Processing-context-dependent pseudonymization of security-critical medical data via a network

Patent metadata

Field	Value
Publication number	US-9754127-B2
Application number	US-201414225723-A
Country	US
Kind code	B2
Filing date	Mar 26, 2014
Priority date	Jun 19, 2013
Publication date	Sep 5, 2017
Grant date	Sep 5, 2017

Abstract

An apparatus, a method and a product for transferring security-critical medical data records via a public network are disclosed. In order to be able to transmit security-critical data sections in pseudonymized form, a pseudonymization function is adaptively applied to the data records. The pseudonymization function is in each case calculated dynamically on the basis of a processing context that has been read in and that takes account of the planned user role, the planned intended use of the data processing and an application context.

First claim

What is claimed is:

1. An apparatus to transfer medical security-critical data records from a transmission station to at least one receiver station via a digital network, the apparatus comprising:
an input data interface configured to capture a medical security-critical data record to be transferred;
a context capture unit configured to capture a planned processing context for the medical security-critical data record;
a processor including a rulebook machine, the rulebook machine configured to store a multiplicity of variable rules for dynamically calculating pseudonymization functions, the rulebook machine further configured to be dynamically updated based on the captured planned processing context during operation of the apparatus;
wherein the processor is configured to execute computer-readable instructions to
calculate a pseudonymization function based on the multiplicity of variable rules,
apply the pseudonymization function to sections of the medical security-critical data record that are determined as critical to security, and
produce a pseudonymized data record for transfer to the at least one receiver station; and

wherein the captured planned processing context is indicative of a planned processing of the pseudonymized data record.

2. A method for transferring medical security-critical data records from a transmission station to at least one receiver station by a transfer apparatus via a digital network, the method comprising:
capturing a medical security-critical data record to be transferred;
capturing a planned processing context for the medical security-critical data record;
dynamically updating, during operation of the transfer apparatus, a rulebook machine based on the captured planned processing context, the rulebook machine storing a multiplicity of variable rules for dynamically calculating pseudonymization functions;
calculating a pseudonymization function based on the multiplicity of variable rules; and
applying the pseudonymization function to sections of the medical security-critical data record that are determined as critical to security to produce a pseudonymized data record for transfer to the at least one receiver station; wherein
the captured planned processing context is indicative of a planned processing of the pseudonymized data record.

3. The method of claim 2 , wherein the captured planned processing context takes account of at least one of:
a user role that the user has for the planned processing of the pseudonymized data record at the at least one receiver station;
at least one of an application context and an array of computer-based processing steps; and
a planned intended data use for the medical security-critical data record to the at least one receiver station.

4. The method of claim 3 , wherein the planned intended data use comprises at least one of:
use of the medical security-critical data record in at least one clinical study;
use of the medical security-critical data record for a remote technical service; and
use of the medical security-critical data record for remote medical appraisal.

5. The method of claim 2 , wherein the medical security-critical data record includes a medical image data record.

6. The method of claim 2 , wherein
the sections of the medical security-critical data record include a first section and a second section;
the applying applies the pseudonymization function to only the second section, from among the first and second sections, to pseudonymize the second section of the medical security-critical data record to produce the pseudonymized data record; and
the first section of the medical security-critical data record is left unaltered.

7. The method of claim 6 , further comprising:
flexibly selecting the first or the second section so that the pseudonymization function is adaptively applied to various portions of the medical security-critical data record.

8. The method of claim 6 , wherein
the first and second sections in the medical security-critical data record are not successive; and
neither the first nor the second section is a contiguous area in the medical security-critical data record.

9. The method of claim 2 , further comprising:
executing the captured planned processing context on the at least one receiver station or at least one further processing station associated with the at least one receiver station.

10. The method of claim 2 , wherein the calculating calculates the pseudonymization function by accessing the rulebook machine.

11. The method of claim 2 , wherein
the medical security-critical data record includes non-security-critical sections and security-critical sections; and
the method further includes automatically identifying the security-critical sections by way of PHI tags or elements for text structuring.

12. The method of claim 2 , wherein
the pseudonymization function is based on an optical character recognition engine; and
the method further includes executing the pseudonymization function by way of a de-identifier tool.

13. A computer program product, loadable or loaded into a memory of a computer-based transmission station, the computer program product comprising commands, readable by the computer-based transmission station, for executing the method of claim 2 when the commands are executed on the computer-based transmission station.

14. The method of claim 3 , wherein the application context includes a medical workflow with an array of planned computer-based processing steps in the application context.

15. The method of claim 5 , wherein the medical security-critical data record includes a medical image data record formatted based on a DICOM protocol.

16. The method of claim 6 , wherein neither the first nor the second section is distributed in the medical security-critical data record.

17. The method of claim 7 , wherein
the first and second sections in the medical security-critical data record are not successive; and
neither the first nor the second section is a contiguous area in the medical security-critical data record.

18. A non-transitory computer-readable storage medium storing computer-executable commands that, when executed on a computer-based transmission station, cause the computer-based transmission station to execute the method of claim 3 .

19. A non-transitory computer readable medium including program code segments that, when executed on a computer, cause the computer to implement the method of claim 2 .

Assignees

• Siemens Ag

Inventors

• König Helmut
• Pfeiffer Andreas
• Ukis Vladyslav

Classifications

• G06F21/00

  Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity · CPC title

• G06F21/6254 Primary

  by anonymising data, e.g. decorrelating personal data from the owner's identification · CPC title

• G06F19/322

  Physics · mapped topic

• G16H10/60 Primary

  for patient-specific data, e.g. for electronic patient records · CPC title