# US 12,191,028 B2 · Safeguarding mechanisms for the operation of medical apparatuses using disposables in a dialysis environment > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,191,028 B2 - Document ID: US12191028B2 - Status: Granted - Kind: B2 - Application number: 17/432,197 - Filed: 2020-02-19 - Published: 2022-06-16 - Granted: 2025-01-07 - Earliest claimed: 2019-02-20 - Assignees: Fresenius Medical Care Deutschland GmbH; Fresenius Medical Care AG & Co. Kgaa - Applicants: Fresenius Medical Care Deutschland GmbH; Fresenius Medical Care AG & Co. KGaA - Inventors: Jonas Hellhund; Robert Lindemann; Arne Peters; Gerome Fischer - Web page: https://patentgrep.com/patent/US12191028B2 ## CPC - G16H 40/20: for the management or administration of healthcare resources or facilities, e.g. managing hospital staff or surgery rooms - G16H 40/40: for the management of medical equipment or devices, e.g. scheduling maintenance or upgrades - G06F 21/31: User authentication - G06F 21/44: Program or device authentication - G16H 20/40: relating to mechanical, radiation or invasive therapies, e.g. surgery, laser therapy, dialysis or acupuncture - G16H 40/60: for the operation of medical equipment or devices - H04L 9/3239: {involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD} - H04L 9/50: {using hash chains, e.g. blockchains or hash trees} - G06F 21/64: Protecting data integrity, e.g. using checksums, certificates or signatures - H04L 63/0853: {using an additional device, e.g. smartcard, SIM or a different communication terminal (cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234)} - H04L 63/12: {Applying verification of the received information (cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32)} - H04L 67/12: specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks - H04L 2209/88: Medical equipments - G16H: HEALTHCARE INFORMATICS, i.e. INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR THE HANDLING OR PROCESSING OF MEDICAL OR HEALTHCARE DATA - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract The disclosure relates to a safeguarding module, a method, and a system for safeguarding an apparatus in the medical environment against an unauthorised operation of the apparatus, wherein the authorisation is dependent upon a linking event between two linking partners within the framework of an operation of the apparatus, wherein the apparatuses are connected via a network, and wherein one of the linking partners is an item which is used during the operation of the apparatus. The system comprises a plurality of apparatuses, wherein in each case an apparatus comprises a safeguarding module, comprising: a read-in interface for reading-in a first identifier and a second identifier; a processing unit which is designed to perform the safeguarding method; a memory for storing the calculated documentation value in a distributed ledger structure; and an interface to the network, via which the apparatuses exchange data. ## Claims ### Claim 1 A method for safeguarding an apparatus in a medical environment against an unauthorised operation of the apparatus, wherein the apparatus is connected to other apparatuses via a network, and wherein authorisation is dependent upon a linking event between at least two linking partners within the framework of an operation of the apparatus, wherein one of the linking partners is an item of use which is used during the operation of the apparatus, the method comprising: reading-in a first identifier for identifying a first linking partner of the at least two linking partners in a unique manner and a second identifier for identifying a second linking partner of the at least two linking partners in a unique manner; applying at least a first calculation rule to the read-in first identifier and applying a second calculation rule to the second identifier for calculating a documentation value that defines a unique signature of each instance of a linking event between the first and second linking partners, wherein calculating the documentation value includes calculating a third identifier as a repetition value which uniquely represents a number of repetitions for a linking event between the first and second linking partners so repetitions of linking events can be documented in a distinguishable manner using a unique signature of the linking partners involved in the linking events; causing synchronised storage of the calculated documentation value in memories of apparatuses of the network; and safeguarding the operation of the apparatus for the first and second linking partners. ### Claim 2 (depends on 1) The method of claim 1, wherein the synchronised storage is effected using a distributed memory structure. ### Claim 3 (depends on 2) The method of claim 2, wherein the distributed memory structure is a distributed ledger structure. ### Claim 4 (depends on 3) The method of claim 3, wherein the distributed ledger structure is implemented in that a data block comprises at least the calculated documentation value and does not contain any reference to other blocks. ### Claim 5 (depends on 1) The method of claim 1, further comprising validating and/or authorising the calculated documentation value by applying a consensus algorithm such that causing and safeguarding are performed only if validation is successful. ### Claim 6 (depends on 5) The method of claim 5, wherein the applying the consensus algorithm comprises: accessing a memory of a distributed memory structure of an apparatus in order to check for a specified documentation value whether it is already stored, and only when the result of this check is negative and/or the number of permissible repetition values is less than a pre-definable number thereof, validating the documentation value. ### Claim 7 (depends on 5) The method of claim 5, wherein the apparatus is disabled for the intended operation with the two respective linking partners when the validation is not successful and/or authorisation is not provided. ### Claim 8 (depends on 5) The method of claim 5, wherein the validating and/or authorising the linking event is performed in a timed manner and/or event-based manner. ### Claim 9 (depends on 1) The method of claim 1, wherein the calculation of the documentation value includes applying a third calculation rule to a first partial result, obtained by applying the first calculation rule to the first identifier, and a second partial result, obtained by applying the second calculation rule to the second identifier, for providing a third partial result and a further linking function being applied to the third partial result. ### Claim 10 (depends on 1) The method of claim 1, wherein all of the apparatuses apply the same calculation rules for calculating the documentation value. ### Claim 11 One or more non-transitory computer readable storage media storing instructions that, when executed by at least one programmable processor, cause the at least one programmable processor to perform operations comprising: reading-in a first identifier for identifying a first linking partner of the at least two linking partners in a unique manner and a second identifier for identifying a second linking partner of the at least two linking partners in a unique manner; applying at least a first calculation rule to the read-in first identifier and applying a second calculation rule to the second identifier for calculating a documentation value that defines a unique signature of each instance of a linking event between the first and second linking partners, wherein calculating the documentation value includes calculating a third identifier as a repetition value which uniquely represents a number of repetitions for a linking event between the first and second linking partners so repetitions of linking events can be documented in a distinguishable manner using a unique signature of the linking partners involved in the linking events; causing synchronised storage of the calculated documentation value in memories of apparatuses of the network; and safeguarding the operation of the apparatus for the first and second linking partners. ### Claim 12 A safeguarding module for an apparatus for the medical environment, the safeguarding module comprising: a read-in interface for reading-in a first identifier and a second identifier; at least one processor programmed with instructions to perform operations comprising: reading-in a first identifier for identifying a first linking partner of the at least two linking partners in a unique manner and a second identifier for identifying a second linking partner of the at least two linking partners in a unique manner; applying at least a first calculation rule to the read-in first identifier and applying a second calculation rule to the second identifier for calculating a documentation value that defines a unique signature of each instance of a linking event between the first and second linking partners, wherein calculating the documentation value includes calculating a third identifier as a repetition value which uniquely represents a number of repetitions for a linking event between the first and second linking partners so repetitions of linking events can be documented in a distinguishable manner using a unique signature of the linking partners involved in the linking events; causing synchronised storage of the calculated documentation value in memories of apparatuses of the network; and safeguarding the operation of the apparatus for the first and second linking partners; an interface to a memory or with a memory for storing the calculated documentation value; and an interface to a network, via which the apparatuses exchange data. ### Claim 13 (depends on 12) The safeguarding module of claim 12, wherein the safeguarding module further comprises an interface to further safeguarding modules of other apparatuses of the network. ### Claim 14 (depends on 12) An apparatus comprising the safeguarding module of claim 12. ### Claim 15 A system for safeguarding an apparatus in the medical environment against an unauthorised operation of the apparatus, the system comprising one or more computers and one or more computer storage media storing instructions that are operable, when executed by the one or more computers, to cause the one or more computers to perform operations comprises: reading-in a first identifier for identifying a first linking partner of the at least two linking partners in a unique manner and a second identifier for identifying a second linking partner of the at least two linking partners in a unique manner; applying at least a first calculation rule to the read-in first identifier and applying a second calculation rule to the second identifier for calculating a documentation value that defines a unique signature of each instance of a linking event between the first and second linking partners, wherein calculating the documentation value includes calculating a third identifier as a repetition value which uniquely represents a number of repetitions for a linking event between the first and second linking partners so repetitions of linking events can be documented in a distinguishable manner using a unique signature of the linking partners involved in the linking events; causing synchronised storage of the calculated documentation value in memories of apparatuses of the network; and safeguarding the operation of the apparatus for the first and second linking partners. ### Claim 16 (depends on 15) The system of claim 15, wherein the system includes multiple apparatuses, and memories of the apparatuses form a distributed memory structure. ### Claim 17 (depends on 15) The system of claim 15, wherein the first linking partner is a patient who is allocated the first identifier which identifies him and wherein the second linking partner is the medical item of use which is marked with an identification marking, wherein the second identifier is allocated in a unique manner to the identification marking, and wherein the linking event represents the use of the item of use for the patient during a treatment on a specific medical apparatus. ### Claim 18 (depends on 15) The system of claim 15, wherein the first linking partner is a membrane, wherein the membrane is designed having an identification marking which identifies it in a unique manner, wherein the first identifier is allocated in a unique manner to the identification marking, wherein the second linking partner is a reverse osmosis unit which is designed having an identification marking which identifies it in a unique manner and to which the second identifier is allocated in a unique manner, and wherein the linking event represents the use of the membrane in the reverse osmosis unit.