JP2022165381A - Information processing system, information processing method and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To strengthen anti-spoofing measures in medical services using a medical care booth.

SOLUTION: An information processing system according to one embodiment of the present disclosure, comprises one or more computers, where the one or more computers include means for supporting provision of medical services using a medical care booth, means for authenticating a user before the provision of the medical services or during the provision of the medical services, means for determining whether or not to start the provision of the medical services or whether or not to continue the provision of the medical services, depending on the result of the personal authentication, and means for limiting the medical services to be provided to the user when it is determined not to start the provision of the medical services, or not to continue the provision of the medical services.

SELECTED DRAWING: Figure 8

COPYRIGHT: (C)2023,JPO&INPIT

Description

The present disclosure relates to an information processing system, an information processing method, and a program.

In recent years, Japan has been promoting efforts to appropriately implement and spread telemedicine. Patients can receive telemedicine at home, saving them the trouble of going to the hospital. On the other hand, at the patient's home, it is difficult for the doctor to obtain the biological information required for diagnosis, and the patient cannot receive the medicine on the spot.

Patent Literature 1 discloses a technology related to a medical kiosk in which a patient can receive remote medical diagnosis and drug provision in a medical booth equipped with measuring equipment and drug storage.

Japanese Patent Application Laid-Open No. 2015-215769

In medical services in general, from the perspective of preventing illegal acquisition of drugs and illegal use of health insurance, it is necessary to take countermeasures against the act of impersonating a patient to receive medical services (spoofing). In particular, telemedicine requires effective countermeasures against spoofing because the information that can be obtained from the person receiving the medical service is limited compared to face-to-face medical care.

US Pat. No. 6,200,000 states that the camera can be used for patient identification. However, US Pat. No. 6,200,003 does not describe how patient identification can be accomplished using a camera, nor what actions the medical kiosk can take depending on the results of the identification.

A first object of the present disclosure is to strengthen countermeasures against spoofing in medical services using medical booths. A second object of the present disclosure is to provide high-quality medical services while reducing the time and effort required for patients to visit hospitals.

An information processing system according to an aspect of the present disclosure includes one or more computers, and the one or more computers include means for supporting provision of medical services using a medical booth and means for authenticating the identity of the user during the provision of medical services, means for determining whether to start providing medical services or whether to continue providing medical services according to the results of the authentication, and and means for limiting the medical services provided to the user if it is determined not to initiate or continue to provide the services.

According to the present disclosure, it is possible to strengthen spoofing measures in medical services using medical booths. According to the present disclosure, it is possible to provide high-quality medical services while reducing the time and effort required for patients to visit hospitals.

It is a block diagram showing the configuration of the medical service system of the present embodiment. 2 is a block diagram showing configurations of a client device and a server; FIG. It is a figure which illustrates the external appearance of the medical booth of this embodiment. It is a figure which illustrates the internal space of the medical booth of this embodiment. It is an explanatory view of the preparation phase of the medical service of this embodiment. FIG. 4 is an explanatory diagram of a medical service provision phase according to the present embodiment; It is a figure which shows the data structure of the information database for authentication of this embodiment. It is a figure which shows the 1st part of the whole flow of a medical service provision process of this embodiment. It is a figure which shows the 2nd part of the whole flow of a medical service provision process of this embodiment. It is a figure which shows the example of a screen displayed in the medical service provision process of this embodiment. It is a figure which shows the example of a screen displayed in the medical service provision process of this embodiment. It is a figure which shows the example of a screen displayed in the medical service provision process of this embodiment. FIG. 11 is a block diagram showing the configuration of a medical service system of modification 1; FIG. 10 is a diagram showing an installation example of a medical booth and storage in the medical service system of Modification 1; 2 is a block diagram showing the configuration of a storage warehouse management device; FIG. FIG. 11 is a diagram illustrating an appearance of a storage cabinet according to modification 1; FIG. 10 is a diagram showing a data structure of a permission information database of modification 1; 10 is a flowchart illustrating a medical product provision process of Modification 1;

An embodiment of the present invention will be described in detail below with reference to the drawings. In the drawings for describing the embodiments, in principle, the same constituent elements are denoted by the same reference numerals, and repeated description thereof will be omitted.

(1) Configuration of Medical Service System The configuration of the medical service system of this embodiment will be described. FIG. 1 is a block diagram showing the configuration of the medical service system of this embodiment.

As shown in FIG. 1 , the medical service system 1 includes a medical booth 5 , a server 30 and a doctor terminal 50 . A medical service system 1 provides medical services using a medical booth 5 to patients.
The medical booth 5 is a base for providing medical services to patients. Medical booths 5 can be located, for example, in petrol stations, drug stores, shopping centers, railway stations, airports, highway service areas, public facilities, office buildings, or school premises. Medical booth 5 includes client device 10 .

Here, the number of medical booths 5, servers 30, and doctor terminals 50 is not limited to one, and may be two or more.

The client device 10, server 30, and doctor terminal 50 can be connected via a network (for example, the Internet or an intranet) NW.

The client device 10 is an example of an information processing device that transmits requests to the server 30 . Client device 10 may be, for example, one or more computers.

The server 30 is an example of an information processing device that provides the client device 10 with a response in response to a request transmitted from the client device 10 . Server 30 is, for example, a web server, an application server, a database server, or a combination thereof.

The doctor terminal 50 is, for example, an information processing device for business use by medical personnel. Medical personnel are typically physicians, but may be pharmacists, nurses, midwives, public health nurses, or other health care professionals, or assist in the provision of medical services, depending on the nature of the medical services to be provided. service providers (for example, SaaS (Software as a Service) operators). The doctor terminal 50 may have the same or similar hardware configuration as the client device 10, for example. The doctor terminal 50 may be, for example, a smart phone, a tablet terminal, or a PC (Personal Computer).

(1-1) Configuration of Client Apparatus The configuration of the client apparatus according to this embodiment will be described. FIG. 2 is a block diagram showing configurations of a client device and a server.

As shown in FIG. 2, the client device 10 includes a storage device 11, a processor 12, an input/output interface 13, and a communication interface .

Storage device 11 is configured to store programs and data. The storage device 11 is, for example, a combination of ROM (Read Only Memory), RAM (Random Access Memory), and storage (eg, flash memory or hard disk).

Programs include, for example, the following programs.
・OS (Operating System) programs ・Applications that execute information processing (for example, web browsers or healthcare apps) programs

The data includes, for example, the following data.
・Data and databases referenced in information processing ・Data obtained by executing information processing (that is, execution results of information processing)

The processor 12 is configured to implement the functions of the client device 10 by activating programs stored in the storage device 11 . Processor 12 is an example of a computer. The programs and data stored in the storage device 11 may be provided via a network, or may be provided by being recorded on a computer-readable recording medium. At least part of the functions of the client device 10 may be realized by one or more pieces of dedicated hardware.

The input/output interface 13 acquires signals (e.g., user instructions, sensing data) from input devices connected to the client device 10, and outputs signals (e.g., image signals, audio signal, control signal).
The input device is, for example, a camera (for example, cameras 161 and 163 to be described later), an IC (Integrated Circuit) card reader, a scanner, a microphone, a sensor, a keyboard, a pointing device, a touch panel (for example, a touch panel 162 to be described later), or is a combination of
The output device is, for example, a display (for example, displays 171 and 172 described later), a speaker, or a combination thereof.

Communication interface 14 is configured to control communication between client device 10 and an external device (eg, server 30 or physician terminal 50).

(1-2) Server Configuration The server configuration of this embodiment will be described.

As shown in FIG. 2, the server 30 includes a storage device 31, a processor 32, an input/output interface 33, and a communication interface .

Storage device 31 is configured to store programs and data. Storage device 31 is, for example, a combination of ROM, RAM, and storage (eg, flash memory or hard disk).

Programs include, for example, the following programs.
・OS program ・Application program that executes information processing

The data includes, for example, the following data.
・Data and databases referenced in information processing ・Execution results of information processing

The processor 32 is configured to implement the functions of the server 30 by activating programs stored in the storage device 31 . Processor 32 is an example of a computer. The programs and data stored by the storage device 31 may be provided via a network, or may be provided by being recorded on a computer-readable recording medium. At least part of the functions of the server 30 may be realized by one or more pieces of dedicated hardware.

The input/output interface 33 is configured to obtain signals from input devices connected to the server 30 and to output signals to output devices connected to the server 30 .
Input devices are, for example, keyboards, pointing devices, touch panels, or combinations thereof.
Output devices are, for example, displays, speakers, or a combination thereof.

Communication interface 34 is configured to control communication between server 30 and an external device (eg, client device 10 or physician terminal 50).

(1-3) Configuration of Medical Booth The configuration of the medical booth according to this embodiment will be described. FIG. 3 is a diagram illustrating the appearance of the medical booth of this embodiment. FIG. 4 is a diagram illustrating the internal space of the medical booth of this embodiment.

As shown in FIG. 3, the medical booth 5 includes a box-shaped housing HS1. The housing HS1 is preferably composed of a soundproof wall from the viewpoint of patient privacy protection. A door DR1 is provided on the front side of the housing HS1 for opening and closing an entrance for a patient to enter and leave the internal space of the medical booth 5 .

The door DR1 has an electronic lock EL1. The electronic lock EL1 is temporarily unlocked under the control of the client device 10 or the server 30 when the patient enters the room, but in principle it is locked except for such limited timing. For example, the electronic lock EL1 is automatically locked after a certain period of time has passed since it was unlocked and after the door DR1 has been opened and closed. This can prevent people other than the pre-registered patients from entering the medical booth 5 without justifiable reason. Further, the electronic lock EL1 is configured so that it can be manually unlocked from the internal space of the medical booth 5 . As a result, the patient can quickly leave the medical booth 5 even in the event of an emergency, disaster, trouble with the medical service system 1, or other unforeseen circumstances.

The door DR1 has a window WN1. The window WN1 is preferably made of opaque glass (eg, frosted glass, molded glass, etc.). As a result, while protecting the privacy of the patient using the medical booth 5, a person outside the medical booth 5 can roughly check the inside of the medical booth 5. - 特許庁For example, a patient who intends to use the medical booth 5 or an operator who maintains the medical booth 5 can confirm the usage status (in use/empty) of the medical booth 5 .

A camera 161 connected to the client device 10, a touch panel 162, and a display 171 are provided on the front side of the housing HS1. The camera 161, the touch panel 162, and the display 171 are used for UI (User Interface) before the patient enters the medical booth 5 and face recognition of the patient.

As shown in FIG. 4, the interior space of the medical booth 5 is equipped with a chair CH1, a storage ST1, a measuring device MD1, a client device 10, a camera 163, and a display 172.

The patient PT1 can receive medical services while sitting on the chair CH1.

Various medical products MP1 to MP3 are stored in the storage ST1. The storage box ST1 may be equipped with an environment control mechanism (for example, a refrigeration mechanism) for maintaining a good storage environment for medical products. Medical products can include, for example, at least one of the following:
・Pharmaceuticals ・Test kits ・Vaccines ・Medical instruments and machines ・Quasi-drugs ・Cosmetics ・Health foods ・Health drinks

When the medical product stored in the storage box ST1 is permitted to be provided to the patient PT1 by the doctor's judgment, the medical product is discharged by a discharge mechanism (not shown). A patient PT1 can receive medical products from the outlet OT1.
Alternatively, the storage room ST1 may have a configuration similar to a remotely controllable locker. That is, the stocker ST1 has a plurality of luggage compartments with electronic locks, and each medical product is stored in one of the luggage compartments. When the server 30 permits the provision of the medical products stored in the storage box ST1 to the patient PT1 according to the doctor's instruction, the electronic lock of the cargo room storing the medical products may be unlocked. .

In the example of FIG. 4, the storage ST1 is installed in front of the patient PT1 sitting on the chair CH1. However, the stocker ST1 may be installed at any location. For example, the storage box ST1 may be installed on the side or back of the patient PT1 sitting on the chair CH1, or may be installed outside the medical booth 5.

The measuring device MD1 is used to measure biological information of the patient PT1. The measuring device MD1 may be connected to the client device 10 or connected to the server 30 via the network NW. The measurement device MD1 can include, for example, at least one of the following.
・Sphygmomanometer ・Height gauge ・Body scale ・Thermometer ・Electrocardiograph ・Pulse oximeter

A camera 163 and a display 172 are connected to the client device 10 . The camera 163 and the display 172 are used for UI after the patient enters the medical booth 5 and face recognition of the patient.

(2) Outline of Embodiment An outline of the present embodiment will be described. FIG. 5 is an explanatory diagram of the preparation phase of the medical service of this embodiment. FIG. 6 is an explanatory diagram of the medical service provision phase of this embodiment.

The medical service of this embodiment includes a provision phase in which the patient receives the medical service and a preparation phase in which various preparations necessary for the patient to receive the medical service are performed.

As shown in FIG. 5, the preparation phase includes application installation (1-1), user information registration (1-2), and identity verification (1-3). Although the preparation phase for patients will be described below, a preparation phase for doctors can be realized in the same way.

First, the patient's terminal (hereinafter referred to as "patient terminal") performs application installation (1-1). Specifically, the patient terminal installs an application (for example, a health care app) that supports the provision of the medical service of the present embodiment according to the user's (patient's) operation.

After application installation (1-1), the patient terminal performs user information registration (1-2). Specifically, the patient terminal activates the application installed in application installation (1-1) according to the user's (patient's) operation. The patient terminal acquires user information and transmits it to the server 30 . User information includes at least one of the following.
・User name, password, identity verification documents (for example, My Number card, passport, driver's license, or doctor's certificate (if the user is a doctor)) face photo information (an example of "biometric information")
・Face image information (an example of “biological information”)
・Information related to identity verification documents (including face photo information)
・Information about health insurance card

The face photo information is, for example, information related to the user's face photo printed or attached to the user's (patient's) identity verification document, or information related to the user's face photo stored in the IC chip mounted on the user's identity verification document. Information.

The patient terminal acquires, for example, one of the following facial photograph information and transmits it to the server 30 .
・Face photo information acquired by reading the IC chip mounted on the identity verification document with the IC card reader included in the input device ・Face photo information generated by taking the identity verification document with the camera included in the input device ・Face photo information generated by scanning the identity verification document with the scanner included in the input device Face photo information pre-stored in the storage device of the patient terminal

The patient terminal activates the camera connected to the patient terminal. A camera generates face image information by photographing a user's face. The patient terminal transmits the generated face image information to the server 30 .

After user information registration (1-2), the server 30 performs identity verification (1-3). Specifically, the server 30 performs personal authentication (eKYC) by referring to the authentication information based on the facial photograph information acquired in the user information registration (1-2) and the user's face information. When the server 30 obtains an authentication result indicating that the user is the same person as the owner of the identity verification document, the identity verification (1-3) ends normally. Thereafter, the user can receive medical services (if he is a patient) or provide medical services (if he is a doctor). On the other hand, the server 30 performs predetermined error processing when the authentication result that the user is the same person as the owner of the personal identification document is not obtained.

After the preparation phase (FIG. 5) is completed, the user (patient) can operate the touch panel 162 to request the server 30 to start the provision phase.

As shown in FIG. 6, the provision phase includes an admission phase (2-1), an examination phase (2-2), and a medical product provision phase (2-3). In the provision phase, the server 30 repeatedly authenticates the user (patient).
Specifically, the server 30 acquires authentication information based on the patient's facial photograph information registered as the user. The server 30 may repeatedly acquire the user's facial image information without operating the client device 10 during the provision phase (particularly, after the room entry phase (2-1)). In response to acquisition of the user's face image information, the server 30 refers to the face image information and authentication information to determine whether the user is the same person as the patient, thereby authenticating the user's face. conduct. As a result, it is possible to strengthen spoofing countermeasures in medical services using the medical booth 5 without imposing a burden on the user, such as forcing a specific operation or action.

The server 30 controls medical services provided to the user according to the result of personal authentication. In particular, when the server 30 determines not to start or continue the provision of the medical service based on the result of the authentication of the user, the server 30 restricts the medical service provided to the user.

Before the room entry phase (2-1) (that is, before the medical service is provided), the server 30 uses an image captured by the camera 161 to authenticate the user (patient). If the personal authentication is successful, the server 30 determines to start providing medical services to the user, and permits transition to the room entry phase (2-1). For example, the server 30 unlocks the electronic lock EL1. On the other hand, if the personal authentication fails (authentication NG), the server 30 determines not to start providing medical services to the user, and denies the user entry into the medical booth 5 . For example, without unlocking the electronic lock EL1, the server 30 displays a message image on the display 171 indicating that you cannot enter the room because it cannot be confirmed that you are the patient (the message image includes an imaged text). , the same below) may be displayed.

In the entering phase (2-1), the user (patient) opens the door DR1 and enters the medical booth 5. FIG. The client device 10 detects the entry of the user into the room. As an example, the client device 10 analyzes an image captured by the camera 163 inside the medical booth 5, analyzes the output of a pressure sensor embedded in the chair CH1 inside the medical booth 5, or uses other means such as a human sensor. can detect the user's entry into the room.

In response to detection of a user (patient) entering the room, the server 30 uses an image captured by the camera 163 to authenticate the user. If the personal authentication is successful, the server 30 determines to continue providing medical services to the user, and permits transition to the medical examination phase (2-2). For example, the server 30 calls a doctor in charge of examining the user (hereafter referred to as "examination doctor"). On the other hand, if the personal authentication is not successful (authentication NG), the server 30 decides not to continue providing medical services to the user, and refuses medical examination to the user. For example, the server 30 may display a message image on the display 172 inside the medical booth 5 to the effect that the patient cannot be examined because the identity of the patient cannot be confirmed.

In the consultation phase (2-2), the examining doctor uses information communication between the doctor terminal 50 and the client device 10 to examine the patient. Specifically, the client device 10 and the doctor terminal 50 transmit and receive text, voice, still images, moving images, or a combination thereof, so that the examining doctor can communicate information to the patient who operates the client device 10. perform an examination using

In the consultation phase (2-2), the examining doctor can instruct the patient to use the measuring equipment (for example, measuring equipment MD1) in the medical booth 5 to measure biological information.
The doctor terminal 50 transmits a measurement instruction to the server 30 according to the operation of the examining doctor. In response to receiving the measurement instruction, the server 30 may perform user authentication using an image captured by the camera 163 . If the personal authentication is successful, the server 30 determines to continue providing the medical service to the user, and permits the use of the measuring equipment instructed by the examining doctor. For example, the server 30 turns on the power of the measuring device instructed by the examining doctor, sets the measuring device to an operable mode, and enables the data output function of the measuring device. On the other hand, if the personal authentication is not successful (authentication NG), the server 30 decides not to continue providing the medical service to the user, stops consulting the user, or refuses to use the measuring device. . For example, the server 30 displays on the display 172 inside the medical booth 5 a message image indicating that the medical examination cannot be continued because it cannot be confirmed that you are the patient, or that you cannot confirm that you are the patient. Therefore, a message image to the effect that the measuring device cannot be used may be displayed.

In the consultation phase (2-2), the examining doctor can finish the consultation. The doctor terminal 50 transmits an end instruction to the server 30 according to the operation of the examining doctor.
In response to receiving the end instruction, the server 30 uses the image captured by the camera 163 to authenticate the user (patient). If the personal authentication is successful, the server 30 determines to continue providing the medical service to the user, and permits transition to the medical product provision phase (2-3). On the other hand, if the personal authentication is not successful (authentication NG), the server 30 decides not to continue providing the medical service to the user, refuses to provide the medical product to the user, or refuses to provide the medical product to the user. refuses to record history regarding medical services (e.g., doctor's visits) performed; For example, the server 30 displays on the display 172 inside the medical booth 5 a message image indicating that medical products cannot be provided because it cannot be confirmed that you are the patient, or a confirmation that you are the patient. A message image may be displayed to the effect that the history cannot be recorded because the history cannot be obtained.

In the medical product provision phase (2-3), the medical product prescribed or recommended by the examining doctor is provided to the user (patient). Specifically, medical products may be available to users in at least one of the following forms.
- The user receives the medical product prescribed or recommended by the examining doctor at the storage ST1, the storage located outside the medical booth 5, or the dispensing pharmacy.
- The user has the medical product prescribed or recommended by the examining physician delivered to his or her home.
- The user uses the prescription (paper prescription or electronic prescription) issued by the examining doctor to receive the medicine prescribed by the examining doctor outside the medical booth 5 (eg, dispensing pharmacy).

At the end of the medical product provision phase (2-3), the server 30 associates the identification information that identifies the user (patient) with information on the medical service provided to the user (for example, consultation, examination, prescription, or historical information about at least one of the treatments) is stored in the storage device 31; As a result, the user can check the contents of the medical service that he or she has received at a later date, and can present the contents to medical personnel.

(3) Data Structure The authentication information database of this embodiment will be described. FIG. 7 is a diagram showing the data structure of the authentication information database of this embodiment.

As shown in FIG. 7, the authentication information database includes a "user ID" field and an "authentication information" field. Each field is associated with each other.

A user ID is stored in the "user ID" field. A user ID is information that identifies a user (patient or doctor).

The "authentication information" field stores authentication information. The authentication information is information used for identity verification of the user (patient or doctor).

The information for authentication may be facial photograph information acquired from the patient terminal or the doctor terminal 50, or may be the result of performing information processing (for example, extraction of a feature amount) on the facial photograph information. If the information processing corresponds to irreversible conversion, the facial photograph information cannot be easily restored from the result of the information processing performed on the facial photograph information. Therefore, by storing the result of performing information processing on the facial photograph information instead of the facial photograph information in the authentication information database as authentication information, the information stored in the authentication information database may be leaked. It is possible to mitigate the damage when it occurs. For example, the authentication information is facial feature amount information extracted from facial photograph information.

(4) Medical Service Provision Processing The medical service provision processing of this embodiment will be described. FIG. 8 is a diagram showing the first part of the overall flow of the medical service provision processing of this embodiment. FIG. 9 is a diagram showing the second part of the overall flow of the medical service provision processing of this embodiment. FIG. 10 is a diagram showing an example of a screen displayed in the medical service providing process of this embodiment. FIG. 11 is a diagram showing an example of a screen displayed in the medical service providing process of this embodiment. FIG. 12 is a diagram showing an example of a screen displayed in the medical service providing process of this embodiment.

The medical service provision process of FIGS. 8 and 9 starts, for example, when at least one of the following start conditions is satisfied.
・The power of the client device 10 is turned on. ・The client device 10 detects the presence of a human by analyzing an image taken by the camera 161, for example. date and time (for example, the opening time of medical booth 5) has arrived

As shown in FIG. 8, the client device 10 accepts a user instruction (S110).
Specifically, processor 12 causes display 171 to display screen P10 (FIG. 10). As shown in FIG. 10, screen P10 includes field objects F101 to F102 and operation objects B101 to B104. The screen P10 in FIG. 10 is merely an example, and some or all of the objects shown in FIG. 10 may be deleted or replaced with other GUI components. Also, the screen P10 may include GUI components not shown in FIG.

A field object F101 is an object that receives a user instruction for designating a user name. The user name is the name of the user registered in user information registration (1-2) in the preparation phase (FIG. 5).

A field object F102 is an object that receives a user instruction for designating a password. The password is the password of the user registered in the user information registration (1-2) in the preparation phase (FIG. 5).

The operation object B101 is an object that receives a user instruction for executing login.
The user inputs to the field object F101 and field object F102, and operates the operation object B101. The processor 12 issues a login request according to the operation of the operation object B101. The login request includes the user name entered in field object F101 and the password entered in field object F102. Processor 12 causes communication interface 14 to send a login request to server 30 .

The operation object B102 is an object that receives a user instruction for executing user information registration. The processor 12 displays a guide screen regarding user information registration on the display 171 when the operation object B102 is operated. As an example, the guidance screen can include information indicating the procedure of the preparation phase (FIG. 5).
Alternatively, the client device 10 and the server 30 may execute part of the processing relating to the preparation phase (FIG. 5) on behalf of the patient terminal when the operation object B102 is operated. For example, the client device 10 acquires user information and transmits it to the server 30 as in user information registration (1-2). The client device 10 generates user's face image information based on the image captured by the camera 161 and transmits it to the server 30 . The server 30 performs personal authentication (eKYC) in the same manner as the personal identification (1-3).

The operation object B103 is an object that receives a user's instruction to browse the equipment information of the medical booth 5. FIG. When the operation object B103 is operated, the processor 12 refers to the equipment information of the medical booth 5 and generates an equipment viewing screen. The processor 12 displays the equipment browsing screen on the display 171 .
Equipment information is information about equipment that can be used in the medical booth 5 . The facility information is stored in the storage device 11 or the storage device 31, for example. As an example, the equipment information includes information on measuring equipment that can be used in the medical booth 5 . The information about the measuring device can include, for example, information about the name of the measuring device, information about the type of the measuring device, information about the type of bioindex measurable by the measuring device, or a combination thereof.

The operation object B104 is an object that receives a user's instruction to browse the inventory information of the medical booth 5. FIG. When the operation object B104 is operated, the processor 12 refers to the inventory information of the medical booth 5 and generates an inventory viewing screen. Processor 12 displays an inventory viewing screen on display 171 .
The inventory information is information about the inventory of medical products in the stocker ST1 associated with the medical booth 5 (for example, installed in the medical booth 5). Inventory information is stored in the storage device 11 or the storage device 31, for example. As an example, the inventory information includes, for each medical product to be handled, information on the name of the product, information on the type of product (for example, cold medicine, gastrointestinal medicine, pill, etc.), information on the inventory quantity, or information on their inventory quantity. Can include combinations.
The inventory information is updated on a case-by-case basis or in batches as medical products stored in storage ST1 are provided or replenished with medical products in storage ST1.

After step S110, the server 30 executes request acquisition (S310).
Specifically, processor 32 acquires the login request transmitted in step S110 via communication interface 34 . The processor 32 refers to the information stored in the storage device 31 and determines whether the combination of the user name and password that the user has entered into the client device 10 is correct. Accordingly, it is possible to determine whether or not the operator of the client device 10 is the user specified by the user name. Processor 32 may instruct client device 10 to prompt the user to re-enter the username and password if the username and password combination is incorrect.

If the user authentication succeeds in step S310, the server 30 and the client device 10 perform personal authentication (S320).
Specifically, first, the client device 10 generates face image information of the user. As an example, the processor 12 activates the camera 161 to take an image, thereby generating face image information of the user. Processor 12 causes communication interface 14 to transmit the facial image information to server 30 .
Processor 12 may cause the output device (display 171 or speaker) to output a message prompting the user to photograph his or her own face. As an example, the processor 12 causes the display 171 to display a screen P11 (FIG. 11).
As shown in FIG. 11, the screen P11 includes display objects A111 to A112.
A display object A111 is an object that displays an image captured by the camera 161 . The display object A111 displays an image captured by the camera 161 with a mark MK1 indicating the ideal position of the user's face superimposed thereon.
The display object A112 is an object that displays a message image to the user.

Next, the server 30 acquires face image information generated by the client device 10 . As an example, the processor 32 obtains facial image information transmitted by the client device 10 via the communication interface 34 .

Next, the server 30 performs personal authentication (face authentication) of the user based on the obtained face image information. As an example, the processor 32 refers to the acquired face image information and the authentication information stored in the storage device 31 (authentication information database (FIG. 7)) in association with the user ID, and the user (client device 10 It is determined whether or not the current operator of the device) and the patient registered in advance as the user are the same person.

If an authentication result is obtained indicating that the user and the pre-registered patient are the same person, the personal authentication (S320) is successfully completed, and the server 30 executes the next step command. If an authentication result indicating that the user and the pre-registered patient are the same person is not obtained, the server 30 can perform predetermined error processing. By way of example, processor 32 may perform at least one of the following. The processor 32 may switch the content of the error processing and the behavior after the error processing according to the number of times the personal authentication is attempted.
- Cause the client device 10 to output a message (the message is a message image or voice; the message is an example of an "alert"; the same shall apply hereinafter) for prompting the user to re-capture the face image.
- Cause the client device 10 to output a message for prompting the user to change the photographing conditions of the face image (for example, move the client device 10 to a position where the user's face is easily photographed).
- Cause the client device 10 to output a message for informing the user that it cannot be confirmed that the user is the same person as the pre-registered patient.
- The client device terminates the medical service provision processing (FIGS. 8 and 9) because it cannot be confirmed that the user is the same person as the pre-registered patient, or sends a message to the user to inform the user of the possibility of termination. output to 10.

After error processing, the medical service provision processing (FIGS. 8-9) ends in error. Alternatively, after the error processing, the server 30 may reacquire the face image information and redo the personal authentication.

After step S320, the server 30 executes a response (S330).
Specifically, processor 32 generates a response that includes admission. Processor 32 transmits the generated response to client device 10 via communication interface 34 .

After step S330, the client device 10 performs screen display (S120).
Specifically, processor 12 obtains the response sent in step S330 via communication interface 14 . Processor 12 unlocks electronic lock EL1 of medical booth 5 . Processor 12 generates a screen according to the content of the response, and causes display 172 to display the screen. For example, the screen P12 (FIG. 12) is displayed on the display 172. FIG. As shown in FIG. 12, the screen P12 includes a display object A121.
The display object A121 is an object that displays a message image to the user. This message image may include at least one of the following information.
- Name of the user (patient) - Name of the examining doctor - Explanation that the examining doctor is being called may be called after the message image is displayed (for example, during the execution of personal authentication (S340), which will be described later, or after success).

After step S330, the server 30 and the client device 10 perform personal authentication (S340). As a result, it is possible to prevent a person who is different from the patient whose identity has been authenticated (S320) from entering the medical booth 5 and masquerading as the patient to receive medical services.
Specifically, first, the client device 10 generates face image information of the user. As an example, the processor 12 automatically activates the camera 163 to take a picture, thereby generating the user's facial image information. Processor 12 may cause the output device (display 171 or speaker) to output a message prompting the user to photograph his or her own face. Alternatively, the processor 12 may cause the camera 163 to shoot without outputting such a message (that is, without making the user aware of it). As a result, it is possible to secure an opportunity to detect a person who is trying to illegally use medical services, and to prevent users who are correctly using the service from feeling discomfort due to repeated personal authentication in a short period of time. be able to. Processor 12 causes communication interface 14 to transmit the facial image information to server 30 . The subsequent processing of personal authentication (S340) is the same as that of personal authentication (S320).

After step S340, the server 30 executes medical service provision support (S350 to S420).
Specifically, processor 32 assists in providing medical services to users (patients). The details of the medical service provision support (S350 to S420) will be described below.

After step S340, the client device 10, server 30, and doctor terminal 50 perform a medical examination (S350).
Specifically, the client device 10 transmits at least one of the patient's voice collected by a microphone and the patient's video or still image captured by a camera, for example, to the server 30 (or an external server that provides an examination room). The same applies hereinafter.). The doctor terminal 50 transmits to the server 30 at least one of the voice of the examining doctor collected by the microphone, or the video or still image of the examining doctor captured by the camera. The server 30 transmits data received from the client device 10 to the doctor terminal 50 and transmits data received from the doctor terminal 50 to the client device 10 . The client device 10 and the doctor terminal 50 output data received from the server 30 . This communication between the patient and the doctor facilitates the examination. However, the medical examination is not limited to video call, and may be realized using text chat or voice call.

The server 30 calls the examining doctor before starting the examination (S350).
Specifically, processor 32 calls the examining physician. The examining physician may be selected by the patient or determined by processor 32 according to an algorithm. As an example, processor 32 causes communication interface 34 to send a push notification to physician terminal 50 associated with the examining physician.
Furthermore, the server 30 and the doctor terminal 50 authenticate the examining doctor.
Specifically, first, the doctor terminal 50 generates face image information. As an example, the processor of the doctor terminal 50 (hereinafter referred to as “processor 52”) activates a camera connected to the doctor terminal 50 to take an image, thereby generating face image information of the user. The processor 52 causes the communication interface of the doctor terminal 50 (hereinafter referred to as “communication interface 54”) to transmit the facial image information to the server 30 .
The server 30 acquires face image information generated by the doctor terminal 50 . As an example, the processor 32 acquires facial image information transmitted by the doctor terminal 50 via the communication interface 34 . The server 30 performs personal authentication (face authentication) of the user based on the obtained face image information. As an example, the processor 32 associates the acquired face image information with the user ID of the examining doctor and stores authentication information (typically, a medical authentication information based on face photo information of the doctor's certificate), and whether the user (the current operator of the doctor terminal 50) and the doctor registered in advance as the examining doctor are the same person. determine whether
If an authentication result is obtained indicating that the user and the pre-registered doctor are the same person, the calling of the examining doctor is completed normally, and the server 30 executes the following instructions. If an authentication result indicating that the user and the pre-registered doctor are the same person is not obtained, the server 30 can perform predetermined error processing. By way of example, processor 32 may perform at least one of the following. The processor 32 may switch the content of the error processing and the behavior after the error processing according to the number of times the personal authentication is attempted.
- Make the doctor terminal 50 output a message for prompting the user to redo the photographing of the face image.
- Make the doctor terminal 50 output a message for prompting the user to change the photographing conditions of the face image.
- Cause the doctor terminal 50 to output a message to inform the user that it cannot be confirmed that the user is the same person as the pre-registered examining doctor.
- Since it cannot be confirmed that the user is the same person as the pre-registered examining doctor, call another doctor, or cause the doctor terminal 50 to output a message to inform the user of the possibility.
After error handling, the call to the examining physician is terminated in error and the server 30 changes the examining physician. Alternatively, after the error processing, the server 30 may reacquire the face image information and redo the personal authentication of the user of the doctor terminal 50 .

In addition, the server 30 may notify the patient or the examining doctor of information used in the online consultation (for example, the URL of the consultation room, the password for using the consultation room, or a combination thereof) before starting the consultation. good. An examination room is a place for examining physicians and patients to exchange voice, text, still images, moving images, or a combination thereof. For example, the examination room may be a web conference conference room, or a video chat, voice chat, or text chat chat room.
In addition, the server 30 may notify the patient or examining doctor of information regarding the result of the identity verification of the contact person. Information for the patient may include information about the results of the examining physician's identification. Information for the examining physician may include information regarding the results of patient authentication. By outputting the notified information from the client device 10 and the doctor terminal 50, the patient and the examining doctor can bi-directionally confirm that the receiving party is not impersonating. Additionally, the information for the examining physician may include patient identification information.

In the medical examination (S350), the examining doctor can instruct the patient to use the measuring equipment in the medical booth 5 to measure the biological information.
The processor 52 causes the communication interface 54 to transmit the measurement instruction to the server 30 according to the operation of the examining doctor. The server 30 can perform processing similar to the above-described personal authentication (S340) in response to receiving the measurement instruction. When the personal authentication is successful, the server 30 determines to continue providing medical services to the user (patient), and permits the use of the measuring equipment instructed by the examining doctor. On the other hand, if the personal authentication fails, the server 30 may decide to stop providing the medical service to the user and refuse to use the measuring device as instructed by the examining doctor.

The examining doctor operates the doctor terminal 50 when deciding to end the examination. The processor 52 causes the communication interface 54 to send a request to the server 30 regarding the end of the examination in accordance with the instructions of the examining physician. This completes the medical examination (S350).

After step S350, the server 30 and the client device 10 perform personal authentication (S360).
Specifically, processor 12 and processor 32 operate in the same manner as the above-described personal authentication (S340).

After step S360 as shown in FIG. 9, the server 30 executes a response (S370).
Specifically, the processor 32 returns a response to the client device 10 to shift to the medical product delivery phase.
As an example, the processor 32, in accordance with the instructions of the examining doctor, stores information on medical fees specified by the examining doctor, information on prescriptions by the examining doctor (hereinafter referred to as “prescription information”), medical treatment recommended by the examining doctor, Get information about our products, or a combination thereof. The prescription information may be document data or image data of the prescription generated based on the instructions of the examining doctor, or may be information input by the examining doctor regarding each item constituting the prescription. Processor 32 generates a response containing information regarding the billing statement. The billing statement information includes at least medical fee details. The billing statement information may further include at least one of a pharmacy billing statement or a medical product billing statement recommended by a medical practitioner. Processor 32 causes communication interface 34 to transmit the response to client device 10 .

After step S370, the client device 10 performs screen display (S130).
Specifically, processor 12 obtains the response sent in step S370 via communication interface 14 . The processor 12 generates a screen according to the contents of the response and displays the screen on the display.

After step S130, the client device 10 accepts a user instruction (S140).
Specifically, the processor 12 acquires payment-related information (hereinafter referred to as “payment information”) input by the user, and causes the communication interface 14 to transmit the information to the server 30 . The payment information can include, for example, information identifying the payment method selected by the user.

After step S140, the server 30 acquires payment information (S380).
Specifically, the processor 32 acquires the payment information transmitted in step S140 via the communication interface 34 .

After step S380, the server 30 and the client device 10 perform personal authentication (S390).
Specifically, processor 12 and processor 32 operate in the same manner as the above-described personal authentication (S340).

After step S390, the server 30 executes settlement processing (S400).
Specifically, the processor 32 makes a payment for the medical service provided to the user based on the payment information acquired in step S380. As an example, processor 32 can perform at least one of the following.
- Guide the client device 10 to a payment page provided by a payment server (not shown).
• Add records to the accounts receivable database for managing accounts receivable.
Activating a settlement device (not shown) installed in the medical booth 5 and allowing the user (patient) to make a settlement within the medical booth 5 .

After step S400, the server 30 performs medical product provision (S410).
Specifically, processor 32 obtains from physician terminal 50 prescription information or information regarding medical products recommended by the examining physician, or a combination thereof. The processor 32 refers to the acquired information to identify medical products that can be provided to the user (patient). In addition, processor 32 performs at least one of the following.
- Controls an unloading mechanism (not shown) for unloading the medical products stored in the storage box ST1, and unloads the drug specified by the prescription information or the medical product recommended by the examining doctor to the unloading port OT1. .
- Unlock the electronic lock of the storage compartment ST1 in which the drug specified by the prescription information or the medical product recommended by the examining doctor is stored.
• Add records to a database for managing medical products delivered to users.
• Providing a prescription to the user based on the prescription information (for example, printing it on a printer, not shown).
A place where the drug specified by the prescription information or the medical product recommended by the examining physician can be received (e.g., a storage outside the medical booth 5 that stores the drug or medical product, the drug or medical The user is guided to information on dispensing pharmacies or sales stores that handle products for personal use.
- Create an electronic prescription based on the prescription information and register it in an external electronic prescription server.
Providing the user with the information necessary to receive the medical product from storage ST1 or storage outside medical booth 5 (e.g. medical product for patient by examining physician (which may include prescribed medication) to the patient terminal, or print the information on a printer (not shown).
Processor 32 may select the mode of delivery of the medical product in response to user instructions.

After step S410, the server 30 executes a response (S420).
Specifically, processor 32 returns a response to client device 10 to inform the user of the completion of the medical service. As an example, processor 32 generates a response that includes a message to inform the user of the completion of the medical service. Processor 32 causes communication interface 34 to transmit the response to client device 10 .
Processor 32 also stores in storage device 31 information regarding medical services provided to the user (eg, historical information regarding at least one of examinations, tests, prescriptions, or treatments) in association with the user's identification information.

After step S420, the client device 10 performs screen display (S150).
Specifically, processor 12 obtains the response sent in step S420 via communication interface 14 . The processor 12 generates a screen according to the contents of the response and displays the screen on the display.

(5) Summary As described above, the server 30 of this embodiment supports provision of medical services using the medical booth 5 . The server 30 authenticates the user before or during the provision of the medical service, and determines whether or not to start providing the medical service or to continue the provision of the medical service according to the result of the authentication. Decide whether or not When the server 30 determines not to start providing medical services or not to continue providing medical services, it limits the medical services provided to the user. This makes it possible to limit medical services provided to users suspected of impersonation. In other words, it is possible to strengthen spoofing measures in medical services using medical booths.

The server 30 may limit the medical services provided by limiting the exchange of information between the user and medical personnel. As a result, it is possible to prevent a third party from masquerading as the patient himself/herself and receiving interpersonal medical services such as examination or counseling from medical personnel.

The server 30 may limit the medical services provided by limiting the use of the measuring device MD1 installed in the medical booth 5. FIG. As a result, it is possible to prevent a third party from impersonating the patient and using the measuring device MD1.

The server 30 is provided by restricting the provision of medical products stored in the storage ST1 installed inside the medical booth 5 or in the storage installed outside the medical booth 5 to the user. May limit medical services. As a result, it is possible to prevent a third party from impersonating a patient and receiving medical products (particularly, illegal acquisition of drugs).

The server 30 may limit the medical services provided by limiting the storage of information on the medical services provided to the user in the storage device 31 . This can prevent information on medical services provided to a third party from being accumulated as information on medical services provided to the patient himself/herself. That is, it is possible to prevent the reliability of the accumulated information from being lowered.

The server 30 may restrict medical services provided by restricting entry into the medical booth 5 . As a result, it is possible to prevent a person other than the pre-registered patient from intruding into the medical booth 5 without justifiable reason, or from receiving medical services by pretending to be the patient himself/herself.

The server 30 may specify a medical product that can be provided to a user (patient) in accordance with an instruction from the examining doctor, and select the form of provision of the medical product in accordance with the user's instruction. This allows users to choose how to receive medical products according to their own needs and circumstances.

The server 30 may identify medical products that can be provided to the user (patient) in accordance with the instructions of the examining doctor, and guide the user to information regarding places where the medical products can be received. This allows the user to receive medical products that are not stocked in the stocker ST1 at another location.

The server 30 may provide users (patients) with prescriptions for medicines that are generated in accordance with instructions from the examining doctor. This allows the user to receive medicines that are not stocked in the storage box ST1 at the dispensing pharmacy.

(6) Modification A modification of the present embodiment will be described.

(6-1) Modification 1
Modification 1 will be described. Modification 1 is an example in which at least one storage is provided independently of the medical booth. That is, Modification 1 is an example in which the storage and the medical booth do not have a one-to-one relationship.

(6-1-1) Configuration of Medical Service System The configuration of the medical service system of this embodiment will be described. FIG. 13 is a block diagram showing the configuration of the medical service system of Modification 1. As shown in FIG. FIG. 14 is a diagram showing an installation example of a medical booth and storage in the medical service system of Modification 1. As shown in FIG.

As shown in FIG. 13 , the medical service system 2 includes a medical booth 5 , storage 7 , server 30 and doctor terminal 50 . The medical service system 2 provides medical services to patients using a medical booth 5 and a storehouse 7 .
Both the medical booth 5 and the storage 7 are bases for providing medical services to patients. The medical booth 5 and the storage vault 7 are, for example, gas stations, drug stores, shopping centers, railway stations, airports, highway service areas, public facilities, office buildings, or school grounds, as illustrated in FIG. Any number of units can be installed in each. The repository 7 includes a repository management device 70 .

Here, the numbers of the medical booth 5, storage box 7, server 30, and doctor terminal 50 are not limited to one, and may be two or more. Further, the medical booth 5 may or may not have the storage ST1 shown in FIG. 4 (that is, the storage as equipment of the medical booth 5).

The client device 10, server 30, doctor terminal 50, and repository management device 70 can be connected via a network NW.

The repository management device 70 is an example of an information processing device that transmits requests to the server 30 . The repository management device 70 may be, for example, one or more computers.

(6-1-1-1) Configuration of Storage Warehouse Management Apparatus The configuration of the storage management apparatus of Modification 1 will be described. FIG. 15 is a block diagram showing the configuration of the storage management apparatus.

As shown in FIG. 15 , the repository management device 70 includes a storage device 71 , a processor 72 , an input/output interface 73 and a communication interface 74 .

Storage device 71 is configured to store programs and data. Storage device 71 is, for example, a combination of ROM, RAM, and storage (eg, flash memory or hard disk).

Programs include, for example, the following programs.
・OS program ・Application program that executes information processing

The data includes, for example, the following data.
・Data and databases referenced in information processing ・Data obtained by executing information processing (that is, execution results of information processing)

The processor 72 is configured to implement the functions of the repository management device 70 by activating programs stored in the storage device 71 . Processor 72 is an example of a computer. The programs and data stored in the storage device 71 may be provided via a network, or may be provided by being recorded on a computer-readable recording medium. At least part of the functions of the repository management device 70 may be realized by one or more pieces of dedicated hardware.

The input/output interface 73 acquires signals (e.g., user instructions, sensing data) from input devices connected to the vault management apparatus 70 and outputs signals (e.g., , image signal, audio signal, control signal).
The input device is, for example, a camera (for example, a camera 761 to be described later), an IC (Integrated Circuit) card reader, a scanner, a microphone, a sensor, a keyboard, a pointing device, a touch panel (for example, a touch panel 762 to be described later), or a combination thereof. is.
The output device is, for example, a display (eg, a display 771 to be described later), a speaker, or a combination thereof.

Communication interface 74 is configured to control communication between repository management device 70 and an external device (eg, server 30).

(6-1-1-2) Configuration of Storage The configuration of the storage 7 of Modification 1 will be described. 16A and 16B are diagrams illustrating the appearance of the storage of Modification 1. FIG.

As shown in FIG. 16, the storage 7 includes a box-shaped housing HS2. A camera 761, a touch panel 762, and a display 771 connected to the storage management device 70 are provided on the front side of the housing HS2. The camera 761, touch panel 762, and display 771 are used for detection of a UI for a patient to apply for receipt of medical products, and identification information in the patient's face recognition or QR code (registered trademark) format.

Various medical products are stored in the internal space of the storage box 7 . The storehouse 7 may be provided with an environment control mechanism (for example, a refrigeration mechanism) for maintaining a favorable storage environment for medical products.

As will be described later, when the server 30 accepts a patient's application for receipt of the medical product, an unloading mechanism (not shown) provided in the storage 7 ejects the medical product. A patient can receive the medical product from the outlet OT2.
Alternatively, the vault 7 may have a configuration similar to a remotely controllable locker. In other words, the stocker 7 has a plurality of luggage compartments with electronic locks, and each medical product is stored in one of the luggage compartments. When the doctor instructs the server 30 to allow the medical product stored in the storage 7 to be provided to the patient, the electronic lock of the luggage compartment storing the medical product may be unlocked.

(6-1-2) Data Structure The permission information database of Modification 1 will be described. FIG. 17 is a diagram showing the data structure of the permission information database of Modification 1. As shown in FIG.

The permission information database is stored in the storage device 31, for example. The permission information database stores permission information. Authorization information is information about authorization by the examining physician to provide medical products (which may include prescribed medications) to the patient.

As shown in FIG. 17, the authorization information database includes a "authorization ID" field, a "physician ID" field, a "patient ID" field, a "product ID" field, and an "expiration date" field.

A permission ID is stored in the “permission ID” field. The authorization ID is information that identifies authorization by the examining physician to provide the medical product to the patient. The Authorization ID may be provided to the user as information necessary to receive the medical product from storage 7 at step S410 of the medical service provision process (FIG. 9).

A doctor ID is stored in the "doctor ID" field. A doctor ID is information that identifies a doctor who has authorized the provision of medical products.

A patient ID is stored in the "patient ID" field. A patient ID is information that identifies a patient authorized to provide a medical product.

A product ID is stored in the "product ID" field. A product ID is information identifying a medical product authorized by a doctor to be provided to a patient.

The “expiration date” field stores expiration date information. The term of validity is information relating to the term of validity of the permission information. The expiration date is set, for example, to four days including the date of issue.

(6-1-3) Medical Product Provision Processing The medical product provision processing of this embodiment will be described. FIG. 18 is a flowchart illustrating the medical product providing process of Modification 1;

As shown in FIG. 18, the server 30 acquires a permission ID (S500).
Specifically, the user (patient) inputs the authorization ID to the repository management device 70 . As an example, the user operates touch panel 762 to enter a permission ID, or causes camera 761 to read the permission ID (which may include a permission ID in QR code format). Processor 72 causes the obtained permission ID to be transmitted to server 30 via communication interface 74 . Processor 32 obtains the authorization ID via communication interface 34 .

After step S500, the server 30 verifies the authorization ID (S510).
Specifically, processor 32 refers to the permission information database (FIG. 17) and verifies the validity of the permission ID obtained in step S510. As an example, processor 32 retrieves the record containing the subject authorization ID from the authorization information database. If the record can be extracted, the processor 32 determines whether or not the expiration date included in the record has passed. The processor 32 determines that the permission ID is valid if the record containing the target permission ID can be extracted and the expiration date has not passed. On the other hand, processor 32 determines that the authorization ID is invalid if the record containing the authorization ID of interest cannot be extracted, or if the expiration date has passed.

If the authorization ID is determined to be valid in step S510, the server 30 authorizes the provision of the medical product (S520).
Specifically, processor 32 causes communication interface 34 to transmit an instruction to provide a medical product to repository management device 70 that is the source of the authorization ID. The medical product provision instruction includes information specifying the medical product to be provided. The repository management device 70 controls the take-out mechanism or the electronic lock of the repository 7 to provide medical products to the user.

After step S520, the server 30 updates the information (S530).
Specifically, processor 32 updates information associated with information identifying the user. As an example, processor 32 updates at least one of a history of medical product delivery to the user or a history of prescriptions to the user.
Upon completion of step S530, the server 30 ends the medical product provision process (FIG. 18).

If it is determined in step S510 that the permission ID is invalid, error processing (S540) is executed.
Specifically, processor 32 may perform at least one of the following. The processor 32 may switch the content of the error processing and the behavior after the error processing according to the number of times the personal authentication is attempted.
- Cause the repository management device 70 to output a message for prompting the user to re-enter the permission ID.
- Cause the repository management device 70 to output a message to inform the user that the authorization ID is not valid.
- Cause the repository management device 70 to output a message to inform the user that the medical product provision process (FIG. 18) is to be terminated because the authorization ID is not valid, or that there is a possibility of such termination.

After step S540, the medical product provision process (FIG. 18) ends in error. Alternatively, after the error processing, the server 30 may reacquire the authorization ID and redo the verification of the authorization ID (S510).

(6-1-4) Summary As described above, the server 30 of Modification 1 sends identification information identifying permission to provide medical products to the user (patient) to the user in accordance with the instruction of the examining doctor. offer. The user inputs the provided identification information to the repository management device 70 . The server 30 acquires the input identification information and verifies the validity of the identification information. When the server 30 determines that the acquired identification information is valid, the server 30 permits provision of the medical product stored in the storage 7 and associated with the identification information. As a result, it is possible to spatially separate the medical booth 5 for receiving medical examinations and the storage box 7 for receiving medical products while preventing illegal acquisition of medical products (in particular, illegal acquisition of drugs). It becomes possible. In other words, the efficiency of inventory management of medical products is improved, and a user experience such as receiving a medical examination at a medical booth 5 near the office during a lunch break at work and receiving the medical products from a storage 7 near the home when returning home is realized. can do.

The server 30 may determine that the identification information is invalid when the expiration date of the identification information has passed. As a result, it is possible to appropriately limit the grace period from the examination doctor's permission to provide the medical product to the receipt of the medical product, and to more reliably prevent unauthorized acquisition or inappropriate use of the medical product. .

The server 30 may store information about medical products provided to a user in the storage device 31 in association with information identifying the user. This allows the user to check the contents of the medical product he or she has received at a later date or to present it to medical personnel.

(7) Other Modifications The medical service using the medical booth 5 described in this embodiment or the medical service using the medical booth 5 and storage 7 described in Modification 1 are linked with other telemedicine services. can be made For example, assume that there is a medical service that allows a user (patient) to install a healthcare application on a patient terminal and receive telemedicine at home or the like using the patient terminal. The server 30 can, for example, provide useful information to users who are receiving telemedicine using the healthcare app (that is, users who are not using the medical booth 5).
Specifically, the server 30 selects a target medical booth according to an instruction from a doctor who is examining a user who is not using the medical booth 5, and provides information on the target medical booth to the user or the doctor. may A target medical booth may be selected, for example, with reference to location information associated with the user (eg, current location, home address, business address, etc.). As a result, the user can go to the medical booth 5 (target medical booth) that is easily accessible and equipped with the necessary equipment, and can receive more advanced medical services (for example, a medical examination considering the measurement results of biological information, or a medical service). The user can be motivated to receive the immediate provision of the product. Here, the doctor's instruction may include designation of the measuring device, and the server 30 may select the medical booth 5 in which the designated measuring device is installed as the target medical booth. The server 30 can refer to the equipment information of each medical booth 5 in order to select the target medical booth. As a result, the user can receive a medical examination from the doctor in consideration of the measurement result of the user's biological information. Alternatively, the doctor's order may include a designation of the medical product, and the server 30 may specify a location where the designated medical product can be received (eg, storage ST1 or storage 7, which stores the medical product). Alternatively, the medical booth 5 associated with the dispensing pharmacy or sales store that handles the medical product may be selected as the target medical booth. A medical product pickup location and a medical booth 5 may be associated, for example, if the distance between them is less than a predetermined threshold. The server 30 can refer to inventory information of each medical booth 5 or a database regarding dispensing pharmacies in order to select a target medical booth. This allows the user to receive the medical product promptly.

The storage device 11 may be connected to the client device 10 via the network NW. Storage device 31 may be connected to server 30 via network NW.

Each step of the information processing described above can be executed by any of the client device 10 , the server 30 , the doctor terminal 50 , and the repository management device 70 . In other words, the allocation of functions among the client device 10, the server 30, the doctor terminal 50, and the repository management device 70 can be arbitrarily changed.

In the above description, an example of executing each step in a specific order in each process was shown, but the execution order of each step is not limited to the example described as long as there is no dependency.

In the above explanation, if the personal authentication does not end normally in any step, the transition to the next step may be blocked or the medical service provision process may end. However, if the user does not impersonate but the identity authentication does not end normally due to a temporary factor, taking such a measure may impair the user's experience. Therefore, for example, it is possible to exempt the user authentication in some steps, or to allow the transition to the next step even if the user authentication does not end normally. Such relaxed operation regarding personal authentication may be uniformly applied to all users, or may be applied to user creditworthiness (for example, user attributes or creditworthiness calculated based on at least one of medical service usage records). It may be applied by switching accordingly.

In the above description, an example of realizing personal authentication (biometric authentication) using facial features has been shown. However, it is also possible to implement personal authentication using biometric information other than facial features. For example, instead of facial features, features such as fingerprints, irises, retinas, and voice may be used as biometric information to realize personal authentication.

In the above description, the doctor terminal 50 has been described as a computer different from the client device 10 . However, the client device 10 provided in the medical booth 5 may be configured to operate as the doctor terminal 50 . As an example, the client device 10 executes applications for patients or applications for doctors or other medical professionals (i.e., providers of medical services) depending on the logged-in user category (patient user/physician user). You may switch whether to run the application of

In the above description, an example was shown in which entry to the medical booth 5 is restricted according to the result of user (patient) identity authentication. However, the user may not be authenticated before entering the medical booth 5, or the user may be authenticated at the patient terminal before entering the room. In this case, the camera 161 attached to the housing HS1 of the medical booth 5 may be unnecessary.
Furthermore, after entering the medical booth 5, the user's login operation may be requested, or the login operation may be performed at the patient terminal. In this case, the touch panel 162 attached to the housing HS1 of the medical booth 5 and the display 171 may be unnecessary.

In the above description, an example was shown in which the user directly inputs the user name and password in receiving the user instruction (S110). However, the medical service system 1 or 2 may be configured to accept login using a QR code representing authentication information for login (hereinafter referred to as "login code").
Specifically, the login code is provided to the user during the preparation phase (FIG. 5) or at some other time. The user presents to the client device 10 the login code displayed on the patient terminal or doctor terminal 50 or printed on paper or other medium. The client device 10 acquires an image of the presented login code from the camera 161, for example. The client device 10 issues a login request based on the acquired image and transmits the login request to the server 30 . The login request includes an image of the login code or authentication information obtained by scanning the login code.
The client device 10 may read the contents of the login code by itself using QR code reading hardware (reader) or application, or may request the server 30 or other external device to read the login code. .

In the above description, an example was shown in which the preparation phase includes application installation (1-1) before user information registration (1-2). However, the medical service system 1 or 2 may be configured so that the user information registration (1-2) can be completed on a web browser instead of the application installed in the application installation (1-1). In addition, installation of the application on the patient terminal or doctor terminal 50 may be unnecessary.

Although the embodiments of the present invention have been described in detail above, the scope of the present invention is not limited to the above embodiments. Also, the above embodiments can be modified and modified in various ways without departing from the gist of the present invention. Also, the above embodiments and modifications can be combined.

(8) Supplementary notes The matters explained in the embodiment and the modified example are additionally noted below.

(Appendix 1)
comprising one or more computers (10, 30, 50, 70), the one or more computers comprising:
Means (S350 to S420) for supporting the provision of medical services using the medical booth (5);
Means (S320, S340, S360, S390) for authenticating a user before or during the provision of medical services;
a means for determining whether to start providing medical services or to continue providing medical services according to the result of personal authentication;
means for limiting the medical services provided to the user if it is determined not to initiate or continue to provide medical services;
Information processing system (1, 2).

(Appendix 2)
Measures to restrict medical services limit the exchange of information between users and medical personnel,
The information processing system according to appendix 1.

(Appendix 3)
A measuring device (MD1) is installed in the medical booth,
Measures to limit medical services include limiting the use of measuring equipment,
The information processing system according to appendix 1 or appendix 2.

(Appendix 4)
The means for restricting medical services restricts the provision to users of medical products stored in the storage cabinets (ST1, 7) installed inside the medical booth or outside the medical booth.
The information processing system according to any one of appendices 1 to 3.

(Appendix 5)
the means for restricting medical services restricts storage in the storage device (31) of information relating to medical services provided to the user;
The information processing system according to any one of appendices 1 to 4.

(Appendix 6)
Measures to limit medical services include restricting access to medical booths,
The information processing system according to any one of appendices 1 to 5.

(Appendix 7)
one or more computers
means for providing the user with identification information identifying permission to provide the medical product to the user in accordance with instructions from a doctor who has examined the user using information communication;
means (S510) for verifying the validity of the identification information in response to the acquisition of the identification information;
If the identification information is determined to be valid, the provision of medical products that are stored in storage (ST1, 7) installed inside the medical booth or outside the medical booth and that is associated with the identification information is permitted. further comprising means for
The information processing system according to any one of appendices 1 to 6.

(Appendix 8)
The identification information has an expiration date,
The means for verifying the validity of the identification information determines that the identification information is invalid when the expiration date of the identification information has passed.
The information processing system according to appendix 7.

(Appendix 9)
The one or more computers further comprise means for storing information relating to the medical product provided to the user in a storage device (31) in association with the information identifying the user;
The information processing system according to appendix 7 or appendix 8.

(Appendix 10)
one or more computers
means for identifying medical products that can be provided to a user according to instructions from a doctor who has examined the user using information communication;
further comprising means for selecting a form of provision of the medical product that can be provided to the user according to the user's instructions;
The information processing system according to any one of appendices 1 to 8.

(Appendix 11)
one or more computers
means for identifying medical products that can be provided to a user according to instructions from a doctor who has examined the user using information communication;
a means for guiding information about the place (ST1, 7) where medical products that can be provided to the user can be received,
11. The information processing system according to any one of appendices 1 to 10.

(Appendix 12)
The one or more computers further comprise means for providing the user with a pharmaceutical prescription generated according to the instructions of the doctor who consulted the user using information communication,
The information processing system according to any one of appendices 1 to 11.

(Appendix 13)
one or more computers
means for selecting a target medical booth by referring to location information associated with a user in accordance with an instruction from a doctor who examines a user who is not using the medical booth;
further comprising means for guiding information about the target medical booth;
13. The information processing system according to any one of appendices 1 to 12.

(Appendix 14)
Physician's orders include designation of a measuring device (MD1),
The means for selecting the target medical booth is to select the medical booth in which the specified measuring equipment is installed as the target medical booth,
The information processing system according to appendix 13.

(Appendix 15)
Physician's orders, including the designation of medical products,
The means for selecting a target medical booth selects a medical booth associated with a place (ST1, 7) where the specified medical product can be received, as the target medical booth;
The information processing system according to appendix 13 or appendix 14.

(Appendix 16)
one or more computers (10, 30, 50, 70)
supporting the provision of medical services using the medical booth (5) (S350-S420);
performing user authentication before or during the provision of medical services (S320, S340, S360, S390);
Determining whether to start providing medical services or to continue providing medical services according to the result of personal authentication;
limiting the medical services provided to the user if it is determined not to initiate or continue to provide medical services;
Information processing methods.

(Appendix 17)
one or more computers (10, 30, 50, 70),
Means for supporting the provision of medical services using the medical booth (5) (S350-S420),
Means for authenticating a user before or during the provision of medical services (S320, S340, S360, S390);
Means for determining whether to start providing medical services or to continue providing medical services according to the result of personal authentication;
A program that acts as a means of limiting the medical services provided to a user if it is decided not to initiate or continue to provide medical services.

1: Medical service system 2: Medical service system 5: Medical booth 7: Storage cabinet 10: Client device 11: Storage device 12: Processor 13: Input/output interface 14: Communication interface 30: Server 31: Storage device 32: Processor 33: Input/output interface 34 : communication interface 50 : doctor terminal 52 : processor 54 : communication interface 70 : vault management device 71 : storage device 72 : processor 73 : input/output interface 74 : communication interface 161 : camera 162 : touch panel 163 : camera 171 : Display 172 : Display 761 : Camera 762 : Touch panel 771 : Display

Claims (17)

one or more computers, the one or more computers comprising:
means for assisting in the provision of medical services using medical booths;
means for authenticating a user before providing said medical service or during providing said medical service;
means for determining whether to start providing the medical service or whether to continue providing the medical service according to the result of the personal authentication;
means for limiting the medical services provided to the user if it is determined not to start providing the medical services or not to continue providing the medical services;
Information processing system. the means for restricting medical services restricts exchange of information between the user and medical personnel;
The information processing system according to claim 1. A measuring device is installed in the medical booth,
the means for restricting medical services restricts use of the measuring device;
The information processing system according to claim 1 or 2. the means for restricting medical services restricts provision to the user of medical products stored in a storage cabinet located within the medical booth or outside the medical booth;
The information processing system according to any one of claims 1 to 3. the means for restricting medical services restricts storage of information about medical services provided to the user in a storage device;
The information processing system according to any one of claims 1 to 4. the means for restricting medical services restricts entry to the medical booth;
The information processing system according to any one of claims 1 to 5. The one or more computers are
means for providing the user with identification information identifying permission to provide a medical product to the user in response to an instruction from a doctor who has examined the user using information communication;
means for verifying the validity of the identification information upon obtaining the identification information;
Means for permitting provision of a medical product stored in a vault located within the medical booth or outside the medical booth and associated with the identification information when the identification information is determined to be valid. and further comprising
The information processing system according to any one of claims 1 to 6. The identification information has an expiration date,
The means for verifying the validity of the identification information determines that the identification information is invalid when the expiration date of the identification information has passed.
The information processing system according to claim 7. The one or more computers further comprise means for storing information regarding medical products provided to the user in a storage device in association with information identifying the user.
The information processing system according to claim 7 or 8. The one or more computers are
means for identifying medical products that can be provided to the user in accordance with instructions from a doctor who has examined the user using information communication;
and means for selecting a form of medical product that can be provided to the user according to the user's instruction.
The information processing system according to any one of claims 1 to 8. The one or more computers are
means for identifying medical products that can be provided to the user in accordance with instructions from a doctor who has examined the user using information communication;
means for directing information regarding where to pick up medical products available to said user;
The information processing system according to any one of claims 1 to 10. The one or more computers further comprise means for providing the user with a pharmaceutical prescription generated in accordance with instructions from a doctor who has examined the user using information communication.
The information processing system according to any one of claims 1 to 11. The one or more computers are
means for selecting a target medical booth by referring to location information associated with the user in response to an instruction from a doctor who is examining a user who is not using the medical booth;
and means for guiding information about the target medical booth,
The information processing system according to any one of claims 1 to 12. the physician's instructions include the designation of measuring equipment;
The means for selecting the target medical booth selects a medical booth in which the specified measuring device is installed as the target medical booth.
The information processing system according to claim 13. said physician's order includes the designation of a medical product;
the means for selecting the target medical booth selects, as the target medical booth, a medical booth associated with a location where the designated medical product can be received;
The information processing system according to claim 13 or 14. one or more computers
Supporting the provision of medical services using medical booths;
authenticating a user before providing said medical service or during providing said medical service;
Determining whether to start providing the medical service or to continue providing the medical service according to the result of the personal authentication;
limiting the medical services provided to the user if it is determined not to initiate or continue to provide the medical services;
Information processing methods. one or more computers,
Means to assist in the provision of medical services using medical booths;
Means for authenticating a user before providing said medical service or during providing said medical service;
means for determining whether to start providing the medical service or to continue providing the medical service according to the result of the personal authentication;
A program that functions as means for limiting the medical service provided to the user when it is determined not to start providing the medical service or not to continue providing the medical service.

Images