Embedded maintenance and authentication of medical devices

Abstract

The present disclosure describes a medical device for assessing a health status of a patient. The medical device includes firmware including maintenance software for maintaining one or more sensor modules and clinical software for obtaining one or more physiological parameter measurements from a patient, the maintenance software including an embedded Web server. And the medical device establishes communication connection between the server and the client with the Web browser on the client equipment. And the medical device is in communication connection with the client through the server to provide access to the maintenance software on the Web browser. Access to maintenance software can be provided without loading the maintenance software onto a client device.

Description

[0001] Related Applications

[0002] This application is a PCT international patent application filed on June 29, 2023, claiming the rights and priority of the U.S. Provisional Patent Application with application number US 63 / 367,501, filed on July 1, 2022, and the U.S. Non-Provisional Patent Application with application number US18 / 341,005, filed on June 26, 2023, the disclosures of which are incorporated herein by reference in their entirety. Background Art

[0003] In clinical care settings, caregivers often use various types of healthcare equipment to provide healthcare services to patients. Healthcare equipment may include multifunctional medical devices that perform more than one function during patient assessment. Such multifunctional medical devices are often used in clinical care settings to measure one or more physiological parameters from a single patient or multiple patients. In addition, such multifunctional medical devices typically include various types of sensor modules and peripheral components to measure one or more physiological parameters.

[0004] These types of medical devices require regular maintenance. For example, sensors, probes, and other peripheral components connected to multifunctional medical devices have a defined lifespan before they need to be replaced. Likewise, the software and firmware running on the medical device also needs to be updated regularly. Summary of the invention

[0005] In summary, the present disclosure relates to a medical device including embedded maintenance. In one possible configuration, the technical effect achieved by the medical device is to provide access to the maintenance software on a web browser of a client device without loading the maintenance software on the client device. In another possible configuration, the technical effect achieved by the medical device is to determine the accessibility level of the maintenance software based on a signed certificate for a user holding a verification device. Various aspects described in the present disclosure include, but are not limited to, the following aspects.

[0006] One aspect relates to a medical device for assessing a patient's health status, the medical device comprising: one or more sensor modules, each sensor module being configured to obtain one or more physiological parameter measurements from a patient; at least one processing device; and a memory device storing: firmware comprising maintenance software for maintaining the one or more sensor modules and clinical software for obtaining one or more physiological parameter measurements from a patient, the maintenance software comprising an embedded Web server; and instructions which, when executed by the at least one processing device, cause the at least one processing device to: establish a server-client communication connection with a Web browser on a client device; provide access to the maintenance software on the Web browser through the server-client communication connection, and provide access to the maintenance software without loading the maintenance software onto the client device.

[0007] On the other hand, a medical device for assessing a patient's health status is provided, the medical device comprising: at least one processing device; and a memory device storing instructions, which instructions, when executed by the at least one processing device, cause the at least one processing device to: receive a password assigned to an authentication device; receive a signature certificate stored on a verification device, the signature certificate being created by a certificate authority; verify the signature certificate by using a public key stored on the memory device; determine an accessibility level based on the signature certificate; establish a server-client communication connection between an embedded Web server installed on the medical device and a Web browser installed on a client device; and provide access to maintenance software installed on the medical device on the Web browser through the server-client communication connection, the accessibility level determining the access level to the maintenance software on the Web browser.

[0008] Yet another aspect relates to a method for verifying a medical device maintenance user, the method comprising: activating an authentication device; receiving a signature certificate stored on the verification device; verifying the signature certificate by using a public key; when verifying the signature certificate, determining an accessibility level for the user based on the signature certificate; establishing a server-client communication connection between an embedded Web server installed on the medical device and a Web browser installed on a client device; providing access to maintenance software installed on the medical device on the Web browser through the server-client communication connection, the accessibility level determining an access level to the maintenance software on the Web browser. BRIEF DESCRIPTION OF THE DRAWINGS

[0009] The following drawings constitute part of this application, illustrate the technology described herein, and are not intended to limit the scope of protection of the present invention in any form.

[0010] Figure 1 An example of a system for collecting physiological parameter measurements from a patient in a clinical care setting is schematically shown.

[0011] Figure 2 Shows Figure 1 Examples of medical devices in the illustrated system.

[0012] Figure 3 Schematic diagram showing the maintenance Figure 2 An example of a kit of medical devices is shown.

[0013] Figure 4 Schematically shows Figure 2 An example of device firmware installed on a medical device is shown.

[0014] Figure 5 Schematic diagram showing maintenance Figure 2 Examples of methods of medical devices are shown.

[0015] Figure 6 Schematic diagram showing the configuration of the authentication device for maintenance Figure 2 Examples of methods of medical devices are shown.

[0016] Figure 7 Schematically shows Figure 6 An example of an authentication device after the method shown is completed.

[0017] Figure 8 Schematically shows a method for providing Figure 2 An example of a public key infrastructure hierarchy for access maintenance software installed on a medical device is shown.

[0018] Fig. 9 Schematic diagram showing the verification Figure 2 An example of a method of maintaining a user of a medical device is shown.

[0019] Fig.10 Schematically shows Figure 2 Examples of medical devices shown. DETAILED DESCRIPTION

[0020] Figure 1 An example of a system 100 for collecting physiological parameter measurements from a patient in a clinical care setting 10 is schematically shown. The clinical care setting may include, for example, a healthcare facility, such as a hospital, a surgical center, a nursing home, a long-term care facility, or a similar type of facility. Figure 1 As shown, the system 100 includes an Electronic Medical Record (EMR) system 102 , an interface system 104 , medical devices 106A- 106N, and a network 108 .

[0021] The network 108 is a communication network that facilitates data communication between the medical devices 106A-106N and between the medical devices 106A-106N and the interface system 104. The network 108 may include a group of computing devices and links between the computing devices. The computing devices in the network 108 use links to enable data communication between the computing devices in the network. The network 108 may include routers, switches, mobile access points, bridges, hubs, intrusion detection devices, storage devices, independent server devices, blade server devices, sensors, desktop computers, firewall devices, notebook computers, tablet computers, handheld computers, smart phones, and other types of computing devices. In various embodiments, the network 108 includes various types of links. For example, the network 108 may include wired links and / or wireless links. In certain embodiments, the network 108 is implemented in various scales. For example, the network 108 may be implemented as one or more local area networks (LANs), metropolitan area networks, subnets, wide area networks (such as the Internet), or may be implemented in other scales.

[0022] The EMR system 102 is a computing system that allows for the storage, retrieval, and manipulation of electronic medical records. As used herein, a computing system is a system of one or more computing devices. A computing device is a tangible physical device that processes data. Examples of types of computing devices include personal computers, stand-alone server computers, blade server computers, mainframe computers, notebook computers, tablet computers, handheld computers, smart phones, and other types of electronic devices that process data.

[0023] Each medical device 106 is a computing device. The medical device 106 may provide various types of functions. For example, the medical device 106 may include a physiological parameter monitoring platform or a field monitor, such as Figure 2 In these examples, a physiological parameter monitoring platform or field monitor may be used by a clinician to measure and / or monitor physiological parameters of multiple patients and display representations of the measured physiological parameters.

[0024] In other examples, the medical device 106 may include any type of physical assessment device, such as, but not limited to, an ophthalmoscope, an otoscope, a dermatoscope, a vision screener, etc. The medical device 106 may further include other types of devices capable of measuring physiological parameters, such as a hospital bed. The medical devices 106 may communicate with each other via the network 108.

[0025] The interface system 104 is a computing system that acts as an interface between the EMR system 102 and the medical device 106. In some embodiments, the interface system 104 includes a computer system manufactured by Hillrom, Inc. of Batesville, Indiana. Vital Signs Management Software.

[0026] By way of example, the interface system 104 provides a single software interface for each medical device 106, such that the medical device can send a request to the software interface provided by the interface system 104. When the interface system 104 receives a request from one of the medical devices 106, the interface system 104 translates the request into a request that works with the software interface provided by the EMR system 102. The interface system 104 then provides the translated request to the EMR system 102. When the interface system 104 receives a response from the EMR system 102, the interface system 104 translates the response into a format that the medical device 106 can interpret, and then forwards the translated response to the appropriate medical device 106. In this way, the interface system 104 allows the use of medical devices 106 in various types of EMR systems.

[0027] The medical device 106 may send various types of data to the interface system 104 for storage in the EMR system 102, and may receive various types of data from the EMR system 102 through the interface system 104. For example, the medical device 106 may send physiological parameter measurements and clinical observations to the interface system 104 for storage in the EMR system 102. In other examples, the medical device 106 may retrieve past physiological parameter measurements, clinical observations, laboratory results, scan results, and other patient health information from the EMR system 102 through the interface system 104.

[0028] Figure 2 An example of a medical device 106 of the system 100 is shown. In this embodiment, the medical device 106 is a physiological parameter monitoring platform or a field monitor. The medical device 106 may include one or more sensor modules. Each sensor module is configured to measure one or more physiological parameters of a patient.

[0029] Figure 2 In the illustrative example shown, the medical device 106 includes a body temperature sensor module 212 accessible from the front of the device, and a photoplethysmography (PPG) sensor module 214 and a non-invasive blood pressure measurement (NIBP) sensor module 216 accessible from the left side of the device. As used herein, a "module" is a combination of a physical structure located inside the medical device 106 and a peripheral component attached to the outside of the medical device 106. The medical device 106 may include additional sensor modules for receiving additional physiological parameter measurements, including ECG or EKG measurements.

[0030] The temperature sensor module 212 is designed to receive a patient's temperature measurement. By way of example, the temperature sensor module 212 includes a front panel 212a, the outer surface of which is accessible from the front of the medical device 106. The front panel 212a provides access to a wall (not shown) that stores a removable probe (not shown), also known as a temperature probe, attached to a probe handle 212b. The temperature probe and the probe handle 212b are tethered to the temperature sensor module 212 by an insulated wire 212c. The temperature probe is configured to make physical contact with the patient to sense the patient's temperature.

[0031] The photoplethysmogram sensor module 214 can be used to measure blood oxygen saturation and pulse. In addition, the photoplethysmogram sensor module 214 can be used to measure respiration rate based on changes in the photoplethysmographic waveform. The photoplethysmogram sensor module 214 includes a front panel 214a, and its connector port 214b enables a pulse oximeter (not shown) to establish a connection with the photoplethysmogram sensor module 214 located inside the medical device 106. The pulse oximeter is located externally and is configured to interoperate with the photoplethysmogram sensor module 214 when connected to the photoplethysmogram sensor module 214 via the connector port 214b. The pulse oximeter may include a clamp attached to a patient's appendage (such as a finger). The clamp includes an infrared light emitter and a sensor that detects and measures blood oxygen saturation and pulse rate based on infrared light transmission through the patient's appendage.

[0032] The NIBP sensor module 216 can be used to measure the patient's blood pressure. The NIBP sensor module 216 includes a front panel 216a, and its connector port 216b enables one or more peripheral NIBP components to establish a connection with the NIBP sensor module 216 located inside the medical device 106. The peripheral NIBP components are located outside and are configured to interoperate with the NIBP sensor module 216 when connected to the NIBP sensor module 216 via the connector port 216b. The peripheral NIBP components may include an inflatable cuff attached to the patient's appendage (such as an upper arm). The inflatable cuff is used to measure the patient's systolic and diastolic blood pressure, the patient's mean arterial pressure (MAP), and the patient's blood flow pulse rate.

[0033] like Figure 2As shown, the front of the medical device 106 includes a display screen 218. In this example, the display screen 218 is a built-in display. The display screen 218 can display graphical representations of physiological parameter measurements received from various sensor modules of the medical device 106 (including the body temperature sensor module 212, the photoplethysmography sensor module 214, and the NIBP sensor module 216). The display screen 218 can also display graphical representations of additional physiological parameter measurements and clinical observations from other sources, such as from other medical devices and EMR systems 102 connected via the network 108. In some examples, the display screen 218 is a touch screen that receives manual input from a user of the medical device 106. In addition, the medical device 106 may include one or more handles 220 on its housing to enable the user to hand-carry the medical device 106.

[0034] The medical device 106 can operate in one or more workflows. A workflow is a series of one or more tasks performed by a user of the medical device 106. When the medical device 106 operates in a workflow, the medical device 106 provides functions suitable for assisting the user (e.g., a caregiver) in performing the workflow. When the medical device 106 operates in different workflows, the medical device 106 provides different functions.

[0035] During the manufacture of the medical device 106, the medical device 106 is configured to operate in one or more predefined workflows. After the manufacture of the medical device 106 is complete, the medical device 106 can be reconfigured to operate in one or more additional and / or custom workflows. In this way, the clinical care environment 10 (e.g., a hospital) can adjust the medical device 106 as needed for use in a custom workflow.

[0036] For example, the medical device 106 can operate in a monitoring workflow or a non-monitoring workflow. The monitoring workflow may include continuous monitoring of physiological parameters of a single patient. Types of non-monitoring workflows include, for example, spot check workflows and / or triage workflows.

[0037] When the medical device 106 operates in a monitoring workflow, the medical device 106 acquires a series of measurements of one or more physiological parameters (e.g., temperature, SpO2, blood pressure, EKG, etc.) of a single patient over a period of time. In addition, the medical device 106 displays a monitoring workflow home screen on the display screen 218. The monitoring workflow home screen may include representations of the physiological parameters measured from the patient being monitored.

[0038] By way of example, when the medical device 106 is operating in the monitoring workflow, the medical device 106 may obtain blood pressure measurements of a single patient every ten minutes for six hours. The medical device 106 may display a monitoring workflow home screen on the display screen 218 to display a representation of the blood pressure measurements taken from the patient. In this way, the medical device 106 allows a user (e.g., a caregiver in a medical facility) to monitor the health status of the patient.

[0039] When the medical device 106 is operated in a non-monitoring workflow, the medical device 106 obtains measurements of one or more physiological parameters from a previously identified series of patients. As used herein, a patient is a previously identified patient when the medical device 106 stores information about the identity of the patient. The medical device 106 may display a non-monitoring workflow home screen on the display screen 218 to display representations of physiological parameters measured from previously identified patients in a series of patients. In this way, the medical device 106 allows a user (e.g., a caregiver in a medical institution) to check the health status of multiple patients.

[0040] In another example, when the medical device 106 is operating in a triage workflow, the medical device 106 can obtain measurements of physiological parameters from each patient in a series of unidentified patients, such as when the patient arrives at a hospital emergency department. In this example, the medical device 106 displays a triage workflow home screen to display representations of physiological parameters measured from previously unidentified patients. In this way, the medical device 106 can triage unidentified patients as they arrive. As used herein, a patient is an unidentified patient when the medical device 106 does not store information about the patient's identity.

[0041] The monitoring workflow main screen may differ from the non-monitoring workflow main screen in various ways. For example, the monitoring workflow main screen may include at least one user-selectable control that is not included in the non-monitoring workflow main screen, and / or the non-monitoring workflow main screen may include at least one user-selectable control that is not included in the monitoring workflow main screen. As another example, different navigation options may be provided in different workflows to enable more efficient navigation in their respective workflows based on their specific functions and / or requirements. The present disclosure also contemplates other examples of differences between the monitoring workflow main screen and the non-monitoring workflow main screen.

[0042] Figure 3 Schematically illustrated is an example of a kit 300 for maintaining a medical device 106. Illustrative examples of maintenance that may be provided on a medical device 106 may include, but are not limited to, calibration (including generation of a signed calibration certificate), functional verification testing, accuracy checks, component reporting, log file display and download, debugging, factory reset, and / or retirement, etc.

[0043] The kit 300 includes a client device 302, which may include any type of networked device that allows secure Internet communication protocols such as Hypertext Transfer Protocol Secure (HTTPS). Illustrative examples of the client device 302 may include, but are not limited to, laptop computers, tablet computers, smart phones, and other computing devices.

[0044] The medical device 106 includes an embedded Web server 304. In some exemplary embodiments, the embedded Web server 304 is stored on a storage device of the medical device 106. In some examples, the medical device 106 is manufactured as a unified deliverable with the embedded Web server 304 installed, and then delivered to a customer, such as an operator of the clinical care environment 10. Fig.10 Examples of various types of storage devices on the medical device 106 are described in detail.

[0045] Figure 3 In the illustrated example, the kit 300 also includes a cable 310 having a first connector 312 and a second connector 314. In the illustrated example, the medical device 106 includes a first port 308 for receiving the first connector 312 of the cable 310, and the client device 302 includes a second port 316 for receiving the second connector 314 of the cable 310 to provide a physical connection for a server-client communication connection between an embedded web server 304 installed on the medical device 106 and a web browser 306, which can be viewed on a display screen 318 of the client device 302. In the illustrated example, the cable 310 is a universal serial bus (USB) cable, and the first port 308 and the second port 316 are USB ports. The first port 308 and the second port 316 may include, but are not limited to, USB-A, USB-C, Lightning, and other types of connector ports. The cable 310 may provide an Ethernet or similar type of connection between the medical device 106 and the client device 302 for Internet Protocol (IP) communication between the medical device 106 and the client device 302.

[0046] In some examples, the medical device 106 and the client device 302 are wirelessly connected to each other to provide a server-client communication connection between an embedded web server 304 installed on the medical device 106 and a web browser 306 viewable on a display screen 318 of the client device 302. The wireless connection can be used for IP communication between the medical device 106 and the client device 302. Illustrative examples of wireless connections between the medical device 106 and the client device 302 may include, but are not limited to, Wi-Fi, Bluetooth, wireless local area network (WLAN) links, ZigBee, ultra-wideband (UWB), and other wireless technologies.

[0047] The embedded web server 304 installed on the medical device 106 establishes a server-client communication connection with the web browser 306 installed on the client device 302 to facilitate maintenance of the medical device 106. For example, the medical device 106 can send real-time status and telemetry data to the web browser 306, and the web browser 306 can display a user interface on the display screen 318 for the user to view to drive the calibration workflow. The medical device 106 can perform and report all maintenance operations through the embedded web server 304 backend code without loading dedicated software on the client device 302. This eliminates the need to maintain and update dedicated software on the client device 302.

[0048] Figure 3 In the illustrated example, the client device 302 is a notebook computer that includes input devices such as a keyboard 320 and a touchpad 322 that allow a user of the client device 302 (e.g., a biomedical device technician) to operate a maintenance software application installed on the medical device 106 via the server-client communication connection. In some cases, the input devices of the client device 302 allow a user of the client device 302 (e.g., a biomedical device technician) to control one or more sensor modules on the medical device 106 via the server-client communication connection.

[0049] The server-client communication connection allows the client device 302 to maintain the medical device 106 without requiring separate maintenance software to be installed on the client device 302. In this way, maintaining the medical device 106 eliminates the need to install maintenance software on the client device 302 that must be created and maintained separately from the maintenance software application installed on the medical device 106. This is particularly advantageous given that maintaining a separate maintenance software application on the client device 302 may require careful management of firmware versions that are compatible with the device.

[0050] The embedded web server 304 need not load any maintenance software onto the client device 302 for maintaining the medical device 106. Instead, the web browser 306 may be any type of web browser that supports a programming language (e.g., JavaScript) that allows connection to the embedded web server 304 on the medical device 106. Thus, the web browser 306 allows a user of the client device 302 to access the maintenance software application installed on the medical device 106 without requiring any dedicated maintenance software application to be installed on the client device 302. Examples of the web browser 306 may include, but are not limited to, Google Chrome, Microsoft Edge, Firefox, Safari, IE, and other types of browsers that support server-client communication connections.

[0051] In some examples, the server-client communication connection includes a physical connection (e.g., via a cable 310) between the medical device 106 and the client device 302. In other examples, the server-client communication connection includes a wireless connection between the medical device 106 and the client device 302, such as via Wi-Fi, Bluetooth, WLAN, ZigBee, UWB, and other wireless communication protocols.

[0052] like Figure 3 As shown, the kit 300 may also include an authentication device 330 for authenticating a user of the client device 302, such as a biomedical equipment technician authorized to maintain the medical device 106. In some examples, the authentication device 330 may be plugged into a third port 332 on the client device 302 to authenticate the user of the client device. In some examples, the third port 332 is a USB-A, USB-C, Lightning, or other type of connector port. In alternative examples, the authentication device 330 may be plugged into a second port 316 on the client device 302 to authenticate the user of the client device. In other alternative examples, the authentication device 330 may be plugged into a first port 308 of the medical device 106 to authenticate the user of the client device. In other examples, the authentication device 330 may be connected to the client device 302 or the medical device 106 via a wireless interface such as near field communication (NFC) or other similar types of proximity technologies that are recognizable by the medical device 106 and / or the client device 302. The following is in conjunction with Figures 6 to 9 The authentication device 330 will be described in detail.

[0053] Figure 4 The schematic diagram shows an example of device firmware 400 installed on the medical device 106. The device firmware 400 includes maintenance software 402 for maintaining one or more sensor modules on the medical device 106 and clinical software 404 for evaluating the health status of one or more patients monitored by the medical device 106.

[0054] like Figure 4 As shown, maintenance software 402 is separated from clinical software 404. In this illustration, maintenance software 402 is separated from clinical software 404 by a barrier 410. In some examples, barrier 410 is a firewall.

[0055] One or more client devices 302 (i.e., any type of networked device, including laptops, tablet computers, smart phones, and other computing devices) can access the maintenance software 402. According to the above example, the client device 302 can access the maintenance software 402 through a server-client communication connection established by an embedded Web server 304 installed on the medical device 106 (see Figure 3 ).

[0056] like Figure 4 As shown, the client device 302 is prevented and / or blocked from accessing the clinical software 404. By preventing access to the clinical software 404, one or more client devices 302 are prevented from accessing medical data on the medical device 106. For example, the one or more client devices 302 cannot receive medical data, such as protected health information, including information collected by the clinical care environment 10 regarding health status (e.g., physiological parameter measurements, clinical observations, test results, etc.), healthcare provision or healthcare payment, and can be linked to a specific individual, such as a patient monitored by the medical device 106.

[0057] The maintenance software 402 may include the embedded web server 304 and one or more maintenance software applications 406 for maintaining the medical device 106. For example, the maintenance software 402 may include: a calibration application 406a for calibrating one or more sensor modules of the medical device 106; a component status application 406b for checking the status of one or more peripheral components of the medical device 106; a logging application 406c for displaying and downloading log files; and other types of maintenance software applications 406n for performing various maintenance functions on the medical device 106. The maintenance software applications 406 do not obtain or include protected health information.

[0058] like Figure 4As shown, the clinical software 404 may include one or more applications 408 for performing various functions related to assessing the health status of a patient. For example, the clinical software 404 may include: a physiological parameter application 408a for receiving and displaying a graphical representation of physiological parameter measurements received from peripheral components and sensors connected to the medical device 106; a historical physiological parameter application 408b for receiving and displaying historical physiological parameter measurements such as from the EMR system 102; a patient information application 408c for receiving and / or displaying patient information such as patient name, date of birth, patient medical record number, etc.; and other types of patient assessment applications 408n. In this example, one or more applications 408 in the clinical software 404 may include protected health information belonging to one or more patients.

[0059] Figure 5 An example of a method 500 for performing maintenance on a medical device 106 is schematically shown. In some exemplary embodiments, the method 500 may be performed by an embedded web server 304 installed on the medical device 106.

[0060] The method 500 includes an operation 502 of establishing a server-client communication connection with a web browser 306 installed on a client device 302. In some examples, the server-client communication connection is established through a physical connection, such as by plugging a first connector 312 of a cable 310 into a first port 308 of a medical device 106 and plugging a second connector 314 of the cable 310 into a second port 316 of the client device 302. In these examples, once the physical connection between the medical device 106 and the client device 302 is established, the embedded web server 304 can recognize and / or identify the client device 302, and then the embedded web server 304 establishes a server-client communication connection with the web browser 306 on the client device 302.

[0061] In other examples, the server-client communication connection is established through a wireless connection, such as through Wi-Fi, Bluetooth, WLAN, ZigBee, UWB, and other wireless communication protocols. In these examples, the embedded Web server 304 can wirelessly identify and / or recognize the client device 302, and thereafter the embedded Web server 304 can send a request to the client device 302 to establish a server-client communication connection with the Web browser 306 on the client device 302. Operation 502 does not include loading any special software onto the client device 302 to maintain the medical device 106.

[0062] The method 500 includes an operation 504 of providing access to one or more maintenance software applications 406 installed on the medical device 106 on the web browser 306. The one or more maintenance software applications 406 can be used to perform various maintenance functions on the medical device 106, such as, but not limited to, calibration of sensor modules, functional verification testing, accuracy checks, component reporting, log file display and download, debugging, factory reset and / or retirement, etc. In operation 504, the embedded web server 304 can provide two-way communication between the client device 302 and the maintenance software 402 installed on the medical device 106 without loading any dedicated maintenance software onto the client device 302.

[0063] The method 500 also includes an operation 506 of blocking or preventing the web browser 306 from accessing the clinical software 404 installed on the medical device 106. As described above, the clinical software 404 includes one or more applications 408 that may contain protected health information. Operation 506 prevents the client device 302 from obtaining the protected health information, whether intentionally or unintentionally. In some examples, operation 506 is performed by isolating the maintenance software 402 from the clinical software 404, so that the embedded web server 304 cannot provide the web browser 306 with access to one or more applications 408 of the clinical software 404.

[0064] like Figure 4 As shown, one or more client devices 302 can access the maintenance software 402 through a server-client communication connection established by an embedded Web server 304 installed on the medical device 106 to view one or more maintenance software applications 406 on a Web browser 306. As described in detail below, the medical device 106 includes the following features: restricting access to the maintenance software 402 stored on the medical device 106 to protect the security of the medical device 106 from malicious users and to protect the confidentiality of protected health information on the medical device 106.

[0065] In other cases, the medical device 106 may not be connected to a local area network (LAN), such as the network 108 (see Figure 1 ). In these instances, the medical device 106 cannot use a standard authentication server to authenticate a user requesting access to the maintenance software 402 on the medical device. As described in detail below, features included on the medical device 106 enable the medical device 106 to identify, authenticate, and authorize a user of the client device 302, regardless of whether the medical device 106 is connected to a network, to ensure that only authorized personnel can access the maintenance software application 406 to maintain the medical device 106.

[0066] As used herein, identifying includes identifying a user requesting access to one or more maintenance software applications 406 installed on the medical device 106. In some examples, the medical device 106 identifies the user requesting access to the maintenance software 402 and monitors the user's actions after identifying the user.

[0067] As used herein, authentication includes determining that an identified user is who they claim to be. Best practices indicate that storing a simple password is not sufficient to authenticate a user given current security threats such as phishing attacks.

[0068] As used herein, authorization includes determining which functions and maintenance a verified user is allowed to perform, which may be restricted based on geographic location, training level, and other qualifications. Authorization may include associating a particular user with a set of permitted actions based on the user's credentials. For example, a manufacturer of medical devices 106 may authorize a representative to maintain all medical devices 106, or may authorize a representative to maintain only certain medical devices 106 based on a particular geographic region. As another example, a healthcare services organization (HDO) may authorize a biomedical equipment technician to maintain medical devices 106 used in a particular healthcare institution or medical devices 106 used in a particular department or floor within the institution. As another example, a manufacturer of medical devices 106 may only authorize a biomedical equipment technician to maintain a medical device 106 after the technician has completed appropriate training or otherwise holds sufficient credentials.

[0069] As described above, kit 300 (see Figure 3 ) may include an authentication device 330 for identifying, authenticating and authorizing a user of the client device 302 to maintain the medical device 106. Figure 6 An example of a method 600 for configuring the authentication device 330 to maintain the medical device 106 is shown. In some examples, the method 600 is performed by the manufacturer of the medical device 106 to ensure that only authorized personnel are allowed to access the maintenance software application 406. In some examples, the method 600 follows a public key infrastructure (PKI) process.

[0070] Method 600 includes operation 602, registering a public key with a certificate authority. The certificate authority stores, signs, and issues signed certificates. In some examples, the certificate authority is based on a hierarchy (e.g., Figure 8 The public key verifies the signed certificate issued by the certificate authority to verify the user. In some examples, the manufacturer of the medical device 106 manages the certificate authority.

[0071] Next, the method 600 includes an operation 604 of storing the public key on the medical device 106. The public key may be stored on a memory device 1004 and / or a mass storage device 1012 installed on the medical device 106, such as Fig.10shown.

[0072] Next, the method 600 includes an operation 606 of loading the signing certificate onto the authentication device 330. Figure 3 As shown, the authentication device 330 is similar to a flash drive (also known as a thumb drive), which is a data storage device that includes a memory (such as flash memory) with an integrated connection interface. The memory of the authentication device 330 is rewritable, so that the authentication device 330 can be updated to store a new signing certificate. The authentication device 330 is a portable device that can be removably plugged into one or more ports on the medical device 106 and / or the client device 302.

[0073] Next, method 600 includes operation 608 of assigning a password to authentication device 330. The password is configured to unlock authentication device 330 for identification by medical device 106. In some examples, the manufacturer of medical device 106 creates an initial password and assigns it to authentication device 330, and after delivery of authentication device 330, the user can change the password.

[0074] Figure 7 An example of an authentication device 330 after method 600 is completed is schematically shown. The authentication device 330 stores a signature certificate 702 and a password 704. The authentication device 330 also includes an integrated connection interface 706. In some examples, the integrated connection interface 706 includes a plug interface, such as a USB-A, USB-C, Lightning, or other type of physical interface. In some examples, the integrated connection interface 706 includes a wireless interface that can be recognized by the medical device 106 and / or the client device 302, such as near field communication (NFC).

[0075] Figure 8 An example of a public key infrastructure (PKI) hierarchy 800 for providing access to a maintenance software application 406 installed on a medical device 106 is schematically shown. The hierarchy 800 is an illustrative example and is provided for reference only. Figure 8 As shown, a Certificate Authority (CA) 802 may issue signed certificates to various entities and individuals to maintain the medical device 106. As described above, the CA 802 may be managed by the manufacturer of the medical device 106.

[0076] In this illustrative example, CA 802 issues a first type of signature certificate 820 to maintenance engineering department 804, a second type of signature certificate 822 to maintenance personnel department 806, and a third type of signature certificate 824 to software test and debug department 808. Maintenance engineering department 804, maintenance personnel department 806, and software test and debug department 808 may all be departments within the manufacturer of medical device 106. Maintenance engineering department 804, maintenance personnel department 806, and software test and debug department 808 may distribute their respective signature certificates to their respective members, such as maintenance engineer SE, maintenance personnel SP, and test engineer TE.

[0077] In this illustrative example, the maintenance staff department 806 issues a second type of signing certificate 822 to one or more customers such as the first healthcare organization 810a and the second healthcare organization 810b. As shown, the first healthcare organization 810a and the second healthcare organization 810b can each issue a second type of signing certificate 822 to one or more of their employees (such as a biomedical equipment technician BT).

[0078] Each of the different classes of signing certificates can provide different levels of access to the embedded web server 304, the maintenance software 402, and the maintenance software application 406 based on the user credentials. In other examples, the signing certificate can define a date range within which the signing certificate is valid and beyond which the signing certificate expires. In this way, it can be verified that the signing certificate is still valid and / or authorized by the CA 802. When the signing certificate is stored on the verification device 330, it allows the medical device to identify, authenticate, and authorize various users without requiring a network connection (such as the Internet).

[0079] By way of example, the first type of signature certificate 820 and the second type of signature certificate 822 provide maintenance engineers SE and biomedical equipment technicians BT with access to a set of standard maintenance software applications 406 to maintain the medical device 106, while the third type of signature certificate 824 provides a higher level of access for test engineers TE. For example, the higher level of access may allow the test engineer TE to test and debug the device firmware 400, while not allowing the maintenance engineer SE and the biomedical equipment technician BT to test and debug the device firmware 400. It is also possible to exemplify how the signature certificates provide different levels of access to the device firmware 400.

[0080] Fig. 9An example of a method 900 for verifying a maintenance user of a medical device 106 is schematically shown. In some examples, the method 900 is performed by the medical device 106. In some examples, after the method 900 is performed, a server-client communication connection is established between the embedded Web server 304 installed on the medical device 106 and the Web browser 306 on the client device 302. Accordingly, the medical device 106 can execute the method 900 so that after verifying the user of the client device 302, the user can operate the client device 302 to maintain the medical device 106. In other examples, when the medical device 106 is not connected to a network, the method 900 can be executed to identify, verify and authorize the user in order to maintain the medical device 106.

[0081] The method 900 includes an operation 902 of prompting a user (e.g., one of a maintenance engineer SE, a maintenance person SP, or a test engineer TE) to enter a password to start a maintenance software application 406 on a medical device 106. The user can access the maintenance software application 406 through an advanced setting on the medical device 106. When the user opens the maintenance software application 406, the maintenance software application 406 prompts the user to enter a password. In an example where the display screen 218 is a touch screen, a prompt is displayed on the display screen 218, and the user can enter a password by using the display screen 218. In an alternative example, the user can enter a password by using one or more input devices on the client device 302. In some examples, the maintenance software applications 406 included in the maintenance software 402 share the same password. In other examples, the maintenance software applications 406 can each have a unique password.

[0082] Next, the method 900 includes an operation 904 to determine whether the password received in the operation 902 is correct. When the password is incorrect (i.e., "No" in the operation 904), the method 900 may return to the operation 902 and request the user to re-enter the password. When the password is correct (i.e., "Yes" in the operation 904), the method 900 proceeds to the operation 906 to activate the verification device 330.

[0083] In some examples, operation 906 includes activating a port (e.g., first port 308) on the medical device into which the authentication device 330 is inserted to activate the authentication device 330. In other examples, operation 906 includes detecting a wireless signal from the authentication device 330, such as a near field communication (NFC) signal, to detect the presence of the authentication device 330 and then activating the authentication device 330. In other examples, operation 906 may require the user to touch a portion 334 on the authentication device 330 (see Figure 3 ) to determine that the authentication device 330 is held by a human operator, and then activate the authentication device 330.

[0084] In other examples, the medical device 106 may detect when the authentication device 330 is removed from a port of the medical device 106 or is no longer in proximity to the medical device 106, such that the medical device 106 no longer receives wireless signals from the authentication device 330. When the medical device 106 detects that the authentication device 330 is removed or no longer in proximity, the method 900 may immediately deny access to the maintenance software application 406 on the client device 302 (see operation 918), which may occur at any time during the method 900 or when the user of the client device is authorized to access the maintenance software application 406 after the method 900 is completed.

[0085] Next, the method 900 includes an operation 908 of prompting the user to enter the password 704 associated with the authentication device 330. In an example where the display screen 218 is a touch screen, a prompt is displayed on the display screen 218, and the user can enter the password 704 by using the display screen 218. In an alternative example, the user can enter the password 704 by using one or more input devices on the client device 302. As described above, each authentication device 330 can have a unique password.

[0086] Next, the method 900 includes an operation 910 to determine whether the password received in operation 908 matches the password 704 stored on the authentication device 330. When the password does not match the password 704 stored on the authentication device 330 (i.e., "No" in operation 910), the method 900 may return to operation 908 and request the user to re-enter the password of the authentication device 330. When the passwords match (i.e., "Yes" in operation 910), the method 900 proceeds to operation 912 to obtain the signature certificate 702 stored on the authentication device 330.

[0087] Next, the method 900 includes an operation 914 to verify whether the signed certificate 702 stored on the authentication device 330 is valid. For example, the operation 914 may include using a public key stored on the medical device 106 to verify the signed certificate 702. When it is determined that the signed certificate 702 is valid (i.e., "yes" in operation 914), the method 900 proceeds to operation 916 to determine the accessibility level of the user. Otherwise, when it is determined that the signed certificate 702 is invalid due to revocation, expiration, etc. (i.e., "no" in operation 914), the method 900 proceeds to operation 918 to deny the user access to the maintenance software application 406 on the medical device 106.

[0088] Operation 916 may include determining the accessibility level of the user using the signed certificate 702 stored on the authentication device 330. As described above, the accessibility level of the user may be based on a hierarchy (e.g., Figure 8Different types of signing certificates are issued to different personnel (for example, the illustrated hierarchy). Therefore, the medical device 106 can use the signing certificate 702 to determine the user's accessibility level based on credentials such as the user's position and / or role, training level, etc. In other examples, the accessibility level can also be limited based on the geographic location of the clinical care environment 10 or the location of the medical device 106 in the clinical care environment.

[0089] In other examples, the signing certificate 702 may define a date range during which the signing certificate 702 is valid and after which the signing certificate 702 expires. This can verify that the signing certificate 702 is still authorized by the CA 802. In these examples, the medical device 106 can maintain a local real-time clock (RTC) that can be used to verify the validity of the signing certificate 702. In some examples, the medical device 106 can be configured to manage time so that a malicious user cannot roll back the RTC to protect the integrity of the expiration date set for the signing certificate 702. In addition, revoking the user's authorization to access the maintenance software application 406 can be accomplished by maintaining a certificate revocation list, which can include tracking the expiration date of the signing certificate 702.

[0090] Next, the method 900 includes an operation 920 to determine whether the user's accessibility level is appropriate for the maintenance software application 406. When the user's accessibility level indicates that the user possesses appropriate credentials and / or qualifications (i.e., "yes" in operation 920), the method 900 proceeds to operation 922 to grant access to the maintenance software application 406. Otherwise, when the user's accessibility level indicates that the user lacks appropriate credentials or qualifications to access the maintenance software application 406 (i.e., "no" in operation 920), the method 900 proceeds to operation 918 to deny access to the maintenance software application 406.

[0091] By way of example, the maintenance software application 406 may include a software test and debug application that is accessible only to the test engineer TE. In these examples, the test engineer TE is provided with a verification device 330, which includes a signed certificate 702 issued by a certificate authority (CA) 802, allowing the test engineer TE to access the software test and debug application. The maintenance engineer SE, the service personnel SP, and the biomedical equipment technician, as well as other personnel with the authentication device 330, hold a signed certificate 702 that does not allow access to the software test and debug application. The present disclosure contemplates other examples of restricting access to the maintenance software application 406 based on the signed certificate 702 issued by the CA 802.

[0092] In view of the above, method 900 provides multiple layers of security: (1) requiring the user to know the password to maintenance software application 406; (2) requiring the user to possess authentication device 330; (3) requiring the user to know the password to authentication device 330; (4) requiring authentication device 330 to have a valid signing certificate; (5) requiring the valid signing certificate on authentication device 330 to have an appropriate level of accessibility to maintenance software application 406. Additional layers of security may also be provided.

[0093] Other advantages of method 900 include that the medical device 106 can be maintained offline, and the user who maintains the medical device 106 can be authenticated without connecting to an authentication server. Instead, the medical device 106 is loaded with an engineering access public certificate. In some examples, the medical device 106 is loaded with an additional locally maintained healthcare service organization (HDO) certificate. The authentication device 330 stores a signature certificate that identifies the user holding the authentication device 330. The user can use the authentication device 330 an unlimited number of times until the signature certificate expires or is replaced. This allows the medical device 106 to verify the user offline without the medical device 106 being connected to a verification server. In addition, the signature certificate stored on the verification device 330 is too large to be manually entered. For example, the minimum key size of the signature certificate is 2048 bits. This further improves the security of verifying the user because the size of the signature certificate makes it difficult to forge.

[0094] Fig.10 Schematically illustrates an example of a medical device 106 that can be used to implement various aspects of the present disclosure. Fig.10 As shown, the medical device 106 includes one or more processing devices 1002, a memory device 1004, and a system bus 1006 that couples the memory device 1004 to the one or more processing devices 1002. The one or more processing devices 1002 may include a central processing unit (CPU). The processing power and speed of the processing device 1002 allow the medical device 106 to perform maintenance functions on its own without requiring a separate external device (e.g., client device 302) to perform maintenance functions, such as maintenance software application 406, which may require a large amount of computing power.

[0095] like Fig.10 As shown, the memory device 1004 may include a random access memory ("RAM") 1008 and a read only memory ("ROM") 1010. The ROM 1010 may store therein basic input and output logic having basic routines that facilitate the transfer of information between elements within the medical device 106 (e.g., during startup).

[0096] The medical device 106 may also include a mass storage device 1012, which may include an operating system 1014 and store software instructions 1016 and data. The mass storage device 1012 is connected to the processing device 1002 via a system bus 1006. The mass storage device 1012 and its associated computer-readable data storage media provide non-volatile, non-transitory storage for the medical device 106.

[0097] Although the computer-readable data storage medium described herein refers to the mass storage device 1012, it should be understood by those skilled in the art that the computer-readable data storage medium can be any available non-transitory physical device or article from which the medical device 106 can read data and / or instructions. The computer-readable storage medium can be entirely composed of non-transitory media. The mass storage device 1012 is an example of a computer-readable storage device.

[0098] Computer-readable data storage media include volatile and nonvolatile, removable and non-removable media implemented in any method or technology for storing information such as computer-readable software instructions, data structures, program modules or other data. Example types of computer-readable data storage media include, but are not limited to, RAM, ROM, EPROM, EEPROM, flash memory or other solid-state storage technology, or any other medium that can be used to store information and be accessible to a device.

[0099] The medical device 106 operates in a network environment using logical connections to other medical devices 106 and other electronic devices through the network 108. The medical device 106 accesses the network 108 through a network interface unit 1018 connected to the system bus 1006. The network interface unit 1018 can also connect to other types of communication networks and devices, including through Bluetooth, Wi-Fi, and cellular telecommunication networks (including 4G and 5G networks). The network interface unit 1018 can also connect the medical device 106 to other networks, systems, and devices, such as the EMR system 102, digital health gateways, and other clinical resource centers.

[0100] The medical device 106 includes an input / output unit 1020 for receiving and processing input and output from a plurality of peripheral devices. Examples of peripheral devices may include, but are not limited to, temperature probes, blood pressure cuffs, ECG or EKG leads, clamps for measuring blood oxygen saturation and pulse, and other peripheral devices.

[0101] The mass storage device 1012 and the RAM 1008 may store software instructions and data. The software instructions may include an operating system 1014 suitable for controlling the operation of the medical device 106. The mass storage device 1012 and / or the RAM 1008 may also store software instructions 1016 that, when executed by the processing device 1002, cause the device to provide the functionality of the medical device 106 described herein.

[0102] The above embodiments are provided only in an illustrative manner and should not be interpreted as limiting in any way. Various modifications may be made to the above embodiments without departing from the true spirit and scope of protection of the present disclosure.

Claims

1. A medical device for evaluating a patient's health status, the medical device comprising: one or more sensor modules, each sensor module configured to obtain one or more physiological parameter measurements from a patient; at least one processing device; and A memory device storing: Firmware, including: Maintenance software for maintaining the one or more sensor modules, the maintenance software comprising an embedded Web server; and clinical software for obtaining said one or more physiological parameter measurements from said patient; and instructions, which when executed by the at least one processing device cause the at least one processing device to: Establishing a server-client communication connection with a web browser on a client device; Access to the maintenance software is provided on the Web browser through the communication connection between the server and the client, and access to the maintenance software is provided without loading the maintenance software onto the client device.

2. The medical device according to claim 1, wherein: The server is communicatively coupled to a client device to enable the client device to control the one or more sensor modules.

3. The medical device according to claim 1, wherein: The communication connection between the server and the client is established via the secure hypertext transfer protocol HTTPS.

4. The medical device according to claim 1, wherein: The maintenance software includes one or more maintenance software applications for calibration, functional verification testing, accuracy checks, component reporting, and log file display and downloading.

5. The medical device according to claim 1, wherein: Access to the clinical software is blocked on the web browser.

6. The medical device according to claim 5, wherein: Access to the clinical software is provided on a built-in display of the medical device.

7. The medical device according to claim 5, wherein: The clinical software includes protected health information from the patient.

8. The medical device according to claim 1, wherein: The instructions further cause the at least one processing device to: Communication is provided between the client device and the medical apparatus via an Internet protocol to facilitate real-time calibration of the one or more sensor modules.

9. The medical device according to claim 1, wherein: The server-client communication connection includes an Ethernet connection between the medical device and the client device.

10. The medical device according to claim 1, wherein: The server-client communication connection is a wireless connection between the medical device and the client device.

11. The medical device according to claim 1, wherein: The instructions further cause the at least one processing device to: receiving a password assigned to the authentication device; receiving a signature certificate stored on the authentication device; verifying the signed certificate by using a public key stored on the memory device; and An accessibility level is determined based on the signing certificate, wherein the accessibility level determines a level of access to the maintenance software on the Web browser.

12. The medical device according to claim 11, further comprising: At least one port is used to insert the authentication device, wherein the medical device receives the signed certificate through the at least one port.

13. The medical device according to claim 11, wherein: The medical device receives the signed certificate from the authentication device via a wireless signal.

14. The medical device according to claim 11, wherein: The instructions further cause the at least one processing device to: When the authentication device is removed from the port of the medical device or moved away so that the authentication device is no longer proximate to the medical device, access to the maintenance software on the Web browser is blocked.

15. A medical device for assessing a patient's health status, the medical device comprising: at least one processing device; and A memory device storing instructions, which when executed by the at least one processing device causes the {HRMG-23003-CNPT / 02120944v1} -2- At least one processing device: receiving a password assigned to the authentication device; Receiving a signature certificate stored on the verification device, wherein the signature certificate is created by a certificate authority; verifying the signed certificate by using a public key stored on the memory device; determining an accessibility level based on the signed certificate; Establishing a server-client communication connection between an embedded Web server installed on the medical device and a Web browser installed on a client device; and The server is connected to the client in communication to provide access to the maintenance software installed on the medical device on the Web browser, and the accessibility level determines the access level of the maintenance software on the Web browser.

16. The medical device according to claim 15, further comprising: At least one port for inserting the authentication device, wherein the medical device receives the signed certificate from a connection within the at least one port.

17. The medical device according to claim 15, wherein: The medical device receives the signed certificate from the authentication device via a wireless signal.

18. The medical device according to claim 15, wherein: The instructions further cause the at least one processing device to: Access to the maintenance software on the web browser is blocked when the authentication device is removed from the port of the medical device or the authentication device is no longer in proximity to the medical device.

19. The medical device according to claim 15, wherein: The communication connection between the server and the client is established via the secure hypertext transfer protocol HTTPS.

20. A method for authenticating a medical device maintenance user, the method comprising: Activate the authentication device; Receiving the signature certificate stored on the verification device; Verifying the signed certificate by using a public key; and When verifying the signing certificate, determining an accessibility level for the user based on the signing certificate; Establishing a server-client communication connection between an embedded Web server installed on the medical device and a Web browser installed on a client device; and Access to maintenance software installed on the medical device is provided on the web browser through the server and client communication connection, wherein the accessibility level determines the access level of the maintenance software on the web browser.

21. The method according to claim 20, wherein: Activating the authentication device includes receiving a valid password assigned to the authentication device.

22. The method according to claim 20, wherein: The signed certificate stored on the authentication device is received from a port on the medical device.

23. The method according to claim 20, wherein: When the verification device is brought into proximity with the medical device, the signed certificate stored on the verification device is wirelessly received.

24. The method of claim 20, further comprising: Access to the maintenance software on the web browser is blocked when the authentication device is removed from the port of the medical device or the authentication device is no longer in proximity to the medical device.

25. The method according to claim 20, wherein: Access to the maintenance software on the Web browser is provided without loading the maintenance software onto the client device.

26. The method of claim 20, further comprising: Using the server to client communication connection allows the client device to control one or more sensor modules of the medical device.

27. The method according to claim 20, wherein: The communication connection between the server and the client is established via the secure hypertext transfer protocol HTTPS.

28. The method of claim 20, wherein: The maintenance software includes one or more maintenance software applications for calibration, functional verification testing, accuracy checks, component reporting, and log file display and downloading.

Images