GR1008922B - System for remote non-supervised dynamic interaction with medico-technical devices - Google Patents

Abstract

Embodiments of the present invention relate to a medical application-specific system and method that defines accessibility conditioning for remote interaction with a medical device. The present disclose associates, simultaneously and in realtime, a variety of factors such as the medical device specific characteristics with the type and criticality of the actions requested to be performed on a medical device from a remote user, thus defining the spatiotemporal footprint of remote interaction. Critical embodiments include two cooperating units, an Access Rights Management Agent and a Real-TimeAccess Management Controller, which in synergy allow or forbid remote interaction, acting under a sophisticated framework of multi-dimensional authorization rules and risk management processes, rendering physical supervision from the device operator redundant.

Description

Remote, Unsupervised, Dynamic System

Interaction with Medical Technological Devices

Technical field of the invention. Prior Art Level and Evaluation thereof

The recent technological developments in the field of medical technological devices include new automated technologies and Hi Tec applications which were developed in order, on the one hand, to respond to the evolving needs in the Health sector and on the other hand to increase the efficiency of laboratory procedures. Medical devices consist of electronic boards that receive commands from firmware, which is embedded in integrated circuits, and software applications that run on computers. The high degree of complexity of these devices highlights the key issue of their support and maintenance. This issue affects and requires the close cooperation of the entire spectrum of professionals in the bioscientific community, and more specifically Laboratories, Hospitals, Healthcare professionals, Suppliers, Maintenance managers and Manufacturers of these devices.

In order to address the above issue, the adoption of “Remote Monitoring and Control” is experiencing a remarkable increase due to the outstanding benefits it presents. Despite its complex approach, remote access is already considered the most valuable way to obtain information in a direct and accurate manner regarding the performance and functionality of medical devices. Applications based on Machine-to-Machine (M2M) communication enable users to remotely access a medical device and interact with it or even control it, in order to monitor, manage and repair connected components and their maintenance. Due to the special nature of the data extracted from the medical devices, the imposed access arrangements and regulations must be taken into account depending on the type of user and the action being performed.

Automated medical technology devices perform a multitude of complex tasks based on strict schedules in order to serve high-performance processes. Unlike other types of devices, remote access to a medical device can be performed within a limited time interval, the definition of which is multi-parametric and directly related to the action that the remote user wants to perform. Otherwise, there is a risk of disrupting the optimal operation of the device and potentially interrupting important processes, causing malfunctions or even jeopardizing the safety of laboratory staff and patients.

Modern approaches either use none, or simply use a standard remote access management system where the way an access request is evaluated takes into account only a set of one-dimensional and fixed rules that result in the request being approved or rejected. Available solutions incorporate monitoring systems that either allow access to the entire system and medical device data in an insecure manner, i.e. without using access control procedures, or allow access by applying simple rules that are insufficient to protect the medical device and the "sensitive" data of the patients (EP 2 255 722 A1, US 2004/0075619 A1, US 2005/0125675 A1). In the second case, the applied rules focus on enforcing common authentication procedures, defining different categories of users and allowing access to specific areas of the medical device according to the predefined access rights of each category. Even approaches such as that described in US 2015/0178295 A1 are not sufficient to protect a medical device, as they focus on protecting e-mail, web pages and installed programs, while completely ignoring the implications of unauthorized access to those cases where either the specific procedures performed on the medical device or the specific regulations followed during the operation of the device prohibit remote access itself. Such standard management systems that determine the approval or rejection of a request based on the above simple rules fail to respond to the distinct particularities of medical devices. This is because they do not recognize the inherent risks associated with remote access, nor do they assess, evaluate, or adopt remedial measures regarding the individual risks inherent when a user interacts with and/or controls a medical device from a remote location.

This problem is usually addressed by using the 'Supervised' remote access model, which is based on the 'four eyes' principle. This principle considers that always, during a remote session, the actions of the remote user (e.g. the support technician) must be supervised by an authorized worker (device operator) who is responsible for the device/system in need to be maintained. The physical presence of the latter in front of the device is considered mandatory in order to ensure that critical processes are not interrupted, as well as that all actions of the remote user are risk-free and within the scope of the remote session. However, this approach minimizes the inherent advantages of remote access and is prone to human error.

In addition to contributing to insufficient human resources, since two people always have to be involved in the process of a remote session, the 'Supervised' model has several disadvantages. One of them is the fact that this model makes the operator of the device responsible for evaluating every action taken by the remote user, which he examines on a case-by-case basis, in order to avoid unintended or unauthorized access. However, in this way there is a risk of incorrect evaluation (on the part of the device operator) of the actions of the remote user. Characterizing an action as either safe or non-important may allow, perhaps indirectly, the remote user access to protected and sensitive data. In addition, the operator of the device is required to be a passive observer, a task requiring a high degree of concentration, of the actions of a user who is likely to have superior knowledge of computers/computer systems and of the their capabilities. The evaluation of the remote user's actions by someone without the above special knowledge constitutes a serious security risk with multiple implications especially in the case of medical devices and their data.

Therefore, based on the above evidence and the ever-increasing use of "Remote Monitoring and Control" in the field of medical devices, there is a pressing need for a "medical application-specific" decision-making mechanism that will automatically and dynamically evaluate a combination of factors to accurately define the characteristics of remote interaction with a medical device.

Disclosure of the invention

The object of the present invention is to provide such a dynamic "specialized medical applications" system, which will determine the connectivity conditions with each type of medical technology device with respect to a remote session. Connectivity conditions are determined through the simultaneous and real-time evaluation of a multitude of factors such as the individual characteristics of the medical device and the type and criticality of the requested actions by the remote user (indicative reference). Under a complex framework using multi-parameter authorization rules and risk management processes, the above factors are evaluated to determine not only the positive or negative outcome of the access request, but primarily the spatio-temporal footprint of the remote connection.

The present invention, through the provision of a system "specialized for medical applications" which makes the remote connection completely secure and error-free (given its automated identification), allows all relevant categories of users (Laboratories, Hospitals, Suppliers, responsible Maintenance) to take full advantage of the inherent advantages of remote connection. In addition, the ability of the system of the present invention to enhance and optimize the work flow, constitutes an important competitive advantage for the above categories of professionals.

The system described in the present invention includes 3 basic elements which communicate through a data link. In detail it includes: the medical device, the server and the users who wish to remotely communicate with the medical device. The Server includes two cooperating modules: the Access Rights Management Entity and the Real-Time Access Management Entity, which synergistically allow or deny Users to perform specific actions on the given medical device.

Users, through the Medical Device Monitoring Panel, request permission to remotely connect to a medical device and perform a specific action. The request is transferred to the Server and more specifically to the Access Rights Management Entity, which collects the requests and represents the first level of access rights control, as observed in the standard access management systems described above. The request is either rejected if it conflicts with the entity's fixed rules (indicatively: the user type, the user category, any restrictions and the device state), or it is forwarded to the Real-Time Access Management Entity if it is in accordance with the above rules.

The Real-Time Access Management Entity then evaluates a series of multi-parameter rules and the risks associated with the corresponding actions, including but not limited to the following: the state of the medical device, the type and criticality of the protocols being performed , the nature of the samples, the characteristics of the reagents and performance factors, the information retrieved during the execution of the software, the already programmed tasks of the medical device, information from other connected devices, the access to sensitive data, the geographical location of the device as well as national/international legislation concerning the operation of the specific device. The aforementioned data (real-time data originating from the device and specialized for the medical application being executed) is forwarded to the Real-Time Access Management Entity through the Real-Time Data Retrieval Unit which, serving the specific purpose, has been integrated into the medical device.

The dynamic correlation of the above authorization rules, as indicatively mentioned, determines the exact context under which the requested action is permitted or prohibited, is characterized as potentially or unconditionally acceptable and its exact spatio-temporal footprint is determined. The accessibility conditions satisfied by this system facilitate the proper management of processes and resources, the safety of medical staff and patients in the "connected" Health units and protect against unauthorized or unsafe remote access.

While the invention can accept any modifications and presents alternative forms, Figure 1 shows an exemplary distribution which is analyzed in detail in the following text. It is to be understood, however, that it is not intended to limit the present invention to the form described, but rather it is the intention of the inventor to cover all possible modifications, equivalents and alternatives that come within the scope and purpose of the invention as defined. from the listed claims.

Shape description

Figure 1 presented in the appendix, illustrates the flow of data exchange between the different components of the system. Subsequently, the following notations will be used:

(A) Medical device(s) or system(s) requiring remote interaction

(B) Medical Device Monitoring System(s).

(C) Access Rights Management Entity

(D) Real-Time Access Management Entity

(E) Intermediary Server for communication between (A) and (B)

(F) Contact Member Servant of (B)

(G) Real-time data retrieval module of (A)

(H) Fixed rules used by (C)

(K) Dynamic rules used by (C)

Detailed description of the invention

The brief schematic representation of the elements used for the implementation of the Unsupervised System of Remote Interaction with Medical Technological Devices according to the proposed provisions, is presented in detail in Figure 1.

The main elements of the system are: a Medical Technology device/system that needs remote interaction (A), a Medical Technology Device Monitoring System (B) where a Graphical User Environment is designed to visually display all the individual actions that can be performed by the User during his remote connection to the medical device, an Access Rights Management Entity (C) which allows or rejects a remote connection request to the Medical device/system in need of remote interaction (A), a request which is transmitted through the Medical Device Monitoring System (B) and the Real-Time Access Management Entity (D) which assesses in real time the instantaneous state of the Medical Device/System in need of remote interaction (A) and the nature of the access request carried through the System of Monitoring Medical Technological Devices (B) in order to confirm (or not) the positive response of the Access Rights Management Entity (C) with the consequence of approving (or rejecting) the remote access request with the above characteristics.

The remote connection to a Medical device/system that needs remote interaction (A) includes the execution of a series of actions related to the operating procedures of the device (software/hardware) as well as the remote access to the local storage disk of the device, the connected peripherals and running the desktop sharing function, all of which are subject to strict authorization rules.

The first level of authorization is achieved through the Access Rights Management Entity (C) which includes a standard access rights framework, presented as the set of the following rules:

• The User can perform an Action from a Set of Actions on the Medical device/system that needs remote interaction (A).

More specifically, the Access Rights Management Entity (C) allows a User to perform an Action from a Set of Actions on a Medical Technology device/system that needs remote interaction (A), which should be additionally confirmed by the Access Management Entity to Real Time (D). The latter offers a second level of access control based on multi-parameter rules that are closely related to the type and intended use of the medical device.

Figure 1. illustrates the parameters by which a positive or negative access response can prevail. Parameters include, but are not limited to, the following:

1. The state of the medical device (e.g. active- available, active- in protocol mode, active- unavailable, inactive), 2. The type and criticality of the protocols or operations performed,

3. The nature of the samples,

4. Reagent characteristics and performance factors (such as stability, sensitivity, optimum temperature, contamination risks);

5. The information retrieved during the execution of the software, 6. The short-term or long-term scheduled tasks assigned to the medical device,

7. Information from other connected devices,

8. Access to sensitive data (patient data),

9. The geographical location of the device,

10. National and international legislation concerning the operation of the particular device (eg access restrictions imposed by bilateral intergovernmental agreements concerning the exchange of data and the processing of information).

The Medical Device/System requiring remote interaction (A) and the Medical Device Monitoring System (B) communicate either through a data link or through the Intermediary Server using a persistent connection or a session-based connection.

Whenever a Medical Device Monitoring System User (B) wishes to perform an Action from a Set of Actions on a Medical Device/system that needs remote interaction (A) they must obtain authorization from the Access Rights Management Entity (C). For this purpose, the Medical Device Monitoring System (B) has a Server Communication Element (F), which is responsible for the communication between the Medical Device Monitoring System (B) and the Access Rights Management Entity (C) so that the ability to receive the authorization is ensured.

The Access Rights Management Entity (C) upon receiving an incoming request from the Medical Device Monitoring System (B) related to a desired action on a Medical Device/system in need of remote interaction (A), evaluates the associated Fixed Rules (H ) and issues a positive or negative response (YES/NO) for the specific request. The response is accompanied by a Response Report containing information indicating the context under which the desired action could potentially be accepted such as the time period and applicable location restrictions, or otherwise documenting the reasons for rejection.

In the case of a negative answer (NO), the Access Rights Management Entity (C) communicates directly with the Medical Device Monitoring System (B) through the Server Communication Link (F) and informs the User with the relevant Response Report.

In the event that the Access Rights Management Entity (C) issues a positive response (YES) the request is transferred to the Real-Time Access Management Entity (D). The latter processes the incoming record coming from the Access Rights Management Entity (C) in comparison with the available information regarding the medical device. For this purpose, the Medical device/system requiring remote interaction (A) has a Real-time Data Retrieval Unit (G) which is responsible on the one hand for collecting real-time data in relation to the aforementioned features of the Medical device, and on the other hand for the transfer of this data to the Real Time Access Management Entity (D). This is followed by the simultaneous evaluation of all available parameters related to the prevailing conditions in the Medical Technology device/system that needs remote interaction (A) in combination with the characteristics of the given request. All of the above are contrasted with the set of Dynamic Rules (K), resulting in the Real-Time Access Management Entity (D) issuing a positive or negative response along with the associated Response Report. The response is transmitted to the Access Rights Management Entity (C), which in turn informs the Medical Device Monitoring System (B) and by extension the User.

In complex systems of "connected" Healthcare units it is possible to have both a number of Medical Technology Device Monitoring Systems (B) and a number of Medical Technology devices/systems that need remote interaction (A). In these cases and with the ultimate aim of avoiding unnecessary data processing, the present invention can effectively respond and serve the requests of multiple entities through a single Access Rights Management Entity (C) and through a single Real-Time Access Management Entity ( D). However, in alternative structures such as those where isolated communication is either a requirement or simply preferred, an Access Rights Management Entity (C) and a Real-Time Access Management Entity (D) may be exclusively available to serve each Medical Technology device/system that needs remote interaction (A) and their respective Users.

While the invention has been described in text and related form, this description has been construed as exemplary and not restrictive and describes only those modifications and modifications which are intended to be protected.

i illustrated in detail in the above image and illustration should be considered a racter. It should also be noted that exemplary structures and that all changes in the spirit of the invention are desired

Claims (15)

Claims The inventor claims: 1. A method serving a system in need of remote interaction, and consisting of the following: a. A system equipped with a computer that requires remote interaction, which requires authorization so that: i. To be able to remotely execute a set of actions related to the processes resulting from the predetermined use of the system (hardware/software) and ii. To be able to remotely access local storage media, the connected peripherals as well as the execution of the desktop sharing function, hereinafter referred to as "protected access actions". To serve the system that needs remote interaction, the latter is in communication with a monitoring system equipped with a computer. b. The association of said system that needs remote interaction with an Access Rights Management Entity. Through this entity will be subject to processing every communication of the said monitoring system to in relation to such protected access actions. c. The association of a Real-Time Access Management Entity with said Access Rights Management Entity to evaluate remote access authorization requests. Requests that are relevant to said protected access actions of said system in need of remote interaction are evaluated based on specific parameters of said system in need of remote access, and d. Ensuring that said monitoring system has access to said protected access actions only after obtaining authorization from said Access Rights Management Entity, taking into account the decision of said Real-Time Access Management Entity. 2. A method as described in claim 1, wherein the authorization of access to said protected access actions is performed by performing a real-time authorization process. This process takes into account the discrete access requests generated by said monitoring system so as to grant access to said protected access actions for the purpose of servicing said system in need of remote interaction. 3. A method, as described in claim 1, in which the decision to deny or accept access to said protected access actions is performed by automatically identifying the actions that need authorization. 4.    A method as described in claim 1, wherein positive authorization relating to a request to gain access to said protected access actions of said system in need of remote interaction is ensured through said Access Rights Management Entity. Authorization is based on the parameters of said system requiring remote interaction and is obtained through said Real Time Access Management Entity. 5.   A method as described in claim 1, wherein the denial of authorization pertaining to a request to gain access to said protected access actions of said system requiring remote interaction is performed through said Access Rights Management Entity. The non-authorization is based on the parameters of that system that needs remote interaction and its rejection is done through that Real-Time Access Management Entity. 6.   A method, as described in claim 1, claim 4 and claim 5, in which said monitoring system is informed of the reason for the authorization not being secured and, when possible, the conditions under which the authorization is in potentially feasible. 7.   A method as described in claim 1, in which it is possible to simultaneously authorize access to said protected access actions to multiple access requests originating from multiple said monitoring systems and involving multiple said systems requiring remote interaction. 8. An arrangement serving a system requiring remote interaction, consisting of the following: a. A system equipped with a computer that requires remote interaction, which interaction requires authorization so that: i. To be able to remotely execute a set of actions related to the processes resulting from the predetermined use of the system (hardware/software) and ii. To be able to remotely access local storage media, the connected peripherals as well as the execution of the desktop sharing function, in order to serve the system that needs remote interaction, it is in communication with a monitoring system equipped with a computer. b. The association of said system that needs remote interaction with an Access Rights Management Entity. Through this entity, any communication of said monitoring system in relation to said protected access actions shall be processed. c. The association of a Real-Time Access Management Entity with said Access Rights Management Entity to evaluate remote access authorization requests. Requests that are relevant to said protected access actions of said system in need of remote interaction are evaluated based on specific parameters of said system in need of remote access, and d. Ensuring that said monitoring system has access to said protected access actions only after obtaining authorization from said Access Rights Management Entity, taking into account the decision of said Real-Time Access Management Entity. 9.   An arrangement as described in claim 1, wherein the authorization of said access to said protected access actions is performed by performing a real-time authorization process. This process takes into account the discrete access requests generated by said monitoring system so as to gain access to said protected access actions for the purpose of servicing said system in need of remote interaction. 10.  A provision, as described in claim 1, in which the decision to deny or accept access to said protected access actions is made through automatic identification of actions requiring authorization. 11. An arrangement, as described in claim 8, in which said protected access actions include a set of actions related to the operation of said system that needs remote interaction (hardware/software), a set of actions related to the local storage media of said system in need of remote interaction, a set of actions related to performing the desktop sharing function with said system in need of remote interaction, and a set of actions related to connected peripherals of said system that needs remote interaction. 12.  A provision as described in claim 1, wherein the affirmative authorization relating to a request to obtain access to said protected access actions of said system requiring remote interaction is ensured through said Access Rights Management Entity. Authorization is based on the parameters of said system requiring remote interaction and is obtained through said Real Time Access Management Entity. 13.  A provision as described in claim 1, wherein the denial of authorization relating to a request to gain access to said protected access actions of said system requiring remote interaction is effected through said Access Rights Management Entity. The non-authorization is based on the parameters of that system that needs remote interaction and its rejection is done through that Real-Time Access Management Entity. 14.  A provision, as described in postulate 1, postulate 4 and postulate 5, in which the reason for authorization not being secured and, where possible, the circumstances under which authorization is not secured, are communicated to said monitoring system. potentially feasible. 15.  A device as described in claim 1, in which it is possible to simultaneously authorize access to said protected access actions to multiple access requests originating from multiple said monitoring systems and involving multiple said systems requiring remote interaction.