Patent Description:
Medical devices, such as dialysis machines, are known for use in the treatment of renal disease. The two principal dialysis methods are hemodialysis (HD) and peritoneal dialysis (PD). During hemodialysis, the patient's blood is passed through a dialyzer of a dialysis machine while also passing dialysate through the dialyzer. A semi-permeable membrane in the dialyzer separates the blood from the dialysate within the dialyzer and allows diffusion and osmosis exchanges to take place between the dialysate and the blood stream. During peritoneal dialysis, the patient's peritoneal cavity is periodically infused with dialysate, or dialysis solution. The membranous lining of the patient's peritoneum acts as a natural semi-permeable membrane that allows diffusion and osmosis exchanges to take place between the solution and the blood stream. Automated peritoneal dialysis machines, also called PD cyclers, are designed to control the entire peritoneal dialysis process so that it can be performed at home, usually overnight, without clinical staff in attendance. Both HD and PD machines may include displays with touch screens or other user interfaces that display information of a dialysis treatment and/or enable an operator or patient to interact with the machine.

The Food and Drug Administration (FDA) recognizes that as medical devices become more digitally interconnected and interoperable, they can improve the care patients receive and create efficiencies in the health care system, but that medical devices, like computer systems, can be vulnerable to security breaches, potentially impacting the safety and effectiveness of the device. The FDA has identified and accepted a role in medical device cybersecurity that includes issuing cybersecurity guidance documents, including guidance concerning controlling secure access to the medical device to prevent unauthorized use.

It would be desirable to provide a system and techniques that address the issues noted above concerning prevention of unauthorized access to and use of a dialysis machine medical device.

<CIT> describes a device that allows for patient identification comprising a housing, a biometric sensor, coupled to the housing. the biometric sensor is configured to detect a biometric feature of a patient. The device further comprises a signal transmitter configured to transmit data related to the detected biometric feature to a medical treatment machine for carrying out a medical treatment on the patient. The patient identification device is configured to be secured to the patient during the dialysis treatment.

<CIT> describes medical record management using fingerprint identification. Fingerprints of patients, medical professionals, health payer or pharmacy personnel and potential customers are submitted to a central server and are compared with stored fingerprints of registered users. If a match is found, the user is granted an access level of authority based on the stored personal information and a "need-to-know" basis in the medical field.

Claim <NUM> relates to a method of securing access to a dialysis machine. Claim <NUM> relates to a dialysis system that uses the claimed method.

Embodiments and features of the system described herein are explained with reference to the several figures of the drawings, which are briefly described as follows.

Medical devices (e.g., dialysis machines) and related components (e.g. access cards, accessories and/or peripheral devices, etc.) can be configured to wirelessly communicate with each other and other devices through a connection between the devices. A connection established between devices as described herein refers to electronic communication between two or more devices such that data can be communicated between the devices. The connection may be established or a network that may include both small scale networks (e.g. a home network) and/or larger scale networks (e.g. using mobile telecommunications). The connection can be a unidirectional connection (in which data travels one way) or a bidirectional connection (in which data travels both ways). Although the present disclosure is discussed herein principally in connection with a particular type of dialysis machine, namely a hemodialysis machine, the system described herein may be used and implemented in connection with other configurations of dialysis machines, including different types of hemodialysis machines and peritoneal dialysis machines, as well as other types of medical devices for which secure access is desirably controlled.

A dialysis system may include a dialysis machine (e.g., a hemodialysis machine or a peritoneal dialysis machine) that is configured to communicate with a portable device, such as a secure access card having onboard computer processing capabilities, using a wireless connection established according to a wireless communication protocol. Implementations of the wireless connection may include a short range wireless technology protocol, such as, for example, Near Field Communication (NFC), WiFi and/or Bluetooth technology protocols. For a discussion of establishing wireless connections between medical devices, including use of short range-wireless technology protocols, reference is made to <CIT> to Arrizza, entitled "Associating Dialysis Accessories Using Near Field Communication," and <CIT>, entitled "Short-Range Wireless Communication for a Dialysis System,".

According to the system described herein, the secure access card may include biometric security using biometric authentication to control secure access to the dialysis machine. Biometric authentication is the automated use of behavioral and/or physiological characteristics to verify a person's identity. An example of biometric authentication, and that is primarily discussed herein, is fingerprint authentication. The example of a secure access card will be used throughout this description, although it is noted that the system described herein may be implemented in connection with other types of smartcards, smart devices and/or access devices having onboard computer processing capabilities. Secure access cards, in particular, offer the advantages of secure access devices that are readily portable and issuable to particular patients/cardholders in connection with controlling access to specific dialysis machines and prescribed dialysis treatments. The system described herein may be used in connection with dialysis systems located in a home (e.g. home dialysis machines) and/or with dialysis systems used in a clinic or hospital environment. As discussed herein, the secure access card may control access to a dialysis machine for a cardholder, who may be, for example, a patient, clinician and/or a machine service technician.

<FIG> shows a dialysis system <NUM> configured to wirelessly communicate with a short-range wireless device, such as a secure access card <NUM>. As further discussed in detail herein, the secure access card <NUM> may include biometric authentication technology that includes biometric sensing, scanning and/or other biometric processing performed on/by the secure access card <NUM>. In an implementation, the biometric authentication may be fingerprint authentication. The dialysis system <NUM> may include a dialysis machine <NUM>, e.g. a hemodialysis machine. In the hemodialysis machine implementation, as illustrated, the dialysis machine <NUM> is connected to a disposable blood component set <NUM> that partially forms a blood circuit. It is noted that the system described herein may be implemented in connection with other types of dialysis machines or medical devices, including peritoneal dialysis machines. During a hemodialysis treatment, an operator connects arterial and venous patient lines <NUM>, <NUM> of the blood component set <NUM> to a patient. The blood component set <NUM> includes an air release device <NUM>, which contains a self-sealing vent assembly that allows air but does not allow liquid to pass. As a result, if blood passing through the blood circuit during treatment contains air, the air release device <NUM> will vent the air to atmosphere.

The blood component set <NUM> is secured to a module <NUM> attached to the front of the dialysis machine <NUM>. The module <NUM> includes the blood pump <NUM> capable of circulating blood through the blood circuit. The module <NUM> also includes various other instruments capable of monitoring the blood flowing through the blood circuit. The module <NUM> includes a door that when closed, as shown in <FIG>, cooperates with the front face of the module <NUM> to form a compartment that is sized and shaped to receive the blood component set <NUM>. In the closed position, the door presses certain blood components of the blood component set <NUM> against corresponding instruments exposed on the front face of the module <NUM>.

The operator uses a blood pump module <NUM> to operate the blood pump <NUM>. The blood pump module <NUM> includes a display window, a start/stop key, an up key, a down key, a level adjust key, and an arterial pressure port. The display window displays the blood flow rate setting during blood pump operation. The start/stop key starts and stops the blood pump <NUM>. The up and down keys increase and decrease the speed of the blood pump <NUM>. The level adjust key raises a level of fluid in an arterial drip chamber.

The dialysis machine <NUM> further includes a dialysate circuit formed by the dialyzer <NUM>, various other dialysate components, and dialysate lines connected to the dialysis machine <NUM>. Many of these dialysate components and dialysate lines are inside the housing <NUM> of the dialysis machine <NUM> and are thus not visible in <FIG>. During treatment, while the blood pump <NUM> circulates blood through the blood circuit, dialysate pumps (not shown) circulate dialysate through the dialysate circuit.

A dialysate container <NUM> is connected to the dialysis machine <NUM> via a dialysate supply line <NUM>. A drain line <NUM> and an ultrafiltration line <NUM> also extend from the dialysis machine <NUM>. The dialysate supply line <NUM>, the drain line <NUM>, and the ultrafiltration line <NUM> are fluidly connected to the various dialysate components and dialysate lines inside the housing <NUM> of the dialysis machine <NUM> that form part of the dialysate circuit. During hemodialysis, the dialysate supply line <NUM> carries fresh dialysate from the dialysate container <NUM> to the portion of the dialysate circuit located inside the dialysis machine <NUM>. As noted above, the fresh dialysate is circulated through various dialysate lines and dialysate components, including the dialyzer <NUM>, that form the dialysate circuit. As will be described below, as the dialysate passes through the dialyzer <NUM>, it collects toxins from the patient's blood. The resulting spent dialysate is carried from the dialysate circuit to a drain via the drain line <NUM>. When ultrafiltration is performed during treatment, a combination of spent dialysate (described below) and excess fluid drawn from the patient is carried to the drain via the ultrafiltration line <NUM>.

The dialyzer <NUM> serves as a filter for the patient's blood. The dialysate passes through the dialyzer <NUM> along with the blood, as described above. A semi-permeable structure (e.g., a semi-permeable membrane and/or semi-permeable microtubes) within the dialyzer <NUM> separates blood and dialysate passing through the dialyzer <NUM>. This arrangement allows the dialysate to collect toxins from the patient's blood. The filtered blood exiting the dialyzer <NUM> is returned to the patient. The dialysate exiting the dialyzer <NUM> includes toxins removed from the blood and is commonly referred to as "spent dialysate. " The spent dialysate is routed from the dialyzer <NUM> to a drain.

A drug pump <NUM> also extends from the front of the dialysis machine <NUM>. The drug pump <NUM> is a syringe pump that includes a clamping mechanism configured to retain a syringe <NUM> of the blood component set <NUM>. The drug pump <NUM> also includes a stepper motor configured to move the plunger of the syringe <NUM> along the axis of the syringe <NUM>. A shaft of the stepper motor is secured to the plunger in a manner such that when the stepper motor is operated in a first direction, the shaft forces the plunger into the syringe, and when operated in a second direction, the shaft pulls the plunger out of the syringe <NUM>. The drug pump <NUM> can thus be used to inject a liquid drug (e.g., heparin) from the syringe <NUM> into the blood circuit via a drug delivery line <NUM> during use, or to draw liquid from the blood circuit into the syringe <NUM> via the drug delivery line <NUM> during use.

The dialysis machine <NUM> includes a user interface with input devices such as a touch screen <NUM> and a control panel <NUM>. The touch screen <NUM> and the control panel <NUM> allow the operator to input various different treatment parameters to the dialysis machine <NUM> and to otherwise control the dialysis machine <NUM>. The touch screen <NUM> displays information to the operator of the dialysis system <NUM>. The touch screen <NUM> can also indicate whether the secure access card <NUM> is in within communication range of the dialysis machine <NUM>.

The dialysis machine <NUM> also includes a control unit <NUM> (e.g., a processor) configured to receive signals from and transmit signals to the touch screen <NUM>, the control panel <NUM>, and a communication module <NUM> (e.g., a short range wireless communication transceiver). The control unit <NUM> can control the operating parameters of the dialysis machine <NUM>, for example, based at least in part on the signals received by the touch screen <NUM>, the control panel <NUM>, and the communication module <NUM>. The communication module <NUM> is configured to communicate with a short-range wireless device using a short-range wireless technology protocol. For example, the communication module <NUM> allows the dialysis machine <NUM> to communicate with the secure access card <NUM>.

The control unit <NUM> is configured to identify presence of the secure access card <NUM>. For example, when the secure access card <NUM> is within wireless communication range of the communication module <NUM>, the communication module <NUM> can send a signal to the control unit <NUM> indicating that the secure access card <NUM> is present. In response, the control unit <NUM> can cause the dialysis machine <NUM> to perform an action, as described in more detail below. Similarly, when the secure access card <NUM> is taken out of wireless communication range of the communication module <NUM> (e.g., the secure access card <NUM> goes from being in wireless communication range of the communication module <NUM> to not being in wireless communication range of the communication module <NUM>), the communication module <NUM> can send a signal to the control unit <NUM> indicating that the secure access card <NUM> is not present. In response, the control unit <NUM> can cause the dialysis machine <NUM> to perform an action.

In some implementations, the dialysis system <NUM> may communicate via another network device, such as a gateway device, that is located in proximity to the dialysis machine (e.g. in the home) and connected via the short-range communication network to the dialysis machine <NUM> and that controls access to an unsecure network, such as the Internet. Data may be exchanged between the dialysis machine and a remote network or cloud-based service via a connected health system. For an example implementation of a connected health system and network that may be utilized in connection with the system described herein, reference is made to <CIT>, entitled "Securely Distributing Medical Prescriptions,".

Additionally and/or alternatively, the dialysis machine <NUM> may include a network communication module <NUM>. The network communication module <NUM> allows the dialysis system <NUM> to communicate with remote servers, computer systems, databases and/or other medical devices over a network such as a local area network (LAN) or the Internet. The network communication module <NUM> allows the dialysis system <NUM> to communicate with other medical devices, computer systems, servers, and/or databases associated with one or more medical facilities. The network communication module <NUM> may enable communication over the network using wired and/or wireless connections. For example, the network communication module <NUM> may enable communication using WiFi communication protocols and infrastructure and/or may enable communication using wireless mobile telecommunication networks. The system described herein may use appropriate encryption and security standards and protocols in connection with the transmission of sensitive and/or protected data in accordance with all statutory and regulatory requirements.

<FIG> shows an example of an implementation of the secure access card <NUM> that provides biometric secure access, and/or in connection with controlled proximity access, to the dialysis machine. The secure access card <NUM> includes a communication module <NUM> (e.g., a short range wireless communication transceiver) that is configured to communicate with other communication modules using a short-range wireless technology protocol, such as the communication module <NUM> of the dialysis machine <NUM>. The secure access card <NUM> may also include a visual indication <NUM> on the card concerning the wireless communication capability of the secure access card <NUM>. In various implementations, the secure access card <NUM> may also include a photo <NUM> of the person associated with the secure access card and identification information <NUM> in text form. In this example, the secure access card <NUM> is associated with a patient, and the identification information <NUM> may include, for example, the patient's name, the patient's address, and a patient identification number. As further discussed elsewhere herein, in other implementations, the secure access card <NUM> may be associated with other types of cardholders, such as, for example, a clinician and/or a service technician.

The secure access card <NUM> includes a biometric authentication sensor that, in an implementation, is illustrated and described as a fingerprint sensor <NUM>. The fingerprint sensor <NUM> is capable of capturing a digital image of a fingerprint pattern for a finger applied to the fingerprint sensor <NUM>. In an implementation, the fingerprint sensor <NUM> may be a capacitive fingerprint sensor, although other types of fingerprint sensors may also be used, such as optical and/or thermal fingerprint sensors. In an implementation, an onboard processor module <NUM> on the secure access card <NUM> may provide the processing for the fingerprint sensor <NUM> and may also include a memory for storing data, such as a digital template of the user's fingerprint that is captured and stored at the time of enrollment and association of the secure access card <NUM> to the user. The processor module <NUM> thereby includes the circuitry and/or processing capability needed for the fingerprint authentication. In an implementation, the on-board processor module <NUM> may include a battery and/or other power supply that provides power for the module and/or other elements of the secure access card <NUM>. Alternatively, the secure access card <NUM> may be powered by induction via a magnetic field and/or RF field of the dialysis machine or other corresponding peripheral component, as further discussed elsewhere herein, such that the secure access card may not require an on-board battery and/or other power supply.

Accordingly, in an implementation, the hardware of the fingerprint sensor <NUM> and/or the algorithm for matching and verifying the fingerprint via the process module <NUM> are embedded onto the secure access card <NUM> itself. For a discussion of example fingerprint sensing technologies and implementation of fingerprint sensor technology on access cards and devices, reference is made to "<NPL>, and to "<NPL>.

It is noted that other types of biometric authentication sensors that may implemented on a smartcard or device, may also be used with the system described herein.

The communication modules <NUM>, <NUM> may include short-range communication antennas and modules. For example, the communication modules <NUM>, <NUM> may implement NFC communication as the short range communication and may be referred to as NFC initiators and NFC targets. NFC is a short-range wireless technology protocol that enables devices to establish radio communication amongst each other (e.g. paired to each other) in order to quickly exchange data over a low latency link (e.g., a link which has relatively low delay between transmission and receipt of a portion of data such as a data packet or frame). Some implementations of NFC techniques are based on standards defined by the International Electrotechnical Commission and/or the International Organization for Standardization (ISO), for example, standards such as ISO <NUM> and ISO <NUM>. As further discussed elsewhere herein, it is noted that short range communication technologies and protocols other than NFC may be used in connection with the system described herein, including, for example, WiFi and Bluetooth communication protocols.

In some examples, the communication module <NUM> of the dialysis machine <NUM> may be an NFC initiator, and the communication module <NUM> of the secure access card <NUM> may be an NFC target. For example, the secure access card <NUM> may include a short-range communication technique, such as a contactless chip. Techniques for using contactless chips that could be used with the secure access card <NUM> may be defined, see e.g., ISO <NUM>. The NFC initiator can generate an RF field that powers the NFC target when the NFC target is within operable range of the NFC initiator, thereby allowing the NFC target to provide data to the NFC initiator. In this way, the secure access card <NUM> can provide information to the dialysis system <NUM>.

The operable range of the NFC initiator and NFC target may be in the order of inches (e.g., <NUM>-<NUM> inches i.e. <NUM>-<NUM>,<NUM>).

In some implementations, the transfer of data is initiated upon the NFC initiator and the NFC target making physical contact with each other. In some implementations, the NFC initiator and/or the NFC target can include a motion sensor (e.g., an accelerometer) to assist in identifying the occurrence of physical contact between the modules. It is noted that in other short-range communication protocol implementations, such as WiFi and/or Bluetooth, the operable range may be larger (e.g. <NUM> feet or more).

The NFC initiator is sometimes part of another electronic device such as a mobile phone, a computer, or as in this example, a medical device. The NFC initiator can have an independent power source or it can receive power from a power source that provides power to the electronic device. The NFC initiator can include a loop antenna that uses magnetic induction to generate an RF field.

The NFC target (sometimes referred to as an NFC tag) is typically a passive module that relies on the power generated by the RF field to operate. The NFC target can include a memory that stores data to be provided to the NFC initiator. The NFC target can also include a loop antenna that is configured to modulate the RF field generated by the NFC initiator. The modulation is based at least in part on the stored data. The NFC initiator can identify characteristics of the modulated field, compare them to characteristics of the generated RF field, and use the comparison information to determine the data stored on the NFC initiator. Because an implementation of the NFC target does not necessarily require its own power supply, in some implementations, the NFC target can take relatively simple form factors that can easily be incorporated into small portable devices, such as the secure access card <NUM>. However, in other implementations, the NFC target may be powered by its own power supply. In some examples, the NFC target can also generate an RF field, and the NFC initiator can modulate the RF field generated by the NFC target in a manner similar to that described above in order to provide data to the NFC target.

The NFC initiator and NFC target can transfer data at various speeds and according to various codings. For example, data can be transferred at speeds in the range of <NUM>-<NUM> kbit/s according to a delay encoding scheme or a phase encoding scheme. The NFC target and/or the NFC initiator can employ an amplitude modulation scheme (e.g., an amplitude-shift keying scheme) or a phase modulation scheme (e.g., a phase-shift keying scheme), among others, to modulate the generated RF field in order to convey information.

<FIG> is a side perspective view of the dialysis system <NUM> in which the secure access card <NUM> is shown being brought into close proximity to a housing of the dialysis machine <NUM>. The communication module <NUM> can be positioned an appropriate position on the dialysis machine <NUM> such that the secure access card <NUM> is within wireless communication range of the communication module <NUM> when the secure access card <NUM> is placed on a surface <NUM> (e.g., a top surface) of the housing <NUM> of the dialysis machine <NUM>. For example, the communication module <NUM> may be positioned at or near the top of the dialysis machine <NUM>, such as within the housing <NUM> at a location substantially adjacent to the surface <NUM>. In some implementations, the surface <NUM> includes a recess (not shown) in which the secure access card <NUM> can rest such that the secure access card <NUM> does not easily slide off of the surface with incidental contact.

The dialysis system <NUM> also includes a data storage configured to store data corresponding to the more short-range wireless devices, including the secure access card <NUM>, and the authentication processes related thereto. The data storage can be included as part of the dialysis machine <NUM> or may be remote from the dialysis machine <NUM> (e.g., on a server accessible by a computer network).

The secure access card <NUM> is configured to provide information related to the patient's identity to the dialysis system <NUM> when the secure access card <NUM> is in proximity to (e.g., within wireless communication range of) the communication module <NUM> and/or after successful biometric authorization from the results of the fingerprint sensor <NUM> and processing by the processing module <NUM>. In some implementations, the biometric authorization functionality and processing of the secure access card <NUM> may only occur after the secure access card <NUM> has been brought into proximity to the communication module <NUM>. In this way, the system described herein may require proximity of the secure access card <NUM> to the dialysis machine <NUM> and biometric authentication, e.g. fingerprint authentication, by an authorized person, thereby ensuring a requirement of biometric proximity as a security mechanism for access and/or controlling the dialysis system <NUM>.

In connection with the biometric authentication, the dialysis system <NUM> can determine the patient's identity based on the received identification information communicated from the secure access card <NUM>. In an implementation, the patient's identity is determined using the results of the biometric (fingerprint) scan performed on the secure access card <NUM>. Moreover, the dialysis system <NUM> may access the data storage that stores data corresponding to the secure access card <NUM>, and use identified information concerning the patient's name and/or ID (or, e.g., the corresponding value) received from the secure access card <NUM> to identify records of the patient. In response, the dialysis machine <NUM> can perform an action that is based at least in part on the identity of the patient.

In some implementations, the data corresponding to the one or more secure access cards can include portions of patient records, such as each associated patient's name, address, phone number, identification number, and the like. The data corresponding to identities of one or more short-range wireless devices can include data representing the value that corresponds to the patient's name and/or ID number. The dialysis system <NUM> can query the data corresponding to identities of one or more short-range wireless devices using the patient name, ID, and/or value received from the secure access card <NUM> to find the corresponding patient record and determine the identity of the patient. In various implementations, the data may be stored on the dialysis system <NUM> and periodically updated, such as via transmission using storage devices, e.g., having universal serial bus (USB) interfaces, that are transferred between the dialysis system <NUM> and a remote computer and/or site. In other implementations, the data may be obtained by the dialysis system <NUM> using real-time communication over a network, as described in further detail elsewhere herein.

The data corresponding to the secure access card <NUM> can also be used to access information such as each associated patient's medical history, treatment prescriptions, treatment parameters, and the like. Examples of treatment parameters include a dialysate type, a dialysate fill volume, and a dialysate flow rate, to name a few. Upon determining that the secure access card <NUM> belongs to a particular patient, the dialysis system <NUM> can request and download, for example, using a connected health system as further discussed elsewhere herein, prescription treatment information corresponding to a particular treatment for that patient and cause the dialysis machine <NUM> to carry out that treatment. The control unit <NUM> can cause the dialyzer <NUM> to carry out the dialysis treatment based on the downloaded prescription.

For example, suppose that the patient associated with the secure access card <NUM>, John Doe, has a medical condition that requires an atypical dialysis treatment. Perhaps John's treatment requires an abnormally low dialysate flow rate. The secure access card <NUM> is used to biometrically authenticate the user John Doe when the secure access card <NUM> is in proximity to the dialysis system <NUM>, as further discussed elsewhere herein. After biometric proximity authentication, the dialysis system <NUM> receives the patient identification information from the secure access card <NUM>, accesses remote data storage, and uses the received patient identification information to identify medical information related to John Doe. The medical information includes John Doe's medical history, treatment prescriptions, and treatment parameters; in particular, the treatment prescription includes instructions for causing the dialysis machine <NUM> to employ the abnormally low dialysate flow rate that John Doe requires. Such information is obtained (e.g. downloaded) and provided to the control unit <NUM>, and the control unit <NUM> causes the appropriate treatment to be administered to John Doe. For example, the control unit <NUM> can cause the dialyzer <NUM> to operate a pump (e.g., a dialysate pump) such that the required dialysate flow rate is achieved.

<FIG> is a schematic illustration of components and processing of a biometric security system <NUM> using a secure access card according to an implementation of the system described herein. The system <NUM> includes an enrollment module <NUM> and a biometric authentication module <NUM>. The enrollment module <NUM> is where a biometric template of an authorized user <NUM> is initially obtained, for example, using a biometric sensor <NUM>, such as a fingerprint sensor, that scans a fingerprint of the authorized user <NUM> at a time of enrollment. In various implementations, the biometric sensor <NUM> may be incorporated on a tablet computer, a stand-alone fingerprint sensor, and/or as part of a machine at an enrollment location. In another implementation, the biometric sensor <NUM> may be the sensor embedded on the secure access card <NUM> when the secure access card <NUM> is brought into proximity of a site or computer that performs enrollment processing. A feature extraction module <NUM> extracts features from the scanned biometric data, e.g. extracted fingerprint feature data, and stores them in a database <NUM>. In various implementations, as further discussed elsewhere herein, the database <NUM> may be a remote database as part of a connected health system, a database stored on a medical device, such as the dialysis machine <NUM>, and/or a database that is accessible directly on or by the secure access card <NUM>.

After enrollment processing of the authorized user <NUM> by the enrollment module <NUM>, an access-requesting user <NUM>' may request access to a medical device, such as the dialysis machine <NUM>, by presenting the secure access card <NUM>, which access request requires biometric acquisition and verification by the authentication module <NUM> according to an implementation of the system described herein. The authentication by the authentication module <NUM> may be initiated when the requesting user <NUM>' brings the secure access card <NUM> into proximity of the dialysis machine <NUM>. At that time, the secure access card <NUM> may pair with the dialysis machine <NUM>, and information, such as ID information <NUM>, associated with the authorized user <NUM> of the secure access card <NUM> may be transmitted. An embedded biometric sensor <NUM> of the secure access card <NUM>, such as the fingerprint sensor <NUM>, may be activated and a biometric/fingerprint scan of the user <NUM>' acquired using the embedded biometric sensor <NUM>. Identifying features of the biometric data scanned by the sensor <NUM> are extracted at a feature extraction module <NUM> that may, for example, be performed on the secure access card <NUM>. Using the ID information <NUM>, the biometric template data for the authorized user <NUM> that has been previously stored is obtained from the database <NUM>. The stored biometric data is matched to the scanned/acquired biometric data in a verification module <NUM>. In various implementations, the verification module <NUM> may be located/processed on the secure access card <NUM>, at the dialysis machine <NUM>, and/or at a remote site, and a result <NUM>, e.g. either a positive or negative match, is determined. The result <NUM> may be used to determine whether access to the dialysis machine <NUM> by the requesting user <NUM>' is granted or denied.

<FIG> is a schematic illustration of an implementation of the dialysis system <NUM> with biometric security implemented using a connected health system <NUM>. In an implementation, as discussed in further detail below, the biometric template information (e.g. fingerprint matching template) may be stored on a server or database <NUM> accessible via a secure network connection <NUM> that may be established over an unsecure and/or cloud-based network <NUM>, such as via the Internet, using the connected health system. Enrollment of the cardholder, and acquisition of the enrolled biometric (fingerprint) data, may occur elsewhere and stored in the database <NUM> for access in response to a biometric authentication request.

As illustrated, the connected health system <NUM> may include components that enable establishment of a secure network connection <NUM> with a remote server, database or cloud-based service, see, e.g., database <NUM> shown in the network <NUM>. In an implementation, as illustrated, the secure network connection <NUM> may be established using a gateway device <NUM> that controls secure access to the unsecure network, such as the Internet, and in some implementations, may establish connection using a wide area network and/or a mobile telecommunications network. The gateway device <NUM> may then further control establish of a short-range network connection <NUM>, such as an NFC, WiFi or Bluetooth network connection that enables short range communication among components of the dialysis system <NUM>, such as the gateway device <NUM>, the dialysis machine <NUM> and the secure access card <NUM> (and/or any other peripheral devices of the dialysis system <NUM>, such as a connected blood pressure cuff and/or a connected weight scale, for example). In an implementation, the dialysis system <NUM> and other short-range networked connected components may be implemented in a patient's home for a home dialysis treatment.

In an implementation, for biometric proximity authentication according to the system described herein, the secure access card <NUM> is brought into proximity of the dialysis machine <NUM>, such as via an NFC connection, as further discussed elsewhere herein. The cardholder desiring access to the dialysis machine <NUM> then invokes the biometric authentication, for example, by applying a finger to the fingerprint sensor <NUM> on the secure access card <NUM>. The fingerprint sensor <NUM> scans the fingerprint of the cardholder and, in the illustrated embodiment, sends data corresponding to the scanned fingerprint to the dialysis machine <NUM>, e.g. via wireless short-range transmission. It is noted that, in an embodiment, the fingerprint data may be sent using the via the short-range communication network <NUM> (e.g. NFC, WiFi and/or Bluetooth) to the dialysis machine <NUM>. The short-range communication network <NUM> may be established using wireless components of the dialysis machine <NUM> (e.g. module <NUM>) and/or using the gateway device <NUM> shown in the figure. Thereafter, in an implementation, the obtained fingerprint data may be sent via the secure network communication <NUM> via the cloud-based network <NUM> to the database <NUM> for matching verification. The fingerprint matching verification is performed remotely and a result of that matching verification, either positive or negative, is returned to the dialysis machine <NUM>. If verified, the then cardholder is thereby authenticated as permitted to access the dialysis machine <NUM>.

Alternatively, in another implementation, using ID and/or other identification information obtained from the secure access card concerning the enrolled cardholder, corresponding fingerprint data may be retrieved by the gateway device <NUM> and/or the dialysis machine <NUM> over the secure network communication <NUM> from the database <NUM> via the cloud-based network <NUM>. The fingerprint matching verification may be then be performed at the gateway device <NUM> and/or at the dialysis machine <NUM>.

<FIG> is a schematic illustration of another implementation of the dialysis system <NUM> with biometric security implemented using a connected health system <NUM> with medical record retrieval and/or prescription download functionality. In some implementations, data corresponding to a patient/cardholder enrolled to the secure access card <NUM> is stored remote from the dialysis system <NUM>. For example, the data can be stored on a computer system, server, and/or database <NUM> that is associated with a medical facility corresponding to that of the dialysis system <NUM>, e.g., accessible via the cloud-based network <NUM>. The computer system, server, and/or database <NUM> may be a medical database in which patient information is stored. In this way, the dialysis system <NUM> can receive portions of patient records, including prescriptions for treatment, from a remote location, e.g. obtained via communication over a network, when the secure access card <NUM> is within wireless communication range of the communication module <NUM> and biometric authentication has occurred via the secure access card <NUM>. The dialysis system <NUM> can then use the received information to identify the patient and determine the patient's medical history, treatment prescriptions, treatment parameters, and the like. In an implementation, after biometric proximity authentication using the secure access card <NUM> according to the system described herein, a current prescription of the patient/cardholder may be downloaded using the connected health system <NUM> and delivered to the dialysis machine <NUM> in connection with performance of a dialysis treatment for the patient/cardholder.

<FIG> is a flow diagram <NUM> showing processing for biometric authentication using a secure access card (e.g. secure access cards <NUM>) according to one or more implementations of the system described herein. At a step <NUM>, the secure access card <NUM> is brought into proximity of a dialysis machine (e.g. dialysis machine <NUM>). The secure access card <NUM> is issued to and carried by a patient/cardholder and used to provide biometric authentication for providing secure access when the secure access card is in proximity to the dialysis machine <NUM>. At a step <NUM>, the secure access card <NUM> and the dialysis machine <NUM> are paired to register that the secure access card <NUM> has been brought into proximity of the dialysis machine <NUM>, for example, via a short-range wireless protocol, such as NFC. At a step <NUM>, the patient/cardholder engages the biometric sensing or scanning of the secure access card <NUM>, such as applying a finger to the fingerprint sensor embedded on the secure access card <NUM>. At a step <NUM>, the fingerprint sensor of the secure access cards <NUM> obtains the biometric fingerprint data of the patient/cardholder.

At a step <NUM>, the fingerprint data undergoes verification processing by matching the obtained fingerprint data to stored fingerprint template data of the patient/cardholder that has been previously obtained, e.g. at a time of enrollment of the patient/cardholder with the secure access card <NUM>. The fingerprint matching according to the system described herein may occur in different locations according to various implementations. For example, in an implementation, the fingerprint matching verification may occur on the secure access card <NUM> using an embedded algorithm of the onboard processing of the secure access cards <NUM>. The result of the fingerprint verification may then be communicated to the dialysis machine <NUM>. In other implementations, the fingerprint data obtained from the fingerprint scan may be transmitted form the secure access card to the dialysis machine <NUM>. The dialysis machine may then either transmit the fingerprint data via a network to a remote computer and/or database, e.g. via a connected health system, for fingerprint verification matching and receive thereafter the result from the remote computer and/or database. Alternatively, the dialysis machine <NUM> may send a request to the remote computer and/or database for transmission to the dialysis machine <NUM> of the previously stored fingerprint template data patient/cardholder enrolled to the secure access cards <NUM>. Thereafter, the fingerprint verification matching may occur at the dialysis machine <NUM> (and/or via a locally connected component of the dialysis machine, such as a gateway device).

At a decision step <NUM>, the result of the fingerprint matching is analyzed to assess if the verification is a positive match. If the verification is positively matched (YES), meaning the obtained fingerprint data matches the enrolled template fingerprint data, then at a step <NUM>, the patient/cardholder who presented the secure access card <NUM> at the dialysis machine <NUM> is granted access to the dialysis machine <NUM>, and which may include the obtaining and/or downloading of records corresponding to the patient/cardholder. If the verification is not positively matched (NO) at the decision step <NUM>, then at a step <NUM>, access to the dialysis machine <NUM> is denied. In an embodiment, the access may be access by a patient and/or caregiver and included access to the patient's medical records and treatment prescription. In another embodiment, the access may be access by a service technician to service the dialysis machine.

Implementations discussed herein may be combined with each other in appropriate combinations in connection with the system described herein. Additionally, in some instances, the order of steps in the flow diagrams, flowcharts and/or described flow processing may be modified, where appropriate. The system may further include a display and/or other computer components for providing a suitable interface with a user and/or with other computers. Aspects of the system described herein may be implemented or controlled using software, hardware, a combination of software and hardware and/or other computer-implemented or computer-controlled modules or devices having described features and performing described functions. Data exchange and/or signal transmissions to, from and between components of the system may be performed using wired or wireless communication. This communication may include use of one or more transmitter or receiver components that securely exchange information via a network, such as an intranet or the Internet, and may include use of components of local area networks (LANs) or other smaller scale networks, such as Wi-Fi, Bluetooth or other short range transmission protocols, and/or may include use of components of wide area networks (WANs) or other larger scale networks, such as mobile telecommunication networks.

Software implementations of aspects of the system described herein may include executable code that is stored in a computer-readable medium and executed by one or more processors. The computer-readable medium may include volatile memory and/or non-volatile memory, and may include, for example, a computer hard drive, ROM, RAM, flash memory, portable computer storage media, an SD card, a flash drive or other drive with, for example, a universal serial bus (USB) interface, and/or any other appropriate tangible or non-transitory computer-readable medium or computer memory on which executable code may be stored and executed by a processor. The system described herein may be used in connection with any appropriate operating system. The meanings of any method steps of the invention(s) described herein are intended to include any suitable method of causing one or more parties or entities to perform the steps unless a different meaning is expressly provided or otherwise clear from the context.

As used herein, an element or operation recited in the singular and preceded with the word "a" or "an" should be understood as not excluding plural elements or operations, unless such exclusion is explicitly recited. References to "one" embodiment or implementation of the present disclosure are not intended to be interpreted as excluding the existence of additional embodiments that also incorporate the recited features. Furthermore, a description or recitation in the general form of "at least one of [a], [b] or [c]," or equivalent thereof, should be generally construed to include [a] alone, [b] alone, [c] alone, or any combination of [a], [b] and [c].

Claim 1:
A method of securing access to a dialysis machine (<NUM>), the method comprising:
controlling access, via a secure access card (<NUM>), to the dialysis machine (<NUM>), wherein the secure access card includes a biometric security module embedded on the secure access card, and wherein the biometric security module includes a biometric sensor (<NUM>) that obtains biometric data from a requesting user of the secure access card; and
performing verification processing, via a biometric verification module, to verify the obtained biometric data from the requesting user in relation to template biometric data previously stored during an enrollment of an authorized user that associates the authorized user to the secure access card, wherein either:
a) the user is a service technician and the access granted to the requesting user includes access allowing the requesting user to service the dialysis machine, or
b) the requesting user is a caregiver of the patient and the access granted to the requesting user includes enabling the dialysis machine to obtain medical records of the patient.