of reading log information stored in the log information storage unit 454 and transmitting it to the maintenance terminal 7 in response to a request from the maintenance terminal 7.

The converted waveform data monitoring processing unit 43 includes a converted waveform data display unit 431 and a log output unit 432.
When the converted waveform data display unit 431 receives an access request for the waveform data of a specific patient from the user terminal 6, the converted waveform data display unit 431 corresponds to the converted waveform data storage unit 452 after performing authentication processing for the access request source. The patient's file data is read out, and the read file data is transmitted to the requesting user terminal 6.

  The log output unit 432 generates log information representing the processing history by the converted waveform data display unit 431 and stores the generated log information in the log information storage unit 454. The log output unit 432 also has a function of reading log information stored in the log information storage unit 454 and transmitting it to the maintenance terminal 7 in response to a request from the maintenance terminal 7.

(3) Waveform Data Analysis Management Server The waveform data analysis management server 5 is composed of a server computer in the same manner as the waveform data management server 4 described above, and is configured as follows. FIG. 4 is a block diagram showing the functional configuration.
That is, similarly to the waveform data management server 4, the waveform data analysis management server 5 includes an authentication processing unit 50, a converted waveform data processing unit 51, a converted waveform data monitoring processing unit 53, and an information storage unit 55. I have.

  Prior to the reception of file data from the waveform data transmission client 3, the authentication processing unit 50 acquires patient identification information and its password from the waveform data transmission client 3, and uses the acquired identification information and password as a user information storage unit 551. The patient is authenticated by collating with the user information stored in.

  The information storage unit 55 uses a non-volatile readable / writable memory such as an HDD (Hard Disk Drive) or a NAND flash memory as a storage medium, and includes a user information storage unit 551, a converted waveform data storage unit 552, and the like. The summary value storage unit 553 and the log information storage unit 554 are provided.

  In the user information storage unit 551, attribute information such as name and age and an authentication password are stored in advance in association with the identification information for each patient. The converted waveform data storage unit 552 is used to store file data and attribute information sent from the waveform data transmission client 3. The summary value storage unit 553 is used to store the summary value calculated by the summary value calculation unit 512 described later for each file data. The log information storage unit 554 is used to store log information representing the processing history of the waveform data analysis management server 5.

  The converted waveform data processing unit 51 has a central processing unit (CPU). As a control function necessary for carrying out this embodiment, a converted waveform data receiving unit 511, a summary value calculating unit 512, a log An output unit 513, a waveform data analysis unit 514, and a falsification verification unit 515 are provided.

  The converted waveform data reception unit 511 receives the file data of the patient's electrocardiogram data converted from the waveform data transmission client 3 and the attribute information of the patient, and receives the received file data and attribute information. The converted waveform data storage unit 552 stores the file data in association with the identification information of the file data. At this time, data representing the measurement start time and time length of the file data is also stored.

  The summary value calculation unit 512 reads the file data from the converted waveform data storage unit 552, calculates the summary value of the electrocardiogram data composed of continuous waveform data for each file data, and uses the calculated summary value as the summary value. Store in the storage unit 553. As the summary value, the same hash value as that of the waveform data transmission client 3 is used.

  The waveform data analysis unit 514 performs waveform analysis processing for each file data stored in the waveform data storage unit 552 and compares the result with a preset abnormality pattern, thereby detecting an abnormality in the electrocardiogram data. . Then, an abnormality flag is assigned to the file data corresponding to a predetermined time before and after the time when the abnormality is detected, and this is stored in the file data management table stored in the converted waveform data storage unit 552.

  The falsification verification unit 515 compares the summary value stored in the summary value storage unit 553 of the server 5 with the summary value acquired from the waveform data management unit 4 in response to a falsification verification request from the user terminal 6. The processing is performed to compare the waveform data stored in the converted waveform data storage unit 552 of the own server 5 with the waveform data acquired from the waveform data management unit 4, and report data representing the comparison result is generated. To the user terminal 6.

  The log output unit 513 generates log information representing the processing history of the converted waveform data receiving unit 511, summary value calculation unit 512, and waveform data analysis unit 514, and the generated log information is stored in the log information storage unit 554. Store. The log output unit 513 also has a function of reading log information stored in the log information storage unit 554 and transmitting it to the requesting maintenance terminal 7 in response to a request from the maintenance terminal 7.

  The converted waveform data monitoring processing unit 53 includes a converted waveform data display unit 531 and a log output unit 532.

  When the converted waveform data display unit 531 receives an access request for the waveform data of a specific patient from the user terminal 6, the converted waveform data display unit 531 corresponds to the converted waveform data storage unit 552 after performing authentication processing for the access request source. The patient's file data is read out, and the read file data is transmitted to the requesting user terminal 6.

  The log output unit 532 generates log information representing the processing history by the converted waveform data display unit 531 and performs processing for storing the generated log information in the log information storage unit 554. The log output unit 532 also has a function of reading out log information stored in the log information storage unit 554 and transmitting it to the maintenance terminal 7 in response to a request from the maintenance terminal 7.

(Operation)
Next, the operation of the system configured as described above will be described.
(1) Reception / storage of electrocardiogram data When an electrocardiogram is to be measured, the patient first inputs his / her identification information and password at the waveform data transmission client 3 in response to a request from the client. Then, in the waveform data transmission client 3, the authentication processing unit 31 compares the input identification information and password input with the user information stored in the user information storage unit 361, thereby authenticating the patient. As a result of this authentication, if it is confirmed that the patient has been registered for use, the waveform data transmission client 3 enters a state of waiting for reception of electrocardiogram data.

  In this state, when the patient wears the simple electrocardiograph 1 on the body and starts measurement, the electrocardiogram data of the patient is transmitted from the simple electrocardiograph 1 to the waveform data transmission client 3. On the other hand, the waveform data transmission client 3 performs the following waveform data processing. FIG. 5 is a flowchart showing the processing procedure and processing contents.

  That is, first, under the control of the waveform data receiving unit 321, the electrocardiogram data is received and stored in the buffer memory in step S11. Then, when the designated time set in the waveform data processing setting file has elapsed, the process proceeds from step S12 to step S13. Then, under the control of the format conversion unit 322, the received electrocardiogram data is read from the buffer memory by a certain length (for example, 5 seconds) and converted into standard format file data. The converted file data is stored in the waveform data storage unit 362 together with the header information indicating the data structure and the file name. FIG. 10 shows an example of header information. At this time, the measurement start time and the length of the measurement time are stored in the file data management table in association with the file name. FIG. 11 shows an example of the file data management table.

Subsequently, in step S14, file data is sequentially read from the waveform data storage unit 362 under the control of the summary value calculation unit 323, and a summary value, for example, a hash value, is calculated for the continuous waveform of the electrocardiogram data for each file data. Is done. The calculated summary value is stored in the summary value storage unit 363 in a state associated with the file name. If an interrupt occurs during the conversion process, the file data conversion process is stopped in step S15.
Thereafter, the process shown in FIG. 5 is repeated until the patient performs an electrocardiogram data measurement end operation.

(2) Setting of save flag It is assumed that the patient feels an abnormality in his / her heart and presses the alarm button during the measurement of the electrocardiogram data. In this case, the waveform data transmission client 3 performs the following processing. FIG. 6 is a flowchart showing the processing procedure and processing contents.

  That is, when the alarm signal transmitted from the alarm button 2 is received in step S21, the reception time is first specified in step S22 under the control of the alarm data processing unit 324. In step S23, file data corresponding to the reception time is specified, and in step S24, a measurement time before the reception time is retrieved from the file data management table of the waveform data storage unit 362.

Next, after waiting for file data for a predetermined time to be stored in the waveform data storage unit 362, in step S25, the measurement time is included in m seconds before and n seconds after the specified measurement time. File data is selected from the file data management table. In step S26, a save flag is set on the file data management table in association with each selected file data as shown in FIG. 11, for example.
The storage flag setting process described above is performed every time the patient presses the alarm button 2 during the electrocardiogram data measurement period.

(3) Setting of Abnormal Flag The waveform data transmission client 3 performs waveform data analysis processing as follows each time a certain period of time elapses during the electrocardiogram data measurement period. FIG. 7 is a flowchart showing the processing procedure and processing contents.

  That is, when the waveform data analysis time comes, it is first determined in step S31 whether or not unanalyzed file data is stored in the waveform data storage unit 362 under the control of the waveform data analysis unit 326. If unanalyzed file data is stored as a result of this determination, the unanalyzed file data is read from the waveform data storage unit 362 in step S32, and an abnormal waveform is detected. The detection of the abnormal waveform is performed by, for example, storing an abnormal waveform pattern of an electrocardiogram in advance, extracting a waveform pattern from the file data for each predetermined section, and comparing the extracted waveform pattern with the abnormal waveform pattern. Made. Examples of abnormal waveform patterns of the electrocardiogram include detection of ventricular delay potential, minute potential and intraventricular high-frequency potential, waveform analysis, and heart rate variability analysis.

When an abnormal pattern is detected, an abnormal flag is set as shown in FIG. 11, for example, in association with the file data in which the abnormal pattern is detected in the file data management table in step S34. In addition to the file data in which an abnormal pattern is detected, an abnormal flag may be set for file data for a predetermined time before and after that.
The above waveform data analysis processing ends when there is no unanalyzed file data in the waveform data storage unit 362, or when the preset time or the number of file data is executed.

(4) Deletion of File Data The waveform data transmission client 3 performs file data deletion processing as follows under the control of the waveform data deletion unit 327 at the preset time of the day. FIG. 9 is a flowchart showing a processing procedure and processing contents of the waveform data deletion unit 327.

  First, in step S51, the measurement time of the file data deleted in the previous deletion process is read from the file data management table, and file data after the measurement time is selected. In step S52, it is determined by referring to the file data management table whether or not a save flag or an abnormality flag is set for the selected file data. As a result of this determination, if the save flag or the abnormality flag is set, the file data is excluded from the deletion target.

On the other hand, if the save flag or the abnormality flag is not set, it is subsequently determined in step S53 whether or not the file data is within the deletion target period. As a result of this determination, if the file data is included in the deletion target period set in advance, the file data is deleted in step S54. On the other hand, if the file data is not included in the deletion target period, the measurement time of the last deleted file is stored in step S55, and the process ends. If the storage capacity is large, it is possible to leave all file data without executing the deletion process.
By periodically deleting the file data as described above, the storage capacity of the waveform data storage unit 362 can be saved.

(5) Transfer of ECG data The ECG data is transferred from the waveform data transmission client 3 to the waveform data management server 4 and the waveform data analysis management server 5 as follows.
That is, the waveform data transmission client 3 transmits the converted waveform data (file data) according to the transmission processing parameters set in the waveform data transmission processing setting file 35 under the control of the converted waveform data transmission unit 341. For example, each time the converted waveform data (file data) for a predetermined time is stored in the waveform data storage unit 362, the file data group is read. Then, the read file data group is transmitted to the waveform data management server 4 and the waveform data analysis management server 5 together with the corresponding patient attribute information. The file data includes the header information shown in FIG.

  On the other hand, in the waveform data management server 4 and the waveform data analysis management server 5, first, the user information storage unit 451 for the patient identification information and the password transmitted from the waveform data transmission client 3 by the authentication processing units 40 and 50. , 551, the authentication is performed based on the user information stored. When the validity of the patient is confirmed, the converted waveform data receiving units 411 and 511 receive the converted waveform data (file data) and the patient attribute information transmitted from the waveform data transmission client 3, respectively. The The received file data and patient attribute information are stored in the converted waveform data storages 452 and 552 in association with the identification information of the file data. At this time, data representing the measurement start time and time length of the file data is also stored.

  When the storage of the file data and patient attribute information is completed, the waveform data management server 4 sequentially reads the file data from the converted waveform data storage unit 452 under the control of the summary value calculation unit 412. For each file data, a summary value, such as a hash value, is calculated for the continuous waveform of the ECG data. The calculated summary value is stored in the summary value storage unit 453 in a state associated with the file name.

(6) Analysis of electrocardiogram data in the waveform data analysis management server 5 The waveform data analysis management server 5 performs waveform data analysis processing as follows each time a certain time elapses after receiving and storing file data. Is called. FIG. 8 is a flowchart showing the processing procedure and processing contents.

  That is, when the waveform data analysis time comes, it is first determined in step S41 whether unanalyzed file data is stored in the converted waveform data storage unit 552 under the control of the waveform data analysis unit 514. If unanalyzed file data is stored, the file data is sequentially read from the converted waveform data storage unit 552 under the control of the summary value calculation unit 512, and the electrocardiogram data for each file data is read out. A summary value, such as a hash value, is calculated for the continuous waveform. The calculated summary value is stored in the summary value storage unit 553 in a state associated with the file name.

  Next, in step S43, the unanalyzed file data is read from the converted waveform data storage unit 552, and an abnormal waveform is detected. The detection of the abnormal waveform is performed by, for example, storing an abnormal waveform pattern of an electrocardiogram in advance, extracting a waveform pattern from the file data for each predetermined section, and comparing the extracted waveform pattern with the abnormal waveform pattern. Made. Examples of abnormal waveform patterns of the electrocardiogram include detection of ventricular delay potential, minute potential and intraventricular high-frequency potential, waveform analysis, and heart rate variability analysis.

When an abnormal pattern is detected, an abnormal flag is set in association with the file data in which the abnormal pattern is detected on the file data management table stored in the converted waveform data storage unit 552. In addition to the file data in which an abnormal pattern is detected, an abnormal flag may be set for file data for a predetermined time before and after that.
The above waveform data analysis processing ends when there is no unanalyzed file data in the converted waveform data storage unit 552, or when the preset time or the number of file data is executed.

(7) Browsing of electrocardiogram data Assume that, for example, a family doctor performs an operation for browsing the electrocardiogram data of a patient on the browser at the user terminal 6. Then, after the authentication process for the doctor who has made the access request is performed, a browsing request including the identification information of the patient to be browsed is sent from the user terminal 6 to the waveform data management server 4.

  On the other hand, in the waveform data management server 4, under the control of the converted waveform data display unit 431, the corresponding patient file data is converted into the converted waveform data storage unit 452 according to the patient identification information included in the received browsing request. Read from. Then, after the read file data is converted into a form that can be displayed on the user terminal 6, the file data is transmitted to the requesting user terminal 4. In the user terminal 4, when file data is sent from the waveform data management server 4, the file data is displayed on the display unit.

  The electrocardiogram data browsing process described above is performed by transmitting a browsing request from the user terminal 6 to the waveform data analysis management server 5 and transmitting the corresponding file data from the waveform data analysis management server 5 to the user terminal 6. Is also feasible.

(8) Verification of falsification When a suspicious point is found in electrocardiogram data in medical care, a doctor can request falsification verification for the corresponding electrocardiogram data. The alteration verification process is performed by the alteration verification unit 515 as follows. FIG. 14 is a sequence diagram showing the processing procedure and processing contents.

  That is, in the user terminal 6, when a doctor first performs a waveform data service use request operation in order to request verification of the falsification, an authentication process for the doctor is performed between the user terminal 6 and the waveform data analysis management server 5. Done. When the validity of the doctor is confirmed by this authentication, the waveform data service utilization screen data is sent from the waveform data analysis management server 5 to the user terminal 6 and displayed on the display.

  In this state, when a doctor performs a display data list display operation on the user terminal 6, the request information is sent from the user terminal 6 to the waveform data analysis management server 5. On the other hand, the waveform data analysis management server 5 generates save file selection screen display data designated by the request information and sends it to the user terminal 6. FIG. 12 shows an example of this waveform data selection screen.

  When the doctor designates the acquisition date and time of the comparison target waveform on the screen, comparison request information including the designated date and time is transmitted to the waveform data analysis management server 5. On the other hand, the waveform data analysis management server 5 first performs a summary value comparison process for the corresponding saved file as follows.

  That is, as shown in FIG. 14, first, a summary value corresponding to the corresponding saved file data is read from the summary value storage unit 553 of the waveform data analysis management server 5. Subsequently, acquisition request information for the waveform data summary value at the specified date and time is transmitted to the waveform data management server 4. On the other hand, the waveform data management server 4 reads the corresponding summary value from the summary value storage unit 453 in accordance with the request information and returns it to the waveform data analysis management server 5. In the waveform data analysis management server 5, the summary value returned from the waveform data management server 4 is compared with the summary value read out by the own server. Then, report data representing the comparison result is generated.

Next, the waveform data analysis management server 5 performs waveform data comparison processing for the corresponding saved file as follows. FIG. 15 is a flowchart showing the processing procedure and processing contents.
That is, the waveform data analysis management server 5 reads waveform data corresponding to the designated date and time of the corresponding saved file data from the converted waveform data storage unit 552. Subsequently, acquisition request information for the waveform data at the specified date and time is transmitted to the waveform data management server 4. On the other hand, the waveform data management server 4 reads the waveform data corresponding to the designated date and time of the corresponding saved file data from the converted waveform data storage unit 452 according to the request information and returns it to the waveform data analysis management server 5. . The waveform data analysis management server 5 compares the waveform data returned from the waveform data management server 4 with the waveform data read by the own server. Then, report data representing the comparison result is generated.

  Finally, report data representing the comparison result of the summary values generated previously and report data representing the comparison result of the waveform data are returned from the waveform data analysis management server 5 to the requesting user terminal 6. FIG. 13 shows an example of the report data display screen. By viewing this display screen, the doctor can grasp the presence / absence of falsification from the report data indicating the comparison result of the summary value, and further, the portion of the waveform data that has been falsified from the report data of the comparison result of the waveform data Can be specified.

(effect)
As described in detail above, in one embodiment, the waveform data analysis management server 5 calculates and saves a summary value from the electrocardiogram file data transferred from the waveform data transmission client 3, and performs tampering from the user terminal 6. When a verification request is sent, the summary value calculated by the server 5 is compared with the summary value calculated by the waveform data management server 4 to determine whether or not tampering has occurred. At the same time, by comparing the waveform data stored in the server 5 with the waveform data stored in the waveform data management server 4, the portion of the altered waveform data is specified.

  Therefore, even if the electrocardiogram file data stored in the waveform data management server is falsified, the presence or absence of falsification can be easily and reliably determined by comparing the summary values. In addition, it is possible to specify a part of biometric information that has been altered. In addition, since the alteration verification process is performed in the waveform data analysis management server 5 operated by a third party, it is possible to perform a highly reliable alteration verification.

[Other Embodiments]
In the embodiment, the comparison processing of the file data summary value transmitted from the waveform data transmission client 3 and the file data summary value stored in the waveform data management server 4, and the waveform data transmission client 3 The case where the waveform data analysis management server 5 operated by a third party organization performs the comparison process between the waveform of the file data and the waveform of the file data stored in the waveform data management server 4 has been described. However, the present invention is not limited thereto, and the summary data comparison process and the waveform comparison process may be performed by the waveform data transmission client 3. In this way, even in a system in which the waveform data analysis management server 5 does not exist, it is possible to determine whether or not tampering has occurred, and it is possible to detect a tampered waveform.

  In addition, the configuration of each server and its processing procedure and processing contents can be variously modified and implemented without departing from the gist of the present invention.

  In short, the present invention is not limited to the above-described embodiment as it is, and can be embodied by modifying the constituent elements without departing from the scope of the invention in the implementation stage. Further, various inventions can be formed by appropriately combining a plurality of constituent elements disclosed in the embodiment. For example, some components may be deleted from all the components shown in the embodiment. Furthermore, you may combine suitably the component covering different embodiment.

  US: Patient home / care facility, CS: Medical cloud (third party), HC ... Hospital / data center, HB ... Hospital / clinic, NW ... Network, 1 ... Simple electrocardiograph, 2 ... Alarm button, 3 ... Waveform data transmission client, 4 ... Waveform data management server, 5 ... Waveform data analysis management server, 6 ... User terminal, 7 ... Maintenance terminal, 30 ... Process reception unit, 31, 40, 50 ... Authentication processing unit, 32 ... Waveform data processing unit 33 ... Waveform data processing setting file 34 ... Waveform data transmission processing unit 35 ... Waveform data transmission processing setting file 36, 45, 55 ... Information storage unit 41, 51 ... Converted waveform data processing unit 42, 52 ... converted waveform data processing setting file, 43, 53 ... converted waveform data monitoring processing unit, 44, 54 ... converted waveform data monitoring processing setting File, 321 ... Waveform data receiving unit, 322 ... Format conversion unit, 323 ... Summary value calculation unit, 324 ... Alarm data processing unit, 325, 342, 413, 432, 513, 532 ... Log output unit, 515 ... Tampering verification unit 326 ... Waveform data analysis unit, 327 ... Waveform data deletion unit, 341 ... Converted waveform data transmission unit, 361, 451, 551 ... User information storage unit, 362 ... Waveform data storage unit, 363, 453, 553 ... Summary value Storage unit, 364, 454, 554 ... log information storage unit, 452, 551, 552 ... converted waveform data storage unit.

Claims (9)

A medical information management system comprising a client device that acquires user biometric information and a management server device that manages medical information including the user biometric information, and these devices are connected via a network,
The client device is
Means for converting the acquired biometric information into file data in a preset format, and transmitting the converted file data together with the attribute information of the user to the management server device;
Means for calculating a first summary value of the file data for each file data after conversion, and storing the calculated first summary value in association with identification information of the file data in a first storage unit; With
The management server device
Means for receiving the converted file data and attribute information transmitted from the client device, and storing the received converted file data and attribute information in the second storage unit in association with the identification information of the file data When,
For each of the stored file data, a second summary value of the file data is calculated independently of the calculation of the first summary value by the client device, and the calculated second summary value is calculated in the file Means for storing in the second storage unit in association with identification information of the data,
The client device is
When determining whether or not the file data of the biometric information stored in the management server device has been tampered with, the second summary value stored in the second storage unit from the management server device is obtained for each file data. A medical information management system, comprising: means for acquiring and comparing the acquired second summary value and the first summary value stored in the first storage unit. The client device is
Biometric information storage control means for storing the acquired biometric information or the converted file data in the first storage unit in association with the identification information;
When specifying falsified file data among the biometric information file data stored in the management server device, the file data after conversion stored in the second storage unit is acquired from the management server device. The medical device according to claim 1, further comprising means for comparing the acquired converted file data with the biometric information stored in the first storage unit or the converted file data. Information management system. The biological information storage control means includes
When a notification signal for notifying the user's physical condition is input to the client device, the biometric information acquired in a predetermined time range before and after the generation time of the notification signal or the file data after the conversion is specified information. The medical information management system according to claim 2, wherein the medical information management system is stored in the first storage unit. The biological information storage control means includes
When the acquired biological information is analyzed and an information component defined as an abnormality is detected, the biological information acquired in the predetermined range before and after the position where the abnormality is detected or the file data after the conversion is specified The medical information management system according to claim 2, wherein the medical information management system stores the information in the first storage unit. The biological information storage control means includes
Of the biological information stored in the first storage unit or the file data thereof, a storage or abnormality flag is assigned to the specific information, and the biological information or file data to which the storage or abnormality flag is not added is added to the first information. 5. The medical information management system according to claim 3, wherein the medical information management system is deleted from one storage unit. A client device that obtains user biometric information, a first management server device that manages medical information including the user biometric information, and a second management server device that is operated by a third-party organization, and these devices Is a medical information management system connected through a network,
The client device is
Means for converting the acquired biometric information into file data in a preset format, and transmitting the converted file data to the first and second management server devices together with the attribute information of the user, respectively.
The first management server device includes:
Means for receiving the converted file data and attribute information transmitted from the client device, and storing the received converted file data and attribute information in the first storage unit in association with the identification information of the file data When,
Means for calculating a first summary value of the file data for each stored file data, and storing the calculated first summary value in association with identification information of the file data in the first storage unit; And
The second management server device
Means for receiving the converted file data and attribute information transmitted from the client device, and storing the received converted file data and attribute information in the second storage unit in association with the identification information of the file data When,
For each of the stored file data, a second summary value of the file data is calculated independently of the calculation of the first summary value by the first management server device, and the calculated second summary is calculated. Means for storing the value in the second storage unit in association with the identification information of the file data;
When determining whether or not the file data of the biometric information stored in the first management server device is falsified, for each file data, obtain the first summary value from the first management server device, A medical information management system comprising: means for comparing the acquired first summary value with the second summary value stored in the second storage unit. The second management server device
The post-conversion stored in the first storage unit from the first management server device when specifying the falsified file data among the biometric information file data stored in the first management server device And a means for comparing the acquired file data after conversion and the converted file data stored in the second storage unit. Medical information management system. A medical information management method executed by a system that includes a client device that acquires user biometric information and a management server device that manages medical information including the user biometric information, and these devices are connected via a network. And
The client device converts the acquired biometric information into file data in a preset format, and transmits the converted file data together with the user attribute information to the management server device;
The client device calculates a first summary value of the file data for each of the converted file data, and associates the calculated first summary value with identification information of the file data in a first storage. The process of memorizing in the department,
The management server device receives the converted file data and attribute information transmitted from the client device, associates the received converted file data and attribute information with the identification information of the file data, Storing in the storage unit;
The management server device calculates a second summary value of the file data for each of the stored file data independently from the calculation of the first summary value by the client device . Storing the summary value in the second storage unit in association with the identification information of the file data;
When the client device determines whether or not the file data of biometric information stored in the management server device has been tampered with, the file stored in the second storage unit from the management server device is stored for each file data. 2. A medical information management method comprising: obtaining two summary values, and comparing the obtained second summary value with the first summary value stored in the first storage unit . A client device that obtains user biometric information, a first management server device that manages medical information including the user biometric information, and a second management server device that is operated by a third-party organization, and these devices Is a medical information management method executed by a system connected via a network,
The client device converts the acquired biometric information into file data in a preset format, and transmits the converted file data to the first and second management server devices together with the attribute information of the user. Process,
The first management server device receives the converted file data and attribute information transmitted from the client device, and associates the received converted file data and attribute information with the identification information of the file data. Storing in the first storage unit;
The first management server device calculates a first summary value of the file data for each stored file data, and associates the calculated first summary value with the identification information of the file data. Storing in the first storage unit;
The second management server device receives the converted file data and attribute information transmitted from the client device, and associates the received converted file data and attribute information with the identification information of the file data. Storing in the second storage unit;
The second management server device calculates a second summary value of the file data for each file data stored in the second storage unit by calculating the first summary value by the first management server device. Independently calculating and storing the calculated second summary value in association with the identification information of the file data in the second storage unit;
When the second management server device determines whether or not the file data of the biometric information stored in the first management server device has been tampered with, for each file data, the first management server device Obtaining the first summary value stored in the first storage unit, and comparing the acquired first summary value with the second summary value stored in the second storage unit. A medical information management method characterized by:

Images