Data security interaction platform based on third-party medical examination station
By introducing data encryption, access control, transmission security, and compliance management into the data exchange platform of third-party medical testing laboratories, the issues of privacy leakage, tampering, and compliance during the data exchange process have been resolved, achieving secure data storage, transmission, and compliant use.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-12-22
- Publication Date
- 2026-03-03
AI Technical Summary
In the process of data exchange between third-party medical testing laboratories, there are problems such as leakage of patient privacy, data tampering, loss, and difficulty in ensuring compliance. In particular, there is a lack of effective security and compliance protection in the transmission and use of data between different institutions.
A data security interaction platform based on a third-party medical testing laboratory was designed, including a data encryption module, an access control module, a data transmission security module, a data storage security module, and a compliance management module. It adopts asymmetric encryption algorithms, HTTPS protocol, distributed storage technology, and a compliance review mechanism to ensure data security and compliance.
Effectively prevent the leakage of sensitive data, ensure the integrity of data transmission and the reliability of storage, meet legal and ethical requirements, provide operational traceability and query basis, and ensure the security and compliance of data at all stages.
Smart Images
Figure CN121603293A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of medical data processing technology, and more specifically to a data security interaction platform based on a third-party medical testing laboratory. Background Technology
[0002] In the healthcare industry, third-party medical testing laboratories undertake a large volume of patient testing and screening. With the development of medical informatization, these laboratories generate massive amounts of testing data, including patient information, test results, and even human genetic information. This data is not only crucial for subsequent patient diagnosis and treatment but also holds immense value in medical research and disease control. However, numerous problems currently exist in the data exchange process among third-party medical testing laboratories.
[0003] On the one hand, patient personal information and genetic information involve personal privacy and ethical issues. Leakage of such information can cause significant harm to patients and trigger ethical controversies. For example, the leakage of genetic information may lead to discrimination against patients in employment and insurance. On the other hand, ordinary testing data also needs to ensure its accuracy, integrity, and security to prevent tampering, loss, or illegal acquisition. Moreover, in practice, third-party medical testing laboratories often need to interact with multiple parties, including medical institutions and research institutions, making it difficult to effectively guarantee data security and compliance. For example, inconsistent data formats and transmission protocols between different institutions can easily lead to data leakage risks; the lack of effective supervision and security protection mechanisms for data analyzed with the assistance of third-party testing laboratories results in numerous security risks during data transmission, storage, and use.
[0004] Therefore, proposing a data security interaction platform based on a third-party medical testing laboratory to solve the difficulties of existing technologies is a problem that urgently needs to be solved by those skilled in the art. Summary of the Invention
[0005] In view of this, the present invention provides a data security interaction platform based on a third-party medical testing laboratory to solve the security and compliance issues existing in the data interaction process of third-party medical testing laboratories in the prior art, and to ensure the secure storage, transmission and use of patient data.
[0006] To achieve the above objectives, the present invention provides the following technical solution: A data security interaction platform based on a third-party medical testing laboratory includes, in sequence, a data encryption module, an access control module, a data transmission security module, a data storage security module, and a compliance management module; wherein, The data encryption module is used to encrypt patient data during the interaction process; The access control module is used to manage user permissions when accessing the platform. The data transmission security module is used to ensure the security of patient data during transmission; The data storage security module is used to ensure the security of patient data during the storage process; The compliance management module is used to manage the compliance of patient data usage.
[0007] Optionally, patient data includes sensitive data and routine testing data; sensitive data is encrypted using an asymmetric encryption algorithm, while routine testing data is encrypted using a symmetric encryption algorithm. Sensitive data includes patient personal information and human genetic information.
[0008] Optionally, the encryption process of the asymmetric encryption algorithm is as follows: a third-party medical testing laboratory generates a key pair, the public key is provided to the external institution for encrypting sensitive data and then uploading it, and the private key is kept by the third-party medical testing laboratory for decryption.
[0009] Optionally, the access control module establishes a user permission management system to grant different levels of data access permissions based on the type and needs of external organizations.
[0010] Optionally, the user access management system can be configured with different data access roles, each with different data access permissions.
[0011] Optionally, the data transmission security module uses the HTTPS protocol for data transmission and uses a hash algorithm to verify the integrity of the data during transmission.
[0012] Optionally, the data storage security module uses distributed storage technology to store data and performs multiple backups of the data.
[0013] Optionally, the compliance management module establishes a data usage compliance review mechanism to conduct compliance reviews of the user's purpose and method of use when data is provided to third parties.
[0014] As can be seen from the above technical solution, compared with the prior art, the present invention discloses a data security interaction platform based on a third-party medical testing laboratory, the beneficial effects of which are: 1) By using an asymmetric encryption algorithm for sensitive data and a symmetric encryption algorithm for ordinary test data through the data encryption module, it is possible to effectively prevent sensitive data such as patient personal information and genetic information, as well as ordinary test data, from being illegally obtained during the interaction process, thus ensuring the confidentiality of the data; 2) The data transmission security module uses the HTTPS protocol combined with a hash algorithm for integrity verification to ensure that the data is not tampered with during transmission, thus guaranteeing data integrity and transmission security; 3) The data storage security module adopts distributed storage technology and performs multiple backups, with the copies located in different physical locations, which not only improves the reliability of data storage but also reduces the risk of data loss; 4) The compliance management module establishes a data usage compliance review mechanism and a regular audit system, which can ensure that the use of data complies with relevant laws, regulations and ethical requirements, avoid legal and ethical issues caused by improper use of data, and at the same time, the recording of operation logs facilitates the traceability of the data interaction process and provides a basis for querying potential problems. Attached Figure Description
[0015] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.
[0016] Figure 1 This invention provides a structural diagram of a data security interaction platform based on a third-party medical testing laboratory. Detailed Implementation
[0017] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.
[0018] See Figure 1 As shown, this invention discloses a data security interaction platform based on a third-party medical testing laboratory, comprising a data encryption module, an access control module, a data transmission security module, a data storage security module, and a compliance management module connected in sequence; wherein, The data encryption module is used to encrypt patient data during the interaction process; The access control module is used to manage user permissions when accessing the platform. The data transmission security module is used to ensure the security of patient data during transmission; The data storage security module is used to ensure the security of patient data during the storage process; The compliance management module is used to manage the compliance of patient data usage.
[0019] Furthermore, patient data includes sensitive data and routine testing data; sensitive data is encrypted using an asymmetric encryption algorithm, while routine testing data is encrypted using a symmetric encryption algorithm. Sensitive data includes patient personal information and human genetic information.
[0020] Furthermore, the encryption process of the asymmetric encryption algorithm is as follows: a third-party medical testing laboratory generates a key pair, the public key is provided to the external institution for encrypting sensitive data and then uploading it, and the private key is kept by the third-party medical testing laboratory for decryption.
[0021] The encryption process of the symmetric encryption algorithm is as follows: the third-party medical testing laboratory and the external institution negotiate in advance and share the same symmetric key; when encrypting data, the data encryption module uses the symmetric key to encrypt ordinary test data; when decrypting data, the recipient uses the same symmetric key to decrypt the encrypted ordinary test data.
[0022] Furthermore, the access control module establishes a user permission management system, granting different levels of data access permissions based on the type and needs of external organizations.
[0023] Specifically, for medical institutions, the access control module grants the right to view the test results of patients within the institution; for research institutions, after obtaining patient authorization and ethical approval, limited access to specific datasets is granted, and the right is only used for specific research projects.
[0024] Furthermore, the user access management system sets up different data access roles, with each role corresponding to different data access permissions.
[0025] Furthermore, the data transmission security module uses the HTTPS protocol for data transmission and employs a hash algorithm to verify data integrity during transmission.
[0026] Specifically, the integrity verification process is as follows: the sending end uses a hash algorithm to calculate the hash value of the data, the receiving end calculates the hash value of the received data and compares it with the hash value of the sending end. If they do not match, the receiving end rejects the data.
[0027] The specific steps for integrity verification using hash algorithms include: Data preprocessing: The sending end standardizes the patient data to be transmitted, removes redundant format information, and ensures that the data format is consistent; Hash value generation: The sending end inputs the preprocessed patient data into a preset hash algorithm (such as SHA-256) to generate a fixed-length hash value; Hash value appending: The sending end encapsulates the generated hash value along with the corresponding patient data and transmits it to the receiving end via the HTTPS protocol; Receiver verification: The receiver separates the patient data and hash value from the transmitted data, performs the same preprocessing and hash algorithm calculation on the patient data as the sender, and obtains a new hash value; Consistency comparison: The receiving end compares the newly generated hash value with the transmitted hash value bit by bit. If they are completely consistent, the data is considered complete; otherwise, the data is considered to have been tampered with or corrupted during transmission.
[0028] Furthermore, the data storage security module uses distributed storage technology to store data and performs multiple backups of the data.
[0029] The data storage security module provides physical security protection for storage devices, including setting access permissions and installing monitoring equipment.
[0030] Specifically, the process of storing data using distributed storage technology includes: Data Sharding: The data storage security module divides the received patient data into multiple data shards according to preset rules, and each shard contains a portion of the patient data; Node allocation: The hash value of each data shard is calculated using a hash algorithm, and the data shards are allocated to different storage nodes in the distributed storage cluster based on the hash value; Replica Placement: A preset number of replicas are generated for each data shard, and the replicas are assigned to other storage nodes that are different from the storage nodes where the data shards are located, with the nodes where the different replicas are located in different physical locations; Data Index: Establish an index that maps data shards to storage nodes, and record the storage location information of each data shard and its replicas; Data reading: When data needs to be read, the storage node storing the data shard is located based on the data index. Data is read from the node with the fastest response time first. If the node fails, data is read from the node where its replica is located.
[0031] Furthermore, the compliance management module establishes a data usage compliance review mechanism, which reviews the user's purpose and method of use when data is provided to third parties.
[0032] Specifically, when a research institution applies to use data, the compliance management module reviews the submitted research project plan and ethics approval documents, and authorizes data access after the review is approved.
[0033] In a specific embodiment: This embodiment uses the interaction of patient test data between a medical institution and a third-party medical testing laboratory as an example to detail the specific implementation process of a data security interaction platform based on a third-party medical testing laboratory. The medical institution needs to send the patient's blood sample test data to the third-party medical testing laboratory for further analysis. After completing the analysis, the third-party medical testing laboratory returns the results to the medical institution. The entire process involves the secure interaction of sensitive data such as patient personal information and genetic information, as well as ordinary test data.
[0034] Specific implementation steps
[0035] 1. Preliminary preparation stage
[0036] Key Generation and Sharing: The third-party medical testing laboratory generates a pair of asymmetric keys (public key PK and private key SK) through the data encryption module and provides the public key PK to the medical institution. Simultaneously, the third-party medical testing laboratory and the medical institution negotiate and share a symmetric key K through a secure offline channel, which is used for the encryption and decryption of routine test data.
[0037] User permission configuration: The access control module configures user permissions for relevant personnel in the medical institution. Doctors are granted permission to view patient test results within the institution, and nurses are granted permission to assist in uploading patient sample information; nurses, however, do not have permission to view detailed test result data.
[0038] 2. Data upload stage (from medical institution to third-party medical testing laboratory)
[0039] Data collection and classification: Nurses in medical institutions upload patient data through the platform, including sensitive data such as patient name, ID number, and preliminary genetic testing data, as well as routine testing data such as blood sample test indicators.
[0040] Data encryption: The data encryption module uses the public key PK provided by a third-party medical testing institution to perform asymmetric encryption on sensitive data, generating encrypted sensitive data S_enc.
[0041] The data encryption module uses a symmetric key K to symmetrically encrypt ordinary detection data, generating encrypted ordinary data D_enc.
[0042] Hash value generation and appending: The data transmission security module preprocesses the encrypted sensitive data S_enc and ordinary data D_enc to remove redundant format information.
[0043] The hash value H of the preprocessed data is calculated using the SHA-256 hash algorithm, and H is then encapsulated together with S_enc and D_enc.
[0044] Data transmission: The packaged data is transmitted to a third-party medical testing laboratory via the HTTPS protocol.
[0045] 3. Data Reception and Storage Stage (Third-Party Medical Testing Laboratory)
[0046] Data integrity verification: The data transmission security module of the third-party medical testing laboratory receives the transmitted data and separates S_enc, D_enc, and hash value H. S_enc and D_enc undergo the same preprocessing as the sender, and a new hash value H' is calculated using the SHA-256 hash algorithm. H' is compared with H; if they match, the data is considered complete and accepted; otherwise, it is rejected and the medical institution is notified to retransmit.
[0047] Data decryption: The third-party medical testing laboratory uses the private key SK to decrypt S_enc to obtain the sensitive data S; since ordinary test data does not need to be viewed immediately, D_enc is not decrypted at this time.
[0048] Distributed storage: The data storage security module divides the sensitive data S and the encrypted ordinary data D_enc into multiple data fragments according to preset rules, such as dividing S into S1 and S2, and dividing D_enc into D1 and D2.
[0049] The hash value of each data shard is calculated using a hash algorithm. Based on the hash value, S1 and D1 are allocated to storage node A, and S2 and D2 are allocated to storage node B.
[0050] Two replicas are generated for each data shard. The replica S1' of S1 is assigned to storage node C, and the replica S2' of S2 is assigned to storage node D. The replica D1' of D1 is assigned to storage node E, and the replica D2' of D2 is assigned to storage node F. Nodes A, C, and E are located in different physical data centers, and nodes B, D, and F are located in different physical data centers.
[0051] Establish an index to map data shards to storage nodes, and record storage location information such as S1 in node A and S1' in node C.
[0052] Encrypted storage: The data storage security module encrypts each segment of sensitive data S before storing it, sets access permissions for the storage device, and only authorized administrators can physically access the storage device. Monitoring equipment is also installed to monitor the access status of the storage device in real time.
[0053] 4. Data processing and result return stage (from third-party medical testing laboratories to medical institutions)
[0054] Data Reading: After gaining access, personnel at a third-party medical testing laboratory need to read sensitive data S and ordinary data D_enc for analysis. The data storage security module locates storage nodes A and B based on the data index. It reads S1 and D1 from node A (which has a faster response time) and S2 and D2 from node B, combining them to obtain the complete S and D_enc. The symmetric key K is then used to decrypt D_enc to obtain the ordinary test data D.
[0055] Result Generation and Encryption: After completing the analysis, the testing personnel generate a test result report, which includes new routine test result data. The data encryption module uses a symmetric key K to encrypt the report, generating an encrypted report R_enc.
[0056] Hash value generation and transmission: The data transmission security module preprocesses R_enc, calculates the hash value H_r using the SHA-256 hash algorithm, encapsulates R_enc and H_r together, and transmits them to the medical institution via the HTTPS protocol.
[0057] 5. Results Receipt and Viewing Stage (Medical Institutions)
[0058] Data integrity verification: The data transmission security module of the medical institution receives R_enc and H_r, preprocesses R_enc and calculates the hash value H_r', compares it with H_r and if they match, the data is received.
[0059] Data decryption and viewing: Medical institutions use the symmetric key K to decrypt R_enc, obtaining the test result report R. Doctors can log in to the platform to view the report after authorization by the access control module; nurses, due to access restrictions, cannot view the report content.
[0060] 6. Compliance Management
[0061] Throughout the data interaction process, the compliance management module records data access, transmission, and usage operation logs, including information such as the time when nurses from medical institutions upload data and the time when personnel from third-party medical testing laboratories read data.
[0062] Regularly audit operation logs for compliance issues, checking for unauthorized access, abnormal data transmission, etc., to ensure that data interaction complies with relevant laws, regulations, and ethical requirements.
[0063] Through the above embodiments, the data security interaction platform based on third-party medical testing laboratories has enabled secure interaction of patient data between medical institutions and third-party medical testing laboratories, ensuring the security and compliance of data in all aspects such as encryption, transmission, storage, access and use.
[0064] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. The same or similar parts between the various embodiments can be referred to each other.
[0065] The above description of the disclosed embodiments enables those skilled in the art to make or use the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.
Claims
1. A data security interaction platform based on a third-party medical testing laboratory, characterized in that, This includes, in sequence, a data encryption module, an access control module, a data transmission security module, a data storage security module, and a compliance management module; among which, The data encryption module is used to encrypt patient data during the interaction process; The access control module is used to manage user permissions when accessing the platform. The data transmission security module is used to ensure the security of patient data during transmission; The data storage security module is used to ensure the security of patient data during the storage process; The compliance management module is used to manage the compliance of patient data usage.
2. The data security interaction platform based on a third-party medical testing laboratory as described in claim 1, characterized in that, Patient data includes sensitive data and routine testing data; sensitive data is encrypted using an asymmetric encryption algorithm, while routine testing data is encrypted using a symmetric encryption algorithm. Sensitive data includes patient personal information and human genetic information.
3. The data security interaction platform based on a third-party medical testing laboratory as described in claim 2, characterized in that, The encryption process of the asymmetric encryption algorithm is as follows: a third-party medical testing laboratory generates a key pair. The public key is provided to the external institution for encrypting sensitive data before uploading, and the private key is kept by the third-party medical testing laboratory for decryption.
4. The data security interaction platform based on a third-party medical testing laboratory as described in claim 1, characterized in that, The access control module establishes a user permission management system, granting different levels of data access permissions based on the type and needs of external organizations.
5. A data security interaction platform based on a third-party medical testing laboratory as described in claim 4, characterized in that, The user access management system sets up different data access roles, and each role corresponds to different data access permissions.
6. The data security interaction platform based on a third-party medical testing laboratory according to claim 1, characterized in that, The data transmission security module uses the HTTPS protocol for data transmission and employs a hash algorithm to verify data integrity during transmission.
7. The data security interaction platform based on a third-party medical testing laboratory according to claim 1, characterized in that, The data storage security module uses distributed storage technology to store data and performs multiple backups of the data.
8. A data security interaction platform based on a third-party medical testing laboratory as described in claim 1, characterized in that, The compliance management module establishes a data usage compliance review mechanism, which reviews the user's purpose and method of use when data is provided to third parties.