JPH10111897A - Clinical consultation information sharing method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To share clinical consultation data on condition that the privacy of an individual is protected and security is secured by providing a means which adds an access control setting file as one attribute of medical consultation information of a patient of each medical organ, and exchanging clinical consultation information on the patient according to the access control setting file. SOLUTION: A hospital 101 and a hospital 102 performs a mutual authenticating process about whether or not they have the right to exchange clinical consultation data on the patient A. Then a random number R generated on the side of the hospital 101 is sent together with the ID number of the patient A according to the address HOSP of a file server 105 of the hospital 102 in the access control setting file. The file server 105 of the hospital 102 takes the mutual authentication key Ak of the access control setting file out of a clinical consultation data storage file of the patient A. Then Ak(R) generated by ciphering the random number R with the authentication key Ak and the random number R generated at the hospital 102 are sent back to the hospital 101 according to the address HOSP of a file server 104 of the hospital 101 in the access control setting file.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention provides a means for safely sharing medical information of patients in a plurality of medical institutions, and relates to a wide-area medical information system.

[0002]

2. Description of the Related Art As a method of sharing medical information across a plurality of medical institutions, an IC card called a health care card is often used from the viewpoint of protecting the privacy of patients. The IC card is carried by the patient, and the contents of the card are kept safe unless the card is lent or transferred to a third party. In addition, in the IC card, a microprocessor is embedded in the card itself, and the microprocessor can check an access right by a password. Therefore, the data in the IC card is not disclosed to an unspecified third party who does not have access authority to the IC card. Usually, this access right is usually given to the card holder, a doctor, or the like.

[0003]

As described above, the method of recording information on an IC card and sharing medical information at a plurality of medical institutions can achieve strong privacy protection,
There is the inconvenience of not being able to look up patient information unless the doctor has a card at hand. For example, if a patient is attending multiple medical institutions at the same time, it is not possible for each attending physician to know the medicine prescribed at each medical institution, the results of recent tests, the details of the diagnosis, etc. Importantly, the information on the card cannot be obtained except when the patient carries the card and comes to the attending physician. Therefore, it is practically impossible for the attending physician to check various information of the patient in advance before visiting the patient and to utilize the information for diagnosis and treatment in the future. As described above, the method of sharing medical information among a plurality of medical institutions based on an IC card has a problem that information on a patient cannot be obtained in a timely manner when the attending physician wants to know it.

[0004]

A table in which a list of addresses of a plurality of medical institutions on a network is described for each patient, an encryption key assigned for the patient, and a table for each medical institution. Means for the patient to arbitrarily create a file containing the key used for the mutual authentication process, means for each medical institution to authenticate that the file is indeed related to the patient, and Means for adding as one attribute of the medical information of the patient,
This can be achieved by securely sharing the medical information of the patient via a secure access path for the patient between medical institutions formed based on the file.

[0005]

BEST MODE FOR CARRYING OUT THE INVENTION

"Example 1" As an embodiment of the present invention, a case where a patient A visits two medical institutions will be described. First, as the first embodiment, the access control setting file 20 for forming a secure access path dedicated to the patient A is described.
A case where an IC card is used as a means for sharing 1 will be described. FIG. 1 illustrates the configuration of the entire system. FIG. 2 shows the configuration of a file used in this embodiment. In this figure, it is assumed that the medical data of the patient A is shared between the two entities of the hospital 101 and the hospital 102. Here, patient A
Is assumed to have visited the hospital 101 after having visited the hospital 102. The hospital 101 and the hospital 102 have file servers 104, 10
Have five. In the file servers 104 and 105, chart data of patients who have undergone medical treatment at hospitals are registered. In this figure, it is assumed that the medical data 106 of the patient A in the file server 105 is registered. Patient A has a health care card 107. here,
The healthcare card means a secure medium such as an IC card related to healthcare, such as an examination card or an insurance card.

[Generation of Access Control Setting File and Generation of Medical Data File] Generation of the access control setting file in the healthcare card 107 and generation of the medical data file of the patient A will be described.

(1) Patient A instructs health care card 107 to generate access control setting file 201. At this time, the key generation module 302 of the healthcare card 107
Generates a key Dk by encrypting the random number R1 with the master key in the card, and stores the encryption key storage area 303 in the access control setting file storage area 301.
Register with. Similarly, the key generation module 302 of the health care card 107 generates a random number R2, encrypts the random number with a master key in the card to generate a key Ak, and generates a key Ak for the mutual authentication key in the access control setting file storage area 301. Register in the storage area 304. (FIG. 3) (2) The hospital 102 creates a medical data file for the patient A in the file server 105. And hospital 102
Visits the hospital 10 in the address table 305 of the medical institution in the access control setting file storage area 301.
2 address HOSP2 is registered.

(3) In the processing of (2), the patient A
It is also performed when you visit 1. The hospital 101 creates a medical care data file for the patient A in the file server 104.
Then, the address HOSP1 of the hospital 101 is registered in the address table 112 of the medical institution in the access control setting file storage area 301.

Here, the addresses of the hospitals 101 and 102 refer to the locations of the network 103 of the file servers 104 and 105.

"Setting of access control setting information" Based on the access control setting file in the healthcare card 107,
A procedure for setting the access control setting information in the medical data file of the patient A will be described.

(1) At the hospital 101, when the patient A comes to the hospital, the contents of the access control setting file 201 may be read from the access control setting file storage area 301 of the healthcare card 107. As a result, the hospital 101 sets the encryption key and the mutual authentication key of the access control setting file 201, and the address HOSP of the hospital 102.
It is possible to obtain 2.

(2) Similarly in the hospital 102, the contents of the access control setting file 201 are read from the access control setting file storage area 301 of the healthcare card 107. Here, in the hospital 102, the information on the encryption key and the mutual authentication key in the access control setting file 201 can be read from the health care card 107, but the address table 205 is blank. Therefore,
The address of the hospital A (the hospital 101 in this embodiment) that the patient A who consulted the hospital 102 subsequently visited is
It must be obtained by another means. Here, the address of the hospital 101 is delivered from the hospital 101 by the following means. The hospital 101 searches the address table 112 of the medical institution in the access control setting file 201 read in (1). In this example, since only the hospital 102 is registered, only the address is taken out. Then, the hospital 10 is registered with the mutual authentication key in the access control setting file 201.
After performing mutual authentication between the hospital 2 and the hospital 101, the ID of the patient A
The address HOSP1 of the hospital 101 along with the number is encrypted with the encryption key of the access control setting file 201 and sent to the hospital 102. As described above, the hospital 102 sets the encryption key, the mutual authentication key, and the address HOSP of the hospital 101 for the patient A in the access control setting file 201.
1 was obtained. Here, the address table 112 of the medical institution of the access control setting file 201 is described.
If the addresses of a plurality of medical institutions are registered at the time of searching, the address of the hospital (in this case, the address of the hospital 101) is multicast to all the hospitals.

(3) According to (1) and (2), the access control setting information obtained in the hospital 101 and the hospital 102 is stored in the hospital 101 and the hospital 102 in the medical data file 206 (for the patient A) in the file servers 104 and 105. It is taken into the access control setting information 208 of the electronic medical record data) and managed as one attribute of the medical treatment information.

In the case of medical data, from the viewpoint of protecting the privacy of the patient, the information (the file 201 in the above embodiment) defining the secure access route must be managed as one attribute of the medical data of the patient. In addition, the authentication that the access control setting file 201 is indeed the case of the patient A is performed when the patient A visits each hospital and directly receives a health care card issued by a trusted third party organization from the patient. It is guaranteed by receiving the information of the access control setting file 201.

Next, a description will be given of a means for exchanging data between the hospital 101 and the hospital 102 by communicating the medical information of the patient A via the network 103. For example, hospital 1
01 is the medical treatment data file 106 of the patient A in the hospital 102
Let's refer to Next, FIG. 4 will be described.

(1) The hospital 101 and the hospital 102
A mutual authentication process is performed to determine whether the user has the right to exchange medical data. Here, a three-pass partner authentication method is applied as the mutual authentication processing.

1) Along with the ID number of the patient A, the hospital 10
1 generates the random number R in the access control setting file 2
01 of the file server 105 of the hospital 102 of the address H
Transmit based on OSP2.

2) File server 105 of hospital 102
Extracts the mutual authentication key Ak of the access control setting file 201 from the medical data storage file of the patient A. Then, Ak (R) which encrypted the random number R with Ak and the hospital 10
2. The random number S generated in step 2
Address HO of file server 104 of one hospital 101
It is sent back to the hospital 101 based on SP1.

Hereinafter, the communication between the hospital 101 and the hospital 102 is as follows.
This is performed based on the addresses HOSP1 and HOSP2.

3) The hospital 101 sends the received Ak
If (R) is decrypted with the mutual authentication key Ak and matches the random number R transmitted in 1), the hospital 101 knows that the hospital 102 owns the medical data of the patient A. If they do not match, the subsequent processing is stopped and the medical data exchange of the patient A is stopped.

4) The hospital 101 transmits Ak (S) obtained by encrypting the random number S with the mutual authentication key Ak to the hospital 102.

5) The hospital 102 sends the received Ak
(S) is decrypted with the mutual authentication key Ak, and compared with the random number S transmitted in 2). If they match, the hospital 102 becomes the hospital 10
It can be seen that 1 has access to patient A's medical data. If they do not match, the subsequent processing is stopped and the medical data exchange of the patient A is stopped.

(2) File server 105 of hospital 102
Generates a session key for data encryption and a session key for data authentication in this session.

1) The encryption processing key Dk of the access control setting file 201 is extracted from the medical data storage file of the patient A.

2) File server 105 of hospital 102
Generates random numbers T1 and T2 and encrypts them with an encryption processing key Dk to generate a data encryption session key DTk and a data authentication session key MTk.

(3) The data encryption session key DTk and the data authentication session key MTk generated in (2)
And the hospital 102 encrypts the Ak with the mutual authentication key Ak.
(DTk) and Ak (MTk) are transmitted to the hospital 101.
The hospital 101 decrypts the Ak (DTk) and Ak (MTk) sent in (3), and extracts the data encryption session key DTk and the data authentication session key MTk.

(4) The hospital 102 generates a message digest for the medical treatment data 106 using a predetermined hash function, and creates an authentication code encrypted with the data authentication session key MTk. Next, a code obtained by adding the generated authentication code to the medical treatment data 106 is encrypted with the data encryption session key DTk. This is called hospital 10
Send to 1.

(5) In the hospital 101, the data transmitted in (4) is transmitted to the data encryption session key DT.
k, the medical data 106 and the authentication code are taken out, a message digest is generated from the medical data 106 by a predetermined hash function, and the authentication code encrypted with the data authentication session key MTk is sent. Compare with If they match, the medical data of the patient A is correct.

As described above, between the hospital 101 and the hospital 102, the medical treatment data on the patient A can be safely shared by the data authentication and the data encryption. Here, there is one feature due to the above configuration. The hospital 101 can refer to the information of the patient A who has visited the hospital from the file server of the hospital 102.
It is impossible to refer to the medical data of patients who have not visited the hospital. This is because whether or not the patient A has the right to exchange medical data is performed with the mutual authentication key of the patient A, and data cannot be exchanged unless mutual authentication is established in this process. This feature makes it impossible to refer to medical data from a doctor other than the patient's attending physician or the hospital where the patient's doctor is enrolled, thereby protecting the privacy of the patient.

Another feature of the present invention will be described. First, the characteristics of the medical care data will be briefly described. The medical treatment data is data accumulated in the course of medical treatment of a certain patient, and is considered to be a property of the patient together with the attending physician who records the data. That is, the medical data has a feature that the user (medical worker) and the owner do not completely match. This causes a troublesome problem in securing the security of the medical care data. For example, even if a plurality of medical institutions, which are users of medical data, form an appropriate group and statically construct a secure communication channel within the group, the patient who is the owner of the medical data will It is not always the case that you visit only a medical institution. As a result, as long as a patient who has consulted one of the medical institution groups consults another medical institution in the group, medical data can be safely exchanged. Therefore, the safety of medical data exchange with this medical institution cannot be ensured. Patients who own medical data
It is common to visit a number of healthcare facilities in different regions during a lifetime, and it is not acceptable to assume that the patient's consultation activity is consistent with the healthcare facilities in the group. Therefore, as in the above-described embodiment, a mechanism for dynamically setting a safe access route for each patient between medical institutions where the patient has been examined is required.

Lastly, in the above embodiment, two hospitals are described, but the same applies to the sharing of medical care data among three or more medical institutions.

[Embodiment 2] In the following embodiment, the access control setting file 201 is transmitted from the patient A's home via the network 503 to the hospital 501 and the hospital 50 as shown in FIG.
Distribute to 2. In this embodiment, it is assumed that the patient A knows the address HOSP3 of the hospital 501 and the address HOSP4 of the hospital 502 by some other means.

[Generation of Access Control Setting File] (FIG. 6) A procedure for generating the access control setting file 201 with the healthcare card 107 at the home of the patient A will be described with reference to FIG.

(1) The patient A instructs the health care card 107 to generate the access control setting file 201. At this time, the key generation module 302 of the healthcare card 107
Generates a key Dk by encrypting the random number R1 with the master key in the card, and stores the encryption key storage area 603 in the access control setting file storage area 601.
Register with. Similarly, the key generation module 602 of the healthcare card 107 generates a random number R2, encrypts the random number with the master key in the card to generate a key Ak, and generates a key Ak for the mutual authentication key in the access control setting file storage area 601. Register in the storage area 604.

(2) Register the address HOSP3 of the hospital 501 in the storage area 605 of the access table of the access control setting file storage area 601. Similarly, hospital 50
The second address HOSP4 is registered in the storage area 605 of the access table.

(3) Access control setting file 201 recorded in access control setting file storage area 601
Then, an electronic signature is made with the secret key Sa of the health care card 107.

(4) Download the access control setting file 201 digitally signed in (3) to the terminal 507 of the patient A.

[Distribution of Access Control Setting File] The access control setting file 201 is stored in the hospital 501 and the hospital 502.
The procedure for delivery to is described.

(1) From the terminal A 507 of the patient A, the hospital 50
1 address HOSP3 and hospital 502 address HOSP
Based on P4, an electronically signed access control setting file 201 is transmitted to each hospital.

(2) At each hospital, the healthcare card 107
After verifying the electronic signature with the public key Pa corresponding to the secret key Sa, the hospital 501 and the hospital 502 register the access control setting file 201 in the medical data file of the patient A.

Here, it is assumed that the public key Pa is indeed the one of the patient A, because the public key certificate is issued by a trusted third party.

As described above, since the access control setting file of the patient A is obtained at the hospital 501 and the hospital 502, the sharing of the medical care data is the same as that of the first embodiment. Also, in this example, two hospitals were described as an example,
The same applies to three or more medical institutions.

[0043]

The access control setting file 201 for each patient is shared by each medical institution and managed as one attribute of the medical treatment information data of the patient. With the address table 205, the medical data of the patient across a plurality of medical institutions are linked on the network. In addition, with the encryption key and the mutual authentication key managed by the access control setting file 201, the link between the medical data of the patients on the network can ensure data integrity and confidentiality. In addition, the mutual authentication processing using the mutual authentication key prohibits access from medical staff other than the patient's doctor or the hospital where the patient was consulted, thereby ensuring the privacy of the patient. As described above, the patient's medical data are securely linked on the network, so that the patient's physician or the hospital where the patient is consulted can always safely share the patient's data.

[Brief description of the drawings]

FIG. 1 is a system configuration diagram of an embodiment of the present invention.

FIG. 2 is a configuration diagram of a file used in an embodiment of the present invention.

FIG. 3 is a diagram showing processing in a healthcare card according to an embodiment of the present invention.

FIG. 4 is a diagram showing a protocol for sharing medical care data according to the embodiment of the present invention.

FIG. 5 is a system configuration diagram of an embodiment of the present invention.

FIG. 6 is a diagram showing processing in a health care card according to the embodiment of the present invention.

[Explanation of symbols]

101 ... hospital, 102 ... hospital, 103 ... network,
104: File server, 105: File server, 1
06: medical treatment data file, 107: health care card,
201: access control setting file, 202: patient I
D, 203: encryption key, 204: mutual authentication key, 20
5 ... address table, 206 ... medical data file,
207: patient ID, 208: access control setting information, 2
09 each medical data, 301 access control setting file storage area, 302 key generation module, 501 hospital, 502 hospital, 503 network, 504 file server, 505 file server, 506 medical data file, 507 patient home Terminal, 601: access control setting file storage area, 602: key generation module,

Claims (5)

[Claims] An exchange of medical information between a communication terminal device distributed in a plurality of medical institutions, a plurality of databases connected by a communication network and shared by the plurality of medical institutions, and the communication terminal device. In the wide area medical information system that can be, a table that describes a list of addresses on a network of multiple medical institutions for each patient,
Means for creating an access control setting file including a key for encryption assigned for the patient and a key used for mutual authentication processing between medical institutions, and the access control setting file surely relates to the patient. Means for each medical institution to authenticate that the medical treatment is performed, and means for adding the access control setting file as one attribute of the medical information of the patient at each medical institution. A medical information sharing method characterized by exchanging information safely. 2. Exchange of medical information between a communication terminal device distributed and installed in a plurality of medical institutions, a plurality of databases connected by a communication network and shared by the plurality of medical institutions, and the communication terminal device. In a wide-area medical information system that can be used, a table describing a list of addresses of multiple medical institutions on the network, an encryption key assigned for the patient, and a mutual authentication process between medical institutions 2. The medical information sharing method according to claim 1, wherein an access control setting file including a key to be performed is stored and managed in a storage device of the portable medium. 3. Exchange of medical information between a communication terminal device distributed and installed in a plurality of medical institutions, a plurality of databases connected by a communication network and shared by the plurality of medical institutions, and the communication terminal device. In a wide-area medical information system capable of performing the above-mentioned, regarding a table in which an address list of a plurality of medical institutions on a network included in the access control setting file according to claim 1 is described, a medical institution newly added is included in the table. 2. The medical care information sharing method according to claim 1, wherein the address of the medical institution is sent to each address on the network to be used. 4. Exchange of medical information between a communication terminal device distributed and installed at a plurality of medical institutions, a plurality of databases connected by a communication network and shared by the plurality of medical institutions, and the communication terminal device. In communication of medical data to a patient in a wide-area medical information system capable of performing the above, mutual authentication is performed with a key used for a mutual authentication process included in the access control setting file according to claim 1, and communication is performed using an encryption key. 2. The medical information sharing method according to claim 1, wherein 5. Exchange of medical information between a communication terminal device distributed and installed in a plurality of medical institutions, a plurality of databases connected by a communication network and shared by the plurality of medical institutions, and the communication terminal device. In a wide-area medical information system capable of performing the above, a patient digitally signs the access control setting file of claim 1 with a patient-specific private key,
2. The method according to claim 1, wherein a list of addresses of a plurality of medical institutions on the network included in the access control setting file is transmitted to each address of the table.
How to share medical information.