Medical data transmission / reception system, transmission side system, reception side system, and data transmission / reception method

Abstract

To provide a medical data transmission / reception system, a transmission side system, a reception side system, and a data transmission / reception method that can facilitate medical examinations and the like at medical institutions to which the data is sent.SOLUTION: In a medical data transmission side system 10, a transmission side system 20 transmits encrypted data set ID encrypted with a public key of the reception system 60 and an encrypted common key to the reception system 60. Then, the reception system 60 obtains the encrypted target data set from an external repository 40 using the decryption data set ID decrypted with its own private key, and decrypts and expands the target data set using the decryption common key decrypted with its own private key.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to a medical data transmission and reception system, a transmission side system, a receiving side system, and a data transmission and reception method, and more particularly to a medical data transmission and reception system, a transmission side system, a receiving side system, and a data transmission and reception method used for transmitting and receiving medical data while ensuring security, for example. [Background technology]

[0002] 2. Description of the Related Art When a patient is referred from one medical institution to another, a technique has been developed for transmitting medical data (eg, medical image data) of the patient to the referred medical institution (Patent Document 1).

[0003] Patent Document 1 aims to make it possible to easily import medical image data and the like (

[0006] , Abstract). To achieve this aim, an image input device (211) in Example 1 of Patent Document 1 (Abstract,

[0013] to

[0069] ) transmits data acquired from a card to a data processing device (213) as patient appointment card data, and receives a response indicating a valid or invalid patient appointment card from the data processing device (213). When receiving a response indicating a valid patient appointment card, the image input device (211) determines whether medical data exists in the medium (16), and when determining that medical data exists in the medium (16), transmits the medical data acquired from the medium (16) to the data processing device (213). In Example 1 of Patent Document 1, the medium (16) on which the medical data is recorded is inserted by the patient (17), in other words, is carried by the patient (17) (

[0040] ,

[0071] , Fig. 2).

[0004] In Example 2 (

[0070] to

[0080] ) of Patent Document 1, medical data is transmitted and received using a virtual private network (VPN). That is, LANs (15, 25) of a source medical institution (10) and a destination medical institution (20) are connected to a server device (41) of an external network (40) via VPN routers (42, 43) (

[0072] ).

[0005] Then, the image output device (11) of the medical institution (10) uploads the medical data of the patient (17) to the server device (41) (export process). The patient (17) receives a slip on which an acquisition code (token) for acquiring his / her own medical data is recorded at the examination department counter of the medical institution (10) or the like, and carries the slip to the medical institution (20) instead of the media (16). At the medical institution (20), the patient (17) inserts his / her own medical card for the medical institution (20) into the medical card insertion slot of the image input device (211) according to the instructions of the reception counter, and starts importing the medical data (

[0073] ). When importing, the data processing device (213) downloads the medical data from the server device (41) using the token as a key. Thereafter, the data processing device (213) performs a match determination of the patient information, adapts the patient information, and transmits the data to the PACS (22) (import process) (

[0076] ). [Prior art documents] [Patent documents]

[0006] [Patent Document 1] JP 2017-021535 A Summary of the Invention [Problem to be solved by the invention]

[0007] As described above, in Example 2 of Patent Document 1, medical data is transmitted from a source medical institution (10) to a destination medical institution (20) using a VPN and an external server device (41) (

[0070] to

[0076] , FIG. 2). In this Example 2, the patient (17) carries an acquisition code (token) for acquiring the patient's (17) medical data to the destination medical institution (20) (

[0072] ). Then, the data processing device (213) of the import system (21) of the destination medical institution (20) downloads the medical data from the external server device (41) using the token as a key and via the VPN (

[0076] ).

[0008] However, for example, in the case of medical image data, the data size is relatively large and it may take time to download. In a configuration in which the patient (17) carries the token, the download of the medical data cannot start until the patient (17) has gone to the medical institution (20) to which the data is to be sent. Therefore, the time required for downloading may cause delays in medical examinations, etc.

[0009] The present invention has been made in consideration of the above-mentioned problems, and aims to provide a medical data transmission and reception system, a transmitting system, a receiving system, and a data transmission and reception method that can facilitate medical examinations, etc. at the medical institution to which the data is sent. [Means for solving the problem]

[0010] The medical data transmission and reception system according to the present invention comprises: A transmitting side system in a medical institution that transmits medical data; A receiving system in a medical institution that receives the medical data; an external repository that temporarily stores the medical data and relays data transfer from the sending system to the receiving system; and The sending system includes: A target dataset, which is a set of medical data to be transmitted, is encrypted with a common key to generate an encrypted target dataset; encrypting a data set ID, which is an identification code of the target data set, and the common key with a public key of the receiving system to generate an encrypted data set ID and an encrypted common key; Transmitting the data set to be encrypted and an unencrypted data set ID that is an unencrypted data set ID to the external repository; Transmitting the encrypted data set ID and the encrypted common key to the receiving system via an external server or directly; The external repository records the encryption target data set and the non-encrypted data set ID received from the transmitting system, The receiving system includes: decrypting the encrypted data set ID and the encrypted common key received from the transmitting system using a private key of the receiving system to generate a decrypted data set ID and a decryption common key; Requesting the external repository to transmit the encrypted data set identified by the decryption data set ID; The external repository transmits to the receiving system the encryption target data set identified by the unencrypted data set ID corresponding to the decrypted data set ID received from the receiving system; The receiving system decrypts the encrypted target data set received from the external repository with the decryption common key, and expands and records each medical data included in the decrypted target data set. It is characterized by:

[0011] According to the present invention, an encrypted data set ID encrypted with the public key of the receiving system and an encrypted common key are transmitted from a transmitting system to a receiving system. Then, the receiving system acquires an encrypted target data set from an external repository using the decrypted data set ID decrypted with its own private key, and decrypts and expands the target data set using the decrypted common key decrypted with its own private key. This allows the encrypted data set ID (which replaces the token in Patent Document 1) to be delivered to the receiving system through communication between the transmitting system and the receiving system without the patient having to carry it. Therefore, the receiving system can download medical data before the patient comes to the medical institution to which the medical data is to be transmitted. This makes it possible to facilitate examinations and the like after the patient comes to the medical institution to which the medical data is to be transmitted.

[0012] Furthermore, the target dataset, which is a set of medical data to be transmitted, is encrypted and decrypted using a common key, while the dataset ID and the common key are encrypted and decrypted using the public key and private key of the receiving system. This makes it possible to ensure security and reduce the computational load by using encryption and decryption using a common key for the target dataset, which may have a relatively large data size. On the other hand, for the dataset ID and common key, which may have a relatively small data size, higher security can be ensured by using encryption and decryption using the public key and private key of the receiving system (and by combining it with a common key cryptography method for the target dataset).

[0013] A transmitting side system according to another aspect of the present invention is provided in a medical institution that transmits medical data, the transmitting system transmits the medical data to a receiving system in a medical institution that receives the medical data via an external repository that temporarily stores the medical data; Furthermore, the transmitting system A target dataset, which is a set of medical data to be transmitted, is encrypted with a common key to generate an encrypted target dataset; encrypting a data set ID, which is an identification code of the target data set, and the common key with a public key of the receiving system to generate an encrypted data set ID and an encrypted common key; Transmitting the data set to be encrypted and an unencrypted data set ID that is an unencrypted data set ID to the external repository; The encrypted data set ID and the encrypted common key are transmitted to the receiving system via an external server or directly. It is characterized by:

[0014] The transmitting system may display a transmission setting screen on which a user of the transmitting system sets the transmission of the target data set. The transmission setting screen may include a transmission destination input field for inputting a transmission destination of one or more of the target data sets selected from the multiple receiving systems, a medical data input field for inputting one or more of the medical data to be transmitted that are included in the target data set, and a transmission button for instructing the transmission of the target data set to the transmission destination. This allows the transmission setting screen to input the transmission destination, input the medical data to be transmitted that are included in the target data set, and instruct the transmission. This makes it possible to improve the operability of the transmitting system for the user.

[0015] When the send button is pressed on the send setting screen, the sending system may generate the data set to be encrypted, the encrypted data set ID, and the encrypted symmetric key, send the data set to be encrypted and the unencrypted data set ID to the external repository, and send the encrypted data set ID and the encrypted symmetric key to the receiving system. This makes it possible to improve operability for a user of the sending system.

[0016] A receiving system according to yet another aspect of the present invention is provided in a medical institution that receives medical data, the receiving system receives the medical data from a transmitting system in a medical institution that transmits the medical data via an external repository that temporarily stores the medical data; Furthermore, the receiving system Receive from the transmitting system via an external server or directly an encrypted data set ID in which a data set ID, which is an identification code of a target data set that is a set of medical data to be transmitted from the transmitting system, is encrypted with the public key of the receiving system, and an encrypted common key in which a common key used to encrypt the target data set is encrypted with the public key of the receiving system; decrypting the encrypted data set ID and the encrypted common key with a private key of the receiving system to generate a decrypted data set ID and a decryption common key; requesting the external repository to transmit an encrypted target data set, the target data set being encrypted by the common key in the transmitting system, the encrypted target data set being identified by the decrypted data set ID; The encrypted target data set received from the external repository is decrypted with the decryption common key, and each medical data included in the decrypted target data set is expanded and recorded. It is characterized by:

[0017] The receiving system may display a dataset list screen including a dataset list displaying one or more target datasets for which reception of the encrypted target datasets from one or more sending systems via the external repository and subsequent decryption and extraction have been completed, and when one of the target datasets is selected by a user of the receiving system on the dataset list screen, the receiving system may display a dataset detailed information screen including detailed information on the selected target dataset.

[0018] This allows the time-consuming reception (downloading), decryption, and extraction to proceed without waiting for the user of the receiving system to operate, further enhancing the effect of preventing delays.In addition, the user of the receiving system can easily check detailed information about the target data set that has been received, decrypted, and extracted.

[0019] A data transmission and reception method according to still another aspect of the present invention includes the steps of: A sending system at a sending side of data; a receiving system at a receiving end of the data; an external repository that temporarily stores the data and relays data transfer from the sending system to the receiving system; A method for performing a data transmission and reception system having The sending system includes: A target data set, which is a set of data to be transmitted, is encrypted with a common key to generate an encrypted target data set; encrypting a data set ID, which is an identification code of the target data set, and the common key with a public key of the receiving system to generate an encrypted data set ID and an encrypted common key; Transmitting the data set to be encrypted and an unencrypted data set ID that is an unencrypted data set ID to the external repository; Transmitting the encrypted data set ID and the encrypted common key to the receiving system via an external server or directly; The external repository records the encryption target data set and the non-encrypted data set ID received from the transmitting system, The receiving system includes: decrypting the encrypted data set ID and the encrypted common key received from the transmitting system using a private key of the receiving system to generate a decrypted data set ID and a decryption common key; Requesting the external repository to transmit the encrypted data set identified by the decryption data set ID; The external repository transmits to the receiving system the encryption target data set identified by the unencrypted data set ID corresponding to the decrypted data set ID received from the receiving system; The receiving system decrypts the encrypted target data set received from the external repository with the decryption common key, expands the data into each data included in the decrypted target data set, and records the data. It is characterized by: Effect of the Invention

[0020] According to the present invention, it is possible to facilitate medical examinations and the like at the medical institution to which the data is transmitted. [Brief description of the drawings]

[0021] [Figure 1]It is a schematic configuration diagram of a medical data transmission / reception system according to an embodiment of the present invention. [Diagram 2] It is a schematic configuration diagram of a transmission-side gateway terminal according to the embodiment. [Diagram 3] It is a schematic configuration diagram of a reception-side gateway terminal according to the embodiment. [Figure 4] It is a diagram showing the flow of processing during medical data transmission in the embodiment. [Diagram 5] It is a diagram showing the flow of processing during medical data reception in the embodiment.

Mode for Carrying Out the Invention

[0022] A. One Embodiment <A-1. Configuration of this Embodiment> [A-1-1. Overall Configuration] FIG. 1 is a schematic configuration diagram of a medical data transmission / reception system 10 according to an embodiment of the present invention. The medical data transmission / reception system 10 (hereinafter also referred to as the "transmission / reception system 10") includes a plurality of transmission-side systems 20, an authentication server 30, an external repository 40, a mail server 50, and a plurality of reception-side systems 60. Note that in FIG. 1, only one transmission-side system 20 and one reception-side system 60 are shown. Also, here, for ease of understanding, the transmission-side system 20 and the reception-side system 60 are separated, but it is also possible that the transmission-side system 20 has the functions of the reception-side system 60 and the reception-side system 60 has the functions of the transmission-side system 20. The transmission-side system 20 can communicate with the authentication server 30, the external repository 40, and the mail server 50 via a communication network 70 such as the Internet. The reception-side system 60 can also communicate with the authentication server 30, the external repository 40, and the mail server 50 via the communication network 70.

[0023] In the transmitting / receiving system 10, a target data set, which is a set of medical data to be transmitted, is transmitted from the transmitting system 20 to the receiving system 60 via the external repository 40. At that time, the target data set is transmitted in the form of an encrypted data set encrypted with a common key (session key) generated by the transmitting system 20.

[0024] The transmitting system 20 also transmits information (hereinafter referred to as "download-related information") to the receiving system 60, which is the data transmission destination, via the mail server 50, for the receiving system 60 to download the encrypted data set from the external repository 40 and then decrypt and extract the data. Meanwhile, in ISO / TS22691, an HI-TOKEN (Health Information Token) is defined, which describes information required for downloading in order to exchange medical data between facilities via a repository. In light of this, the download-related information is also referred to as an "HI token" below. The HI token includes, for example, a data set ID, which is an identification code of the target data set, and a common key (session key) used to encrypt the target data set. The HI token is transmitted in the form of an encrypted HI token encrypted with a private key of the receiving system 60, which is the data transmission destination.

[0025] The receiving system 60, which has received the encrypted HI token from the sending system 20 via the mail server 50, uses its own private key to decrypt the encrypted HI token and generate a decrypted HI token. Then, it downloads the encrypted data set from the external repository 40 using the data set ID (decryption data set ID) included in the decrypted HI token, and then performs decryption and extraction using the common key (decryption common key) included in the decrypted HI token.

[0026] The authentication server 30 performs authentication (grant of access authority) when the sending system 20 and the receiving system 60 access the external repository 40 .

[0027] [A-1-2. Transmitting system 20] (A-1-2-1. Overview of the transmitting system 20) The transmitting system 20 is used by a medical institution that transmits medical data (target data set). As described above, the transmitting system 20 transmits the medical data (target data set) encrypted with a common key to the receiving system 60, which is the data transmission destination, via the external repository 40, and also transmits an HI token encrypted with the public key of the receiving system 60 to the receiving system 60, which is the data transmission destination, via the mail server 50.

[0028] As shown in FIG. 1, the transmitting system 20 includes a PACS 200, an electronic medical record system 210, an SS-MIX standardized storage 220, a transmitting gateway terminal 230, and a router 240. The PACS 200 is a medical image management system. PACS is an abbreviation of "Picture Archiving and Communication System". The electronic medical record system 210 is a system that manages electronic medical records. The SS-MIX standardized storage 220 is a storage standardized by the "Ministry of Health, Labor and Welfare Electronic Medical Information Exchange Promotion Project" (SS-MIX: Standardized Structured Medical Information eXchange). The transmitting gateway terminal 230 transmits medical data stored in the PACS 200, the electronic medical record system 210, and the SS-MIX standardized storage 220 to the receiving system 60. The router 240 is a device for connecting the transmitting gateway terminal 230 and the like to a communication network 70 (Internet). The router 240 in this embodiment is not a VPN (Virtual Private Network) type, but may be a VPN type.

[0029] (A-1-2-2. Transmitting gateway terminal 230) 2 is a schematic configuration diagram of the sending gateway terminal 230 according to this embodiment. As described above, the sending gateway terminal 230 transmits medical data stored in the PACS 200, the electronic medical record system 210, and the SS-MIX standardized storage 220 to the receiving system 60. As the sending gateway terminal 230, for example, a general personal computer (desktop type, notebook type, etc.) can be used. Alternatively, the sending gateway terminal 230 may be another information terminal such as a smartphone or a tablet terminal.

[0030] As shown in FIG. 2, the sending gateway terminal 230 has a communication device 2300, an input / output device 2310, a control device 2320, and a storage device 2330. In addition, the sending gateway terminal 230 may have an authentication device (not shown) for personal authentication. The communication device 2300 can communicate with the authentication server 30, the external repository 40, and the mail server 50 via the router 240 and the communication network 70 (FIG. 1). The input / output device 2310 accepts input from a user of the sending gateway terminal 230 (a person in charge of the sending medical institution (a doctor, a system person, an assistant, an office worker, etc.)) and outputs to the user. The input / output device 2310 includes a keyboard 2311 and a mouse 2312 as input devices, and a display device 2313 as an output device.

[0031] The control device 2320 controls the entire transmission side gateway terminal 230. In this embodiment, the control device 2320 performs processing related to the transmission of medical data. The storage device 2330 stores software executed by the control device 2320 and various data.

[0032] As shown in FIG. 2, the control device 2320 includes an export processing unit 2321, an upload data generating unit 2322, an upload unit 2323, an HI token generating unit 2324, an HI token destination management unit 2325, and an HI token transmitting unit 2326. The export processing unit 2321 executes a process (export process) of exporting medical data to be transmitted to a destination medical institution (receiving system 60). The upload data generating unit 2322 generates data (target data set) to be uploaded to the external repository 40. The upload unit 2323 uploads the target data set to the external repository 40. The HI token generating unit 2324 generates an HI token (described later). The HI token destination management unit 2325 manages the destination of the HI token. The HI token transmitting unit 2326 transmits the HI token. As described later, in this embodiment, the HI token is transmitted as the body of an encrypted e-mail.

[0033] [A-1-3. Authentication Server 30] The authentication server 30 (FIG. 1) performs authentication (grant of access authority) when the sending system 20 and the receiving system 60 access the external repository 40. The authentication server 30 includes a communication device, an input / output device, a control device, and a storage device, all of which are not shown.

[0034] [A-1-4. External repository 40] As described above, the external repository 40 temporarily stores medical data (target data set) and relays data transfer from the transmitting system 20 to the receiving system 60. The external repository 40 can be configured as, for example, a storage server. Alternatively, the external repository 40 may be configured as a Network Attached Storage (NAS). The external repository 40 has a communication device, an input / output device, a control device, and a storage device, which are not shown.

[0035] [A-1-5. Mail Server 50] The mail server 50 relays transmission of the encrypted HI token (including the encrypted data set ID and the encrypted common key) from the sending system 20 to the receiving system 60. The mail server 50 has a communication device, an input / output device, a control device, and a storage device, which are not shown.

[0036] [A-1-6. Receiving system 60] (A-1-6-1. Overview of Receiving System 60) The receiving system 60 is used in a medical institution that receives medical data (target data set). As described above, the receiving system 60 receives the HI token from the transmitting system 20 via the mail server 50, and also receives the medical data (target data set) from the transmitting system 20 via the external repository 40.

[0037] As shown in FIG. 1, the receiving system 60 includes a router 600, a receiving gateway terminal 610, a RIS terminal 620, a PACS 630, an electronic medical record system 640, and an SS-MIX standardized storage 650. The router 600 is a device for connecting the receiving gateway terminal 610 and the like to a communication network 70 (Internet). The router 600 in this embodiment is not a VPN type, but may be a VPN type. The receiving gateway terminal 610 imports each medical data included in the target data set from the transmitting system 20 to the PACS 630, the electronic medical record system 640, and the SS-MIX standardized storage 650. The RIS terminal 620 is a radiology information system. The PACS 630 is a medical image management system. The electronic medical record system 640 is a system for managing electronic medical records. The SS-MIX standardized storage 650 is a storage standardized by SS-MIX.

[0038] (A-1-6-2. Receiving gateway terminal 610) 3 is a schematic configuration diagram of the receiving side gateway terminal 610 according to this embodiment. As described above, the receiving side gateway terminal 610 imports each medical data included in the target data set from the transmitting side system 20 into the PACS 630, the electronic medical record system 640, and the SS-MIX standardized storage 650. As the receiving side gateway terminal 610, for example, a general personal computer (desktop type, notebook type, etc.) can be used. Alternatively, the transmitting side gateway terminal 230 may be another information terminal such as a smartphone or a tablet terminal.

[0039] As shown in FIG. 3, the receiving gateway terminal 610 has a communication device 6100, an input / output device 6110, a control device 6120, and a storage device 6130. In addition, the receiving gateway terminal 610 may have an authentication device (not shown) for personal authentication. The communication device 6100 can communicate with the authentication server 30, the external repository 40, and the mail server 50 via the router 600 and the communication network 70 (FIG. 1). The input / output device 6110 accepts input from a user of the receiving gateway terminal 610 (a person in charge (doctor, system person, assistant, office worker, etc.) of the destination medical institution) and outputs to the user. The input / output device 6110 includes a keyboard 6111 and a mouse 6112 as input devices, and a display device 6113 as an output device.

[0040] The control device 6120 controls the entire receiving gateway terminal 610. In this embodiment, the control device 6120 performs processing related to reception of medical data. The storage device 6130 stores software executed by the control device 6120 and various data. The various data here includes medical data received from the transmitting system 20 via the external repository 40 (details will be described later).

[0041] As shown in FIG. 3, the control device 6120 includes an HI token receiving unit 6121, a download unit 6122, a decoding / expansion unit 6123, a received information management unit 6124, and an import processing unit 6125. The HI token receiving unit 6121 receives an HI token (e-mail) from the transmission-side system 20 via the mail server 50. The download unit 6122 downloads an encrypted data set from the external repository 40. The decoding / expansion unit 6123 decodes and expands the encrypted data set. The received information management unit 6124 manages the received target data set, etc. before and after the import processing. The import processing unit 6125 executes a process (import process) of importing the decoded / expanded target data set (or each medical data (file) included therein).

[0042] <A-2. Processing in this Embodiment> [A-2-1. Overview] Next, the processing in this embodiment will be described. As described above, in this embodiment, an encrypted data set is transmitted from the transmission-side system 20 to the reception-side system 60 via the external repository 40 using the symmetric key encryption method. Also, an encrypted HI token (including an encrypted data set ID and an encrypted common key) is transmitted from the transmission-side system 20 to the reception-side system 60 via the mail server 50 using the public key encryption method.

[0043] [A-2-2. Processing at the Time of Transmitting Medical Data] FIG. 4 is a diagram showing the flow of processing at the time of transmitting medical data in this embodiment. In FIG. 4, it includes processing for temporarily storing an encrypted data set from the transmission-side system 20 to the external repository 40, and processing for transmitting an encrypted HI token (e-mail) from the transmission-side system 20 to the reception-side system 60 via the mail server 50.

[0044] In step S101 of Fig. 4, the transmitting system 20 (the transmitting gateway terminal 230) performs an export process. The export process is a process for exporting medical data to be transmitted to a destination medical institution (the receiving system 60). In the export process, the transmitting system 20 displays a transmission setting screen (not shown) for allowing a user of the transmitting system 20 to perform transmission settings for a target data set.

[0045] The transmission setting screen includes, for example, a patient name input field, an examination input field, a medical data input field, a transmission destination input field, and a send button (none of which are shown). The patient name input field is an input field for the name of a patient whose medical data is to be transmitted to a destination medical institution. The examination input field is an input field for the examination details that specify the medical data to be transmitted. The medical data input field is a field for inputting one or more pieces of medical data to be transmitted (e.g., data on a medical information report, an image file showing test results, prescription data) contained in the target data set. The transmission destination input field is a field for inputting the transmission destination of one or more target data sets selected from multiple receiving systems 60.

[0046] When inputting data into the patient name input field, the examination input field, and the medical data input field, the sending system 20 (the sending gateway terminal 230) may assist the user's input by acquiring data as appropriate from the PACS 200, the electronic medical record system 210, or the SS-MIX standardized storage 220 and using a user interface that is easy for the user to input data. Examples of such a user interface include keyword search and thumbnail display of image data. Similarly, when inputting data into the destination input field, the sending system 20 (the sending gateway terminal 230) may assist the user's input by acquiring data of the destination medical institution (the receiving system 60) from another external server (for example, an account management server (not shown) that manages the account information of each medical institution) and using a user interface that is easy for the user to input data.

[0047] The send button is a button for issuing a command to send the target data set to the destination. When the send button is pressed, the following steps S102 to S110 are automatically performed by the sending system 20 etc. Note that some of the export process (e.g., selection of the destination, selection of medical data (file) to be sent) can be performed in the same manner as in Patent Document 1.

[0048] In step S102, the transmitting system 20 generates a session key (common key) for encrypting the target data set and a target data set ID. As the session key (common key), for example, a password as a character string consisting of a predetermined number of letters, numbers, and symbols randomly combined can be used. Also, as the target data set ID, for example, a character string consisting of a predetermined number of letters, numbers, and symbols randomly combined can be used.

[0049] In step S103, the transmitting system 20 requests the authentication server 30 for access authority to the external repository 40. The request includes authentication information of the transmitting system 20. The authentication information may include, for example, an account number and an account password of the transmitting system 20. In step S104, the authentication server 30 grants access authority to the transmitting system 20. More specifically, the authentication server 30 uses the authentication information included in the request from the transmitting system 20 to confirm (authenticate) whether the transmitting system 20 is permitted to access the external repository 40. If the authentication is successful, the authentication server 30 transmits a token (access token) indicating access authority to the transmitting system 20.

[0050] In step S105, the transmitting system 20 encrypts the target data set with a session key (common key) to generate an encrypted data set. In step S106, the transmitting system 20 transmits the encrypted data set to the external repository 40. At this time, the transmitting system 20 adds an access token indicating access authority and an unencrypted data set ID (unencrypted data set ID).

[0051] In step S107, the external repository 40 temporarily stores the encrypted data set from the sending system 20. More specifically, the external repository 40 confirms that there is access authority based on the access token from the sending system 20. Next, the external repository 40 records a combination of the encrypted data set and the unencrypted data set ID in a storage device (not shown). When the temporary storage is completed, the sending system 20 is notified of the completion of the temporary storage. This notification enables the sending system 20 to confirm the completion of the temporary storage.

[0052] In step S108, the transmitting system 20 generates an HI token in the form of an e-mail. The HI token includes, for example, a session key (common key) and a data set ID. The contents of the HI token are included as the body of the e-mail. In addition to the HI token, contents to be included in the e-mail (for example, the e-mail address of the receiving system 60 as the destination) are also generated.

[0053] In step S109, the sending system 20 encrypts the HI token (mail body) with the public key of the destination receiving system 60 to generate an encrypted HI token. The encrypted HI token includes an encrypted data set ID and a common key (i.e., an encrypted data set ID and an encrypted common key). The public key of the destination receiving system 60 is obtained, for example, from another external server (not shown) (for example, a public key management server (not shown) that manages the public keys of each medical institution or the account management server). Also, S / MIME (Secure / Multipurpose Internet Mail Extensions) can be used.

[0054] In step S110, the sending system 20 transmits an e-mail including the encrypted HI token to the mail server 50. At this time, SMTPS (SMTP over SSL / TLS) can be used as the protocol. In step S111, the mail server 50 temporarily stores the e-mail from the sending system 20 in its own storage device (not shown).

[0055] In step S112, the receiving system 60 accesses the mail server 50 at a predetermined timing (for example, every 10 minutes) to check whether or not there is any new mail. In step S113, if there is any new mail (encrypted HI token), the mail server 50 transmits (transfers) it to the receiving system 60. In step S114, the receiving system 60 receives the new mail (encrypted HI token) from the mail server 50. Note that steps S112 to S114 can also be considered as processing when receiving medical data.

[0056] [A-2-3. Processing when receiving medical data] Fig. 5 is a diagram showing the flow of processing when receiving medical data in this embodiment. Fig. 5 includes processing for downloading, decrypting, and extracting the encrypted data set from the external repository 40 by the receiving system 60 after receiving the encrypted HI token (email). Steps S201 to S208 in Fig. 5 are automatically performed by the receiving system 60 or the like without involving any operation by the user of the receiving system 60.

[0057] In step S201, the receiving system 60 receives a new mail (encrypted HI token) from the mail server 50. Step S201 is the same as step S114 in Fig. 4, and is described in each of Figs. 4 and 5 for ease of understanding.

[0058] In step S202, the receiving system 60 decrypts the encrypted HI token (mail body) included in the e-mail with its own private key, and generates a decryption session key (decryption common key) and a decryption data set ID.

[0059] In step S203, the receiving system 60 requests the authentication server 30 for access authority to the external repository 40. The request includes authentication information of the receiving system 60. The authentication information may include, for example, an account number and an account password of the receiving system 60. In step S204, the authentication server 30 grants access authority to the receiving system 60. More specifically, the authentication server 30 uses the authentication information included in the request from the receiving system 60 to confirm (authenticate) whether the receiving system 60 is permitted to access the external repository 40. If the authentication is successful, the authentication server 30 transmits a token (access token) indicating the access authority to the receiving system 60.

[0060] In step S205, the receiving system 60 requests the external repository 40 to transmit the encrypted data set corresponding to the decrypted data set ID. At this time, the receiving system 60 adds an access token indicating access authority.

[0061] In step S206, the external repository 40 reads the encrypted data set corresponding to the decrypted data set ID from the receiving system 60 from its own data storage (not shown) and transmits it to the receiving system 60. More specifically, the external repository 40 verifies that there is access authority based on the access token from the receiving system 60. Then, the external repository 40 reads the encrypted data set identified by the unencrypted data set ID that corresponds to (or matches) the decrypted data set ID from the receiving system 60 from the data storage and transmits it to the receiving system 60.

[0062] In step S207, the receiving system 60 receives the encrypted data set from the external repository 40, decrypts it with the decryption session key (common decryption key), and then unpacks it. The unpacked medical data (file) is stored in the storage device 6130 of the receiving gateway terminal 610. In step S208, the receiving system 60 updates a list of downloaded target data sets (downloaded list). That is, information on the currently downloaded target data set is added to the downloaded list.

[0063] In step S209, the receiving system 60 performs an import process. The import process is a process of importing the target data set received from the transmitting system 20 or each medical data included therein (particularly, the target data set that has already been downloaded or each medical data included therein).

[0064] In the import process, the receiving system 60 displays a downloaded list screen (dataset list screen) (not shown) including a downloaded list of target datasets to be imported or each medical data included therein that can be selected by the user of the receiving system 60. When one of the target datasets is selected by the user of the receiving system 60 on the downloaded list screen, the receiving system 60 displays a dataset detailed information screen (not shown) including detailed information on the selected target dataset.

[0065] The dataset detailed information screen may include, for example, the name of the medical institution that sent the data, the patient name, a thumbnail display of the image data (file), a content display field for the target dataset (or each medical data included therein), and an import destination input field. As the import destination, in the case of image data, PACS 630 or the like is specified, and in the case of medical information reports, test results, and prescriptions, the electronic medical record system 640, the SS-MIX standardized storage 650, or the like is specified.

[0066] In addition, in order to associate and manage each patient data at the destination medical institution, in this embodiment, the RIS terminal 620 manages the patient data at the highest level. Therefore, in order to associate the patient data managed by the RIS terminal 620 with the patient data (target data set) received from the transmitting system 20, an import command must be issued from the RIS terminal 620 when importing the target data set (or each medical data included therein).

[0067] Therefore, in this embodiment, it is possible to complete the process up to step S208 in Fig. 5 before the patient arrives at the destination medical institution. On the other hand, as for the import process, when the patient arrives at the destination medical institution, the RIS terminal 620 issues an import command to the receiving gateway terminal 610, and then the data is imported into the PACS 630, electronic medical record system 640, SS-MIX standardized storage 650, etc. by a system staff member on the receiving system 60 side.

[0068] When the patient is a first-time visit to the receiving medical institution, the basic data (such as patient ID number) of the patient is input and recorded in the RIS terminal 620. Then, an import command is issued from the RIS terminal 620 to the receiving gateway terminal 610. The user of the receiving gateway terminal 610 confirms that the patient specified by the import command is the same as the patient of the target dataset downloaded by the receiving gateway terminal 610, and then performs imports to the PACS 630, the electronic medical record system 640, the SS-MIX standardized storage 650, etc.

[0069] When the patient is a revisit to the receiving medical institution, similar to the case of a first-time visit, the user of the receiving gateway terminal 610 confirms that the patient specified by the import command is the same as the patient of the target dataset downloaded by the receiving gateway terminal 610, and then performs imports to the PACS 630, the electronic medical record system 640, the SS-MIX standardized storage 650, etc. Alternatively, for example, when the association between the patient ID information in the sending medical institution and the patient ID information in the receiving medical institution is already completed and the patient ID information in the sending medical institution is included in the decrypted HI token, the receiving gateway terminal 610 may import each medical data of the downloaded target dataset to the PACS 630, the electronic medical record system 640, the SS-MIX standardized storage 650, etc. without an import command from the RIS terminal 620. In this case, the import can be either by user operation or automatically performed by the receiving gateway terminal 610.

[0070] Note that the role of the above-mentioned RIS terminal 620 may be assumed by a hospital information system (HIS: Hospital Information Systems). Also, a part of the import process can be performed in the same manner as in Patent Document 1.

[0071] <A-3. Effects of this Embodiment> According to this embodiment, the transmitting system 20 transmits the encrypted data set ID and the encrypted common key encrypted with the public key of the receiving system 60 to the receiving system 60 (S110 to S114 in FIG. 4). Then, the receiving system 60 acquires the encrypted target data set from the external repository 40 using the decrypted data set ID decrypted with its own private key (S205, S206 in FIG. 5), and decrypts and expands the target data set using the decrypted common key decrypted with its own private key (S207). This allows the encrypted data set ID (which replaces the token in Patent Document 1) to be delivered to the receiving system 60 through communication between the transmitting system 20 and the receiving system 60 without the patient having to carry it. Therefore, the receiving system 60 can download the medical data before the patient comes to the medical institution to which the medical data is to be transmitted. This makes it possible to facilitate the examination and the like after the patient comes to the medical institution to which the medical data is to be transmitted.

[0072] Furthermore, the target data set, which is a set of medical data to be transmitted, is encrypted and decrypted with a common key (S105 in FIG. 4, S207 in FIG. 5), while the data set ID and the common key are encrypted and decrypted with the public key and private key of the receiving system 60 (S109 in FIG. 4, S202 in FIG. 5). This makes it possible to ensure security while reducing the computational load by using encryption and decryption with a common key for the target data set, which may have a relatively large data size. On the other hand, for the data set ID and the common key, which may have a relatively small data size, higher security can be ensured by using encryption and decryption with the public key and private key of the receiving system 60 (and by combining with a common key cryptography method for the target data set).

[0073] In this embodiment, the transmitting system 20 displays a transmission setting screen where the user of the transmitting system 20 sets up transmission of the target data set (S101 in FIG. 4). The transmission setting screen includes a destination input field for inputting a transmission destination of one or more target data sets selected from a plurality of receiving systems 60, a medical data input field for inputting one or more medical data to be transmitted that are included in the target data set, and a transmission button for issuing a command to transmit the target data set to the transmission destination (S101 in FIG. 4). This allows the transmission setting screen to be used to input the transmission destination, input the medical data to be transmitted that are included in the target data set, and issue a transmission command. This makes it possible to improve the operability of the transmitting system 20 for the user.

[0074] In this embodiment, when the send button is pressed on the send setting screen, the sending system 20 generates the data set to be encrypted, the encrypted data set ID, and the encrypted common key (S102, S105, S108, S109 in FIG. 4), sends the data set to be encrypted and the unencrypted data set ID to the external repository 40 (S106), and sends the encrypted data set ID and the encrypted common key to the receiving system 60 (S110). This makes it possible to improve operability for the user of the sending system 20.

[0075] In this embodiment, the receiving system 60 displays a dataset list screen (downloaded list) that can selectively display one or more target datasets for which reception of an encrypted target dataset from one or more transmitting systems 20 via the external repository 40 and subsequent decryption and expansion have been completed (S208 in FIG. 5). On the dataset list screen, when one of the target datasets is selected by the user of the receiving system 60, the receiving system 60 displays a dataset detailed information screen including detailed information on the selected target dataset. As a result, time-consuming reception (download), decryption, and expansion proceed without waiting for the operation of the user of the receiving system 60, making it possible to further enhance the effect of preventing delay. In addition, the user of the receiving system 60 can confirm the detailed information of the target dataset for which reception, decryption, and expansion have been completed with a simple operation.

[0076] B. Modification Note that the present invention is not limited to the above embodiment, and various configurations can of course be adopted based on the description in this specification. For example, the following configurations can be adopted.

[0077] <B-1. Configuration> The transmission / reception system 10 of the above embodiment included an authentication server 30 for the transmission system 20 and the reception system 60 to acquire access rights to the external repository 40 (FIG. 1). However, for example, focusing on the point of transmitting an encrypted dataset using a symmetric key encryption method and transmitting an encrypted dataset ID and an encrypted symmetric key using an asymmetric key encryption method, it is not limited to this, and it is also possible to omit the authentication server 30.

[0078] The transmission and reception system 10 of the above-described embodiment included a mail server 50 for transmitting HI tokens in the form of e-mail (FIG. 1). However, for example, focusing on the point that the encrypted data set ID and the encrypted common key are transmitted from the transmitting system 20 to the receiving system 60 via a communication path different from the encrypted data set, it is not limited to this. For example, it is also possible to establish a communication path between the transmitting system 20 and the receiving system 60 without going through the mail server 50 and perform direct communication between the two.

[0079] <B-2. Control> In the above-described embodiment, the medical data (target data set) was transmitted in the order shown in FIG. 4. However, for example, focusing on the point that the encrypted data set is transmitted using the common key encryption method and the encrypted data set ID and the encrypted common key are transmitted using the public key encryption method, it is not limited to this. For example, the generation of the HI token (S108) may be performed before the temporary storage (S106, S107) of the encrypted data set in the external repository 40.

[0080] In the above-described embodiment, the target data set as medical data was transmitted from the transmitting system 20 to the receiving system 60 (FIG. 4). However, for example, focusing on the point that the encrypted data set is transmitted via the external repository 40 using the common key encryption method and the encrypted data set ID and the encrypted common key are transmitted using the public key encryption method, it is not limited to this. For example, the data to be transmitted may be other than medical data (for example, content data such as a movie).

[0081] In the above-described embodiment, the target data set as a set of data (data file) that may include a plurality of data was transmitted from the transmitting system 20 to the receiving system 60 (FIG. 4). However, for example, focusing on the point that the encrypted data is transmitted via the external repository 40 using the common key encryption method and the ID of the encrypted data and the encrypted common key are transmitted using the public key encryption method, it is not limited to this. For example, the data (data file) to be transmitted may be only one.

[0082] In the above embodiment, the description has been given assuming a case where the target data set is transmitted to one receiving system 60 as one transmission destination (FIG. 4). However, for example, if attention is paid to the fact that the encrypted data set is transmitted via the external repository 40 using a common key cryptosystem and the encrypted data set ID and the encrypted common key are transmitted using a public key cryptosystem, the present invention is not limited to this, and it is also possible to transmit the same target data set collectively to multiple receiving systems 60. This makes it possible, for example, when an emergency occurs to a patient and the patient needs to be urgently transferred to another medical institution, to transmit the target data set collectively to multiple other medical institutions that are candidates for the transfer destination.

[0083] When the same target data set is transmitted to a plurality of destinations in this way, a plurality of receiving systems 60 are set (or input) as destinations of the same target data set in the export process (S101 in FIG. 4). Then, one target data set (encrypted data set) encrypted with a common symmetric key for the plurality of destinations is temporarily stored in the external repository 40 (S106, S107). In addition, an encrypted HI token (including an encrypted data set ID and an encrypted symmetric key) is generated (S109) using the public key of each of the plurality of destinations (receiving systems 60), and the encrypted HI token is transmitted to each destination (S110). For example, an encrypted HI token for destination A is generated using the public key of destination A and transmitted to destination A. In addition, an encrypted HI token for destination B is generated using the public key of destination B and transmitted to destination B.

[0084] Then, each destination (receiving system 60) decrypts the encrypted HI token using its own private key (S202 in FIG. 5), downloads the encrypted data set from the external repository 40, and performs decryption and extraction (S205 to S207). This makes it possible to transmit the same target data set to multiple destinations collectively while ensuring security. Here, by making the common key common to each of the multiple destinations, it becomes possible to reduce the load of generating the encrypted data set in the transmitting system 20 and the load of transmitting (uploading) the encrypted data set to the external repository 40.

[0085] Instead of using a common common key for multiple destinations, it is also possible to use separate common keys for multiple destinations. In this case, since the common key is different for each destination (in other words, for each encrypted data set), the encrypted data set is stored separately for each destination in the external repository 40. In addition, the data set ID used to identify the encrypted data set in the external repository 40 must also be different for each destination (in other words, for each encrypted data set). [Explanation of symbols]

[0086] 10... Medical data transmission / reception system 20... Transmitting system 30: Authentication server 40: External repository 50...Mail server 60...Receiving system 70…Communications network

Claims

1. A transmitting side system in a medical institution that transmits medical data; A receiving system in a medical institution that receives the medical data; an external repository that temporarily stores the medical data and relays data transfer from the sending system to the receiving system; A medical data transmission and reception system comprising: The sending system includes: A target dataset, which is a set of medical data to be transmitted, is encrypted with a common key to generate an encrypted target dataset; encrypting a data set ID, which is an identification code of the target data set, and the common key with a public key of the receiving system to generate an encrypted data set ID and an encrypted common key; Transmitting the data set to be encrypted and an unencrypted data set ID, which is an unencrypted data set ID, to the external repository; Transmitting the encrypted data set ID and the encrypted common key to the receiving system via an external server or directly; The external repository records the encryption target data set and the unencrypted data set ID received from the transmitting system, The receiving system includes: decrypting the encrypted data set ID and the encrypted common key received from the transmitting system using a private key of the receiving system to generate a decrypted data set ID and a decryption common key; Requesting the external repository to transmit the encrypted data set identified by the decryption data set ID; The external repository transmits to the receiving system the encryption target data set identified by the unencrypted data set ID corresponding to the decrypted data set ID received from the receiving system; The receiving system decrypts the encrypted target data set received from the external repository with the decryption common key, and expands and records each medical data included in the decrypted target data set. A medical data transmission and reception system comprising:

2. A transmitting side system in a medical institution that transmits medical data, the transmitting system transmits the medical data to a receiving system in a medical institution that receives the medical data via an external repository that temporarily stores the medical data; Furthermore, the transmitting system A target dataset, which is a set of medical data to be transmitted, is encrypted with a common key to generate an encrypted target dataset; encrypting a data set ID, which is an identification code of the target data set, and the common key with a public key of the receiving system to generate an encrypted data set ID and an encrypted common key; Transmitting the data set to be encrypted and an unencrypted data set ID, which is an unencrypted data set ID, to the external repository; The encrypted data set ID and the encrypted common key are transmitted to the receiving system via an external server or directly. A transmitting system comprising:

3. 3. The transmitting system according to claim 2, The transmitting side system displays a transmission setting screen for allowing a user of the transmitting side system to perform transmission setting of the target data set; The transmission setting screen is A destination input field for inputting a destination of one or more of the target data sets selected from a plurality of the receiving systems; a medical data input field for inputting one or more pieces of medical data to be transmitted that are included in the target data set; a transmission button for instructing the transmission of the target data set to the transmission destination; Includes A transmitting system comprising:

4. 4. The transmitting system according to claim 3, When the send button is pressed on the send setting screen, the sending system generates the data set to be encrypted, the encrypted data set ID, and the encrypted common key, transmits the data set to be encrypted and the unencrypted data set ID to the external repository, and transmits the encrypted data set ID and the encrypted common key to the receiving system. A transmitting system comprising:

5. A receiving system in a medical institution that receives medical data, the receiving system receives the medical data from a transmitting system in a medical institution that transmits the medical data via an external repository that temporarily stores the medical data; Furthermore, the receiving system Receive from the transmitting system via an external server or directly an encrypted data set ID in which a data set ID, which is an identification code of a target data set that is a set of medical data to be transmitted from the transmitting system, is encrypted with the public key of the receiving system, and an encrypted common key in which a common key used to encrypt the target data set is encrypted with the public key of the receiving system; decrypting the encrypted data set ID and the encrypted common key with a private key of the receiving system to generate a decrypted data set ID and a decryption common key; requesting the external repository to transmit an encrypted target data set, the target data set being encrypted by the common key in the transmitting system, the encrypted target data set being identified by the decrypted data set ID; The encrypted target data set received from the external repository is decrypted with the decryption common key, and each medical data included in the decrypted target data set is expanded and recorded. A receiving system comprising:

6. 6. The receiving system according to claim 5, The receiving system displays a dataset list screen including a dataset list displaying one or more of the target datasets for which reception of the encrypted target datasets from one or more sending systems via the external repository and subsequent decryption and extraction have been completed in a selectable manner; When a user of the receiving system selects one of the target datasets on the dataset list screen, the receiving system displays a dataset detail information screen including detailed information about the selected target dataset. A receiving system comprising:

7. A sending system at a sending side of data; a receiving system at a receiving end of the data; an external repository that temporarily stores the data and relays data transfer from the sending system to the receiving system; A data transmission / reception method executed in a data transmission / reception system having the following features: The sending system includes: A target data set, which is a set of data to be transmitted, is encrypted with a common key to generate an encrypted target data set; encrypting a data set ID, which is an identification code of the target data set, and the common key with a public key of the receiving system to generate an encrypted data set ID and an encrypted common key; Transmitting the data set to be encrypted and an unencrypted data set ID, which is an unencrypted data set ID, to the external repository; Transmitting the encrypted data set ID and the encrypted common key to the receiving system via an external server or directly; The external repository records the encryption target data set and the unencrypted data set ID received from the transmitting system, The receiving system includes: decrypting the encrypted data set ID and the encrypted common key received from the transmitting system using a private key of the receiving system to generate a decrypted data set ID and a decryption common key; Requesting the external repository to transmit the encrypted data set identified by the decryption data set ID; The external repository transmits to the receiving system the encryption target data set identified by the unencrypted data set ID corresponding to the decrypted data set ID received from the receiving system; The receiving system decrypts the encrypted target data set received from the external repository with the decryption common key, expands the data into each data included in the decrypted target data set, and records the data. A data transmission and reception method comprising:

Images