WO2011161160A2

WO2011161160A2 - Device and method for the secure recording and consulting of contextualised data

Info

Publication number: WO2011161160A2
Application number: PCT/EP2011/060446
Authority: WO
Inventors: Kambiz Sharif
Original assignee: Kambiz Sharif
Priority date: 2010-06-23
Filing date: 2011-06-22
Publication date: 2011-12-29
Also published as: FR2961925B1; FR2961925A1; WO2011161160A3

Abstract

The invention relates to a device (100) for recording and consulting data contextualised in relation to a subject, so-called owner, said device comprising: a so-called data storage network comprising a primary server (21) comprising metadata and a plurality of secondary servers (22, 22', 23, 23') that can contain data segments and are electronically connected to the primary server (21); a so-called user network (1) comprising means for the acquisition and recording of raw data (10, 121), means (11) for identifying a third-party user and the owner of said data, and means for recording contextual data; and so-called BOX computer means (12) forming an interface between the user network (1) and the storage network (2), that can compile the raw data and the contextual data, encrypt them and send them to the storage network (2), said BOX (12) comprising geolocalisation means (125).

Description

DEVICE AND METHOD FOR SECURE RECORDING AND CONSULTING OF CONTEXTUALIZED DATA

The invention relates to a device and a method for the secure recording and consultation of contextualized data, in particular medical data, said recordings being searchable in any place provided with an internet connection, but in the respect of the security of the data.

The invention is more particularly, but not exclusively, suitable for recording and consulting data relating to radiological examinations and to medical data, particularly medical imaging. However, the invention may also be adapted for other uses, wherever a double security concerning both the recording and the consultation of the data, as well as a contextualization of said data is necessary.

The invention is particularly useful for tracking data recorded by different users of the consultants. In the field of medical imaging, it makes it possible to facilitate the follow-up of patients, by comparing exams, thanks to simple and quick access to previous examinations, by any authorized doctor.

Another object of the invention is to enable the secure archiving of a large volume of data, for a period of up to 20 years, by pooling the means of archiving and the progressive growth of the capacity of these means.

Throughout the text, the terms "contextualised data" denote a set comprising raw data, called objective data, and information, also in the form of computer data, making it possible to contextualize the conditions of acquisition or creation of these raw data, which This information is essential for the interpretation of objective data. For example, the raw data may be an image, such as an X-ray, which radiography, to be interpreted in all its medical teachings, must be contextualized at least by a date and by an attribution to a given patient, defined in particular by sex, age or other relevant data. Said image can also be contextualized by information relating to the conditions of the examination which led to its creation, in particular the protocol followed, or even the objective of the examination which led to the taking of this image. When the patient, subject of the image in question, consults a practitioner, said practitioner must have access, not only to the image, objective data, but also to all of this contextual information to be able to interpret these data; this is particularly important if the practitioner is not the one who made the image or the one who prescribed the medical examination that led to the creation of this image, and more particularly if the practitioner accessing this image is removed in the space or time of the one who made said image.

One of the features of the invention is to propose a device making it possible to manage access authorizations to these data in a sufficiently fine granularity and where the ownership of data, the storage of data and the capacity of interpretation of said data are held by different people, physical or moral. Thus, to use the nonlimiting example of the medical imaging data, these imaging data are, according to the prior art, recorded in the medical imaging center that made them. However, the contextualized data is the property of the patient, who alone can authorize their consultation. Finally, the contextualized data are consulted by a doctor, specialist or generalist, but most often different from the one who created the contextualized data, in order to interpret them. Thus, the person who has the power to authorize access to contextualized records is not himself, neither the creator, nor the host, nor the user of this data.

The digital archiving of data, in particular medical imaging, is carried out according to the prior art within each imaging cabinet, in an archiving system, commonly referred to as "PACS", which includes files corresponding to each patient of the cabinet. In these folders are archived images, in standard DICOM format, and examination reports recorded according to a standard code known as "HL7". This HL7 coding includes, among other things, the identification of the patient and the correspondence between the report and the imaging record relating to said patient. The PACS system is in communication, via a computer network, with a device called "RIS" which uniquely identifies the patient using, generally, a smart card identification, called "Carte Vitale"" in France.

This computer network, called "user", constitutes a secure archive of immediate access for the imaging center. This archiving must be kept for a minimum time, usually defined by the law of the country in which the medical imaging center is located. For example, in France, the law requires that this archiving of immediate access be kept for 2 years. Beyond this time the archives can be recorded on other media in a compression format, called "DICOM Lossy", for delayed access and to be kept for 20 years. Thus, at the scale of the medical imaging office, the imaging data are well contextualized.

When a physician wishes to consult a patient's previous medical file, the patient must make a request to the medical imaging centers of which he was a client, who must, from their immediate access archiving system or from their access archives. deferred, retrieve the elements of the patient's file and transmit them to the latter, which, in turn, transmits them to the doctor, usually on physical media.

This process is long and insecure, data can be lost or diverted. The process is complicated by the fact that several imaging centers are involved and data must, for example, be repatriated from abroad.

There are, of course, examples of centralized remote access data servers. The operation of these servers is usually as follows:

the physician requests access to said server from an administration authority thereof, which provides it with connection information such as a username and a password;

- this identity, used at each connection, gives the doctor access to a portion of the server which may be limited for example to the recordings that it carries out itself, that is to say concerning its customers, or wider access.

This situation, however, is unsatisfactory for the confidentiality and security of the data on the one hand, for the accessibility of these data on the other hand, and finally for the storage capacities. In fact, on the one hand, the patient who owns his or her contextualized data is excluded individually from the access authorization process. If the doctor only has access to his established clientele, he can hardly access information about a new patient. If he has access to a larger part of the directory, he can view medical data that should be confidential. In addition, the administrators of said server can access all the data of the latter without any authorization being granted by the patients. Finally, these centralized storage solutions can not be generalized to the population scale of a country, the necessary storage volumes then becoming extremely important.

There is also, according to the prior art, particularly in the medical field, attempts to pool and interface the storage means of different medical imaging firms. It is then decentralized solutions, based on the principle of computer grids. These solutions make it possible to solve the problem of storage means, however they only imperfectly solve the problem of secure access to data with sufficient granularity, since they are based on principles of computer keys, which, as for centralized systems manage access at the user level, that is to say the practitioner, and not at the level of the owner of the data, that is to say the patient. In addition, these solutions of the prior art do not address the problem of the contextual quality of the data, that is to say the assurance that all the necessary information will be present to allow the interpretation of said data.

Although the foregoing examples are given in the field of medical imaging, those skilled in the art will understand that similar situations may arise in other fields, since the data may be be professional references, data related to the billing of hours of service, financial data or any personal data of an owner to be validated by a third person for their registration and whose consultation by another third party must be authorized beforehand by the owner of the data. This may include confidential data to which a certain date and content must be conferred upon registration, as well as the identification of their owner, and which only the owner may authorize the consultation.

The invention aims in terms of objectives to provide a method and a device for making contextualized and confidential data accessible in digital form from potentially any point in the world connected to the Internet. Such a device must be secure, in the sense of respect for the confidentiality of the data, namely that no one can access them, both in reading and in writing, without being authorized to do so and without The agreement of the owner of the data The device must also be secure, that is to say robust, to avoid any loss of data following a technical failure or a computer attack. The device must also ensure the quality of the data, that is to say the integrity of the raw data, as well as the availability of all the information and contextual elements relating to these data, to allow interpretation. Finally, the invention also aims at ensuring the traceability of the recorded information.

To this end, the invention proposes a device for recording and consulting contextualized data relating to a subject, said owner, said device comprising:

a so-called data storage network comprising a primary server comprising metadata, and a plurality of secondary servers able to contain data segments, in computer connection with the primary server;

a so-called user network comprising means for acquiring and raw data recording means, means for identifying a third party user and the owner of said data and means for recording contextual data;

computer means, known as BOX, forming an interface between the user network and the storage network able to compile the raw data and contextual data, encrypt them and send them to the storage network, said BOX comprising geolocation means.

Metadata are computer data used to characterize and locate the data recorded on secondary servers. Thus, the device that is the subject of the invention inserts two elements, namely, the so-called BOX means and the primary metadata server between the mass storage accessible from any point and distributed over a plurality of secondary servers, and the user network. These two intermediate elements make it possible to solve the disadvantages of the prior art relating to the granularity of the control of data access and organizing this control on two levels:

- a first control at the level of the user by a double identification of the user and the subject;

a second control, centralized on the primary server, through the correspondence between a means, the BOX, and its geolocation;

The invention can be implemented according to the advantageous embodiments, described below, which can be considered individually or in any technically operative combination. Advantageously the BOX includes the recording of a protocol, said contextualization of the data. This characteristic makes it possible to ensure the quality of contextualization of the data. In fact, the storage of data on the storage network is thus authorized only if the contextualization protocol has been respected, which ensures that the data that will be extracted from the storage network will include all the data. information necessary for their interpretation.

Advantageously, the primary server includes a record of the initial geolocation of the BOX. Thus, when accessing these means to the server the correspondence between the actual position of the BOX and its theoretical position can be checked to prevent any attempt to fraudulent access.

The invention also relates to a method using a device according to any one of the preceding embodiments, for recording, by a third party user having personal identification means, data relating to a subject having identification means. said method being characterized by comprising the steps of: a. read the means of identification of the subject; and B. read the means of identification of the authorized third party user; vs. generate, using the data contextualization protocol, a computerized list of tasks corresponding to the nature of the contextualized data; d. perform the acquisitions of raw data and contextual data relating to said tasks; vs. close the acquisition when the last task is completed; d. when the acquisition is closed, send by the BOX the contextualized data, including the identification of the user and the identification of the subject to the primary server; e. save the contextualized data associated with the subject by segmenting them on a plurality of secondary servers in the subject folder on each of these servers.

Some of these steps can be accomplished in parallel. Thus, the respect of the contextualization protocol guarantees the quality of the data recorded on the storage network, and said data are necessarily closely associated with a user and a defined subject. According to this embodiment, write access to the storage network is only possible via a BOX, that is to say, by authorized users having this means, this one authorizing access only subject to a dual user and subject identification.

Advantageously, geolocation data of the BOX are introduced during step d) in the contextualized data. Thus the traceability of the recordings is improved.

Advantageously, the method which is the subject of the invention comprises, between steps c) and d), a step consisting in: f. compare the geolocation of the BOX with the geolocation with the recording of its initial geolocation recorded on the primary server and allow the BOX access to the primary server only if the two geolocation information correspond. Thus, the security of access to data is enhanced.

Advantageously, when performing step e) of the method that is the subject of the invention, the data segments are distributed randomly over the number of secondary servers available. Thus, the greater the number of secondary servers, the more secure and secure the data.

The invention also relates to using a device that is the subject of the invention for consultation by an authorized user having personal identification means, on a computer consultation terminal comprising means for reading the personal identification means of the user and a subject, contextualized data relating to a subject having personal identification means, said method being characterized in that it comprises the steps of: at. read the means of identification of the subject; and B. read the means of identification of the authorized user; vs. send to the primary server the data relating to the identities of the subject and the authorized user; summer. confirm the validity of the identities of the authorized user and the subject, and if this validity is confirmed; f. read on the primary server the identification of the folders corresponding to the subject; boy Wut. search the secondary servers for the data segments contained in the folders corresponding to the identification defined in the previous step f); h. sending said data segments from the secondary servers to the consulting computer terminal; and i. restore the subject's records on the consultation terminal using the received data segments.

This consultation takes place on a computer terminal containing programs for reconstructing data from segments extracted from the storage network and can therefore be implemented without the BOX. In this way, the data stored on the storage network can be securely accessed from anywhere in the world with a computer terminal connected to the Internet network, and with programs enabling both the identification of authorized user and the subject, as well as the dialogue with the storage center and the reconstruction of the data from the received segments.

Thus access to the device for both reading and writing is conditioned by the authorization of the subject who must provide his personal means of identification. Access is restricted to subject files only and access is only available to an authorized user, ie more specifically to a licensed professional possessing personal identification means. This accredited professional may access any file only if the subject concerned authorizes it by his personal means of identification. It is possible to access write access only by having a BOX which must also correspond in geolocation to its real position.

The invention will now be more specifically described in the context of preferred embodiments, in no way limiting, represented in FIGS. 1 to 5 in which:

FIG. 1 schematically represents an example of a device for recording and consulting data of medical examinations;

FIG. 2 schematically shows an exemplary content of a primary server of the storage network of the device for recording and consulting medical examination data;

FIG. 3 schematically shows an exemplary content of a secondary server of the network for storing and consulting medical examination data;

FIG. 4 illustrates by a table an example of distribution of data segments corresponding to a file recorded on the storage network of the device;

FIG. 5 is an example of a flowchart corresponding to the method of recording a medical examination using the device, given the user network (FIG. 5.1), the storage network (5.3) and the interface means (FIG. 5.2).

The invention is described in an application corresponding to the recording and consultation of medical imaging data. The skilled person will easily adapt this particular case to other contexts.

Figure 1, according to an exemplary embodiment the device of the invention comprises a network (1), said user, and a network (2) said storage. The network (1) user is an internal network to a medical imaging center. It is connected to the storage network (2) by a dedicated high-speed line (3) and via interface means (12), called BOX. In practice a plurality networks (1) users are linked by broadband lines dedicated to a network (2) storage.

The storage network is also connected by internet (13) to consultation terminals (130), which are always associated with means (131) for controlling an identity.

The user network comprises means (10), commonly called PACS, for local archiving in direct access to the medical examination data. This data includes images, usually recorded in a format known as "DICOM® lossiess" and review reports, usually recorded in a format known as HL7®. The HL7® format is a standardized international coding based on digital documents in XML® format, for the computerized exchange of clinical, financial and administrative data. The network (1) user further comprises identification means (1 1) of a subject, or patient, and an authorized user, such as one or more smart card readers. The interface means (12), or BOX, are specific and dedicated to a given imaging center and include information recordings relating to the identity and geographic location of the imaging center. According to an exemplary embodiment, these interface means (12) are constituted by a computer comprising network connections, storage (121) and display means (122), as well as data processing capabilities adapted to the implementation of the methods of the invention.

The storage network (2) includes a router (30), a primary server (21) and a plurality of secondary servers (22, 22 ', 23, 23').

Advantageously, to secure the archiving of data, the storage network (2) comprises a second primary server (not shown), mirror of the first (21). Secondary servers are added to the network as the number of medical imaging centers subscribing to the storage solution increases. Thus when an imaging center having a storage capacity T direct access archiving subscribes to the proposed storage solution, two secondary servers storage capacity T 'are added to the storage network (2), whose storage capacity increases by 2T. Thus, the storage network (2) increases in capacity, safety and security with the number of client imaging centers of the device.

FIG. 2, according to a preferred embodiment, the primary server (21) comprises metadata corresponding to the recording of the tree (210) of the files, comprising in particular the files (21 1) relating to each patient, and a table correspondence system (212) for linking each of the patients and each of the recorded examinations (A, B, C) thereof to the files containing the corresponding data, which are on the secondary servers.

3, each secondary server (22) comprises data (220) which are organized according to the same tree as on the primary server (21). Thus the secondary server will include the data relating to the examination (A) of a particular patient under the same folder (21 1) and the same tree as the primary server. However, on a particular secondary server only segments (A1, A3, A6, An) of this file will be found, so that to reconstruct the file, it is necessary to acquire all the segments of the file. corresponding data, which are distributed on all secondary servers, but always in the same directory and under the same file tree. Indeed, for each record of a file from the network (1) user on the network (2) storage, the file is segmented and the segments are randomly distributed, but respecting the tree structure, on all servers secondary network (2) storage. To improve security, the segmented file is saved twice, with both segment distributions random.

FIG. 4, according to an example of distribution of the segments (A1 A8) of a file recorded twice randomly on eight secondary servers (22, 22 ', 23, 23', 24, 24 ', 25, 25'), the failure, for example, of three servers (22, 22 ', 24') does not prevent the reconstruction of the file.

Figure 5, when a patient arrives at an imaging center subscribed to device, the patient identification data is retrieved (510) by the appropriate means (1 1) of the user network, such as a smart card reader, as well as the data (510 ') relating to the identity of the authorized user, the dual identification conditioning access to the device. Depending on the nature of the examinations to be performed, a list of tasks, which is associated with the identification of the patient, is generated automatically (51 1). This task list is generated in HL7® format. According to one embodiment, the task list is generated by the so-called BOX means (12), or, alternatively, it can be generated by other computer means of the user network (1). In the latter case, it must be sent to the BOX (12), which verifies (520) that the task list is generated and that the patient's identity corresponds to that indicated on the task list, if yes, several actions will unfold in parallel.

The BOX (12) will connect (530) to the primary server (21) of the storage network (2) and interrogate (531) it, through the correspondence tables (212), on the existence of a file relating to the identified patient. If such a file exists, the corresponding data segments are searched (533) on the secondary servers, and said patient-owned image and test report segments are loaded (534) from the secondary servers (22, 22 '). , 23, 23 ') and sent (525) to the storage means (121) of the BOX (12) which reconstructs (521) the file from said segments. According to an advantageous embodiment, the examinations that have been carried out in the medical imaging center of the network (1) user including the BOX (12) and which are available on the PACS (10) are not downloaded from the network ( 2) Storage.

If no folder corresponding to the patient's identity exists in the storage network (2), the folder is created (532).

In any case, the new examination leads to the creation of an imaging file and a single examination report file in the file tree (210) of the storage network (2). These unique files are linked to the patient and to the geolocation of the imaging center, which can be obtained by various means, such as a satellite geolocation (125) or by via the IPv6 protocol.

A space dedicated to the examination, and including a location for said imaging file and a location for said examination report file, is created (512) on the direct access archiving means, PACS (10).

The exam is practiced and the steps of the task list are validated

(513) as it progresses to closing.

The closing of the examination takes place when all the tasks of the generated list have been validated and in particular the last which, according to an advantageous embodiment, is constituted by the issue of the electronic care sheet, or the corresponding invoice. examinations. With the close of the review validated (514), as soon as the imaging data and the test report are available at the appropriate locations on the PACS (10), the BOX (12) retrieves (522) the images at the same time. "DICOM® lossless" format on the PACS (10), compresses them in "DICOM® lossy" format, retrieves the report, segments the data and transfers them (523) in the form of packets to the primary server (21) which, once the BOX has notified the end of transmission, updates (535) the tree on the secondary servers (22, 22 ', 23, 23') and distributes (536) the data packets randomly on them. When the registration operation is complete, the primary server (21) notifies the BOX (12) of the success of the operation and the connection between the storage network (2) and the BOX (12) is closed.

Thus, the modification of the data tree on the storage network (2) is not performed until the image and report files are available on the PACS (10), as long as the primary server has not not received the notification of the end of transmission of the data packets or the link between the BOX and the storage network (2) has failed. The data remains however available, in high resolution for the images, on the PACS (10), and advantageously, a specific procedure for an attempt to reload them on the network (2) of storage, this time in absence of the patient, can be set up for the cases, of failure of the connection between the network (1) user and the network (2) of storage at the time of the initial transmission attempt for example.

According to an alternative embodiment, the image files are sent in a continuous flow to the primary server before the closing of the examination, which can then be done later by issuing the examination report, which may allow to other practitioners to access the imaging data immediately, again according to a dual-identification protocol, while allowing the practitioner who practiced the examination time to write the examination report.

Consultation of the data recorded in the storage network (2) is possible either via the BOX (12) or via any computer terminal connected to the Internet. However, any consultation is possible only by matching the identification of a patient and the identification of a person authorized to this consultation, or authorized user, for example, a doctor. According to one embodiment, such a consultation is possible by associating the identification of the patient via his personal smart card and the identification of the authorized user. This double identification is checked during each transaction that it is for viewing or writing data on the servers of the storage center. For example, this consultation is possible by associating the identification of the patient with that of the professional smart card of the authorized user, for example the referring physician of the patient. Smart card identification offers the most security. In particular, it is possible to record in the chip of the patient's card, the identity of his referring doctors, and consequently, to verify the correspondence between this information and the identity of the practitioner wishing to access the records. However, those skilled in the art will easily adapt other cross-identification protocols, using dongles or identification numbers and passwords listed, fingerprints etc.

Whatever the protocol set up, it allows a traceability of the consultations which can be recorded on the primary server (21). This traceability includes geolocation information from the medical imaging center that performed the examination. The cross identification of the practitioner and the patient defines the part of the tree that the practitioner can access. After selecting the elements to be consulted, the corresponding files are sent in packets from the secondary servers (22, 22 ', 23, 23') to the consultation terminal which includes the programs necessary to reassemble the file segments and to decompress them.

The above description clearly illustrates that by its different characteristics and advantages, the present invention achieves the objectives it has set for itself. In particular, it allows secure storage of medical examination data and secure consultation thereof from any terminal connected to the internet network, with the security of dual identification and traceability of all transactions.

Claims

1. Device (100) for the recording and consultation of contextualized data relating to a subject, said owner, characterized in that said device comprises:

a data storage network (2) comprising a primary server (21) comprising metadata and a plurality of secondary servers (22, 22 ', 23, 23') able to contain data segments, in computer connection with the primary server (21);

a user-defined network (1) comprising raw data acquisition and recording means (10, 121), identification means (1 1) of a third-party user and the owner of said data and means of identification; recording of contextual data;

computer means (12), called BOXs, forming an interface between the user network (1) and the storage network (2) able to compile the raw data and the contextual data, encrypt them and send them to the storage network ( 2) said BOX (12) comprising means

(125) of geolocation.

2. Device according to claim 1, characterized in that the BOX (12) comprises the recording of a protocol, said contextualization of the data.

3. Device according to claim 1, characterized in that the primary server (21) comprises a record of the initial geolocation of the

BOX (12).

4. A method using a device according to claim 2 for recording, by a third party user having personal identification means, data relating to a subject having personal identification means, said method being characterized in that it comprises the steps of: a. read the means of identification of the subject (510); and b. read the identification means of the authorized third party user (510 '); vs. generating (51 1) using the data contextualization protocol a computerized list of tasks corresponding to the nature of the contextualized data; d. perform the acquisitions of raw data and contextual data relating to said tasks; vs. close the acquisition when the last task is completed; d. when the acquisition is closed (514), sending by the BOX (12) the contextualized data, including the identification of the user and the identification of the subject to the primary server (21); e. recording (522, 523, 535, 536) the contextualized data associated with the subject by segmenting them on a plurality of secondary servers (22, 22 ', 23, 23') in the subject file on each of these servers.

5. Method according to claim 4 implementing a device according to claim 3, characterized in that geolocation data of the BOX (12) are introduced during step d) in the contextualized data.

6. Method according to claim 5, characterized in that it comprises between steps c) and d) a step consisting of: f. compare the geolocation of the BOX (12) with the geolocation with the registration of its initial geolocation recorded on the primary server (21) and allow the BOX (12) access to the primary server (21) only if the two geolocation information match.

7. Method according to claim 4, characterized in that in step e), the data segments (220) are distributed randomly over the number of secondary servers (22, 22 ', 23, 23') available. .

8. A method using a device according to claim 1, for consultation by an authorized user having personal identification means, on a computer consultation terminal (130) comprising means (131) for reading the personal identification means of the user and a subject, contextualized data relating to a subject having personal identification means, said method being characterized in that it comprises the steps of: a. read the means of identification of the subject; and B. read the means of identification of the authorized user; vs. sending to the primary server (21) the data relating to the identities of the subject and the authorized user; summer. confirm the validity of the identities of the authorized user and subject and if this validity is confirmed; f. read on the primary server (21) the identification of the folders corresponding to the subject; boy Wut. search the secondary servers (22, 22 ', 23, 23') for the data segments (220) contained in the folders (21 1) corresponding to the identification defined in the previous step f); h. sending said segments (220) of data from the secondary servers (22, 22 ', 23, 23') to the consulting computer terminal; and i. reconstructing the subject's records on the consultation terminal (130) using the received data segments (220).