Multi-factor authentication for remote access of patient data
The present disclosure is directed to authenticating a mobile device and a user of the mobile device to receive patient data from a clinical information system of a medical facility. In some implementations, methods include receiving a logon request, the logon request comprising credentials and at least one technical factor, accessing a validation database based on the at least one technical factor, determining that the mobile device is an authorized mobile device based on information provided by the validation database and the at least one technical factor, validating the credentials to ensure that the user is authorized to access patient data provided by the clinical information system, and then, upon determining that the user is authorized to access patient data: establishing a session to communicate patient data between the mobile device and the clinical information system, the data managements system processing the patient data communicated during the session.
1. A computer-implemented method for authenticating a mobile device and a user of the mobile device to receive patient data, the computer-implemented method comprising:
receiving, by a data management system comprising one or more processors, a logon request, the logon request comprising credentials associated with the user and at least one technical factor associated with the mobile device, wherein the credentials comprise a username and a password;
accessing, by the data management system, a validation database based on one of the at least one technical factor and the credentials;
authenticating, by the data management system, the mobile device by determining that the mobile device is an authorized mobile device based on information provided by the validation database and the at least one technical factor and the credentials;
authenticating the user by comparing the credentials received at the data management system with authentication information stored at a first clinical information system of a first medical facility and a second clinical information system of a second medical facility by using the username as an index to retrieve a corresponding stored password that is matched to the password to validate the credentials to ensure that the user is authorized to access the patient data provided by the first clinical information system and the second clinical information system, from which the mobile device is configured to receive the patient data, wherein the first clinical information system is separate from the second clinical information system; and
in response to authenticating the mobile device and authenticating the user:
establishing a session to communicate the patient data between the mobile device and the first clinical information system and the second clinical information system through the data management system,
integrating, by the data management system, the patient data from a plurality of clinical information systems to generate integrated patient data, by synchronizing a portion of the patient data, the portion of the patient data being less than all of an available patient data within the plurality of clinical information systems, such that none of the available patient data is synchronized prior to establishing the session and the portion of the patient data is synchronized based on one or more configuration settings used by the plurality of clinical information systems and a custom rule defining data elements corresponding to the patient data that are to be synchronized, the configuration settings defining a first arrangement of a first set of patients within the first medical facility, each of the first set of patients corresponding to a respective first unit of a first set of units of the first medical facility and a second arrangement of a second set of patients within the second medical facility, each of the second set of patients corresponding to a respective second unit of a second set of units of the second medical facility and being automatically provided by a configuration module to the data management system,
processing, by the data management system, the integrated patient data communicated to the mobile device during the session to generate processed patient data, and
transmitting, by the data management system, the processed patient data to the mobile device for display independent of an operating system operating on the mobile device by using a connectivity mechanism matching the operating system of the mobile device.
2. The computer-implemented method of claim 1 , wherein the credentials comprise a username and a password.
3. The computer-implemented method of claim 1 , wherein the at least one technical factor comprises a device identification associated with the mobile device.
4. The computer-implemented method of claim 3 , wherein the mobile device comprises a mobile phone, and the at least one technical factor further comprises a telephone number associated with the mobile device.
5. The computer-implemented method of claim 1 , wherein the data management system comprises a web server and an application server.
6. The computer-implemented method of claim 5 , wherein the web server operates in a perimeter network and provides services to the application server and an external network, the perimeter network limiting access from the external network to the application server.
7. The computer-implemented method of claim 5 , wherein the web server and the application server are provided on a common physical device and are logically separated from one another.
8. The computer-implemented method of claim 5 , wherein the web server and the application server are provided on respective physical devices to be physically separate from one another.
9. The computer-implemented method of claim 5 , wherein authenticating the mobile device comprises authenticating the mobile device at the web server, and authenticating the user comprises:
in response to determining that the mobile device is the authorized mobile device, transmitting the credentials or the logon request from the web server to the application server.
10. The computer-implemented method of claim 9 , wherein authenticating the user comprises one of transmitting the credentials from the application server to the clinical information system, the clinical information system performing the validating, and retrieving authentication information from the clinical information system, the application server performing the validating based on the authentication information.
11. The computer-implemented method of claim 1 , further comprising transmitting the credentials from the data management system to the clinical information systems when it is determined that the mobile device is the authorized mobile device, each of the clinical information systems authenticating the user.
12. The computer-implemented method of claim 1 , further comprising retrieving authentication information from the clinical information systems, the data management system authenticating the user based on the authentication information.
13. The computer-implemented method of claim 1 , further comprising:
generating at least one of a digital patient data and a patient information at least one of the first medical facility and the second medical facility;
storing at least one of the patient data and the patient information in memory of an information system associated with the at least one of the first medical facility and the second medical facility; and
copying at least one of the patient data and the patient information to the data management system, the data management system being remotely located from the at least one of the first medical facility and the second medical facility.
14. The computer-implemented method of claim 13 , wherein the first medical facility and the second medical facility are included in a facility system, and wherein the data management system is located at the second medical facility of the facility system.
15. The computer-implemented method of claim 13 , wherein the first medical facility and the second medical facility are members of a facility system, and wherein the data management system is resident at a third party location, which is outside of the facility system.
16. The computer-implemented method of claim 13 , wherein the first medical facility and the second medical facility are members of a facility system, and wherein the data management system communicates with the first facility system and a second facility system.
17. The computer-implemented method of claim 13 , further comprising generating the digital patient data using a patient monitoring device that is in communication with the information system.
18. The computer-implemented method of claim 13 , further comprising generating the patient information based on a user input into the information system.
19. A non-transitory computer-readable storage device encoded with a computer program comprising instructions that, when executed, operate to cause one or more processors to perform operations for authenticating a mobile device and a user of the mobile device to receive patient data, the operations comprising:
receiving a logon request, the logon request comprising credentials associated with the user and at least one technical factor associated with the mobile device, wherein the credentials comprise a username and a password;
accessing a validation database based on one of the at least one technical factor and the credentials;
authenticating the mobile device by determining that a mobile device sending the logon request is an authorized mobile device based on information provided by the validation database and the at least one technical factor and the credentials;
authenticating the user by comparing the credentials received at a data management system with authentication information stored at a first clinical information system of a first medical facility and a second clinical information system of a second medical facility by using the username as an index to retrieve a corresponding stored password that is matched to the password to validate the credentials to ensure that the user is authorized to access the patient data provided by the first clinical information system and the second clinical information system, from which the mobile device is configured to receive the patient data, wherein the first clinical information system is separate from the second clinical information system; and
in response to authenticating the mobile device and in response to authenticating the user:
establishing a session to communicate the patient data between the mobile device and the first clinical information system and the second clinical information system through the data management system,
integrating the patient data from a plurality of clinical information systems to generate integrated patient data, by synchronizing a portion of the patient data, the portion of the patient data being less than all of an available patient data within the plurality of clinical information systems, such that none of the available patient data is synchronized prior to establishing the session and the portion of the patient data is synchronized based on one or more configuration settings used by the plurality of clinical information systems and a custom rule defining data elements corresponding to the patient data that are to be synchronized, the configuration settings defining a first arrangement of a first set of patients within the first medical facility, each of the first set of patients corresponding to a respective first unit of a first set of units of the first medical facility and a second arrangement of a second set of patients within the second medical facility, each of the second set of patients corresponding to a respective second unit of a second set of units of the second medical facility and being automatically provided by a configuration module to the data management system,
processing the integrated patient data communicated to the mobile device during the session to generate processed patient data, and
transmitting the processed patient data to the mobile device for display independent of an operating system operating on the mobile device by using a connectivity mechanism matching the operating system of the mobile device.
20. A system comprising:
one or more processors; and
a non-transitory computer-readable medium coupled to the one or more processors having instructions stored thereon which, when executed by the one or more processors, causes the one or more processors to perform operations for authenticating a mobile device and a user of the mobile device to receive patient data, the operations comprising:
receiving a logon request, the logon request comprising credentials associated with the user and at least one technical factor associated with the mobile device, wherein the credentials comprise a username and a password;
accessing a validation database based on one of the at least one technical factor and the credentials;
authenticating the mobile device by determining that a mobile device sending the logon request is an authorized mobile device based on information provided by the validation database and the at least one technical factor and the credentials;
authenticating the user by comparing the credentials received at a data management system with authentication information stored at a first clinical information system of a first medical facility and a second clinical information system of a second medical facility by using the username as an index to retrieve a corresponding stored password that is matched to the password to validate the credentials to ensure that the user is authorized to access the patient data provided by the first clinical information system and the second clinical information system, from which the mobile device is configured to receive the patient data, wherein the first clinical information system is separate from the second clinical information system; and
in response to authenticating the mobile device and in response to authenticating the user:
establishing a session to communicate the patient data between the mobile device and the first clinical information system and the second clinical information system through the data management system,
integrating the patient data from a plurality of clinical information systems to generate integrated patient data, by synchronizing a portion of the patient data, the portion of the patient data being less than all of an available patient data within the plurality of clinical information systems, such that none of the available patient data is synchronized prior to establishing the session and the portion of the patient data is synchronized based on one or more configuration settings used by the plurality of clinical information systems and a custom rule defining data elements corresponding to the patient data that are to be synchronized, the configuration settings defining a first arrangement of a first set of patients within the first medical facility, each of the first set of patients corresponding to a respective first unit of a first set of units of the first medical facility and a second arrangement of a second set of patients within the second medical facility, each of the second set of patients corresponding to a respective second unit of a second set of units of the second medical facility and being automatically provided by a configuration module to the data management system,
processing the integrated patient data communicated to the mobile device during the session to generate processed patient data, and
transmitting the processed patient data to the mobile device for display independent of an operating system operating on the mobile device by using a connectivity mechanism matching the operating system of the mobile device.