Automatic network provisioning of a medical device

Patent metadata

Field	Value
Publication number	US-12549602-B2
Application number	US-202318378123-A
Country	US
Kind code	B2
Filing date	Oct 9, 2023
Priority date	Mar 6, 2019
Publication date	Feb 10, 2026
Grant date	Feb 10, 2026

Abstract

One or more medical devices are configured to connect to a predetermined temporary provisioning network of a healthcare organization, the temporary provisioning network being different than a healthcare network of the healthcare organization. After the devices are received by the healthcare organization, and powered up for the first time, device identifiers corresponding to the medical devices are received at a server remote from the healthcare organization, from the temporary provisioning network, together with an indication that the medical devices are requesting access to a management server within a healthcare network of the healthcare organization. On determining that the medical devices are predetermined to receive access to the management server, a provisioning service configures, through the temporary provisioning network, the medical devices to access and communicate with the management server, and informs the management server that the medical devices have been configured to access and communicate with the management server.

First claim

What is claimed is:

1 . A medical device, comprising:
a non-volatile data storage unit storing (a) predetermined provisioning network connection information and (b) a first certificate for configuring the medical device to access and communicate with a first server; one or more processors; and memory including instructions that, when executed by the one or more processors, cause the one or more processors to: determine a cancellation of the first certificate; upon activation of the medical device, after the cancellation is determined, determine that the activation is at a healthcare facility, wherein the first certificate was received from a production server external to the healthcare facility and distinct from a management server associated with the healthcare facility; establish, based on the activation and the cancellation, a first network connection with a provisioning network in the healthcare facility based at least in part on the predetermined provisioning network connection information, wherein the medical device was configured by the production server to connect to the provisioning network before the cancellation of the first certificate; transmit, via the first network connection, identification information uniquely identifying the medical device; receive, via the first network connection, a second certificate and facility network connection information for accessing a second network different than the provisioning network and for communicating with a management server, wherein the management server is accessible via the second network, and the provisioning network is publicly accessible, while the second network is protected from unauthorized access; terminate the first network connection with the provisioning network; and establish, after receiving the second certificate and facility network connection information, a second network connection with the management server based on the second certificate and facility network connection information.

2 . The medical device of claim 1 , wherein the one or more processors is further caused to:
receive the second certificate from a provisioning server distinct from the management server, the second certificate being associated with an identifier for the medical device.

3 . The medical device of claim 1 , wherein the one or more processors being caused to determine the cancellation comprises:
the one or more processors being caused to receive a revocation of the first certificate from the management server.

4 . The medical device of claim 1 , wherein the cancellation is determined based on an expiration time for the first certificate.

5 . The medical device of claim 1 , wherein the first server is distinct from the management server.

6 . The medical device of claim 1 , wherein the predetermined provisioning network connection information comprises a service set identifier (SSID), and wherein establishing the first network connection comprises wirelessly scanning for a broadcast message including the SSID.

7 . The medical device of claim 1 , wherein the memory includes instructions to further cause the one or more processors to, upon establishing the second network connection, close the first network connection.

8 . The medical device of claim 1 , wherein the medical device comprises an infusion device, a ventilator device, a medicant dispensing device, a medication preparation device, or an automated dispensing device or a device coupled with an infusion device, a ventilator device, a medicant dispensing device, a medication preparation device, or an automated dispensing device.

9 . A machine implemented method, comprising:
configuring a medical device to connect to a predetermined temporary provisioning network responsive to the medical device being powered on in a healthcare organization, the temporary provisioning network being different than a healthcare network of the healthcare organization, wherein the healthcare network includes one or more services not accessible by the temporary provisioning network, and wherein the temporary provisioning network is publicly accessible, while the healthcare network is protected from unauthorized access; determining a first certificate installed on the medical device should be cancelled, wherein the first certificate was received from a production server external to the healthcare organization; sending an instruction to the medical device to cancel the first certificate, the medical device having been configured by the production server to connect to the temporary provisioning network before the instruction to cancel the first certificate is sent to the medical device; receiving, at a first server remote from the healthcare organization, from the temporary provisioning network, an indication of a request from the medical device to access the healthcare network; determining, when the indication of the request is received, that the medical device is predetermined to receive access to a management server within the healthcare network and distinct from the production server, and that a certificate for access to the management server is not configured on the medical device; based on determining that the medical device is predetermined to receive access to the management server and that a certificate is not configured on the medical device: configuring, through the temporary provisioning network, the medical device with a second certificate and connection information to access the healthcare network, and to communicate with the management server on the healthcare network using a new network connection based on the second certificate and connection information; terminating communication between the medical device and the temporary provisioning network; and electronically informing the management server that the medical device has been configured to access and communicate with the management server.

10 . The machine implemented method of claim 9 ,
wherein the second certificate is associated with an identifier for the medical device.

11 . The machine implemented method of claim 9 , further comprising:
determining that the first certificate expired, sending the instruction to revoke the first certificate based on determining that the first certificate expired.

12 . The machine implemented method of claim 9 , further comprising:
wherein the medical device is, before the first certificate is cancelled, configured by the production server to establish the new network connection to the temporary provisioning network when the medical device is activated for a first time or when the medical device is activated and not configured with a certificate to access and communicate with the management server.

13 . The machine implemented method of claim 9 , wherein the temporary provisioning network is configured to broadcast a service set identifier (SSID) preconfigured to be known by the medical device, and the medical device is configured to seek the SSID prior to being powered on for a first time.

14 . The machine implemented method of claim 9 , wherein the medical device comprises an infusion device, a ventilator device, a medicant dispensing device, a medication preparation device, or an automated dispensing device or a device coupled with an infusion device, a ventilator device, a medicant dispensing device, a medication preparation device, or an automated dispensing device.

15 . The machine implemented method of claim 9 , wherein the first server is distinct from the management server.

16 . The machine implemented method of claim 9 , wherein receiving the indi

Assignees

• Carefusion 303 Inc

Inventors

• Weiler Aron
• Gaetano Jeff
• Sullivan Brian

Classifications

• H04L63/0823

  using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263) · CPC title

• G16H40/40 Primary

  for the management of medical equipment or devices, e.g. scheduling maintenance or upgrades · CPC title

• G16H40/67 Primary

  for remote operation · CPC title

• H04L63/18 Primary

  using different networks or channels, e.g. using out of band channels (cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215) · CPC title