Peer-to-peer group-based abnormal behavior detection

Abstract

A peer-to-peer network can include nodes corresponding to different clinicians. The edge can interconnect the two nodes based on the corresponding clinicians sharing at least one common attribute (such as, for example, treating the same patient and / or interacting with the same medical device). A machine learning model can be applied to identify one or more clinician peer groups in the peer-to-peer network. The activity pattern of the clinician can be compared with the activity pattern of other clinicians in the same peer group to determine whether the clinician shows abnormal behavior. When it is determined that the clinician shows abnormal behavior, an investigation workflow can be triggered. The investigation workflow includes generating an alarm, activating a monitoring device and / or isolating the medicine approached by the clinician.

Description

[0001] CROSS REFERENCE TO RELATED APPLICATIONS

[0002] This application claims priority to U.S. Provisional Application No. 62 / 667,409, filed on May 4, 2018, entitled “ADDRESSING ANOMALOUS BEHAVIORAMONG PEER GROUPS OF CLINICIANS,” the disclosure of which is incorporated herein by reference in its entirety. Technical Field

[0003] The subject matter described herein relates generally to complex networks and, more particularly, to a peer-to-peer community-based technique for detecting anomalous behavior. Background Art

[0004] Diversion can refer to the transfer of controlled substances to third parties who are not legally authorized to receive, possess and / or take controlled substances. High-value and / or controlled prescription drugs, especially opioids, are particularly prone to diversion. For example, prescription pain medications may be diverted when they are loaded into and / or retrieved from a dispensing cabinet. Some prescription pain medications, such as morphine, hydromorphone, fentanyl, etc., can be administered to patients via pumps (such as, for example, patient-controlled analgesia (PCA) pumps) that can accommodate larger doses of pain medications that exceed the patient's required dose. These extra doses of pain medications may be diverted by clinicians caring for the patient. For example, some pain medications may be taken out before being loaded into the pump. Alternatively and / or additionally, any pain medications left in the pump may be retained instead of being properly disposed of at the point of disposal. Summary of the invention

[0005] Systems, methods, and articles of manufacture including computer program products are provided for identifying groups of clinicians and detecting abnormal behavior within groups of clinicians. In one aspect, a system is provided. The system may include at least one data processor and at least one memory. The at least one memory may store instructions that, when executed by the at least one data processor, result in operations. The operations may include: identifying a first peer group in a peer network by at least applying a machine learning model trained to identify one or more peer groups present in the peer network, the peer network including a plurality of clinicians, and the first peer group including the first clinician and the second clinician based on at least one common attribute shared by the first clinician and the second clinician from the plurality of clinicians; comparing a first activity pattern of the first clinician with a second activity pattern of the second clinician; determining that the first clinician exhibits abnormal behavior based at least on the comparison between the first activity pattern of the first clinician and the second activity pattern of the second clinician; and triggering an investigation workflow at one or more data systems in response to determining that the first clinician exhibits abnormal behavior.

[0006] In some variations, one or more features disclosed herein including the following features may optionally be included in any feasible combination. The at least one common attribute may include one or more of the same patients treated by the first clinician and the second clinician.

[0007] In some variations, the at least one common attribute may include one or more of the same medical device with which the first clinician and the second clinician interact or a plurality of medical devices located in the same care area.

[0008] In some variations, the at least one common attribute may include one or more of: prescription order, clinician role, scheduling, supervisor, educational background, training, designated care area, medical regimen, and physical layout of the facility.

[0009] In some variations, the peer-to-peer network may be generated to include a first node corresponding to the first clinician and a second node corresponding to the second clinician. The peer-to-peer network may further include an edge interconnecting the first node and the second node based at least on the first clinician and the second clinician sharing the at least one common attribute. The peer-to-peer network may be generated based at least on a plurality of transaction records generated by the one or more data systems in response to the first clinician or the second clinician interacting with the one or more data systems. The plurality of transaction records may include at least one transaction record generated in response to the first clinician interacting with a medical device to retrieve, give or dispose of a drug. The at least one transaction record may include at least one of the following: a timestamp, a first identifier of the first clinician, a second identifier of a patient associated with the drug, a third identifier of the drug, a fourth identifier of the medical device, a location identifier of the medical device, or a quantity of the drug.

[0010] In some variations, the investigative workflow may include sending an alert to a client indicating that the first clinician exhibited unusual behavior.

[0011] In some variations, the investigative workflow may include activating one or more monitoring devices and / or isolating a medication to which the first clinician has access in response to the first clinician interacting with a medical device.

[0012] In some variations, the machine learning model may include at least one of: neural network, minimum cut, hierarchical clustering, Girvan-Newman, modularity maximization, or clique detection.

[0013] In some variations, the edge may be associated with a weight corresponding to the number of common attributes shared between the first clinician and the second clinician.

[0014] In some variations, the comparison may include assigning to the first clinician a grade corresponding to how much the first activity pattern of the first clinician deviates from the norm of the first peer group. The first clinician may be determined to exhibit abnormal behavior based at least on the grade assigned to the first clinician being above or below a threshold. The norm may include an expected norm determined based at least on the first activity pattern of the first clinician and the second activity pattern of the second clinician. The norm may include a composite norm determined based on data other than the first activity pattern of the first clinician and / or the second activity pattern of the second clinician.

[0015] In some variations, a second peer community present in the peer network may be identified by applying at least the machine learning.The comparison to determine whether the first clinician exhibits abnormal behavior may not include a third activity pattern of a third clinician included in the second peer community.

[0016] In another aspect, a computer-implemented method is provided for identifying groups of clinicians and detecting anomalous behavior within the groups of clinicians. The method may include: identifying a first peer group in a peer network by at least applying a machine learning model trained to identify one or more peer groups present in the peer network, the peer network comprising a plurality of clinicians, and the first peer group comprising the first clinician and the second clinician based at least on the first clinician and the second clinician from the plurality of clinicians sharing at least one common attribute; comparing a first activity pattern of the first clinician with a second activity pattern of the second clinician; determining that the first clinician exhibits anomalous behavior based at least on the comparison between the first activity pattern of the first clinician and the second activity pattern of the second clinician; and triggering an investigation workflow at one or more data systems in response to determining that the first clinician exhibits anomalous behavior.

[0017] In some variations, one or more features disclosed herein including the following features may optionally be included in any feasible combination. The at least one common attribute may include one or more of the same patients treated by the first clinician and the second clinician.

[0018] In some variations, the at least one common attribute may include one or more of the same medical device with which the first clinician and the second clinician interact or a plurality of medical devices located in the same care area.

[0019] In some variations, the at least one common attribute may include one or more of: prescription order, clinician role, scheduling, supervisor, educational background, training, designated care area, medical regimen, and physical layout of the facility.

[0020] In some variations, the method may further include generating the peer-to-peer network, the peer-to-peer network including a first node corresponding to the first clinician and a second node corresponding to the second clinician, and the peer-to-peer network further includes an edge interconnecting the first node and the second node based at least on the first clinician and the second clinician sharing the at least one common attribute. The peer-to-peer network may be generated based at least on a plurality of transaction records generated by the one or more data systems in response to the first clinician or the second clinician interacting with the one or more data systems. The plurality of transaction records may include at least one transaction record generated in response to the first clinician interacting with a medical device to retrieve, administer, or dispose of a drug. The at least one transaction record may include at least one of a timestamp, a first identifier of the first clinician, a second identifier of a patient associated with the drug, a third identifier of the drug, a fourth identifier of the medical device, a location identifier of the medical device, or a quantity of the drug.

[0021] In some variations, the investigative workflow may include sending an alert to a client indicating that the first clinician exhibited unusual behavior.

[0022] In some variations, the investigative workflow may include activating one or more monitoring devices and / or isolating a medication to which the first clinician has access in response to the first clinician interacting with a medical device.

[0023] In some variations, the machine learning model may include at least one of: neural network, minimum cut, hierarchical clustering, Girvan-Newman, modularity maximization, or clique detection.

[0024] In some variations, the edge may be associated with a weight corresponding to the number of common attributes shared between the first clinician and the second clinician.

[0025] In some variations, the comparison may include assigning to the first clinician a grade corresponding to how much the first activity pattern of the first clinician deviates from the norm of the first peer group. The first clinician may be determined to exhibit abnormal behavior based at least on the grade assigned to the first clinician being above or below a threshold. The norm may include an expected norm determined based at least on the first activity pattern of the first clinician and the second activity pattern of the second clinician. The norm may include a composite norm determined based on data other than the first activity pattern of the first clinician and / or the second activity pattern of the second clinician.

[0026] In some variations, the method may further include identifying a second peer group present in the peer network by at least applying the machine learning, wherein the comparison to determine whether the first clinician exhibits abnormal behavior does not include a third activity pattern of a third clinician included in the second peer group.

[0027] On the other hand, a non-volatile computer-readable medium storing instructions is provided. The instructions may cause operations when executed by at least one data processor. The operations may include: identifying a first peer group in a peer network by at least applying a machine learning model trained to identify one or more peer groups present in the peer network, the peer network including a plurality of clinicians, and the first peer group including the first clinician and the second clinician based on at least one common attribute shared by the first clinician and the second clinician from the plurality of clinicians; comparing a first activity pattern of the first clinician with a second activity pattern of the second clinician; determining that the first clinician exhibits abnormal behavior based at least on the comparison between the first activity pattern of the first clinician and the second activity pattern of the second clinician; and triggering an investigation workflow at one or more data systems in response to determining that the first clinician exhibits abnormal behavior.

[0028] On the other hand, a device for identifying a group of clinicians and detecting abnormal behavior within the group of clinicians is provided. The device may include a device for identifying a first peer group in a peer network by at least applying a machine learning model trained to identify one or more peer groups present in the peer network, the peer network including a plurality of clinicians, and the first peer group including the first clinician and the second clinician based on at least sharing at least one common attribute by the first clinician and the second clinician from the plurality of clinicians; a device for comparing a first activity pattern of the first clinician with a second activity pattern of the second clinician; a device for determining that the first clinician exhibits abnormal behavior based at least on the comparison between the first activity pattern of the first clinician and the second activity pattern of the second clinician; and a device for triggering an investigation workflow at one or more data systems in response to determining that the first clinician exhibits abnormal behavior.

[0029] On the other hand, a device for performing an investigation workflow is provided. The device may include at least one data processor and at least one memory. The at least one memory may store instructions that, when executed by the at least one data processor, result in an operation. The operation may include: receiving an indication that a first clinician is identified as exhibiting abnormal behavior, the first clinician being part of a peer group in a peer network including a plurality of clinicians, the peer group being identified by at least applying a machine learning model trained to identify one or more peer groups present in the peer network, and the first clinician being identified as exhibiting abnormal behavior based at least on a comparison between a first activity pattern of the first clinician in the peer group and a second activity pattern of a second clinician; and in response to the indication, initiating an investigation workflow, the investigation workflow including activating one or more monitoring devices and / or isolating a drug approached by the first clinician in response to the first clinician interacting with the device.

[0030] In some variations, one or more features disclosed herein including the following features may optionally be included in any feasible combination. The device may be an infusion pump or an automatic medication dispensing device.

[0031] The embodiments of the current theme may include methods consistent with the description provided herein and articles including tangibly embodied machine-readable media, which are operable to cause one or more machines (e.g., computers, etc.) to cause operations that implement one or more of the features. Similarly, a computer system is also described, which may include one or more processors and one or more memories connected to the one or more processors. The memory that may include a non-volatile computer-readable or machine-readable storage medium may include, encode, store or similarly process one or more programs that cause one or more processors to perform one or more operations described herein. The computer-implemented method consistent with one or more embodiments of the current theme may be implemented by one or more data processors residing in a single computing system or multiple computing systems. Such multiple computing systems may be connected, and data and / or commands or other instructions may be exchanged via one or more connections, including, for example, connections via a network (e.g., the Internet, a wireless wide area network, a local area network, a wide area network, a wired network, etc.), via direct connections between one or more of the multiple computing systems, etc.

[0032] Details of one or more variations of the subject matter described herein are set forth in the accompanying drawings and the following description. Other features and advantages of the subject matter described herein will be apparent from the specification and drawings and from the claims. Although certain features of the subject matter disclosed herein are described for illustrative purposes with respect to identifying a group of clinician peers to detect the occurrence of abnormal behavior, it should be readily understood that these features are not intended to be limiting. The claims following this disclosure are intended to define the scope of the protected subject matter. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate certain aspects of the subject matter disclosed herein and, together with the description, help explain some principles associated with the disclosed embodiments.

[0034] In the accompanying drawings,

[0035] Figure 1 depicts a block diagram illustrating a clinician tracking system according to some exemplary embodiments;

[0036] Figure 2 depicts a system diagram showing one example of a clinician tracking system according to some exemplary embodiments;

[0037] Figure 3A depicts a diagram representing an example of a peer-to-peer network, according to some exemplary embodiments;

[0038] Figure 3B depicts a diagram representing an example of a peer-to-peer network, according to some exemplary embodiments;

[0039] Figure 3C depicts a diagram representing another example of a peer-to-peer network, according to some exemplary embodiments;

[0040] Figure 4 depicts a flow chart illustrating a process for tracking clinician behavior, according to some exemplary embodiments; and

[0041] Figure 5 Depicted is a block diagram illustrating a computing system, according to some exemplary embodiments.

[0042] Where practical, similar reference numerals indicate similar structures, features or elements. DETAILED DESCRIPTION

[0043] The misappropriation of medicine may occur at any time point, including, for example, during the shipment, reception, storage, distribution, administration and / or abandonment of medicine. Due to the lack of sufficient supervision during the shipment, reception, storage, distribution, administration and / or abandonment of, for example, prescription painkillers, the situation of misappropriation easily occurs in prescription painkillers. For example, the medicine cabinet at the medical facility may be accessible to multiple clinicians. And different clinicians may be responsible for the distribution, administration and abandonment of medicine. Therefore, even when misappropriation is detected, it may be difficult to determine when misappropriation actually occurs and be identified as the clinician responsible for misappropriation. As such, in some exemplary embodiments, the analysis engine can detect misappropriation and be identified as the clinician responsible for misappropriation by at least identifying the clinician who shows abnormal behavior. For example, the analysis engine can determine that the clinician shows abnormal behavior by comparing the activity data associated with the clinician at least and the activity data associated with one or more other clinicians. For example, if the activity data associated with the clinician include an activity pattern inconsistent with the activity pattern existing in the activity data of other clinicians, it can be determined that the clinician shows abnormal behavior. As used herein, clinician may refer to a medical professional with at least some authority to use controlled substances, including, for example, physicians, nurses, pharmacists, medication technicians, imaging specialists, and the like.

[0044] At least some differences in activity patterns may be due to legal reasons rather than illegal actions (e.g., misappropriation). Therefore, if the analysis engine compares the activity data associated with clinicians whose activity patterns may be different due to legal reasons, the analysis engine may be prone to false positive and / or false negative situations. For example, oncology nurses and nurses working in neonatal intensive care units may show different activity patterns (e.g., in the distribution, administration and / or abandonment of drugs) because the symptoms and medical needs of the patients they treat are different. Similarly, due to the difference in designated shifts, nursing areas (e.g., medical-surgical, intensive care, emergency, infusion center, non-acute, outpatient, observation, etc.), facilities and / or tasks, permanent nurses, mobile nurses, auxiliary nurses, student nurses and head nurses may also show different modes of activity. As such, in some exemplary embodiments, instead of comparing the activity data of different clinicians indiscriminately, the analysis engine may be configured to identify one or more clinician peer groups. Each peer group can be occupied by clinicians who share sufficiently similar attributes, so that the clinicians in the same peer group should also show the same and / or similar activity patterns. Therefore, in order to determine whether a clinician exhibits abnormal behavior, the analysis engine can compare the activity data associated with the clinician with the activity data of other clinicians in the same peer group. If the clinician's activity pattern deviates from the activity pattern of clinicians in the same peer group, the analysis engine can determine that the clinician exhibits abnormal behavior.

[0045] In some exemplary embodiments, the analysis engine can apply a machine learning model (such as, for example, a neural network) trained to identify one or more clinician peer groups. It is also possible to identify clinician peer groups by applying alternative techniques (including, for example, minimum cut, hierarchical clustering, Girvan-Newman, modular maximization, group detection, etc.). One or more clinician peer groups can be identified based on attributes highly correlated with activity patterns. For example, clinician peer groups can be identified based on the patient treated by each clinician, because the clinician treating the same patient should also show the same and / or similar activity patterns. Alternatively and / or additionally, clinician peer groups can be identified based on the interaction with one or more medical devices (such as, for example, a dispensing cabinet, an infusion pump, a discard station, etc.). Due to the extremely adjacent clinician operating (for example, in the same nursing area and / or similar area) should show the same and / or similar activity patterns, the position of the medical device may impose geographic constraints on the membership in each peer group. However, it should be understood that the attributes and / or attribute combinations that can be directly or indirectly detected by the analysis engine can be used to identify different clinician peer groups. For example, peer groups can also be identified based on identical and / or similar prescriptions, clinician roles, shifts, supervisors, educational backgrounds, training, designated care areas, related medical programs, the physical layout of facilities, etc. Additionally or alternatively, groups can be identified based on the treatment of patients who undergo a common care process (including, for example, a conversion between two public care areas) within or across care areas, the duration of the patient in a care area, the timing between care area conversions, etc. In addition, it should be understood that, since the attributes associated with each clinician can change over time, membership in a peer group can remain dynamic. For example, when a clinician starts or stops treating a particular patient, the clinician can be added to a peer group and / or removed from a peer group.

[0046] Figure 1 A system diagram illustrating a clinician tracking system 100 is depicted in accordance with some exemplary embodiments. Figure 1 The clinician tracking system 100 may include an analysis engine 110 that is communicatively coupled to one or more data systems 120 that may include medical devices such as, for example, medication cabinets, infusion pumps, waste stations, etc. Figure 1As shown in , one or more data systems 120 can collect data generated from clinicians interacting with the one or more data systems 120, including, for example, patient identifiers, device identifiers, clinician identifiers, etc. For example, each of the one or more data systems 120 can be configured to generate a transaction record in response to an interaction with a clinician. For example, a clinician dispensing a medication from a dispensing cabinet can trigger the generation of a transaction record, the transaction record including: a timestamp, a clinician identifier of the clinician, a device identifier of the dispensing cabinet, a patient identifier of the patient to whom the medication was prescribed, an identifier of the medication retrieved from the dispensing cabinet, a quantity of medication retrieved from the medication cabinet, a location identifier, etc. An exemplary dispensing cabinet is described in U.S. Patent No. 8,195,328, which is commonly owned and hereby incorporated by reference in its entirety. Alternatively and / or additionally, a clinician administering medication to a patient using an infusion pump can trigger the generation of a transaction record that includes: a timestamp, a clinician identifier of the clinician, a device identifier of the infusion pump, a patient identifier of the patient receiving the medication, an identifier of the medication administered to the patient, the amount of medication administered to the patient, a location identifier, etc. An example of an infusion pump is described in U.S. Pat. No. 9,227,025, which is commonly owned and is hereby incorporated by reference in its entirety. It should be understood that one or more data systems 120 may also provide non-transactional data. For example, one or more data systems 120 may provide an electronic medical record (EMR), which may include a patient's medical history, including, for example, past opioid use, etc. Although the actions of creating, updating, and / or retrieving an electronic medical record may generate a timestamp transaction record, the electronic medical record itself is not a transaction record.

[0047] The analysis engine 110 can receive multiple input data from one or more data systems 120, including, for example, patient identifiers, device identifiers, clinician identifiers, drug identifiers, prescription identifiers, inventory information, shift identifiers, location tracking identifiers, electronic health records (EHR) identifiers, etc. It should be understood that the input data from one or more data systems 120 can include at least a portion of the transaction records generated in response to the interaction with different clinicians. In addition, the input data from one or more data systems 120 can correspond to the attributes that can be used to identify the clinician group. Therefore, in some exemplary embodiments, the analysis engine 110 can determine the clinician peer group based at least on the input data received from one or more data systems 120, and each of the clinician peer groups is associated with the peer group identifier. The clinician in the same peer group may be associated with sufficiently similar attributes so that the clinician in the same peer group should also show the same and / or similar activity mode. On the contrary, the clinician in different peer groups may be associated with different attributes, which leads to the reasonable difference of the activity mode of the clinician in different peer groups.

[0048] For example, the analysis engine 110 can identify a clinician peer group treating the same patient based at least on input data received from one or more data systems 120. Alternatively and / or additionally, the analysis engine 110 can identify a clinician peer group interacting with the same medical device and / or the medical device in the same care area based at least on input data received from one or more data systems 120. As used herein, a care area can refer to an area in a specific medical facility specified based on function and / or location. For example, a facility such as a hospital can include multiple care areas, such as, for example, medical-surgery, intensive care, emergency, observation, non-acute, infusion center, outpatient clinic, etc. It should be understood that the patient's condition can be inferred based at least on the care area occupied by the patient. The patient's condition can also be inferred based on the medicine given to the patient. Clinicians treating patients suffering from the same and / or similar condition should show the same and / or similar activity pattern. As such, in addition to geographic constraints, the location of medical devices within a certain nursing unit may further refine membership in each peer group based on the conditions of the patients treated by the clinicians in each peer group.

[0049] As noted, clinicians in the same peer group should show the same and / or similar activity patterns, while clinicians in different peer groups can show different activity patterns. This similarity and diversity may be attributed to various potential causes. For example, the same patient and / or the patient in the same care area may show the same and / or similar drug demand. Therefore, with respect to the type and / or quantity of the medicine that each clinician retrieves from the dispensing cabinet, gives by an infusion pump and / or disposes of at a discard station, the activity patterns of the clinicians treating the same patient and / or operating in the same care area should be the same and / or similar. Alternatively and / or additionally, the same and / or similar treatment regimen may be applied to the same patient and / or the patient in the same care area. For example, a clinician in a care area may be allowed to give multiple doses of medicine and then dispose of unused medicine at a discard station, while a clinician in another care area may only be allowed to give single doses of medicine and then dispose of unused medicine at a discard station. Therefore, the activity patterns of the clinicians treating the same patient and / or operating in the same care area may also reflect the corresponding treatment regimen. In addition, the design of the care areas (e.g., layout, number of available medical devices, etc.) may produce similarities in the activity patterns of clinicians operating in the care areas. For example, the activity patterns of clinicians operating in the care areas may reflect the distances that the clinicians must travel in order to access patients and / or medical devices in the care areas.

[0050] Because clinicians in the same peer group should exhibit the same and / or similar activity patterns, the analysis engine 110 can determine whether the clinician exhibits abnormal behavior by comparing the clinician's activity pattern with the activity patterns of other clinicians in the same peer group. The clinician's activity pattern can include a series of transaction records, which, as noted, can be generated when the clinician interacts with one or more data systems 120.

[0051] In some exemplary embodiments, the series of transaction records can be divided into, for example, corresponding to the shifts associated with the clinician (for example, working hours) in time. If the activity pattern of the clinician deviates from the activity pattern of other clinicians in the same peer group, then analysis engine 110 can determine that the clinician shows abnormal behavior. For example, analysis engine 110 can distribute to each clinician in the same peer group a grade corresponding to the comprehensive norm and / or expected norm that the activity pattern of the clinician deviates from the peer group. The expected norm of the peer group can be determined based on the activity pattern of at least a portion of the clinicians included in the peer group. Meanwhile, instead of the activity pattern of the clinician in the peer group or in addition thereto, the comprehensive norm of the peer group can be generated based on other data (including, for example, medical schemes, general observations, etc.). If the level of the clinician is higher or lower than a threshold, then analysis engine 110 can determine that the clinician shows abnormal behavior.

[0052] The analysis engine 110 may receive other input data that is not derived from the data system 120. Other input data may include additional signals that can be used to detect peer groups or anomalies. Other input data may include information that triggers the evaluation of groups and behaviors. For example, a user interface may be presented to collect configuration parameters and initiate the evaluation of information received by the analysis engine 110 from the data system 120. In some embodiments, other input data may be received from the attendance system. For example, when a clinician clocks out to indicate that the shift is over, the analysis engine 110 may receive a message that the clinician is identified as clocking out. Because this may indicate that a new batch of transactions may be ready for processing, the analysis engine 110 may initiate one or more of the described processes. In some embodiments, the analysis engine 110 may evaluate transactions from the current shift and provide a response to the attendance system. In this way, if the transaction is consistent with best practices (or at least non-divergent), a message including positive reinforcement may be presented to the clinician. If the clinician's schedule includes suspicious transactions or indicates potential misappropriation behavior, the message may result in the collection of additional information adjacent to the one or more considered transactions in time. The collection may include initiating a survey workflow as described. The collection may include additional information for identifying a clinician group. The patient history is from a repository.

[0053] Figure 2 A system diagram illustrating one example of a clinician tracking system 100 is depicted in accordance with some exemplary embodiments. Figure 2As shown in , the analysis engine 110 and one or more data systems 120 can be communicatively coupled via a network 210. The network 210 can be any wired and / or wireless network, including, for example, a public land mobile network (PLMN), a local area network (LAN), a virtual local area network (VLAN), a wide area network (WAN), the Internet, etc.

[0054] exist Figure 2 In the example shown in , one or more data systems 120 may include an access control system 220a, a dispensing system 220b, and an electronic medical record (EMR) system 220c. As noted, a clinician interacting with the access control system 220a, the dispensing system 220b, and / or the electronic medical record system 220c may trigger the generation of one or more corresponding transaction records. For example, a clinician dispensing medication from a dispensing cabinet may trigger the generation of a transaction record, the transaction record including: a timestamp, a clinician identifier of the clinician, a device identifier of the dispensing cabinet, a patient identifier of the patient to whom the medication was prescribed, an identifier of the medication retrieved from the dispensing cabinet, a quantity of medication retrieved from the medication cabinet, etc. Alternatively and / or additionally, a clinician administering medication to a patient using an infusion pump may trigger the generation of a transaction record, the transaction record including: a timestamp, a clinician identifier of the clinician, a device identifier of the infusion pump, a patient identifier of the patient receiving the medication, an identifier of the medication administered to the patient, a quantity of medication administered to the patient, etc.

[0055] Reference again Figure 2 , the analysis engine 110 may include a peer group controller 230 and an anomaly detector 240. As noted, the analysis engine 110 may receive multiple input data from one or more data systems 120, the input data including at least a portion of a transaction record generated by the one or more data systems 120 in response to an interaction between the one or more data systems 120 and a plurality of different clinicians. In addition, the input data from the one or more data systems 120 may correspond to attributes that can be used to identify different clinician peer groups. Therefore, the peer group controller 230 may identify clinician peer groups that should exhibit the same and / or similar activity patterns based at least on the input data received from one or more data systems 120. For example, in some exemplary embodiments, the peer group controller 230 may identify clinician peer groups that treat the same patient based at least on the input data received from one or more data systems 120. Alternatively and / or additionally, the peer group controller 230 can identify peer groups of clinicians that interact with the same medical device and / or medical device in the same care area (such as, for example, medical-surgical, critical care, emergency, non-acute, observation, outpatient, infusion center, etc.) based at least on input data received from one or more data systems 120.

[0056] In some exemplary embodiments, the anomaly detector 240 can be configured to determine whether the clinician exhibits abnormal behavior by comparing the clinician's activity pattern with the activity pattern of other clinicians in the same peer group. As noted, the clinician's activity pattern can include a series of transaction records, which are generated when the clinician interacts with one or more data systems 120. The series of transaction records can be divided into, for example, corresponding to the shifts associated with the clinician in time. If the clinician's activity pattern deviates from the activity pattern of other clinicians in the same peer group, the anomaly detector 240 can determine that the clinician exhibits abnormal behavior. For example, the clinician can be assigned a grade corresponding to how much the expected norm of the clinician's activity pattern deviates from the clinician's peer group. If the clinician's grade is higher or lower than a threshold, the anomaly detector 240 can determine that the clinician exhibits abnormal behavior. The determination can be based on a combination of scores (e.g., average or moving average) within a period of time based on a single behavior score or a score. In some embodiments, a series of acceptable scores can be used to evaluate the grade. In some embodiments, a threshold value or range can be dynamically generated. For example, when the system collects behavioral information of a specific group, a threshold value or range can be generated to reflect the group. In some implementations, the system may include absolute limits for thresholds or ranges to prevent entire groups of misappropriators from evading detection. A user interface may be provided to receive such configuration of anomaly detector 240, such as the thresholds or ranges described.

[0057] In some exemplary embodiments, the anomaly detector 240 can respond to the identification of the clinician who exhibits abnormal behavior by at least triggering the investigation workflow. The investigation workflow can include the anomaly detector 240 generating an alarm that the clinician is identified as exhibiting abnormal behavior, and sending the alarm to the client 250 via the network 210. In addition, the investigation scheme can include the anomaly detector 240 configuring one or more data systems 120. For example, whenever the clinician approaches a medical device, the anomaly detector 240 activates one or more monitoring devices (e.g., video cameras, still image cameras, audio recorders, etc.) at the medical device (e.g., a dispensing cabinet, an infusion pump, a discard station, etc.). Alternatively and / or additionally, the anomaly detector 240 can configure the medical device to isolate the drugs that the clinician can use. For example, in response to the clinician approaching the discard station to dispose of unused drugs, the anomaly detector 240 can activate the monitoring device at the discard station. In addition, the anomaly detector 240 can configure the discard station to isolate the unused drugs returned by the clinician in a designated container, for example, separate from the container that holds the unused drugs returned by other clinicians.

[0058] As noted, the analysis engine 110 (e.g., the peer group controller 230) can be configured to identify one or more clinician peer groups, each clinician peer group including clinicians that should exhibit the same and / or similar activity patterns. In some exemplary embodiments, the peer group controller 230 can form a clinician peer network based at least on one or more attributes associated with each clinician and then identify peer groups present in the peer network. To further illustrate, Figure 3A A diagram representing a peer-to-peer network 300 is depicted, according to some exemplary embodiments. Figure 3A As shown in, peer-to-peer network 300 can include multiple nodes connected by multiple edges.In some exemplary embodiments, each node in peer-to-peer network 300 can correspond to a clinician including, for example, the first clinician 310a, the second clinician 310b, the third clinician 310c, etc.Simultaneously, each edge in peer-to-peer network 300 can connect two nodes, and therefore can correspond to the common attribute shared between the clinicians corresponding to the two nodes connected by the edge.Peer group controller 230 can form peer-to-peer network 300 by at least identifying a clinician (for example, the node that should be interconnected by the edge) sharing a common attribute and / or a clinician (for example, the node that should not keep the unconnected state) that does not share any common attribute.

[0059] For example, if the clinicians corresponding to two nodes treat at least one common patient, the peer group controller 230 can determine that the two nodes should be interconnected by an edge. Therefore, the edge connecting the first clinician 310a and the second clinician 310b can correspond to one or more patients 320a treated by the first clinician 310a and the second clinician 310b. At the same time, the edge connecting the second clinician 310b and the third clinician 310c can correspond to one or more patients 320b treated by the second clinician 310b and the third clinician 310c. It should be understood that each edge in the peer-to-peer network 300 can be associated with a weight representing the strength of the affiliation between the nodes connected by the edge. Figure 3A In the example shown in , the weight associated with an edge in peer-to-peer network 300 may correspond to the number of patients treated by the clinicians associated with the two nodes connected by the edge.

[0060] The peer-to-peer network 300 may include a plurality of peer groups. The peer group controller 230 may apply one or more supervised and / or unsupervised machine learning techniques to identify peer groups present in the peer network 300. For example, the peer group controller 230 may apply a neural network trained to identify peer groups present in the peer network 300. Alternatively and / or additionally, the peer group controller 230 may also apply alternative techniques, including, for example, minimum cut, hierarchical clustering, Girvan-Newman, modularity maximization, clique detection, etc. However, in some exemplary embodiments, before the nodes in the peer network 300 form a discernible peer group, the peer group controller 230 may be required to generate the peer network 300 based on a plurality of attributes.

[0061] To further illustrate, Figure 3B The peer-to-peer network 300 is further illustrated by applying the medical devices with which each clinician in the peer-to-peer network 300 interacts. As noted, the location of the medical devices may impose geographic constraints on membership in each peer group, since clinicians operating in close proximity (e.g., in the same care area and / or similar areas) should exhibit the same and / or similar activity patterns. For example, Figure 3B As shown in , in addition to treating the same patient, the first clinician 310a can further interconnect with one or more other clinicians who interact with the same medical device and / or medical device located in the same care area (e.g., the first device 330a). Similarly, the second clinician 310b and the third clinician 310c can interconnect with other clinicians who not only treat the same patient but also interact with the same medical device and / or medical device located in the same care area (e.g., the second device 330b). Moreover, as Figure 3B As shown in FIG. 1 , although the first clinician 310 a and the second clinician 310 b may be interconnected because the first clinician 310 a and the second clinician 310 b treat one or more of the same patients, the first clinician 310 a and the second clinician 310 b may be interconnected based on one or more other attributes (including, for example, Figure 3BAs shown in , the medical devices are grouped into different peer groups (used by the first clinician 310a and the second clinician 310b). As noted, the care areas in which the first clinician 310a and the second clinician 310b operate can indicate the conditions of the patients treated by the first clinician 310a and the second clinician 310b. Therefore, although the first clinician 310a and the second clinician 310b may have treated the same patient, the first clinician 310a and the second clinician 310b may have treated these patients at different points of their care. For example, the first clinician 310a may have treated the patient when the patient first received emergency care, while the second clinician 310b may have treated the same patient after the patient was stabilized and transitioned to intensive care. Therefore, Figure 3B A first clinician 310a and a second clinician 310b are shown interconnected but as members of different peer groups.

[0062] Figure 3C A diagram illustrating another example of a peer-to-peer network 350 is depicted in accordance with some exemplary embodiments. Figure 3C As shown in , the peer network 350 may include multiple peer groups, including, for example, a first peer group 355a, a second peer group 335b, a third peer group 335c, a fourth peer group 335d, a fifth peer group 335e, a sixth peer group 335f, etc. As noted, clinicians in the same peer group may share common attributes and therefore may have the same and / or similar activity patterns, while clinicians in different peer groups may have different attributes and different activity patterns. However, it should be understood that clinicians may exhibit different degrees of affiliation with multiple peer groups. Therefore, as Figure 3C As shown in , because clinicians belong to multiple peer groups, different peer groups (such as, for example, the third peer group 335c and the fourth peer group 335d) may overlap. In order to separate overlapping peer groups, the peer group controller 230 can apply additional attributes that distinguish between clinicians who belong to one peer group but not to another peer group.

[0063] A technique for identifying multiple peer groups present in a peer-to-peer network such as, for example, peer-to-peer network 350 may rely on a statistical relationship between group membership and clinician attributes to infer group membership based on each clinician's attributes and to infer each clinician's attributes based on a single group membership. For example, a peer-to-peer network G may include N nodes. Each of the N nodes may correspond to a clinician having K attributes represented by X, where X ukmay correspond to the kth attribute of node u. The K attributes may include, for example, patients treated by the clinician, medical devices with which the clinician interacts, etc. At the same time, the peer-to-peer network G may include C peer groups. For group membership F, each node u may have a non-negative affiliation weight F with a single peer group c. uc ∈[0,∞). Therefore, when F uc = 0, node u does not belong to peer group c.

[0064] In some exemplary embodiments, the peer community controller 230 may construct a graph G(V, E) based on the community membership F. To represent the graph G(V, E), the peer community controller 230 may generate an adjacency matrix A∈{0, 1} N×N Let us represent a graph G(V, E) that uses a probabilistic generation process to detect overlapping peer groups. That is, each entry A in the adjacency matrix A uv The value of ∈{0,1} may correspond to whether the graph G includes an edge interconnecting node u and node v. For example, the following equation (1) may represent the probability P that two nodes u and v belonging to community c are connected uv .

[0065] P uv (c) = 1-exp(-F uc ·F vc ) (1)

[0066] Among them, F uc can represent the affiliation weight between node u and peer group c, and F vc The weight of the affiliation between node v and peer group c can be expressed.

[0067] According to equation (1), if node u or node v does not belong to peer group c (e.g., F uc =0 or F vc =0), then the probability that node u and node v are connected will be zero. In addition, in order for the graph G to not include any edge that interconnects node u or node v, node u or node v may not be connected in any community u. The probability that node u and node v are not connected in the graph G can be expressed by the following equation (2):

[0068] 1-P uv =Π c (1-P uv (c))=exp(-∑ c F uc ·F vc ) (2)

[0069] Therefore, each item A in the adjacency matrix A representing the graph G can be determined according to the following equations (3) and (4):uv The value of ∈{0,1}:

[0070] P uv =1-exp(-∑ c F uc ·F vc ) (3)

[0071] A uv ~Bernoulli(P uv ) (4)

[0072] As noted, the edge in graph G that interconnects node u and node v can correspond to one or more common attributes shared by clinicians associated with each of node u and node v. The common attributes shared between node u and node v can determine the node's membership in peer group c. In addition, the attributes associated with each of nodes u and v can also be inferred by the node's membership in peer group c. For example, the following equations (5) and (6) are based on the probability F that node u is a member of peer group c. uc To represent the probability Q of node u being associated with attribute k uk :

[0073]

[0074] X uk ~Bernoulli (Q uk ) (6)

[0075] Among them, W kc can represent the real-valued logical model parameters of the attributes of the community c to the kth node, and W k(C+1) Can represent partial terms. kc The value of may represent the correlation between node u being a member of peer group c and node u being associated with attribute k.

[0076] To identify the peer groups present in the graph G(V, E) represented by the adjacency matrix A, the peer group controller 230 may infer the values ​​of the latent variables F and W based on the graph G. Therefore, the peer group controller 230 may need to estimate N·C group memberships (i.e., ) and K·(C+1) logistic weight parameters (i.e., To this end, the peer group controller 230 may and The optimal value that maximizes the likelihood l(F, W) = logP(G, X|F, W) of the observed data G, X is determined according to the following equation (7):

[0077]

[0078] Since G and X are conditionally independent given F and W, the log-likelihood log P(G, X|F, W) can be decomposed according to the following equation (8):

[0079]

[0080] in, and

[0081] Based on equations (3) to (6) above, the peer community controller 230 can calculate and As shown in equations (9) and (10) below:

[0082]

[0083]

[0084] Among them, F u It can be the vector of node u {F uc}, and Q uk It can be defined according to equations (3) and (4).

[0085] The peer community controller 230 may further call l on W 1- Regularization is performed to avoid overfitting and learn sparse relationships between communities and attributes. Therefore, the peer community controller 230 may need to solve the optimization problem represented by the following equation (11):

[0086]

[0087] Among them, λ can represent a regularization hyperparameter.

[0088] To solve the optimization problem set forth in equation (11), the peer community controller 230 may apply a block coordinate ascent method, wherein by fixing W and community membership F for at least all other nodes v v To update F for each node u u Once F is updated for all nodes u , then the peer group controller 230 can update W while fixing the group membership F.

[0089] To update the group membership F of a single node u u , while fixing all other parameters (such as, for example, the peer group membership F of other nodes v v and logical model parameters W), the peer community controller 230 may be required to solve the convex subproblem represented by the following equation (12):

[0090]

[0091] in, and include and Involving F u , as shown in equations (13) and (14) below:

[0092]

[0093]

[0094] Where N(u) can represent the set of neighbors of node u. Note that the problem expressed by equations (11) and (12) can be a convex problem, where when W is fixed, Yes F u is a concave function, and Yes F uc The logical function of .

[0095] To solve the convex problem, the peer community controller 230 may apply projected gradient descent calculated according to equations (15) and (16) below:

[0096]

[0097]

[0098] The peer community controller 230 may update each F uc corresponds to the probability that node u is a member of peer group c. For example, according to the following equation (17), each F uc It can be updated by gradient descent and subsequently projected into the non-negative real space [0,∞):

[0099]

[0100] where α may correspond to a learning rate which may be set using a backtracking line search.

[0101] Once the peer community controller 230 has learned the real-valued community membership The peer group controller 230 can then determine whether the node u actually belongs to the peer group c. To this end, the peer group controller 230 can apply a threshold δ so that if the node u is a member of the peer group c, the corresponding probability F uc If the probability that node u is connected to another node that is a member of peer group c exceeds a threshold δ, then node u may be a member of peer group c. The value of threshold δ may be set so that if the probability that node u is connected to another node that is a member of peer group c is greater than Then node u can be a member of peer group c, where N can correspond to the total number of nodes in graph G.

[0102] In some exemplary embodiments, the value of the threshold δ may be determined based on the following equations (18) and (19):

[0103]

[0104]

[0105] Reference again Figure 3C , the peer group controller 230 can be configured to identify multiple peer groups present in the peer network 350, including, for example, a first peer group 355a, a second peer group 335b, a third peer group 335c, a fourth peer group 335d, a fifth peer group 335e, a sixth peer group 335f, etc. Each peer group present in the peer network 350 can correspond to a group of clinicians who share sufficiently similar attributes and should therefore exhibit the same and / or similar activity patterns. For example, each peer group present in the peer network 350 can correspond to clinicians who treat the same patient and interact with the same medical device and / or a medical device located in the same care area. By identifying clinician peer groups that share these common attributes, the peer group controller 230 can be able to distinguish between clinicians who have been assigned different shifts, care areas, and / or tasks, such as permanent clinicians, mobile clinicians, auxiliary clinicians, student clinicians, and supervisor clinicians. As noted, permanent nurses, mobile nurses, auxiliary nurses, student nurses, and charge nurses may also exhibit different activity patterns due to differences in assigned schedules, care areas, and / or assignments. Therefore, by grouping clinicians who have been assigned different schedules, care areas, and / or assignments into appropriate peer groups, the peer group controller 230 can ensure that the anomaly detector 240 compares the activity patterns of clinicians who have been assigned the same and / or similar schedules, care areas, and / or assignments.

[0106] Figure 4 A flow chart illustrating a process 400 for tracking clinician behavior is depicted in accordance with some exemplary embodiments. Figure 1 to Figure 2 , FIG. 3A to FIG. 3C and Figure 4 , process 400 may be performed in whole or in part by analysis engine 110 .

[0107] At 402, the analysis engine 110 may receive, from one or more data systems 120, a plurality of input data corresponding to at least a portion of a transaction record generated by the one or more data systems 120 in response to an interaction between the one or more data systems 120 and a plurality of clinicians. Figure 2 As shown in , one or more data systems 120 may include a proximity control system 220a, a distribution system 220b, and an electronic medical record (EMR) system 220c. In addition, as noted, one or more data systems 120 may include medical devices, such as, for example, a dispensing cabinet, an infusion pump, a waste station, etc. When a clinician interacts with one or more data systems, one or more data systems 120 may generate a transaction record. At least a portion of the transaction record generated by one or more data systems 120 may be sent to the analysis engine 110 as input data. In some embodiments, the transaction record may be normalized to allow meaningful attribute comparisons. For example, a system may use a field called "PATIENT" to refer to a patient, while another system may use a field called "PATIENT_ID" to refer to a patient. Normalization may be performed by the analysis engine 110 as a pre-processing step or by another system within the environment. Normalization may be performed according to a standardized message delivery format (e.g., a health information exchange standard (Health Level Seven, HL7) format or other electronic record format). Normalization can provide comparison of common, similar, and / or semantically equivalent attributes from different transactions.

[0108] For example, a clinician dispensing a medication from a dispensing cabinet may trigger the generation of a transaction record that includes a timestamp, a clinician identifier of the clinician, a device identifier of the dispensing cabinet, a patient identifier of the patient to whom the medication was prescribed, an identifier of the medication retrieved from the dispensing cabinet, a quantity of the medication retrieved from the medication cabinet, etc. Alternatively and / or additionally, a clinician administering a medication to a patient using an infusion pump may trigger the generation of a transaction record that includes a timestamp, a clinician identifier of the clinician, a device identifier of the infusion pump, a patient identifier of the patient receiving the medication, an identifier of the medication administered to the patient, a quantity of the medication administered to the patient, etc.

[0109] At 404, the analysis engine 110 may form a peer-to-peer network including a plurality of clinicians based at least on a plurality of input data received from one or more data systems 120. In some exemplary embodiments, the analysis engine 110 may form, for example, a peer-to-peer network 300 based on one or more attributes associated with the plurality of clinicians (including patients treated by each clinician, medical devices with which each clinician interacts, etc.). For example, the analysis engine 110 may form the peer-to-peer network 300 by interconnecting at least a plurality of nodes corresponding to the clinicians with edges corresponding to common attributes shared between the clinicians. Figure 3A In the example shown in , an edge may correspond to one or more patients treated by clinicians corresponding to the nodes interconnected by the edge. Figure 3BIt is shown that, in addition to treating the same patients, the nodes in the peer-to-peer network 300 may be further interconnected based on corresponding clinicians interacting with the same medical devices and / or medical devices located in the same care area.

[0110] At 406, the analysis engine 110 can identify one or more clinician peer groups within the peer network that should exhibit the same and / or similar activity patterns. In some exemplary embodiments, the analysis engine 110 can identify one or more clinician peer groups in the peer network 300 that share sufficiently similar attributes so that clinicians in the same peer group should also exhibit the same and / or similar activity patterns. For example, as noted, the analysis engine 110 can apply a machine learning model trained to identify one or more clinician peer groups present in, for example, the peer network 300. Alternatively and / or additionally, the analysis engine 110 can identify peer groups by applying alternative techniques (such as, for example, minimum cut, hierarchical clustering, Girvan-Newman, modularity maximization, group detection, etc.).

[0111] At 408, analysis engine 110 can determine whether the clinician shows abnormal behavior based on the activity pattern of other clinicians in the same peer group at least.For example, analysis engine 110 can be configured to determine whether the clinician shows abnormal behavior by comparing the activity pattern of the clinician with the activity pattern of other clinicians in the same peer group.In some exemplary embodiments, the activity pattern of the clinician can include a series of transaction records, which are generated when the clinician interacts with one or more data systems 120.In addition, the series of transaction records can be divided into, for example, corresponding to the schedule associated with the clinician in time.If the activity pattern of the clinician deviates from the activity pattern of other clinicians in the same peer group, then analysis engine 110 can determine that the clinician shows abnormal behavior.For example, analysis engine 110 can assign to the clinician a grade corresponding to the expected norm of the clinician peer group that the activity pattern of the clinician deviates from.If the grade of the clinician is higher or lower than a threshold value, then analysis engine 110 can determine that the clinician shows abnormal behavior.

[0112] At 410, the analysis engine 110 can respond to determining that the clinician exhibits abnormal behavior by triggering an investigation workflow at least at one or more data systems 120. For example, the investigation workflow can include the analysis engine 110 generating an alarm and sending it to the client 250 via the network 210. Alternatively and / or additionally, the investigation workflow can include the analysis engine 110 configuring one or more data systems 120 to activate one or more monitoring devices at the medical device approached by the clinician and / or isolate the medicine approached by the clinician. For example, the analysis engine 110 can configure the dispensing cabinet to activate one or more monitoring devices (e.g., video cameras, still image cameras, audio recorders, etc.) whenever the clinician approaches the dispensing cabinet to retrieve the medicine. Alternatively and / or additionally, the analysis engine 110 can configure the discard station to isolate the unused medicine disposed of by the clinician at the discard station. For example, instead of mixing a shared container of unused medicine disposed of by multiple clinicians, the discard station can be configured to provide a separate container to the clinician.

[0113] In some embodiments, triggering the survey workflow may include activating a sensor or other collection device within the clinician tracking system 100. The activation may include sending a control message to a device to configure the device to initiate the collection of information for the survey workflow, such as biometrics of the survey target, electronic medical records of patients interacting with or near the survey target, location information of the target during one or more shifts, peer clinician information (e.g., peer clinicians working with or adjacent to the target), etc. This may be particularly useful for collecting information without having to alert the survey target of the survey. If the survey target is made aware of the data collection, the survey target may change behavior or take further steps to avoid detection or compromise the integrity of the survey. These features provide a technical solution to ensure the efficiency and reliability of the survey workflow.

[0114] Figure 5 A block diagram illustrating a computing system 500 consistent with implementations of the current subject matter is depicted. Figure 1 and 2 , computing system 500 may be used to implement analysis engine 110 and / or any components thereof.

[0115] like Figure 5As shown in , the computing system 500 may include: a processor 510, a memory 520, a storage device 530, and an input / output device 540. The processor 510, the memory 520, the storage device 530, and the input / output device 540 may be connected via a system bus 550. The processor 510 is capable of processing specific instructions for execution within the computing system 500 to detect abnormal behavior based on the technology of the peer group and dynamically configure the device thereon. Such executed instructions may be implemented as one or more components of the analysis engine 110. In some exemplary embodiments, the processor 510 may be a single-threaded processor. Alternatively, the processor 510 may be a multi-threaded processor. The processor 510 is capable of processing instructions stored in the memory 520 and / or on the storage device 530 to display graphical information provided for the user interface via the input / output device 540.

[0116] Memory 520 is a computer-readable medium (e.g., volatile or non-volatile medium) that stores information within computing system 500. For example, memory 520 can store a data structure representing a configuration object database. Storage device 530 can provide permanent storage for computing system 500. Storage device 530 can be a floppy disk device, a hard disk device, an optical disk device, a magnetic tape device, a solid-state device, and / or any other suitable permanent storage device. Input / output device 540 provides input / output operations for computing system 500. In some exemplary embodiments, input / output device 540 includes a keyboard and / or a pointing device. In various embodiments, input / output device 540 includes a display unit for displaying a graphical user interface.

[0117] According to some exemplary embodiments, the input / output device 540 can provide input / output operations for the network device. For example, the input / output device 540 can include an Ethernet port or other networking port to communicate with one or more wired and / or wireless networks (e.g., a local area network (LAN), a wide area network (WAN), the Internet).

[0118] In some exemplary embodiments, the computing system 500 can be used to execute various interactive computer software applications that can be used to organize, analyze, and / or store data in various formats. Alternatively, the computing system 500 can be used to execute specific peer group anomaly detection software applications. These applications can be used to perform clinician tracking systems (e.g., Figure 1The application may include various functions within the application (such as shown in FIG. 5 ), such as planning functions (e.g., generating, managing, editing spreadsheet documents, word processing documents, and / or any other objects, etc.), computing functions, communication functions, etc. The application may include various plug-in functions, or may be an independent computing product and / or function. When activated within the application, the function may be used to generate a user interface provided via the input / output device 540. The user interface may be generated by the computing system 500 and presented to the user (e.g., on a computer screen monitor, etc.).

[0119] One or more aspects or features of the subject matter described herein can be implemented in digital electronic circuits, integrated circuits, specially designed ASICs, field programmable gate arrays (FPGAs) computer hardware, firmware, software, and / or combinations thereof. These various aspects or features can include implementation in one or more computer programs, which can be executed and / or interpreted on a programmable system, which includes at least one specially configured dedicated or general programmable processor, which is connected to receive data and specific instructions from a storage system, at least one input device, and at least one output device and send data and instructions thereto. A programmable system or computing system may include one or more clients and / or servers. Clients and servers are usually far away from each other, and usually interact via a communication network. The relationship between a client and a server is generated by a computer program that runs on a corresponding computer and has a client-server relationship with each other.

[0120] These specific computer programs (which may also be referred to as programs, software, software applications, applications, components or codes) include machine instructions for programmable processors and may be implemented in high-level procedural and / or object-oriented programming languages ​​and / or in assembly / machine languages. As used herein, the term "machine-readable medium" refers to any computer program product, device and / or device for providing machine instructions and / or data to a programmable processor, such as, for example, a disk, an optical disk, a memory and a programmable logic device (PLD), including a machine-readable medium that receives machine instructions as machine-readable signals. The term "machine-readable signal" refers to any signal for providing machine instructions and / or data to a programmable processor. A machine-readable medium may store such machine instructions in a non-volatile manner, such as, for example, a non-volatile solid-state memory or a magnetic hard drive or any equivalent storage medium. A machine-readable medium may alternatively or additionally store such machine instructions in a volatile manner, such as, for example, a processor cache or other random access memory associated with one or more physical processor cores.

[0121] To provide interaction with a user, one or more aspects or features of the subject matter described herein may be implemented on a computer having a display device (such as, for example, a cathode ray tube (CRT) or a liquid crystal display (LCD) or a light emitting diode (LED) monitor for displaying information to a user) and a keyboard and pointing device (such as, for example, a mouse or trackball, through which a user can provide input to the computer). Other types of devices may also be used to provide interaction with a user. For example, the feedback provided to the user may be any form of sensory feedback, such as, for example, visual feedback, auditory feedback, or tactile feedback, and the input from the user may be received in any form, including sound, voice, or tactile input. Other possible input devices include touch screens or other touch-sensitive devices, such as single-point or multi-point resistive or capacitive trackpads, voice recognition hardware and software, optical scanners, optical pointers, digital image capture devices and associated interpretation software, and the like.

[0122] In the above description and claims, phrases such as "at least one of ..." or "one or more of ..." may appear before a continuous list of elements or features. The term "and / or" may also appear in a list of two or more elements or features. Unless implicitly or obviously contradictory to the context in which it is used, such phrases are intended to represent any individually listed element or feature, or any of the elements or features combined with any other elements or features. For example, the phrases "at least one of A and B", "one or more of A and B" and "A and / or B" are intended to represent "only A, only B or A and B together" respectively. Similar explanations are also intended to be used for lists including three or more items. For example, the phrases "at least one of A, B and C", "one or more of A, B and C" and "A, B and / or C" are intended to represent "only A, only B, only C, A and B together, A and C together, B and C together or A and B and C together" respectively. The use of the term "based on" in the above and claims is intended to represent "based at least in part", so that unrecited features or elements are also allowed. The term "correspond / corresponds / corresponding" may include comparing at least two values, wherein the at least two values ​​match exactly, fuzzily, phonetically, within a predetermined tolerance (e.g., positive or negative), according to a predetermined relationship (e.g., based on a score generated by dynamically generated weights), or according to other metrics of comparing at least two values.

[0123] Depending on the desired configuration, the subject matter described herein may be embodied in systems, devices, methods and / or articles. The embodiments set forth in the foregoing description do not represent all embodiments consistent with the subject matter described herein. On the contrary, they are only some examples consistent with the aspects of the subject matter described. Although some variations have been described in detail above, other modifications or additions are also possible. In particular, in addition to those set forth herein, additional features and / or variations may also be provided. For example, the above-mentioned embodiments may relate to various combinations and sub-combinations of the disclosed features and / or combinations and sub-combinations of several additional features disclosed above. In addition, the logical flows depicted in the drawings and / or described herein do not necessarily require the specific order or sequential order shown to achieve the desired results. Other embodiments may be within the scope of the appended claims.

Claims

1. A peer-to-peer group-based abnormal behavior detection system, comprising: at least one data processor; as well as at least one memory storing instructions that, when executed by at least one data processor, result in operations including: identifying a first peer community in a peer-to-peer network by at least applying a machine learning model including a neural network trained to identify one or more peer communities present in the peer-to-peer network, the peer network including a plurality of clinicians, and the first peer community including a first clinician and a second clinician based at least on the first clinician and the second clinician from the plurality of clinicians sharing at least one common attribute; comparing a first activity pattern of a first clinician to a second activity pattern of a second clinician, wherein the first activity pattern and the second activity pattern are based on the first clinician and the second clinician interacting with a medical device to retrieve, administer, or dispose of a medication; determining that the first clinician exhibits abnormal behavior based at least on a comparison between a first pattern of activity of the first clinician and a second pattern of activity of the second clinician; and In the event that it is determined that the first clinician exhibits abnormal behavior, one or more monitoring devices are activated and / or medications accessed by the first clinician are quarantined in response to the first clinician interacting with the medical device.

2. The abnormal behavior detection system based on peer groups according to claim 1, wherein: The at least one common attribute includes one or more of the same patients treated by the first clinician and the second clinician.

3. The abnormal behavior detection system based on peer groups according to claim 1, wherein: The at least one common attribute includes one or more of the same medical device or multiple medical devices located in the same care area with which the first clinician and the second clinician interact.

4. The abnormal behavior detection system based on peer groups according to claim 1, wherein: The at least one common attribute includes one or more of: prescription order, clinician role, scheduling, supervisor, educational background, training, designated care area, medical protocol, and physical layout of the facility.

5. The abnormal behavior detection system based on peer groups according to claim 1, further comprising: The peer-to-peer network is generated, the peer-to-peer network including a first node corresponding to the first clinician and a second node corresponding to the second clinician, and the peer-to-peer network further includes an edge interconnecting the first node and the second node based at least on the first clinician and the second clinician sharing at least one common attribute.

6. The abnormal behavior detection system based on peer groups according to claim 5, wherein: A peer-to-peer network is generated based at least on a plurality of transaction records generated by the one or more data systems in response to the first clinician or the second clinician interacting with the one or more data systems.

7. The abnormal behavior detection system based on peer groups according to claim 6, wherein: The plurality of transaction records includes at least one transaction record generated in response to the first clinician interacting with a medical device to retrieve, administer, or dispose of a medication.

8. The abnormal behavior detection system based on peer groups according to claim 7, wherein: The at least one transaction record includes at least one of: a timestamp, a first identifier of a first clinician, a second identifier of a patient associated with the medication, a third identifier of the medication, a fourth identifier of the medical device, a location identifier of the medical device, or a quantity of the medication.

9. The abnormal behavior detection system based on peer groups according to claim 1, further comprising: In response to determining that the first clinician exhibits abnormal behavior, an alert is sent to the client indicating that the first clinician exhibits abnormal behavior.

10. The abnormal behavior detection system based on peer groups according to claim 1, wherein: The machine learning model further includes at least one of: minimum cut, hierarchical clustering, Girvan-Newman, modularity maximization, or clique detection.

11. The abnormal behavior detection system based on peer groups according to claim 5, wherein: The edge is associated with a weight corresponding to the number of common attributes shared between the first clinician and the second clinician.

12. The abnormal behavior detection system based on peer groups according to claim 1, wherein: The comparing includes assigning a grade to the first clinician corresponding to how much the first clinician's first activity pattern deviates from a norm of the first peer group, and wherein the first clinician is determined to exhibit abnormal behavior based at least on whether the grade assigned to the first clinician is above or below a threshold.

13. The abnormal behavior detection system based on peer groups according to claim 12, wherein: The norm comprises an expected norm determined based on at least a first activity pattern of a first clinician and a second activity pattern of a second clinician.

14. The abnormal behavior detection system based on peer groups according to claim 12, wherein: The norm includes a composite norm determined based on data other than the first activity pattern of the first clinician and / or the second activity pattern of the second clinician.

15. The abnormal behavior detection system based on peer groups according to claim 1, further comprising: By applying at least the machine learning to identify a second peer community present in the peer network, the comparison to determine whether the first clinician exhibits abnormal behavior excludes a third activity pattern of a third clinician included in the second peer community.

16. A computer-implemented method for detecting abnormal behavior based on a peer group, comprising: identifying a first peer community in a peer-to-peer network by at least applying a machine learning model including a neural network trained to identify one or more peer communities present in the peer-to-peer network, the peer network including a plurality of clinicians, and the first peer community including a first clinician and a second clinician based at least on the first clinician and the second clinician from the plurality of clinicians sharing at least one common attribute; as well as comparing a first activity pattern of a first clinician to a second activity pattern of a second clinician, wherein the first activity pattern and the second activity pattern are based on the first clinician and the second clinician interacting with a medical device to retrieve, administer, or dispose of a medication; determining that the first clinician exhibits abnormal behavior based at least on a comparison between a first activity pattern of the first clinician and a second activity pattern of the second clinician; and In the event that it is determined that the first clinician exhibits abnormal behavior, one or more monitoring devices are activated and / or medications accessed by the first clinician are quarantined in response to the first clinician interacting with the medical device.

17. The computer-implemented method for peer-to-peer community based abnormal behavior detection according to claim 16, wherein: The at least one common attribute includes one or more of the same patients treated by the first clinician and the second clinician.

18. The computer-implemented method for peer-to-peer community based abnormal behavior detection of claim 16, wherein: The at least one common attribute includes one or more of the same medical device with which the first clinician and the second clinician interact or a plurality of medical devices located in the same care area.

19. The computer-implemented method for peer-to-peer community based abnormal behavior detection of claim 16, wherein: The at least one common attribute includes one or more of: prescription order, clinician role, scheduling, supervisor, educational background, training, designated care area, medical protocol, and physical layout of the facility.

20. The computer-implemented method of peer-to-peer community based abnormal behavior detection of claim 16, further comprising: A peer-to-peer network is generated, the peer-to-peer network including a first node corresponding to the first clinician and a second node corresponding to the second clinician, and the peer-to-peer network further including an edge interconnecting the first node and the second node based at least on the first clinician and the second clinician sharing at least one common attribute.

21. The computer-implemented method for peer-to-peer community based abnormal behavior detection of claim 20, wherein: A peer-to-peer network is generated based at least on a plurality of transaction records generated by the one or more data systems in response to the first clinician or the second clinician interacting with the one or more data systems.

22. The computer-implemented method for peer-to-peer community based abnormal behavior detection of claim 21, wherein: The plurality of transaction records includes at least one transaction record generated in response to a first clinician interacting with a medical device to retrieve, administer, or dispose of a medication.

23. The computer-implemented method for peer-to-peer community based abnormal behavior detection of claim 22, wherein: The at least one transaction record includes at least one of: a timestamp, a first identifier of a first clinician, a second identifier of a patient associated with the medication, a third identifier of the medication, a fourth identifier of the medical device, a location identifier of the medical device, or a quantity of the medication.

24. The computer-implemented method for peer-to-peer community based abnormal behavior detection of claim 16, wherein: Also includes: In response to determining that the first clinician exhibits abnormal behavior, an alert is sent to the client indicating that the first clinician exhibits abnormal behavior.

25. The computer-implemented method for peer-to-peer community based anomalous behavior detection according to claim 16, wherein: The machine learning model further includes at least one of: minimum cut, hierarchical clustering, Girvan-Newman, modularity maximization, or clique detection.

26. The computer-implemented method for peer-to-peer community based abnormal behavior detection of claim 20, wherein: The edge is associated with a weight corresponding to the number of common attributes shared between the first clinician and the second clinician.

27. The computer-implemented method for peer-to-peer community based abnormal behavior detection of claim 16, wherein: The comparing includes assigning a grade to the first clinician corresponding to how much the first clinician's first activity pattern deviates from a norm of the first peer group, and wherein the first clinician is determined to exhibit abnormal behavior based at least on whether the grade assigned to the first clinician is above or below a threshold.

28. The computer-implemented method for peer-to-peer community based anomalous behavior detection according to claim 27, wherein: The norm comprises an expected norm determined based on at least a first activity pattern of a first clinician and a second activity pattern of a second clinician.

29. The computer-implemented method for peer-to-peer community based abnormal behavior detection of claim 27, wherein: The norm includes a composite norm determined based on data other than the first activity pattern of the first clinician and / or the second activity pattern of the second clinician.

30. The computer-implemented method for peer-to-peer community based abnormal behavior detection of claim 16, further comprising: By applying at least machine learning to identify a second peer community present in the peer-to-peer network, the comparison to determine whether the first clinician exhibits abnormal behavior excludes a third activity pattern of a third clinician included in the second peer community.

31. A non-transitory computer readable medium storing instructions that, when executed by at least one data processor, result in operations comprising: identifying a first peer community in a peer-to-peer network by at least applying a machine learning model including a neural network trained to identify one or more peer communities present in the peer-to-peer network, the peer network including a plurality of clinicians, and the first peer community including a first clinician and a second clinician based at least on the first clinician and the second clinician from the plurality of clinicians sharing at least one common attribute; as well as comparing a first activity pattern of a first clinician to a second activity pattern of a second clinician; determining that the first clinician exhibits abnormal behavior based at least on a comparison between a first activity pattern of the first clinician and a second activity pattern of the second clinician, wherein the first activity pattern and the second activity pattern are based on the first clinician and the second clinician interacting with a medical device to retrieve, administer, or dispose of medication; In the event that it is determined that the first clinician exhibits abnormal behavior, one or more monitoring devices are activated and / or medications accessed by the first clinician are quarantined in response to the first clinician interacting with the medical device.

32. An abnormal behavior detection device based on a peer group, comprising: means for identifying a first peer community in a peer-to-peer network by at least applying a machine learning model including a neural network trained to identify one or more peer communities present in the peer-to-peer network, the peer-to-peer network including a plurality of clinicians, and the first peer community including a first clinician and a second clinician based at least on the first clinician and the second clinician from the plurality of clinicians sharing at least one common attribute; as well as means for comparing a first activity pattern of a first clinician to a second activity pattern of a second clinician, wherein the first activity pattern and the second activity pattern are based on the first clinician and the second clinician interacting with a medical device to retrieve, administer, or dispose of a medication; means for determining that the first clinician exhibits abnormal behavior based at least on a comparison between a first activity pattern of the first clinician and a second activity pattern of the second clinician; Means for activating one or more monitoring devices and / or isolating medications accessible to the first clinician in response to the first clinician interacting with the medical device if it is determined that the first clinician exhibits abnormal behavior.

33. A computer-implemented apparatus for peer-to-peer community-based abnormal behavior detection, comprising: at least one data processor; as well as at least one memory storing instructions that, when executed by at least one data processor, result in operations including: receiving an indication that a first clinician is identified as exhibiting abnormal behavior, the first clinician being part of a peer group in a peer network including a plurality of clinicians, the peer group being identified by at least applying a machine learning model including a neural network trained to identify one or more peer groups present in the peer network, and the first clinician being identified as exhibiting abnormal behavior based at least on a comparison between a first activity pattern of the first clinician and a second activity pattern of a second clinician in the peer group, wherein the first activity pattern and the second activity pattern are based on the first clinician and the second clinician interacting with a medical device to retrieve, administer, or dispose of a medication; as well as In response to the indication, an investigative workflow is initiated, the investigative workflow comprising activating one or more monitoring devices in response to the first clinician interacting with the device and / or isolating a medication accessed by the first clinician.

34. The computer-implemented apparatus for peer-to-peer community based anomalous behavior detection according to claim 33, wherein: The device includes an infusion pump or an automatic medication dispensing device.

Images