Medical data security partition operation platform

Abstract

The application belongs to the technical field of medical safety operation, and particularly relates to a medical data security partition operation platform, which adopts a framework of central unified control and multi-domain partition operation and comprises the following: a data asset classification and grading module, which is used for checking and classifying and grading full-amount medical data assets, and generating a global data asset directory; a four-level security partition unit, which sets four types of baseline partitions of a core sensitive data area, a business operation data area, a scientific research shared data area and a public open data area based on the data classification and grading results, and implements physical or logical isolation on medical data of different sensitive levels; the four-level security partition is matched through data classification and grading, full-encryption storage and minimum granularity access are realized on core sensitive data, and in combination with a default rejection strategy of a boundary gateway, attack horizontal diffusion is effectively blocked, and the risk of internal and external data leakage is fully prevented.

Description

Technical Field

[0001] This invention relates to the field of medical security operation technology, specifically a medical data security partitioning operation platform. Background Technology

[0002] With the deepening of digital transformation in healthcare, the demand for cross-institutional and cross-scenario data sharing continues to grow in areas such as medical alliance collaboration, hierarchical diagnosis and treatment, mutual recognition of test results, clinical research and innovation, and intelligent medical insurance supervision. However, traditional data sharing models have privacy risks, high compliance costs, and prominent data silos, making it difficult to effectively release the value of medical data.

[0003] Medical data encompasses highly sensitive information such as patient identity, medical records, and biometrics, falling under the key category of personal information protection and data security supervision. It is a high-risk target for data breaches and illegal sales. Currently, the healthcare industry generally suffers from unclear data asset inventories, fragmented storage, and weak perimeter protection.

[0004] Existing medical data security partitioning schemes mostly adopt static isolation architectures, which can only meet the protection needs of fixed business scenarios and cannot flexibly adapt to short-term scenarios such as temporary scientific research projects and public health emergencies. At the same time, they generally suffer from problems such as the lack of a closed loop for the protection of the entire data lifecycle, insufficient granularity of cross-partition access control, and the easy accumulation of temporary permissions and temporary data, making it difficult to achieve a balance between security protection and the release of data value. Summary of the Invention

[0005] The purpose of this invention is to provide a medical data security partitioning operation platform to solve the problems mentioned in the background art.

[0006] To achieve the above objectives, the present invention provides the following technical solution: a medical data security partitioning operation platform, adopting a central unified management and control plus multi-domain partitioning operation architecture, comprising:

[0007] The data asset classification and grading module is used to inventory, classify, and label all medical data assets, and generate a comprehensive data asset catalog.

[0008] The four-level security partition unit sets up four baseline partitions based on the data classification and grading results: core sensitive data area, business operation data area, scientific research shared data area, and public open data area, and implements physical or logical isolation for medical data of different sensitivity levels;

[0009] The partition boundary control gateway is deployed between various security partitions for mandatory authentication, traffic auditing, and behavior control of cross-partition access. It adopts a default denial policy, allowing only access paths authorized by the whitelist.

[0010] The full lifecycle protection module covers the entire process of data collection, storage, transmission, use, sharing, and destruction, constructing a closed-loop data security protection system.

[0011] Dynamic elastic data domain units are used to create independent and isolated elastic data domains for short-term business scenarios, and support automated management of the entire lifecycle of elastic domains; unified operation and control center is used to realize unified scheduling of access control, audit traceability and compliance management.

[0012] Preferably, the data asset classification and grading module covers three types of medical data: structured diagnosis and treatment data, unstructured medical records and image data, and operation and management data, and has a built-in medical data sensitivity identification rule library.

[0013] Preferably, the core sensitive data area is used to store electronic medical records, patient identity information, biometric information, and original test results. It is encrypted using national cryptographic algorithms and can only be accessed by authorized business systems through a dedicated channel at the smallest granularity. Direct export and external sharing are prohibited.

[0014] The business operation data area is used to store operation management data and general diagnosis and treatment business data to support the hospital's daily business operations; the scientific research shared data area is used to store medical datasets that have been de-identified and de-identified, and deploys data sandboxes and privacy computing engines to ensure that data does not leave the domain and is usable but not visible; the public open data area is used to store publicly available medical service information, health science popularization data and institutional publicity information, which is open to the public and has deployed boundary security protection equipment.

[0015] Preferably, the full lifecycle protection module includes:

[0016] The data collection unit is used to standardize the data collection interface, verify the legality of the data source, and perform identity authentication and traffic monitoring at the data collection entry point.

[0017] The storage unit is used to encrypt and store core data using the national cryptographic algorithm SM4. The key is managed by a dedicated cryptographic machine, and data backup and recovery drills are carried out regularly.

[0018] The transmission unit is used to ensure that data transmission across zones and organizations uses an encrypted channel throughout the entire process, and to prohibit the transmission of sensitive data in plaintext.

[0019] The unit is used to deploy dynamic data desensitization, screen watermarking, anti-screenshot and anti-copy technologies, automatically desensitize sensitive fields according to user permissions, and perform security control on the terminal access environment.

[0020] The shared unit provides three sharing modes: data anonymization and delivery, privacy computing, and data sandbox. All external data sharing is conducted through a unified exit and is subject to full auditing and traceability.

[0021] The destruction unit is used to establish a data destruction process, perform irreversible erasure or media destruction on expired or obsolete data, and retain destruction records.

[0022] Preferably, the dynamic elastic data domain unit has the ability to be launched on demand with one click. For temporary scientific research projects, public health emergencies, special medical insurance audits, and short-term scenarios of third-party cooperation, an independent elastic data domain can be created with one click and the corresponding permissions and security policies can be automatically synchronized.

[0023] Preferably, each elastic data domain comes with its own independent isolation environment, permission system, audit logs and lifecycle tags, supports preset validity period, and automatically performs data destruction, permission revocation and log archiving upon expiration, with zero manual intervention throughout the process.

[0024] Preferably, the elastic domain is completely isolated from the baseline partition and other elastic domains by default, and only the whitelisted data path is opened through the unified security bus, so the data flow is controllable throughout the process.

[0025] Preferably, the unified operation and control center establishes a fine-grained permission control system to achieve dynamic access control based on roles, scenarios, and data levels.

[0026] Preferably, the unified operation and control center achieves full coverage of data lifecycle operation audit, log retention time of not less than 180 days, response time for high-risk security incidents not exceeding 5 minutes, and security incident traceability rate of 100%; it has built-in compliance verification rules to meet the requirements of Level 3 network security protection and cryptographic application security assessment.

[0027] Preferably, when the platform is deployed to the regional health system, it is used to unify the data security standards and operating specifications of medical institutions within the jurisdiction, open up cross-institutional data security sharing channels, and support the implementation of regional public health information platforms, hierarchical diagnosis and treatment systems, and public health emergency command scenarios.

[0028] Compared with the prior art, the beneficial effects of the present invention are:

[0029] By classifying and grading data and matching it with four levels of security partitions, core sensitive data is fully encrypted and accessed with minimal granularity. Combined with the default denial policy of the border gateway, it effectively blocks the lateral spread of attacks and comprehensively prevents the risk of internal and external data leakage.

[0030] In the research sharing area, technologies such as de-identification processing, privacy computing, and data sandboxing are used to ensure that data is usable but not visible, supporting compliant data sharing in multiple scenarios such as clinical research, medical alliance collaboration, and medical insurance supervision.

[0031] Dynamic and elastic data domains can adapt to various short-term business scenarios with one click. Upon expiration, they automatically perform data destruction, permission revocation, and log archiving, with zero manual intervention throughout the process. This mechanism avoids the security risks of making temporary permissions permanent and temporary data accumulating.

[0032] The protection system covering the entire data lifecycle, combined with fine-grained access control and full audit traceability mechanism, can meet national and industry compliance requirements such as Level 3 cybersecurity protection and cryptographic application security assessment. The response time for high-risk security incidents can be shortened to less than 5 minutes.

[0033] When deployed to the regional health system, it can unify the data security standards and operating specifications of medical institutions within the jurisdiction, open up cross-institutional secure sharing channels, support the implementation of scenarios such as regional public health information platforms and public health emergency command, and comprehensively improve the efficiency of regional medical services and data governance capabilities. Attached Figure Description

[0034] Figure 1 This is a logic block diagram of the operating system of the present invention. Detailed Implementation

[0035] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0036] Example:

[0037] Please see Figure 1 The present invention provides the following technical solution:

[0038] This solution can be deployed for individual medical institutions or on a large scale for regional health systems. It constructs a data security governance system based on classification and grading, with regional isolation as the core and operation and service as the key, to achieve a balance between security protection and value release.

[0039] Data asset classification and grading module:

[0040] After the platform goes live, it will first conduct a full inventory of data assets, automatically scanning various data storage nodes within the organization, covering three core data asset categories:

[0041] Structured medical data: including medical orders, prescriptions, structured results of laboratory tests and examinations, and billing records;

[0042] Unstructured data includes electronic medical record texts, medical image files, pathology slide images, audio and video treatment records, etc.

[0043] Operational management data: including data on administrative offices, finance, equipment and materials, and human resources management.

[0044] The module has a built-in rule base and classification and grading model for sensitive fields in the medical industry. It can automatically identify sensitive fields such as patient name, ID number, biometrics, and medical records, and complete the sensitivity level labeling according to the national medical data classification and grading standards. The data identification accuracy rate is no less than 95%. Finally, it forms a unified data asset catalog for the entire domain, which clarifies the sensitivity level, storage location, and responsible department of each type of data, providing a basis for subsequent partitioned deployment and permission configuration.

[0045] Level 4 security partition unit:

[0046] The platform establishes four baseline security partitions based on data sensitivity levels, with physical or logical isolation between each partition and corresponding differentiated protection strategies:

[0047] Core sensitive data area:

[0048] This area is used to store the most sensitive data, including core electronic medical records, patient identification information, biometric information, and original laboratory test results. It is protected at the highest level: all data is encrypted using the national cryptographic algorithm SM4, with keys managed and distributed by a dedicated hardware cryptographic machine; only authorized core business systems within the hospital are allowed to access the data at the smallest granularity through a dedicated channel, and direct data export and external sharing in any form are strictly prohibited.

[0049] Business Operations Data Area:

[0050] This area is used to store operational management data related to hospital administration, finance, equipment, and supplies, as well as general medical data that does not involve core privacy. It employs standard security measures and connects to the hospital's HIS, OA, supplies management, and HRP systems to support data access and flow in daily operations, ensuring a balance between operational efficiency and data security.

[0051] Scientific Research Shared Data Area:

[0052] This area is used to store anonymized and de-identified medical datasets. It deploys a data sandbox environment and privacy-preserving computing engines such as federated learning and secure multi-party computation. This area is dedicated to clinical research, statistical modeling, and multi-institutional collaborative research, strictly adhering to the principle of "data not leaving the domain, usable but not visible": researchers can only perform analysis within the sandbox environment and cannot directly export the original detailed data; cross-institutional collaborative research utilizes the privacy-preserving computing engines to ensure that the data remains stationary while the model moves, completing collaborative modeling without disclosing the original data.

[0053] Public open data area:

[0054] This area is used to store non-sensitive data that can be publicly disclosed, such as medical service information, health education data, institutional announcements, and basic information for appointment registration, and is open to the internet and the general public. Firewalls, web application firewalls, and DDoS protection devices are deployed in this area to prevent external network attacks and ensure the stable and secure operation of publicly available services.

[0055] Partition Boundary Management Gateway:

[0056] Deploy a partition boundary control gateway at the boundary of every two security partitions, serving as the sole entry and exit point for cross-partition access, achieving zero-trust boundary control. The gateway incorporates four engines: identity authentication, permission verification, traffic auditing, and behavior detection. It adopts a core strategy of default rejection and whitelisting: all cross-partition access requests are blocked by default, and only access paths that have been approved and included in the whitelist are allowed; each access must verify the user's identity, role permissions, and access scenario, and can only be allowed after all three match; at the same time, all cross-partition traffic is fully logged and real-time anomaly detection is performed, and any violations such as batch exporting or unauthorized access are immediately blocked and alarms are triggered.

[0057] Full lifecycle protection module:

[0058] The platform covers six stages: data collection, storage, transmission, use, sharing, and destruction, constructing an end-to-end closed-loop protection system.

[0059] Data collection stage:

[0060] Standardize and unify data collection interfaces to verify the legality and integrity of data sources; implement identity authentication and traffic monitoring for all data collection entry points; and incorporate SQL injection and malicious script detection rules to prevent illegal data injection and malicious data entry, thereby ensuring data quality and security from the source.

[0061] Storage stage:

[0062] Core sensitive data is encrypted and stored using the national cryptographic algorithm SM4, and the key is managed uniformly by a dedicated hardware cryptographic machine and rotated regularly; a hierarchical data backup mechanism is established, with core data being backed up in multiple locations at different sites, and data backup and recovery drills are conducted regularly to ensure data availability and integrity.

[0063] Transmission process:

[0064] Data transmission across zones and institutions uses national cryptographic encryption channels throughout the entire process, prohibiting the transmission of sensitive data in plaintext; the transmission link is monitored in real time to prevent data eavesdropping, tampering and hijacking during transmission.

[0065] Usage phase:

[0066] Deploy dynamic data anonymization, screen watermarking, anti-screenshot, and anti-copy technologies to automatically anonymize sensitive fields based on user roles, access scenarios, and data levels; perform security verification on terminal access environments to prohibit unauthorized terminals or those without security management software installed from accessing core sensitive data areas; establish a fine-grained permission management system to achieve dynamic access control based on roles, scenarios, and data levels, with 100% approval coverage for high-risk operations such as batch data export and cross-regional access.

[0067] Sharing process:

[0068] It offers three sharing modes: data anonymization delivery, privacy computing, and data sandbox, to adapt to different data sharing scenarios. All external data sharing activities must be initiated through the platform's unified exit and can only be executed after an online approval process. The entire sharing operation is audited to ensure that the data flow is traceable.

[0069] Destruction process:

[0070] Establish a standardized data destruction process to perform irreversible data erasure on data that has exceeded the statutory retention period or is no longer useful; for storage media-level destruction, perform professional destruction operations such as physical shredding; and retain complete destruction approval records and operation logs to prevent the risk of data leakage caused by discarded data.

[0071] Dynamic elastic data domain unit:

[0072] Based on the baseline four-level partitioning, the platform adds dynamic elastic data domain units as an elastic supplement for temporary business scenarios, and has the following characteristics:

[0073] One-click activation on demand:

[0074] For short-term business scenarios such as temporary scientific research projects, public health emergencies, special medical insurance audits, and third-party collaborations, administrators can create independent elastic data domains with one click through the control center; the system automatically synchronizes the corresponding data permissions, security policies, and isolation rules according to the scenario requirements, quickly meeting the needs of temporary data use and significantly shortening the deployment cycle of temporary scenarios.

[0075] Full lifecycle automatic management:

[0076] Each elastic data domain comes with its own independent isolated operating environment, permission system, audit logs, and lifecycle tags. Administrators can preset the validity period of the domain. After the expiration, the system will automatically perform irreversible data destruction, batch revocation of permissions, and log archiving and storage operations, with zero manual intervention throughout the process. This mechanism avoids the security risks of "temporary permissions becoming permanent and temporary data becoming stagnant".

[0077] Zero lateral penetration isolation:

[0078] The elastic domain is completely isolated from the baseline security partition and other elastic domains by default, and whitelisted data paths can only be opened through the platform's unified security bus; all data flows are fully controllable and traceable, eliminating the risk of cross-leakage between different domains.

[0079] Unified Operations and Control Center:

[0080] The unified operations and control center is the platform's management hub, encompassing the following functions:

[0081] Access control:

[0082] Establish a fine-grained, end-to-end access control system that supports three-dimensional dynamic access control based on user roles, business scenarios, and data sensitivity levels; realize online management of the entire process of permission application, approval, modification, and revocation, and regularly and automatically conduct permission audits and clean up redundant permissions.

[0083] Audit traceability:

[0084] It achieves full coverage of data lifecycle operation auditing, and records all data access, export, sharing, cross-region access and other operations with full log recording and a log retention period of no less than 180 days; it has a built-in intelligent security event analysis engine that can automatically identify high-risk operations and abnormal behaviors, shorten the response time of high-risk security events to less than 5 minutes, and achieve a 100% traceability rate for security events.

[0085] Compliance Management:

[0086] It incorporates built-in verification rules for industry standards such as Level 3 cybersecurity protection, cryptographic application security assessment, and medical data security compliance. It can automatically scan platform security configurations and operation records, generate compliance self-inspection reports, and support institutions in successfully passing industry data security compliance assessments.

[0087] When deployed within a regional health system, this platform can unify data security standards and operational norms across medical institutions within the jurisdiction, establish cross-institutional data security sharing channels, and support the implementation of regional public health information platforms, hierarchical medical systems, and public health emergency command, thereby comprehensively improving the efficiency of regional medical services and data governance capabilities. The platform can support more than three types of data application scenarios, including clinical research, medical alliance collaboration, and medical insurance supervision integration, achieving compliant data delivery and sharing services.

[0088] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. It will be apparent to those skilled in the art that the present invention is not limited to the details of the exemplary embodiments described above, and that the invention can be implemented in other specific forms without departing from its spirit or basic characteristics. Therefore, the embodiments should be considered exemplary and non-limiting in all respects. The scope of the invention is defined by the appended claims rather than the foregoing description. Therefore, all variations falling within the meaning and scope of equivalents of the claims are intended to be included within the present invention, and no reference numerals in the claims should be construed as limiting the scope of the claims.

[0089] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A medical data security partitioning operation platform, adopting a centralized unified management and control plus multi-domain partitioning operation architecture, characterized in that, include: The data asset classification and grading module is used to inventory, classify, and label all medical data assets, and generate a comprehensive data asset catalog. The four-level security partition unit sets up four baseline partitions based on the data classification and grading results: core sensitive data area, business operation data area, scientific research shared data area, and public open data area, and implements physical or logical isolation for medical data of different sensitivity levels; The partition boundary control gateway is deployed between various security partitions for mandatory authentication, traffic auditing, and behavior control of cross-partition access. It adopts a default denial policy, allowing only access paths authorized by the whitelist. The full lifecycle protection module covers the entire process of data collection, storage, transmission, use, sharing, and destruction, constructing a closed-loop data security protection system. Dynamic elastic data domain units are used to create independent and isolated elastic data domains for short-term business scenarios, and support automated management of the entire lifecycle of elastic domains; The unified operations and control center is used to achieve unified scheduling of access control, audit traceability and compliance management.

2. The medical data security partitioning operation platform according to claim 1, characterized in that: The data asset classification and grading module covers three types of medical data: structured diagnosis and treatment data, unstructured medical records and imaging data, and operation and management data. It also has a built-in medical data sensitivity identification rule library.

3. The medical data security partitioning operation platform according to claim 1, characterized in that: The core sensitive data area is used to store electronic medical records, patient identity information, biometric information, and original test results. It is encrypted using national cryptographic algorithms and can only be accessed by authorized business systems through a dedicated channel at the smallest granularity. Direct export and external sharing are prohibited. The business operation data area is used to store operation management data and general diagnosis and treatment business data to support the hospital's daily business operations; the scientific research shared data area is used to store medical datasets that have been de-identified and de-identified, and to deploy data sandboxes and privacy computing engines to ensure that data does not leave the domain and is usable but not visible. The public open data area is used to store publicly available medical service information, health science data, and institutional information, and is open to the public with deployed boundary security protection equipment.

4. A medical data security partitioning operation platform according to claim 1, characterized in that: The full lifecycle protection module includes: The data collection unit is used to standardize the data collection interface, verify the legality of the data source, and perform identity authentication and traffic monitoring at the data collection entry point. The storage unit is used to encrypt and store core data using the national cryptographic algorithm SM4. The key is managed by a dedicated cryptographic machine, and data backup and recovery drills are carried out regularly. The transmission unit is used to ensure that data transmission across zones and organizations uses an encrypted channel throughout the entire process, and to prohibit the transmission of sensitive data in plaintext. The unit is used to deploy dynamic data desensitization, screen watermarking, anti-screenshot and anti-copy technologies, automatically desensitize sensitive fields according to user permissions, and perform security control on the terminal access environment. The shared unit provides three sharing modes: data anonymization and delivery, privacy computing, and data sandbox. All external data sharing is conducted through a unified exit and is subject to full auditing and traceability. The destruction unit is used to establish a data destruction process, perform irreversible erasure or media destruction on expired or obsolete data, and retain destruction records.

5. A medical data security partitioning operation platform according to claim 1, characterized in that: The dynamic elastic data domain unit has the ability to be launched with one click on demand. For short-term scenarios such as temporary scientific research projects, public health emergencies, medical insurance special audits, and third-party cooperation, an independent elastic data domain can be created with one click and the corresponding permissions and security policies can be automatically synchronized.

6. A medical data security partitioning operation platform according to claim 5, characterized in that: Each elastic data domain comes with its own independent isolation environment, permission system, audit logs and lifecycle tags, and supports preset validity periods. Upon expiration, it automatically performs data destruction, permission revocation and log archiving, with zero manual intervention throughout the entire process.

7. A medical data security partitioning operation platform according to claim 6, characterized in that: Elastic domains are completely isolated from baseline partitions and other elastic domains by default, and whitelisted data paths are only opened through a unified security bus, making the data flow controllable throughout.

8. A medical data security partitioning operation platform according to claim 1, characterized in that: The unified operation and control center establishes a fine-grained permission control system to achieve dynamic access control based on roles, scenarios, and data levels.

Images