SYSTEM AND METHOD OF ENCRYPTION FOR DICOM VOLUMES

• US 20100115288A1
• Filed: 08/24/2009
• Published: 05/06/2010
• Est. Priority Date: 08/22/2008
• Status: Active Grant

• Current Assignee: DatCard Systems Incorporated
• Original Assignee: DatCard Systems Incorporated
• Inventors: Canessa, Giancarlo, Monk, David, Canessa, Gino G., Canessa, John C.
• Granted Patent: US 8,756,437 B2
• Time in Patent Office: Days
• US Class Current: 713/189
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: G06F 2221/2115 Third party
• CPC Class Codes: G06F 2221/2131 Lost password, e.g. recovery of lost or forgotten passwords
• CPC Class Codes: G16H 30/20 for handling medical images, e.g. DICOM, HL7 or PACS

Abstract

Digital image storage and management systems capable of producing encrypted DICOM volumes on different types of media (e.g., Blu-ray, CD, DVD, memory stick, USB flash drive, etc.), with or without the automatic generation of labels, systems and mechanisms to generate and manage passwords for the encrypted volumes, and systems and mechanisms to manage access to encrypted data on such volumes are disclosed. Generated encrypted DICOM volumes, which can comprise confidential patient data, can be securely interchanged, archived, and distributed to users. The disclosed systems and methods can permit authorized users to access encrypted data, even if the users do not have access to the original encryption mechanism. Encrypted data stored on the volume can be easily and securely accessed by a variety of authorized users.

Claims

1. A computer-implemented system for providing access to securely stored medical data comprising:

a database configured to store decryption passwords for decrypting encrypted medical data stored on a portable medium;

a secure interface configured to authenticate a request for decryption of medical data stored on the portable medium; and

a password retrieval service configured to;

receive the authenticated request from the secure interface;

retrieve from the database a decryption password uniquely associated with medical data stored on the portable medium, wherein the portable medium is associated with one decryption password; and

communicate the decryption password for accessing medical data stored on the portable medium, wherein the decryption password is used for transforming the encrypted medical data into plaintext.

2. The system of claim 1, wherein the secure interface is a secure web interface.

3. The system of claim 1, wherein medical data is represented in Digital Imaging and Communications in Medicine (DICOM) format.

4. A computer-implemented method of providing access to an encrypted medical data stored on a portable medium, the method comprising:

authenticating a user;

retrieving a decryption key associated with the portable medium;

accessing a security mechanism stored on the portable medium and retrieving a decryption password;

comparing the decryption key with the decryption password; and

when there is a match, transforming the encrypted medical data stored on the portable medium into format accessible by the user, wherein the decryption key is used for transforming the encrypted medical data into plaintext.

5. The method of claim 4, wherein the security mechanism stored on the portable medium is encrypted.

6. The method of claim 4, wherein the security mechanism is selected from the group consisting of CMS, PKCS #5, SHA-1, MD5, RSA, AES, and DES.

7. The method of claim 4, wherein medical data is represented in DICOM format.

8. A computer-implemented method of creating portable medium comprising encrypted medical data, the method comprising:

receiving medical data from one or more modalities;

selecting a subset of the received medical data to be included on a portable medium;

encrypting the subset of medical data using an encryption mechanism;

generating a security mechanism for decrypting the encrypted medical data, wherein the security mechanism is used for transforming the encrypted medical data into plaintext; and

recording the encrypted medical data on a portable medium.

9. The method of claim 8, further comprising recording the security mechanism on the portable medium.

10. The method of claim 8, wherein the security mechanism is a password used for transforming the encrypted medical data into plaintext.

11. The method of claim 8, wherein the encryption mechanism is selected from the group consisting of CMS, PKCS #5, SHA-1, MD5, RSA, AES, and DES.

12. The method of claim 8, wherein medical data is represented in DICOM format.

13. A computer-implemented method of creating portable medium comprising encrypted medical data, the method comprising:

receiving medical data from one or more modalities;

selecting a subset of the received medical data to be included on a portable medium;

encrypting the subset of medical data using an encryption mechanism;

determining a security mechanism for decrypting the encrypted medical data, wherein the security mechanism uniquely corresponds to a user of the portable medium such that the user is associated with one security mechanism; and

recording the encrypted medical data on a portable medium.

14. The method of claim 13, further comprising recording the security mechanism on the portable medium.

15. The method claim 13, wherein the security mechanism is a password used for transforming the encrypted medical data into plaintext.

16. The method of claim 13, wherein the encryption mechanism is selected from the group consisting of CMS, PKCS #5, SHA-1, MD5, RSA, AES, and DES.

17. The method as in any of claims 13, wherein medical data is represented in DICOM format.

18. A computer-implemented system for providing access to securely stored medical data comprising:

a database configured to store a decryption password for decrypting medical data stored on a portable medium, wherein the decryption password is generated from information comprised in at least one tag associated with medical data;

a secure interface configured to authenticate a request for decryption of medical data stored on the portable medium; and

a password retrieval service configured to;

receive the authenticated request from the secure interface;

receive information comprised in the at least one tag;

retrieve from the database the decryption password uniquely associated with medical data stored on the portable medium, wherein one decryption password is associated with information comprised in the at least one tag; and

communicate the decryption password for accessing medical data stored on the portable medium, wherein the decryption password is used for transforming the encrypted medical data into plaintext.

19. The system of claim 18, wherein the at least one tag is a DICOM tag.

20. The system of claim 18, wherein the secure interface is a secure web interface.