Computer implementation method

Abstract

To provide a computer implementation method, a host device, an algorithm service and an algorithm service for surely handling health care data having high confidentiality.SOLUTION: A method for moving health care data between a host device and an algorithm service establishes a secure communication channel 110 between a host device 102 and an algorithm service 112, and transmits identification of an algorithm to be applied to health care data held by the host device and the health care data to which the identified algorithm should be applied through the secure communication channel, the algorithm service receives the identification of the algorithm and the health care data, the identified algorithm is applied to the health care data in order to acquire a result, and a result applied to the health care data is transmitted from the algorithm service to the host through the secure communication channel.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present disclosure relates to computer-implemented methods, host devices, algorithmic services, and algorithmic services. [Background technology]

[0002] Medical algorithm devices are typically developed in the form of localhost-only applications for processing efficiency, and are typically based on architectural patterns that are complete enough to implement (and deliver) the medical algorithm device, but do not implement security measures to protect the sensitive personal data handled, nor do they implement service features such as audit trails.

[0003] Such minimally complete architectural patterns enable efficient development of medical algorithm devices, as multiple localhost-only systems will be very similar, with all instances reusing the same architectural patterns, allowing for efficient and streamlined threading models, risk assessments, and penetration testing across all medical algorithm devices developed using the same patterns.

[0004] However, it would be desirable to integrate medical algorithm devices into a networked service environment in the context of a patient's medical treatment, providing healthcare providers with remote access to a cloud-based catalogue of remotely executable medical algorithm devices, as well as providing service capabilities such as user concepts, access permissions, and audit trails.

[0005] Here, the inventors have recognized a problem: how to securely integrate a medical algorithm device into a network service environment when the medical algorithm device has been developed, threat modeled, risk assessed and penetration tested as a local host only application, and no security measures have been implemented to protect the sensitive personal data handled. The inventors have further recognized that the network service environment should be able to assert that the security provided to the sensitive personal data exchanged is equivalent to the security provided by the local host environment in which the medical algorithm device was developed, threat modeled, risk assessed and penetration tested.

[0006] The present disclosure has been made in light of the above considerations. Summary of the Invention

[0007] In a first aspect, an embodiment of the present invention provides a computer-implemented method for moving healthcare data between a host device and an algorithmic service. The host device is in a first computer network and the algorithmic service is in a second computer network different from the first computer network. The method includes the following steps: (a) establishing a secure communications channel between a host device and an algorithmic service; (b) via a secure communications channel, from the host device to the algorithmic service; Identifying an algorithm to be applied to the healthcare data held by the host device; The identified healthcare data to which the algorithm should be applied. transmitting the (c) in the algorithmic service, receiving an identification of the algorithm and the health care data; (d) applying the identified algorithm to the health care data to obtain a result; and (e) transmitting, from the algorithm service to the host over the secure communications channel, a result of applying the identified algorithm to the healthcare data.

[0008] In this way, medical algorithms can be developed as localhost-only applications with minimal integrity architecture patterns and do not require the implementation of security measures to protect sensitive healthcare data, which allows efficient development of medical algorithm devices that can safely handle sensitive healthcare data.

[0009] The first and second computer networks may each include or be separated by one or more firewalls. The firewalls may control data entering and leaving each computer network. The first computer network may have a security configuration that is different from and / or controlled by a different entity than the second computer network. For example, the first computer network may define or reside within a first control domain and the second computer network may define or reside within a second control domain.

[0010] The host device may be a computer, a smartphone, a tablet, or other personal computing device. The algorithm service may be a computer, a server, a collection of computers, a collection of servers, a cloud computing environment, and / or a virtualized machine implemented in any of these. The algorithm service may be implemented as software, a software suite running on a computing device, and / or one or more containers in a cloud computing environment. It may be that the host device does not apply the algorithm to the healthcare data. That is, the algorithm identified in step (b) may be applied only by the algorithm service (which may be a different entity than the host device). The algorithm service may include one or more instances, for example one or more cloud instances, to apply the algorithm in parallel.

[0011] The algorithm(s) provided by the algorithmic service may include a step-by-step procedure or set of instructions designed to solve a particular problem or perform a particular task. These are finite sequences of well-defined and well-defined instructions that are executed in a particular order to achieve a desired result. For example, an algorithm provided by an algorithmic service may receive as healthcare data patient data related to cardiovascular health. The algorithm may perform one or more steps on or using the healthcare data, resulting in an indication of risk of myocardial infarction.

[0012] The algorithm identification may be, for example, a label that identifies a particular algorithm or class of algorithms to be applied to the healthcare data. The host device may maintain a list of algorithms that the algorithm service provides, and the list may be provided to the host device from the algorithm service.

[0013] The identification of the algorithm and the transmission of the healthcare data may occur simultaneously or sequentially in any order.

[0014] The healthcare data may include, for example, physiological data associated with the patient, analytical test results associated with the patient, metadata associated with the patient (e.g., "smoker"), and / or metadata associated with one or more tests performed on the patient or samples obtained from the patient. The healthcare data may be stored locally on the host device or may be retrieved upon command from a user of the host device. When a retrieval is commanded, the healthcare data may be stored, for example, in a Laboratory Information System (LIS) or a Healthcare Information System (HIS). The LIS or HIS may include or be linked to the databases referred to below.

[0015] The method may further include transmitting GUI instructions from the algorithm service to the host device, the GUI instructions causing generation of a graphical user interface when executed by the host device. The GUI instructions are selected by the algorithm service based on an algorithm identified by the host device. The GUI instructions may include an HTML document for rendering by a browser connected to or hosted on the host device. In some examples, the algorithm service initiates an instance of the algorithm identified by the host device, and the initiated algorithm provides the GUI instructions to the algorithm service for onward transmission to the host device. The algorithm service may add any additional instructions, such as a header, to the GUI instructions after receiving them from the algorithm and before transmitting them to the host device.

[0016] The method may further include establishing a second secure communication channel between the host device and the database, and transmitting the patient's identification information and the one or more data field identifiers from the host device to the database via the second secure communication channel. The database returns a patient-specific value for the or each data field identifier, and the patient-specific value(s) are included in or form the healthcare data transmitted from the host device to the algorithm service. The second secure communication channel may be established using TLS. Establishing the second secure communication channel may include the host device authenticating the database identity. Establishing the second secure communication channel may include the host device and the database respectively encrypting messages transmitted between each other. Furthermore, the secure communication channel between the host device and the algorithm service may be established using TLS.

[0017] The method may further include, between steps (c) and (d), sending a confirmation command from the algorithm service to the host device indicating which algorithm to apply to which healthcare data. Step (b) may further include sending a pre-population request requesting that the algorithm service return a GUI pre-populated with healthcare data to which the identified algorithm should be applied. The algorithm service sends the confirmation command in response to receiving the pre-population request. The confirmation command may include a confirmation GUI command. The confirmation GUI command causes generation of a pre-populated graphical user interface showing the provided healthcare data and the applied algorithm. The method may further include receiving, at the host device, one or more modification requests related to the pre-populated graphical user interface and sending these modification requests to the algorithm service. For example, the GUI may include one or more input fields for receiving the modification requests. The algorithm service may then implement the one or more modifications and send a modified confirmation GUI command reflecting the one or more modifications back to the host device. The method may further include receiving, at the host device, an acceptance of the pre-populated graphical user interface and sending it to the algorithm service. The algorithm service then applies the algorithm as specified in the pre-populated graphical user interface.

[0018] The method may further include sending an execution request from the host device to the algorithm service requesting that the algorithm service apply the identified algorithm to the healthcare data. The algorithm service performs steps (d) and (e) in response to receiving the execution request. In some examples, the execution request includes an identification of the algorithm to be applied and the healthcare data to which the identified algorithm is to be applied. In some examples, the execution request references an existing pending request in the algorithm service (the algorithm service maintains an identification of the previously sent algorithm and healthcare data).

[0019] The method may further include transforming a result of applying the algorithm to the healthcare data prior to transmission to the host device and / or transforming the healthcare data prior to transmission to the algorithmic service. For example, the healthcare data may be transformed from one numeric format to another numeric format.

[0020] The algorithm service may include an API, and the host device may include an edge module, and the API and edge module communicate securely over a secure communication channel. The algorithm service may include an algorithm module or an algorithm device, which may be connected to the API over a non-secure channel and / or located in a second computer network (or may actually be connected to the API over a secure channel, if necessary). The algorithm module or device may implement medical algorithms in that it performs calculations on medical data and obtains results. The host device may include an interface module, which is connected to the edge module over a non-secure channel and / or located in the first computer network. The interface module may be a browser or other interface through which a clinician interacts with the host device.

[0021] Establishing the secure communications channel may include the host device authenticating the identity of the algorithmic service. In some examples, establishing the secure communications channel may also include the algorithmic service authenticating the identity of the host device. Establishing the secure communications channel may include the host device and the algorithmic service each encrypting messages sent between each other. This may include, for example, the host device and the algorithmic service agreeing on a set of private keys to use to encrypt and decrypt messages sent between each other.

[0022] Establishing the secure communication channel may include implementing a Transport Layer Security protocol (TLS), where the host device assumes the role of a TLS client and the algorithm service assumes the role of a TLS server.

[0023] In a second aspect, embodiments of the present invention provide a host device, the host device comprising one or more processors, a memory, and a network interface, the memory comprising machine-executable instructions that, when executed on the processor(s), perform the following: (a) causing the network interface to establish a secure communications channel between a host device and an algorithmic service, the host device being in a first computer network and the algorithmic service being in a second computer network distinct from the first computer network; (b) on the host device; Identifying an algorithm to be applied to the healthcare data held by the host device; The identified healthcare data to which the algorithm should be applied. via a secure communications channel to an algorithmic service; (c) causing the host device to receive, via the secure communications channel, results of applying the identified algorithm to the healthcare data from the algorithm service.

[0024] The instructions may further cause the host device to receive GUI instructions from the algorithm service. The GUI instructions, when executed by the processor(s), cause the generation of a graphical user interface. The GUI instructions may be selected by the algorithm service based on an algorithm identified by the host device. The GUI instructions may include an HTML document for rendering in a browser connected to or hosted by the host device. In some examples, the algorithm service has initiated an instance of an algorithm identified by the host device, and the initiated algorithm provides the GUI instructions to the algorithm service for onward transmission to the host device. The algorithm service may add any additional instructions to the GUI instructions after receiving them from the algorithm and before transmitting them to the host device. This step may be prompted by a request from a third party device, such as the algorithm service (which causes steps (a)-(c) to be performed).

[0025] The instructions may further cause the network interface to establish a second secure communication channel between the host device and the database and transmit the patient's identification and the one or more data field identifiers from the host device to the database over the second secure communication channel. The host device then receives from the database a patient-specific value for the or each data field identifier. The patient-specific value(s) are included in or form the healthcare data transmitted from the host device to the algorithm service.

[0026] The instructions may further cause the host device to receive confirmation instructions from the algorithm service indicating which algorithm should be applied to which healthcare data. Step (b) may further include sending a pre-population request requesting that the algorithm service return a GUI pre-populated with the healthcare data to which the identified algorithm should be applied. The algorithm service sends the confirmation instructions in response to receiving the pre-population request. The confirmation instructions may include confirmation GUI instructions. The confirmation GUI instructions cause a pre-populated graphical user interface to be generated that indicates the provided healthcare data and the algorithm to be applied. The host device then receives one or more modification requests associated with the pre-populated graphical user interface and sends these modification requests to the algorithm service.

[0027] The instructions further cause the host device to send an execution request from the host device to the algorithm service for the algorithm service to apply the identified algorithm to the healthcare data. In some examples, the execution request includes an identification of the algorithm to be applied and the healthcare data to which the identified algorithm is to be applied. In some examples, the execution request references an existing pending request in the algorithm service (the algorithm service maintains an identification of the previously sent algorithm and healthcare data).

[0028] The instructions further cause the host device to convert the healthcare data prior to transmission to the algorithmic service, for example, the healthcare data may be converted from one numeric format to another numeric format.

[0029] The host device may include an edge module, which is configurable to securely communicate with an API of the algorithmic service over a secure communication channel. The host device may include an interface module, which is configured to connect to the edge module over a non-secure channel and / or is located on a first computer network. The interface module may be a browser or other interface through which a clinician interacts with the host device.

[0030] Establishing the secure communications channel may include the host device authenticating the identity of the algorithmic service. In some examples, establishing the secure communications channel may also include the algorithmic service authenticating the identity of the host device. Establishing the secure communications channel may include the host device and the algorithmic service each encrypting messages sent between each other. This may include, for example, the host device and the algorithmic service agreeing on a set of private keys to use to encrypt and decrypt messages sent between each other.

[0031] Establishing the secure communication channel may include implementing a Transport Layer Security protocol (TLS), where the host device assumes the role of a TLS client and the algorithm service assumes the role of a TLS server.

[0032] In a third aspect, embodiments of the present invention provide an algorithmic service that includes one or more processors, a memory, and a network interface, the memory including machine-executable instructions that, when executed on the processor(s), perform: (a) causing the network interface to establish a secure communications channel between the algorithm service and a host device, the host device being in a first computer network and the algorithm service being in a second computer network different from the first computer network; (b) to the algorithmic service, Identifying an algorithm to be applied to the healthcare data held by the host device; The healthcare data to which the algorithm should be applied from the host device over a secure communication channel; (c) causing the algorithmic service to apply the identified algorithm to the health care data to obtain an outcome; (e) causing the algorithm service to transmit results of applying the identified algorithm to the healthcare data to the host device over the secure communications channel.

[0033] The instructions may further cause the algorithm service to transmit GUI instructions from the algorithm service to the host device, which when executed by the host device cause the generation of a graphical user interface. The GUI instructions are selected by the algorithm service based on an algorithm identified by the host device. The GUI instructions may include an HTML document for rendering by a browser connected to or hosted on the host device. In some examples, the algorithm service initiates an instance of an algorithm identified by the host device, and the initiated algorithm provides the GUI instructions to the algorithm service for onward transmission to the host device. The algorithm service may add any additional instructions to the GUI instructions after receiving them from the algorithm and before transmitting them to the host device. This step may be prompted by a request from a third party device, such as the host device (which causes steps (a)-(e) to be performed).

[0034] The instructions may cause the algorithm service to transmit, between steps (b) and (c), confirmation instructions from the algorithm service to the host device indicating which algorithm to apply to which healthcare data. Step (b) may further include transmitting a pre-fill request requesting that the algorithm service return a GUI pre-populated with the healthcare data to which the identified algorithm is to be applied. The algorithm service transmits the confirmation instructions in response to receiving the pre-fill request. The confirmation instructions may include confirmation GUI instructions. The confirmation GUI instructions cause generation of a pre-populated graphical user interface indicating the provided healthcare data and the algorithm to be applied.

[0035] The instructions may further cause the algorithm service to perform steps (c) and (e) in response to the algorithm service receiving an execution request from the host device for the algorithm service to apply the identified algorithm to the healthcare data. In some examples, the execution request includes an identification of the algorithm to apply and the healthcare data to which the identified algorithm is to be applied. In some examples, the execution request references an existing pending request in the algorithm service (the algorithm service maintains an identification of a previously submitted algorithm and healthcare data).

[0036] The instructions further cause the algorithm service to transform a result of applying the algorithm to the healthcare data prior to transmission to the host device.

[0037] The algorithm service may include an API, which communicates securely with the edge module of the host device over a secure communication channel. The algorithm service may include an algorithm module or an algorithm device, which is connected to the API over a non-secure channel and / or is located in a second computer network. The algorithm module or device may implement a medical algorithm in that it performs calculations on the medical data to obtain a result.

[0038] Establishing the secure communications channel may include the host device authenticating the identity of the algorithmic service. In some examples, establishing the secure communications channel may also include the algorithmic service authenticating the identity of the host device. Establishing the secure communications channel may include the host device and the algorithmic service each encrypting messages sent between each other. This may include, for example, the host device and the algorithmic service agreeing on a set of private keys to use to encrypt and decrypt messages sent between each other.

[0039] Establishing the secure communication channel may include implementing a Transport Layer Security protocol (TLS), where the host device assumes the role of a TLS client and the algorithm service assumes the role of a TLS server.

[0040] In a fourth aspect, an embodiment of the present invention provides an edge module for a host device, the edge module comprising: (a) establishing a secure communications channel between an edge module and an algorithmic service, the edge module being in a first computer network and the algorithmic service being in a second computer network distinct from the first computer network; (b) receiving from the interface module an identification of an algorithm to be applied to the healthcare data maintained by the host device; (c) to algorithmic services; Identifying an algorithm to be applied to the healthcare data held by the host device; The identified healthcare data to which the algorithm should be applied. over a secure communication channel; (d) receiving from the algorithm service via the secure communications channel the results of applying the identified algorithm to the healthcare data. It is structured as follows.

[0041] The edge module may be configured to receive GUI instructions from an algorithm service. The GUI instructions, when executed by the processor(s), cause generation of a graphical user interface. The GUI instructions may be selected by the algorithm service based on an algorithm identified by the interface module. The GUI instructions may include an HTML document for rendering in a browser connected to or hosted by the host device. The algorithm service has initiated an instance of an algorithm identified by the interface module, and the initiated algorithm provides the GUI instructions to the algorithm service for onward transmission to the host device. The algorithm service may add any additional instructions to the GUI instructions after receiving from the algorithm and before transmitting to the host device.

[0042] The edge module may be further configured to establish a second secure communication channel between the edge module and the database and transmit the patient's identity and the one or more data field identifiers from the edge module to the database over the second secure channel. The edge module then receives a patient-specific value for the or each data field identifier from the database. The patient-specific value(s) are included in or form part of the healthcare data transmitted from the edge module to the algorithm service. This second secure communication channel may have any one or combination of characteristics or features of the secure communication channel between the host device and the algorithm service. For example, the second secure communication channel may authenticate the identity of the database and / or encrypt data transferred between the edge module and the database.

[0043] The edge module may receive a confirmation instruction from the algorithm service indicating which algorithm should be applied to which healthcare data. Step (c) may further include sending a pre-population request requesting that the algorithm service return a GUI pre-populated with the healthcare data to which the identified algorithm should be applied. The algorithm service sends the confirmation instruction in response to receiving the pre-population request. The confirmation instruction may include a confirmation GUI instruction. The confirmation GUI instruction causes generation of a pre-populated graphical user interface showing the provided healthcare data and the applied algorithm. The edge module then receives one or more modification requests related to the pre-populated graphical user interface from the interface module and sends these modification requests to the algorithm service.

[0044] The edge module may be configured to send an execution request to the algorithm service for the algorithm service to apply the identified algorithm to the healthcare data. In some examples, the execution request includes an identification of the algorithm to apply and the healthcare data to which the identified algorithm is to be applied. In some examples, the execution request references an existing pending request in the algorithm service (the algorithm service holds the identification of the previously sent algorithm and healthcare data).

[0045] The edge module may further be configured to transform the healthcare data prior to transmission to the algorithmic service, for example, the healthcare data may be transformed from one numeric format to another numeric format.

[0046] The edge module may form part of a host device (eg, the host device of the second aspect) or may be a separate unit connected over a network to the host device.

[0047] Establishing the secure communications channel may include the edge module authenticating the identity of the algorithm service. In some examples, establishing the secure communications channel may also include the algorithm service authenticating the identity of the edge module. Establishing the secure communications channel may include the edge module and the algorithm service each encrypting messages sent between each other. This may include, for example, the edge module and the algorithm service agreeing on a set of private keys to use to encrypt and decrypt messages sent between each other.

[0048] Establishing the secure communication channel may include implementing a Transport Layer Security protocol (TLS), where the edge module assumes the role of a TLS client and the algorithm service assumes the role of a TLS server.

[0049] In a fifth aspect, an embodiment of the present invention provides a system, the system including the host device of the second aspect and the algorithmic service of the third aspect connected by a network.

[0050] The present invention includes combinations of the described aspects and preferred features unless such combinations are expressly not permitted or explicitly avoided.

[0051] A further aspect of the invention provides a computer program comprising code which, when executed on a computer, causes the computer to perform the method of the first aspect, or portions of the method of the first aspect corresponding to one or both of the host device and the algorithmic service; a computer readable medium having stored thereon a computer program comprising code which, when executed on a computer, causes the computer to perform the method of the first aspect, or portions of the method of the first aspect corresponding to one or both of the host device and the algorithmic service; and a computer system programmed to perform the method of the first aspect, or portions of the method of the first aspect corresponding to one or both of the host device and the algorithmic service. [Brief description of the drawings]

[0052] [Figure 1] FIG. 1 is a schematic diagram of the system. [Diagram 2] FIG. 2 is a flow chart of the method. [Diagram 3] FIG. 3 is a network diagram. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0053] Aspects and embodiments of the present invention will now be described with reference to the accompanying drawings, in which: Further aspects and embodiments will be apparent to those skilled in the art.

[0054] FIG. 1 is a schematic diagram of a system 100. The system includes a host device 102 and an algorithmic service 112. The host device includes an interface module (sometimes called a third party agent) 106, such as a web browser or terminal, through which a clinician interacts with the host device, and thus with the edge module and the algorithmic service. The host device also includes an edge module 104 that communicates with the interface module over a first, non-secure channel 108. The edge module 104 also communicates with an API 114 of the algorithmic service over a first, secure channel 110. The API of the algorithmic service communicates with one or more algorithmic devices 116 over a second, insecure channel 118. In this example, the edge module 104 also communicates with an IT service 120 that includes a database 124. This communication is over a second, secure communication channel 122.

[0055] In operation, the interface module provides in message 1 an identification of an algorithm to be applied to some healthcare data (algoID) and either the healthcare data itself or an identification of the patient (patientID). In the latter example, the patientID is then sent along with one or more data field identifiers to the IT service over the second secure communication channel 122 in message 2. For example, message 2 may specify the patientID and also request their blood glucose concentration and weight (as two data field identifiers). The IT service can then look up values ​​corresponding to those data fields for that patient from its database and return them to the edge module in message 3.

[0056] The edge module then sends the algoID, the value, and an action field containing a request to pre-fill the GUI to the API 114 over the first secure channel 110. In the example where message 1 contains the healthcare data itself, messages 2 and 3 are omitted, so the edge module simply forwards the contents of message 1 to the API along with the action field containing the pre-fill request.

[0057] The API sends message 5, containing the GETUI command and the received values, over the second, non-secure channel 118 to the algorithm device 116 that corresponds to the one identified by the algorithm ID in message 4. In some instances, these values ​​will be transformed (e.g., by converting from one numeric format to another) at some stage in the process, for example by the interface module, the edge module, or indeed by the API at this stage. In such cases, the values ​​are written as f(values), where f is a function that transforms the values. The algorithm device then responds with message 6UI(f(values)). Message 6UI(f(values)) contains GUI commands, for example an HTML document. The HTML document describes the values ​​it received and the algorithm it intends to apply to those values. This message is forwarded by the API over the first secure channel 110 to the edge module 104 as message 7, which in turn forwards this message to the interface module 106 as message 8.

[0058] The clinician can then, via the interface module 106, either authorize the application of the algorithm or submit a change or update request (e.g., a new algorithm to be applied or a change to the healthcare data). A message 9 is sent to the edge module 104. In this example, the message 9 again contains the algorithm ID and a value (which may be either the transformed value, the original value, or a modification of the initial or transformed value in response to a change request from the user), which is understood by the edge module as consent to apply the algorithm to the data described in the UI(f(values)) message. The edge module then sends a message 10 to the API via the first secure communication channel 110. The message 10 contains a request for the algorithm device to apply the algorithm to the values. In this example, the message 10 contains the algorithm ID, the value, and an action field containing a request to run the algorithm.

[0059] In some examples, the algorithm service 112 may store the values ​​initially sent in message 4, so that the clinician may include one or more change or update requests to those values ​​when authorizing or requesting execution of the algorithm in message 10. In other examples, the algorithm service does not store the values, so that upon receipt of message 10, the algorithm device will execute using the values ​​and algorithm ID received in message 10, regardless of the values ​​or algorithm ID received in message 4.

[0060] Upon receipt of message 10 by the API 114, message 11 is made to the algorithm device 116. Message 11 requests that an algorithm be applied to the healthcare data. In this example, message 11 comprises a POST request with an encapsulated value. The algorithm device 116 then applies the algorithm to the healthcare data and provides the results in message 12. In this example, the results are provided in the form of an HTML document that instructs the GUI to display the results (UI(res)). This is forwarded from the API to the edge module 104 as message 13 and from the edge module to the interface module 106 as message 14.

[0061] From the healthcare provider's perspective, the interface module still resides in a local host environment over which the healthcare provider maintains control. Furthermore, the algorithm device does not reside in the same network environment as the healthcare provider's interface module, but rather resides in its own environment connected to the local host environment via a technology network and a first secure communication channel.

[0062] Thus, the interface module 106 does not directly communicate with the algorithm device 116, but with the edge module 104, which is in the same local host environment. The edge module is responsible for communicating with a healthcare provider database (e.g., database 124 provided by IT service 120) for the purpose of retrieving medically relevant data regarding patients under the healthcare provider's care and which patient care context triggers the entire algorithm device. The healthcare provider database DB resides in an IT environment (IT service 120), which is different from the local host environment in which the interface module and the edge module reside. The IT environment and the local host environment are connected by a technology network and a second secure communication channel. The edge module communicates with an API present in the algorithm service environment for the purpose of requesting the execution of the algorithm device and retrieving algorithm result values. The algorithm service environment in which the API resides is different from the local host environment and is connected through a technology network and a first secure communication channel, as described above. The API communicates with the algorithm device for the purpose of program execution of the algorithm contained in the algorithm device and retrieval of algorithm result values.

[0063] In this example, when a healthcare provider in the context of treating a patient identified by the patient identifier ID, and when the healthcare provider needs an algorithm (e.g., a medical algorithm) identified by the algorithm identifier algoID for the purposes of informed medical decision-making, the complete calculation of the algorithm value consists of two round trips within this networked service environment, as described in detail above.

[0064] For the networked service environment shown in Figure 1, it is provided that secure communication channels are used across the technology network connecting the healthcare provider's local host environment and the healthcare provider's IT environment, and across the technology network connecting the healthcare provider's local host environment and the algorithmic service environment.

[0065] A secure channel is one that simultaneously provides both confidentiality and authenticity to the data exchanged over the channel. If a channel provides confidentiality to the data exchanged over the channel, the data exchanged over such a channel is accessible only to well-defined actors that are authorized to access the data. If a channel provides authenticity to the data exchanged over such a channel, the recipient of the data exchanged over such a channel can unambiguously identify the source of the data received.

[0066] It is specified that for the secure channel between the healthcare provider's local host environment and the healthcare provider's IT environment, this secure communication channel must provide bidirectional confidentiality of the data exchanged. It is also specified that this secure channel must provide, at a minimum, authenticity for the data sent from the healthcare provider's IT environment to the healthcare provider's local host environment, such that the edge module can univocally identify that the source of the received healthcare-related algorithm input value (the value of message 3) is a database DB within the healthcare provider's IT environment.

[0067] It is specified that for a secure channel between the healthcare provider's local host and the algorithm service environment, the secure channel must provide bidirectional confidentiality of the data exchanged, and at a minimum, the secure channel must provide authenticity for data sent from the service environment to the healthcare provider's local host environment, such that the edge module can unambiguously identify the source of a retrieved user interface UI populated with either a set of compliant medically relevant algorithm input values ​​or a set of algorithm result values ​​(f(values)).

[0068] In one embodiment of the first and / or secure communication channel communication channel, Transport Layer Security Protocol (TLS) version 1.3 (or version 1.2) is used. If TLS is used to establish the second secure channel, the healthcare provider's local host environment will assume the role of the TLS client and the healthcare provider's IT environment will assume the role of the TLS server. If TLS is used to establish the first secure channel, the healthcare provider's local host environment will assume the role of the TLS client and the service environment will assume the role of the TLS server.

[0069] TLS as a cryptographic protocol is a protocol where the TLS server is always authenticated (TLS server authentication is commonly implemented by using X.509 server certificates) as part of the initial LTS handshake protocol, and the TLS client and TLS server arrive at a shared master secret. This can be achieved by encrypting a client-generated pre-master secret using RSA (Rivest-Shamir-Adleman) or by using ECDHE or DHE key exchange (Elliptic Curve Diffie-Hellman or Diffie-Hellman key exchange). The protocol also requires the master secret to be expanded into a set of multiple cryptographic keys (using a PRF (pseudorandom function) in the case of TLS 1.2, and HKDF in the case of TLS 1.3). Application data is exchanged between the TLS client and TLS server, and confidentiality is provided by encrypting the application data using keys derived from the master secret using encryption (e.g., AES, Advanced Encryption Standard, ChaCha20). Application data exchanged between a TLS client and a TLS server is authenticated through the use of Keyed-Hash Message Authentication Code (HMAC) in the case of TLS 1.2, and Authenticated Encrypted with Associated Data (AEAD) encryption in the case of TLS 1.3.

[0070] Alternative cryptographic protocols may be chosen as long as they provide the same security guarantees for the channel established.

[0071] If a networked service environment implements the security measures described above, the security of an algorithmic device used within such a networked service environment is equivalent to the security of using the algorithmic device in a localhost-only environment.

[0072] The concept of security in the context of algorithmic devices includes four requirements: First, health-related algorithm input values ​​need to be confidential with respect to three environments: the environment of the source of the health-related algorithm input values, the environment of the use of the health-related algorithm input values, and the environment of the sink of the health-related algorithm input values. Second, algorithm result values ​​need to be confidential with respect to two environments: the environment of the source of the algorithm result values ​​and the environment of the sink of the algorithm result values. Third, a sink of an algorithm result value must be able to unambiguously identify the source of the health-related algorithm input values ​​that were used to compute a received algorithm result value. Fourth, a sink of an algorithm result value must be able to unambiguously identify the source of a received algorithm result value.

[0073] Under the assumption of an uncompromised local host environment, the use of the algorithm device in such an uncompromised local host environment can be considered secure according to the four requirements specified above as follows: First, the medically relevant algorithm input values ​​are confidential to the above three environments. Assuming an uncompromised healthcare provider local host environment, the medically relevant algorithm input values ​​are confidential to this healthcare provider local host environment, since all three environments are the same healthcare provider local host environment. Second, the algorithm result values ​​are confidential to the above two environments. Assuming an uncompromised healthcare provider local host environment, the algorithm result values ​​are confidential to this healthcare provider local host environment, since both environments are all the same healthcare provider local host environment. Third, the sink of the algorithm result values, which is an interface module in the healthcare provider local host environment, can unambiguously identify the source of the medically relevant algorithm input values, since the source of the medically relevant algorithm input values ​​is the same interface module in the healthcare provider local host environment. Fourth, the sink of algorithm result values, which is an interface module in the local host environment of the healthcare provider, can unambiguously identify the source of the received algorithm result values ​​because the source of the received algorithm result values ​​is the same medical algorithm device in the local host environment of the healthcare provider.

[0074] By implementing the specified security measures in a networked service environment, the use of an algorithm device in such a networked service environment implementing the specified security measures can be considered as secure according to the four requirements specified above: First, the medical-related algorithm input values ​​are confidential with respect to three environments: the environment of the source of the medical-related algorithm input values, i.e. the IT environment of the healthcare provider, the environment of the use of the medical-related algorithm input values, i.e. the service environment, and the environment of the sink of the medical-related algorithm input values, i.e. the local host environment of the healthcare provider. This is because the networked service environment uses a secure communication channel across the technical network connecting the environment of the source of the medical-related algorithm input values ​​and the environment of the sink of the medical-related algorithm input values, and because the networked service environment uses a secure channel across the technical network connecting the environment of the sink of the medical-related algorithm input values ​​and the environment of the use of the medical-related algorithm input values. If the secure channel used is of the specified security quality, the medical-related algorithm input values ​​are confidential with respect to the three environments specified in the first security requirement. Second, the algorithm result values ​​are confidential with respect to two environments: the environment of the source of the algorithm result values, i.e. the service environment, and the environment of the sink of the algorithm result values, i.e. the healthcare provider's local host environment. This is because the networked service environment uses a secure channel across the technical network connecting the environment of the source of the algorithm result values ​​and the environment of the sink of the algorithm result values. If the secure channel used is of the specified security quality, the algorithm result values ​​are confidential with respect to the two environments specified in the second security requirement. Third, the sink of the algorithm result values, which is an interface module in the healthcare provider's local host environment, can univocally identify the source of the medically relevant algorithm input values, i.e. a database (DB) in the healthcare provider's IT environment.This is because the networked service environment uses a secure channel across the technical network connecting the environment of the source of medical-related algorithm input values ​​and the environment of the sink of algorithm result values. If the secure channel used is of a defined security quality, the sink of algorithm result values ​​can univocally identify the source of the medical-related algorithm input values. Fourthly, the sink of algorithm result values, which is an interface module in the local host environment of the healthcare provider, can univocally identify the source of the received algorithm result values, i.e. the medical algorithm device in the service environment. This is because the networked service environment uses a secure communication channel across the technical network connecting the environment of the sink of algorithm result values ​​and the environment of the source of the received algorithm result values. If the secure channel used is of a defined security quality, the sink of algorithm result values ​​can univocally identify the source of the received algorithm result values.

[0075] 2 is a flow chart of method 200. In a first step S102, a secure communication channel is established between the host device and the algorithm service. Then, in step S104, the host device transmits to the algorithm service, via the established secure communication channel, (i) an identification of an algorithm, and (ii) healthcare data to which the identified algorithm should be applied. Then, in step S106, the algorithm service receives the transmitted data. Then, in step S108, the algorithm service applies the identified algorithm to the healthcare data. In step S110, the result is transmitted to the host device via the established secure communication channel.

[0076] 3 is a network diagram. A host device 302, of the type previously described, is connected to an edge module 304 via a network connection, e.g., by being on the same machine (virtual or physical). The edge module 304 is connected to a wide area network (e.g., the Internet) 306. In this example, the edge module 304 is also connected to an IT service 308 via a network connection in a manner that does not go through the wide area network 306. However, in some examples, the IT service 308 is connected to the wide area network and connected to the edge module 304 via this, as shown by the dotted line.

[0077] An algorithmic service 312 of the type described above is connected to the API 310 via a network connection, for example by being on the same machine (virtual or physical). The API 310 is connected to the wide area network 306. In this manner, the API 310 and the edge module 304 can communicate, establish a secure communication channel, and exchange data.

[0078] The systems and methods of the above embodiments, in addition to the structural components and user interactions described, may be implemented in a computer system (particularly computer hardware or computer software).

[0079] The term "computer system" includes hardware, software, and data storage devices for implementing the system or performing the methods according to the above-described embodiments. For example, a computer system may include a central processing unit (CPU), input means, output means, and data storage devices. A computer system may have a monitor that provides a visual output display. The data storage devices may include RAM, disk drives, or other computer-readable media. A computer system may include multiple computing devices that are connected by a network and can communicate with each other over the network.

[0080] The methods of the above embodiments may be provided as a computer program or as a computer program product or computer readable medium carrying a computer program configured to perform the above-mentioned method(s) when executed on a computer.

[0081] The term "computer-readable medium" includes, but is not limited to, any non-transitory medium that can be read and accessed directly by a computer or computer system. Media can include, but are not limited to, magnetic storage media, such as floppy disks, hard disk storage media, and magnetic tape; optical storage media, such as optical disks or CD-ROMs; electrical storage media, such as memory, including RAM, ROM, and flash memory; and hybrids and combinations of the above, such as magnetic / optical storage media.

[0082] Although the present disclosure has been described in conjunction with the exemplary embodiments set forth above, many equivalent modifications and variations will be apparent to those skilled in the art given this disclosure. Accordingly, the exemplary embodiments of the present disclosure set forth above are considered to be illustrative and not limiting. Various modifications to the described embodiments may be made without departing from the spirit and scope of the present disclosure.

[0083] In particular, although the methods of the above embodiments are described as being implemented on the systems of the described embodiments, the methods and systems of the present disclosure need not be implemented in conjunction with each other and may each be implemented on alternative systems or using alternative methods.

[0084] The features disclosed in this specification, or the following claims, or the accompanying drawings, and expressed in a specific form or in terms of means for conveniently carrying out a disclosed function, or a method or process for obtaining a disclosed result, can be utilized in various forms to realize the disclosure, either individually or in any combination of such features.

[0085] Although the present disclosure has been described in conjunction with the exemplary embodiments set forth above, many equivalent modifications and variations will be apparent to those skilled in the art given this disclosure. Accordingly, the exemplary embodiments of the present disclosure set forth above are considered to be illustrative and not limiting. Various modifications to the described embodiments may be made without departing from the spirit and scope of the present disclosure.

[0086] To avoid any misunderstanding, any theoretical explanations provided herein are provided for the purpose of improving the understanding of the reader, and the inventors do not wish to be bound by any of these theoretical explanations.

[0087] Any section headings used herein are for organizational purposes only and are not to be construed as limiting the subject matter described.

[0088] Throughout this specification, including the claims which follow, unless the context requires otherwise, the terms "comprise" and "include," as well as variations such as "comprises," "comprising," and "including," are understood to imply the inclusion of a stated integer or step or group of integers or steps but not the exclusion of any other integers or steps or group of integers or steps.

[0089] It should be noted that, as used in this specification and the appended claims, the singular forms "a," "an," and "the" include plural referents unless the context clearly dictates otherwise. Ranges may be expressed herein as from "about" one particular value, and / or to "about" another particular value. When such a range is expressed, another embodiment includes from the one particular value and / or to the other particular value. Similarly, when values ​​are expressed as approximations, by use of the antecedent "about," it will be understood that the particular value forms another embodiment. The term "about" with respect to numerical values ​​is arbitrary and may mean, for example, + / - 10%.

Claims

1. 1. A computer-implemented method for moving healthcare data between a host device and an algorithmic service, the host device being in a first computer network and the algorithmic service being in a second computer network distinct from the first computer network, the method comprising: (a) establishing a secure communications channel between the host device and the algorithmic service; (b) from the host device to the algorithmic service via the secure communications channel; Identifying an algorithm to be applied to healthcare data held by the host device; and the identified healthcare data to which the algorithm is to be applied; and transmitting (c) receiving, at the algorithm service, the identification of the algorithm and the health care data; (d) applying the identified algorithm to the healthcare data to obtain a result; (e) transmitting a result of applying the identified algorithm to the healthcare data from the algorithm service to the host via the secure communication channel; 4. A computer-implemented method comprising:

2. 2. The computer-implemented method of claim 1, further comprising: sending GUI instructions from the algorithm service to the host device, the GUI instructions, when executed by the host device, causing generation of a graphical user interface, the GUI instructions being selected by the algorithm service based on an algorithm identified by the host device.

3. 3. The computer-implemented method of claim 1, further comprising: establishing a second secure communication channel between the host device and a database; and transmitting a patient identification and one or more data field identifiers from the host device to the database over the second secure communication channel, the database returning a patient-specific value for the or each data field identifier, the patient-specific value(s) being included in or forming part of the healthcare data transmitted from the host device to the algorithm service.

4. Establishing the second secure communications channel the host device authenticating the identity of the database; and / or The host device and the database each encrypt messages sent between each other. The computer-implemented method of claim 3 , further comprising one or both of:

5. 5. The computer-implemented method of claim 1, further comprising, between steps (c) and (d), sending a confirmation instruction from the algorithm service to the host device indicating which algorithm should be applied to which healthcare data.

6. 6. The computer-implemented method of claim 5, wherein the verification instructions include a verification GUI instruction, the verification GUI instruction causing the generation of a pre-populated graphical user interface showing the provided healthcare data and the algorithm to be applied.

7. 7. The computer-implemented method of claim 6, further comprising receiving, at the host device, one or more modification requests related to the pre-populated graphical user interface and transmitting these modification requests to the algorithmic service.

8. 8. The computer-implemented method of claim 1 , further comprising: transforming the results of applying the algorithm to the healthcare data prior to transmission to the host device; and / or transforming the healthcare data prior to transmission to the algorithm service.

9. 9. The computer-implemented method of claim 1, wherein the algorithmic service includes an API, the host device includes an edge module, and the API and edge module communicate securely over the secure communication channel.

10. 10. The computer-implemented method of claim 1, wherein establishing the secure communications channel includes the host device authenticating an identity of the algorithmic service.

11. 11. The computer-implemented method of claim 1, wherein establishing the secure communications channel includes the host device and the algorithmic service each encrypting messages sent between each other.

12. A host device including one or more processors, a memory, and a network interface, the memory including machine-executable instructions that, when executed on the processor(s), perform the following: (a) causing the network interface to establish a secure communications channel between the host device and an algorithmic service, the host device being in a first computer network and the algorithmic service being in a second computer network distinct from the first computer network; (b) in said host device, Identifying an algorithm to be applied to healthcare data held by the host device; the identified healthcare data to which the algorithm should be applied; to the algorithmic service via the secure communication channel; (c) causing the host device to receive, via the secure communications channel, from the algorithm service, results of applying the identified algorithm to the healthcare data.

13. 1. An algorithmic service comprising one or more processors, a memory, and a network interface, the memory comprising machine-executable instructions that, when executed on the processor(s), perform the following: (a) causing the network interface to establish a secure communications channel between the algorithm service and a host device, the host device being in a first computer network and the algorithm service being in a second computer network different from the first computer network; (b) the algorithmic service; Identifying an algorithm to be applied to healthcare data held by the host device; Healthcare data to which the algorithm is to be applied; from the host device over the secure communication channel; (c) causing the algorithm service to apply the identified algorithm to the healthcare data to obtain an outcome; (e) causing the algorithm service to transmit a result of applying the identified algorithm to the healthcare data to the host device via the secure communication channel.

14. 1. An edge module for a host device, comprising: (a) establishing a secure communications channel between the edge module and an algorithm service, the edge module being in a first computer network and the algorithm service being in a second computer network different from the first computer network; (b) receiving from the interface module an identification of an algorithm to be applied to healthcare data held by the host device or received from the interface module; (c) to the algorithmic service; Identifying the algorithm to be applied to the healthcare data held by the host device; the identified healthcare data to which the algorithm should be applied; over the secure communication channel; (d) receiving from the algorithm service, via the secure communication channel, a result of applying the identified algorithm to the healthcare data. The Edge Module is configured as follows:

15. a host device in a first computer network; an algorithmic service located in a second computer network different from the first computer network; A system comprising: the host device and / or the algorithmic service; configured to establish a secure communication channel between the host device and the algorithm service; The host device, via a secure communications channel to the algorithmic service; Identifying an algorithm to be applied to healthcare data held by the host device; the identified healthcare data to which the algorithm should be applied; is configured to transmit The algorithmic service is applying the identified algorithm to the healthcare data to obtain a result; Transmitting a result of applying the identified algorithm to the healthcare data to the host device over the secure communication channel. The system is configured as follows:

Images