Healthcare operations with passive network monitoring

• US 10,204,211 B2
• Filed: 02/03/2016
• Issued: 02/12/2019
• Est. Priority Date: 02/03/2016
• Status: Active Grant

• Current Assignee: ExtraHop Networks, Incorporated
• Original Assignee: ExtraHop Networks, Incorporated
• Inventors: Hammerle, Eric Joseph, Clement, Samuel Kanen, Shaver, Terry William, Cauthorn, Matthew Couper
• Primary Examiner(s): Durant, Jonathan
• Application Number:
  US15/014,932
• Publication Number:
  US 20170220739A1
• Time in Patent Office: 1,105 Days
• CPC Class Codes: G16H 30/20 for handling medical images, e.g. DICOM, HL7 or PACS
• CPC Class Codes: G16H 40/20 for the management or administration of healthcare resources or facilities, e.g. managing hospital staff or surgery rooms
• CPC Class Codes: G16H 40/67 for remote operation
• CPC Class Codes: G16H 80/00 ICT specially adapted for facilitating communication between medical practitioners or patients, e.g. for collaborative diagnosis, therapy or health monitoring
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management
• CPC Class Codes: H04L 41/14 Network analysis or design
• CPC Class Codes: H04L 43/062 related to network traffic
• CPC Class Codes: H04L 43/12 Network monitoring probes
• CPC Class Codes: H04L 47/2441 relying on flow classification, e.g. using integrated services [IntServ]

Abstract

Embodiments are directed to monitoring communication over a network using a network monitoring computer (NMC). If one or more flows include healthcare traffic provided by one or more healthcare services, the NMC may perform further actions. Healthcare values from the one or more healthcare services may be provided from the network traffic. Values from one or more network traffic flows that are separate from the healthcare traffic may be provided. Other healthcare values from other flows may be provided that include healthcare traffic provided by the healthcare services. Accordingly, if a comparison of the healthcare values and the other healthcare values meet certain conditions, additional actions may be performed based on rules, or policies. The healthcare traffic may be compliant with one or more of Health Level Seven (HL7) standard, Digital Imaging and Communications in Medicine (DICOM) standard, or the like.

Claims

1. A method for monitoring flows of packets over a network, wherein one or more processors in a network computer execute instructions to perform actions, comprising:

instantiating a network monitoring application to perform actions based on one or more healthcare traffic flows provided by one or more healthcare services including;

employing the one or more processors to select one or more types of a plurality of healthcare messages based on configuration information that includes one or more of a filter, a rule, or a condition;

employing the one or more processors to monitor content of the selected type of the plurality of healthcare messages in the one or more healthcare protocol traffic flows, wherein each healthcare message includes a data structure that includes a plurality of different types of healthcare segments that have one or more fields, wherein a particular format of the data structure for each healthcare message is based on one or more of an implementation of a corresponding messaging system or a version of a corresponding healthcare protocol traffic flow;

employing the one or more processors to determine one or more healthcare values from the one or more fields of the one or more healthcare segments based on the particular data structure format of each healthcare message;

employing the one or more processors to determine one or more values from one or more other traffic flows that include a plurality of messages that employ a protocol different from the one or more healthcare protocol traffic flows;

employing the one or more processors to compare one or more patterns in the one or more healthcare traffic flows to identify each of the healthcare services that are communicating over a network and correlate one or more of context or relationship between the one or more identified healthcare services, wherein the correlation is employed in identifying each health care service that is inadvertently sharing information with one or more other healthcare services, or identifying each healthcare service that is failing to share information with the one or more other healthcare services, and wherein the comparison of patterns in healthcare traffic flows to identify health care services improves correlation of the one or more of contexts or relationships for otherwise incompatible healthcare services;

employing the one or more processors to compare one or more health care values to the one or more determined values from the other traffic flows to determine a failure to follow one or more conditions of a policy, one or more other actions to be scheduled in accordance with the policy, and meeting the one or more conditions of the policy, wherein the one or more conditions include one or more of a threshold value for a performance metric; and

employing the comparison of the one or more healthcare values and the one or more determined values from the other traffic flows that meets the one or more conditions of the policy, or provides conclusions for two or more health care services to use the one or more processors to perform one or more other actions with one or more rules, wherein a result of the one or more other actions is communicated to one or more other network computers.

2. The method of claim 1, wherein the healthcare protocol traffic is compliant with one or more of Health Level Seven (HL7) standard, or Digital Imaging and Communications in Medicine (DICOM) standard.

3. The method of claim 1, further comprising employing the one or more processors to perform further actions, including:

providing one or more other healthcare values from one or more other healthcare protocol traffic flows provided by the one or more other healthcare services; and

employing a comparison of the one or more healthcare values and the one or more other healthcare values that meet the one or more conditions to perform one or more other actions with one or more rules, wherein a result of the one or more other actions is communicated to one or more other network computers.

4. The method of claim 1, further comprising employing the one or more processors to perform further actions, including:

providing one or more records that include a portion of the content of the plurality of healthcare messages in the one or more healthcare protocol traffic flows and the one or more healthcare values;

storing the one or more records in a data store; and

providing one or more reports using one or more queries and the one or more records.

5. The method of claim 1, wherein the one or more actions include:

providing one or more patient values from the one or more healthcare protocol traffic flows from the one or more healthcare services; and

providing trend information based on the one or more patient values and associated with one or more of a disease, a diagnosis, a payment, patient schedules, provider schedules, lab results, or, a duration of patient visits.

6. The method of claim 1, wherein the one or more conditions, include, comparing the one or more healthcare values in real-time with one or more defined values.

7. The method of claim 1, wherein the one or more conditions, include, comparing one or more healthcare transaction results in real-time with one or more defined values, wherein one or more incomplete healthcare transactions may be identified.

8. The method of claim 1, wherein the one or more actions include, providing a notification when a drug prescribed to a patient is negatively impacted by another drug prescribed to the patient.

9. A system for monitoring flows of packets over a network comprising:

a network computer, comprising;

a transceiver that communicates over the network;

a memory that stores at least instructions; and

one or more processors that execute instructions that perform actions, including;

instantiating a network monitoring application to perform actions based on one or more healthcare traffic flows provided by one or more healthcare services including;

employing the one or more processors to select one or more types of a plurality of healthcare messages based on configuration information that includes one or more of a filter, a rule, or a condition;

employing the one or more processors to monitor content of the selected type of the plurality of healthcare messages in the one or more healthcare protocol traffic flows, wherein each healthcare message includes a data structure that includes a plurality of different types of healthcare segments that have one or more fields, wherein a particular format of the data structure for each healthcare message is based on one or more of an implementation of a corresponding messaging system or a version of a corresponding healthcare protocol traffic flow;

employing the one or more processors to determine one or more healthcare values from the one or more fields of the one or more healthcare segments based on the particular data structure format of each healthcare message;

employing the one or more processors to determine one or more values from one or more other traffic flows that include a plurality of messages that employ a protocol different from the one or more healthcare protocol traffic flows;

employing the one or more processors to compare one or more patterns in the one or more healthcare traffic flows to identify each of the healthcare services that are communicating over a network and correlate one or more of context or relationship between the one or more identified healthcare services, wherein the correlation is employed in identifying each health care service that is inadvertently sharing information with one or more other healthcare services, or identifying each healthcare service that is failing to share information with the one or more other healthcare services, and wherein the comparison of patterns in healthcare traffic flows to identify health care services improves correlation of the one or more of contexts or relationships for otherwise incompatible healthcare services;

employing the one or more processors to compare one or more health care values to the one or more determined values from the other traffic flows to determine a failure to follow one or more conditions of a policy, one or more other actions to be scheduled in accordance with the policy, and meeting the one or more conditions of the policy, wherein the one or more conditions include one or more of a threshold value for a performance metric; and

employing the comparison of the one or more healthcare values and the one or more determined values from the other traffic flows that meets the one or more conditions of the policy, or provides conclusions for two or more health care services to use the one or more processors to perform one or more other actions with one or more rules, wherein a result of the one or more other actions is communicated to one or more other network computers; and

a client computer, comprising;

a transceiver that communicates over the network;

a memory that stores at least instructions; and

one or more processors that execute instructions that perform actions, including;

visualizing one or more reports made from the result of the one or more other actions.

10. The system of claim 9, wherein the healthcare protocol traffic is compliant with one or more of Health Level Seven (HL7) standard, or Digital Imaging and Communications in Medicine (DICOM) standard.

11. The system of claim 9, wherein the one or more processors of the network computer execute instructions that perform actions, further comprising:

providing one or more other healthcare values from one or more other healthcare protocol traffic flows provided by the one or more other healthcare services; and

employing a comparison of the one or more healthcare values and the one or more other healthcare values that meet the one or more conditions to perform one or more other actions with one or more rules, wherein a result of the one or more other actions is communicated to one or more other network computers.

12. The system of claim 9, wherein the one or more processors of the network computer execute instructions that perform actions, further comprising:

providing one or more records that include a portion of the content of the plurality of healthcare messages in the one or more healthcare protocol traffic flows and the one or more healthcare values;

storing the one or more records in a data store; and

providing one or more reports using one or more queries and the one or more records.

13. The system of claim 9, wherein the one or more actions include:

providing one or more patient values from the one or more healthcare protocol traffic flows from the one or more healthcare services; and

providing trend information based on the one or more patient values and associated with one or more of a disease, a diagnosis, a payment, patient schedules, provider schedules, lab results, or, a duration of patient visits.

14. The system of claim 9, wherein the one or more conditions, include, comparing the one or more healthcare values in real-time with one or more defined values.

15. The system of claim 9, wherein the one or more conditions, include, comparing one or more healthcare transaction results in real-time with one or more defined values, wherein one or more incomplete healthcare transactions may be identified.

16. The system of claim 9, wherein the one or more actions include, providing a notification when a drug prescribed to a patient is negatively impacted by another drug prescribed to the patient.

17. A processor readable non-transitory storage media that includes instructions for monitoring flows of packets over a network, wherein execution of the instructions by one or more hardware processors performs actions, comprising:

instantiating a network monitoring application to perform actions based on one or more healthcare traffic flows provided by one or more healthcare services including;

employing the one or more processors to select one or more types of a plurality of healthcare messages based on configuration information that includes one or more of a filter, a rule, or a condition;

employing the one or more processors to monitor content of the selected type of the plurality of healthcare messages in the one or more healthcare protocol traffic flows, wherein each healthcare message includes a data structure that includes a plurality of different types of healthcare segments that have one or more fields, wherein a particular format of the data structure for each healthcare message is based on one or more of an implementation of a corresponding messaging system or a version of a corresponding healthcare protocol traffic flow;

employing the one or more processors to determine one or more healthcare values from the one or more fields of the one or more healthcare segments based on the particular data structure format of each healthcare message;

employing the one or more processors to determine one or more values from one or more other traffic flows that include a plurality of messages that employ a protocol different from the one or more healthcare protocol traffic flows;

employing the one or more processors to compare one or more patterns in the one or more healthcare traffic flows to identify each of the healthcare services that are communicating over a network and correlate one or more of context or relationship between the one or more identified healthcare services, wherein the correlation is employed in identifying each health care service that is inadvertently sharing information with one or more other healthcare services, or identifying each healthcare service that is failing to share information with the one or more other healthcare services, and wherein the comparison of patterns in healthcare traffic flows to identify health care services improves correlation of the one or more of contexts or relationships for otherwise incompatible healthcare services;

employing the one or more processors to compare one or more health care values to the one or more determined values from the other traffic flows to determine a failure to follow one or more conditions of a policy, one or more other actions to be scheduled in accordance with the policy, and meeting the one or more conditions of the policy, wherein the one or more conditions include one or more of a threshold value for a performance metric; and

employing the comparison of the one or more healthcare values and the one or more determined values from the other traffic flows that meets the one or more conditions of the policy, or provides conclusions for two or more health care services to use the one or more processors to perform one or more other actions with one or more rules, wherein a result of the one or more other actions is communicated to one or more other network computers.

18. The media of claim 17, wherein the healthcare protocol traffic is compliant with one or more of Health Level Seven (HL7) standard, or Digital Imaging and Communications in Medicine (DICOM) standard.

19. The media of claim 17, further comprising employing the one or more processors to perform further actions:

providing one or more other healthcare values from one or more other healthcare protocol traffic flows provided by the one or more other healthcare services; and

employing a comparison of the one or more healthcare values and the one or more other healthcare values that meet the one or more conditions to perform one or more other actions with one or more rules, wherein a result of the one or more other actions is communicated to one or more other network computers.

20. The media of claim 17, further comprising employing the one or more hardware processors to perform further actions:

providing one or more records that include a portion of content of the one or more healthcare protocol traffic flows and the one or more healthcare values;

storing the one or more records in a data store; and

providing one or more reports using one or more queries and the one or more records.

21. The media of claim 17, wherein the one or more actions include:

providing one or more patient values from the one or more healthcare protocol traffic flows from the one or more healthcare services; and

providing trend information based on the one or more patient values and associated with one or more of a disease, a diagnosis, a payment, patient schedules, provider schedules, lab results, or, a duration of patient visits.

22. The media of claim 17, wherein the one or more conditions, include, comparing the one or more healthcare values in real-time with one or more defined values.

23. The media of claim 17, wherein the one or more conditions, include, comparing one or more healthcare transaction results in real-time with one or more defined values, wherein one or more incomplete healthcare transactions may be identified.

24. A network computer for monitoring flows of packets over a network, comprising:

a transceiver that communicates over the network;

a memory that stores at least instructions; and

one or more processors that execute instructions that perform actions, including;

instantiating a network monitoring application to perform actions based on one or more healthcare traffic flows provided by one or more healthcare services including;

employing the one or more processors to select one or more types of a plurality of healthcare messages based on configuration information that includes one or more of a filter, a rule, or a condition;

employing the one or more processors to monitor content of the selected type of the plurality of healthcare messages in the one or more healthcare protocol traffic flows, wherein each healthcare message includes a data structure that includes a plurality of different types of healthcare segments that have one or more fields, wherein a particular format of the data structure for each healthcare message is based on one or more of an implementation of a corresponding messaging system or a version of a corresponding healthcare protocol traffic flow;

employing the one or more processors to determine one or more healthcare values from the one or more fields of the one or more healthcare segments based on the particular data structure format of each healthcare message;

employing the one or more processors to determine one or more values from one or more other traffic flows that include a plurality of messages that employ a protocol different from the one or more healthcare protocol traffic flows;

employing the one or more processors to compare one or more patterns in the one or more healthcare traffic flows to identify each of the healthcare services that are communicating over a network and correlate one or more of context or relationship between the one or more identified healthcare services, wherein the correlation is employed in identifying each health care service that is inadvertently sharing information with one or more other healthcare services, or identifying each healthcare service that is failing to share information with the one or more other healthcare services, and wherein the comparison of patterns in healthcare traffic flows to identify health care services improves correlation of the one or more of contexts or relationships for otherwise incompatible healthcare services;

employing the one or more processors to compare one or more health care values to the one or more determined values from the other traffic flows to determine a failure to follow one or more conditions of a policy, one or more other actions to be scheduled in accordance with the policy, and meeting the one or more conditions of the policy, wherein the one or more conditions include one or more of a threshold value for a performance metric; and

employing the comparison of the one or more healthcare values and the one or more determined values from the other traffic flows that meets the one or more conditions of the policy, or provides conclusions for two or more health care services to use the one or more processors to perform one or more other actions with one or more rules, wherein a result of the one or more other actions is communicated to one or more other network computers.

25. The network computer of claim 24, wherein the healthcare protocol traffic is compliant with one or more of Health Level Seven (HL7) standard, or Digital Imaging and Communications in Medicine (DICOM) standard.

26. The network computer of claim 24, further comprising employing the one or more processors to perform further actions:

providing one or more other healthcare values from one or more other healthcare protocol traffic flows provided by the one or more other healthcare services; and

employing a comparison of the one or more healthcare values and the one or more other healthcare values that meet the one or more conditions to perform one or more other actions with one or more rules, wherein a result of the one or more other actions is communicated to one or more other network computers.

27. The network computer of claim 24, further comprising employing the one or more processors to perform further actions:

providing one or more records that include a portion of content of the one or more healthcare protocol traffic flows and the one or more healthcare values;

storing the one or more records in a data store; and

providing one or more reports using one or more queries and the one or more records.

28. The network computer of claim 24, wherein the one or more actions include:

providing one or more patient values from the one or more healthcare protocol traffic flows from the one or more healthcare services; and

providing trend information based on the one or more patient values and associated with one or more of a disease, a diagnosis, a payment, patient schedules, provider schedules, lab results, or, a duration of patient visits.

29. The network computer of claim 24, wherein the one or more conditions, include, comparing the one or more healthcare values in real-time with one or more defined values.

30. The network computer of claim 24, wherein the one or more conditions, include, comparing one or more healthcare transaction results in real-time with one or more defined values, wherein one or more incomplete healthcare transactions may be identified.