METHODOLOGIES

CROSSS REFERENCE TO RELATED APPLICATIONS

[0001] This patent application claims benefit under 35 U.S. C. § 119(e) of U.S.

Provisional Application Serial No. 61/135,151, filed July 17, 2008, the entirety of the disclosure of which are incorporated herein by reference.

STATEMENT CONCERNING GOVERNMENT FUNDING

[0002] Part of the work during the development of this invention was made with government support from the National Science Foundation, NSF under grant no. NSF 0705676; the United States Government has rights in this invention.

FIELD OF THE INVENTION

[0003] Disclosed embodiments are directed to a system and methodologies that are implemented using ubiquitous computing, which can be used to improve the care and quality of life for elderly persons ("the elderly") or other individuals requiring or benefiting from some level of care giving while protecting privacy and improving the ease of use for care givers.

DESCRIPTION OF THE RELATED ART

[0004] The elderly represent a vulnerable sub-population that constitutes an ever increasing segment of the world's total population. As of 2006, 37.3 million Americans are among the elderly; this figure is predicted to double by 2030. Of these elderly, 30.3% live alone; of those that live alone, the majority are women.

[0005] Many of these elderly suffer from debilitating conditions. For example, it is estimated that 20% of older US adults have chronic disabilities, 7% to 8% have severe cognitive impairments, roughly one third have mobility limitations, 20% have vision problems, and 33% have hearing impairments.

[0006] Traditional monitoring systems often employ passive data collection devices such as cameras. These devices capture and transmit data (e.g., video) to a remote monitor, which may be, in turn, connected to some remote data repository. These systems suffer from two large problems. First, they harm privacy, by placing large amounts of private data (the recordings) in a centralized repository. For the system to be effective, the data must remain available over a large time window. An assailant who compromises the archives gains access to all of this sensitive information.

[0007] In implementation, information security is a difficult problem that is rarely a focus for technology that is consumer targeted. However, information security is a particular problem in instances when the application distributor is not the individual who is at risk of security compromises.

[0008] Secondly, such systems require full-time human monitoring to ensure events are recognized in a timely manner, which is an enormous investment of resources. If continuous monitoring is not employed, a caregiver, upon discovering something amiss, must go to the data repository and retrieve the stored data (e.g., video footage from the last time they were aware of the status of their charge until the present). Then the caregiver must review this footage to find security or safety anomalies. The result of such a methodology is a potentially large response time to address a care or security issue; moreover, the monitoring methodology provides a highly constrained ability to prevent harmful incidents. Thus, using the above-described methodology, accident/incident prevention and response time depend on serendipity - nothing may be detected until there is nothing that can be done to prevent a situation. [0009] Various ubiquitous computing systems have been proposed to resolve the delay problems associated with such conventional monitoring strategies. [0010] The term "ubiquitous computing" often prompts Orwellian visions in the average user, and ubiquitous systems have often conflicted with the desire for privacy. Camp et al. (Camp, L. J., Shankar, K., Connelly, K.: Systematic Design for Privacy in Ubicomp (2006)) describe the application of an approach for dealing with this problem, referred to as "value- sensitive design." By producing a values statement to accompany a technology, adopters of that technology are able to make more informed choices, and system designers are encouraged to put more thought into development. Camp et al. suggest targeting data collection based on risk profiles, filtering data before storing it to minimize information leakage, and taking differing age groups' requirements into account during design.

[0011] Camp et al. also note that the Code of Fair Information practice forms the basis for evaluating the privacy preservation of such ubiquitous computing systems. The principles of transparency (data collection is never secret), consent (no data collection occurs without the consent of the monitored or their caregivers) and correction (incorrect data can be altered or removed) form the basis for this code. [0012] Correction can be particularly problematic in the case of eldercare, as patients with increasing dementia may be motivated to alter monitored data to conceal this, or may simply erase monitored data by mistake. Consent is important when considering which environments can be monitored; the elderly may have substantially different opinions than teens or middle-aged users, and require age-specific monitoring profiles. Some of these problems can be mitigated by providing adjustable levels of sensitivity, but again, the elderly may be motivated to hide troubling data by adjusting these levels.

[0013] Zweig et al. (Zweig, D., Webster, J.: Where is the line between benign and invasive? An examination of psychological barriers to the acceptance of awareness monitoring systems, Journal of Organizational Behavior 23, 605-633 (2002)) discuss the implications of ubiquitous computing on privacy and acceptance in the workplace. Many ubiquitous systems focus on domains in which the users (i.e., the monitored individuals) have a greater capacity to consent and influence system design than may be the case in eldercare. The divide is not as great as it seems; however, in eldercare, it falls to the caregivers of the elderly (who may not be able to perform these functions for themselves) to express consent or raise questions about design implications on privacy. Zweig et al. discuss issues of granularity with sensors (e.g., higher resolution leaks more private data) and conditional consent (giving permission to some parties to view sensor data, but not others) that are especially applicable in eldercare. [0014] Froomkin (Froomkin, A. M.: The Death of Privacy?, Stanford Law Review 52,

1461-1543 (2000)) discusses the increasing use of ubiquitous computing for surveillance, with an emphasis on government applications, such as communications monitoring, vehicle monitoring, and biometrics. In response to the pressure excerpted by society for such monitoring, Froomkin suggests that civilians must push for increased legislation governing the use of such systems in official capacities.

[0015] Jiang (Jiang, X.: Safeguard Privacy in Ubiquitous Computing with Decentralized

Information Spaces, 4 ^th International Conference on Ubiquitous Computing, (2002)) also notes that technological solutions that exist in a vacuum are insufficient to protect individual privacy. In addition to legislative means, Jiang advocates the philosophy of Lawrence Lessig, (i.e., users should exert market pressure and social pressure on designers and producers of systems to ensure that systems are privacy- aware). Jiang advocates a principle of Minimum Asymmetry, in which data flow from users being monitored to those monitoring them is minimized, while feedback from the use of the system by data collectors produces increased data flow to those being monitored. Jiang identifies data persistence, data accuracy, and data confidence (sensor -A- granularity, for example) as the three most important properties for privacy-aware systems to consider.

[0016] Hong et al. (Hong, J., Ng, J., Lederer, S., Landay, J.: Privacy risk models for designing privacy- sensitive ubiquitous computing systems, Conference on Designing Interactive Systems, 91-100 (2004)) provide an excellent overview of the design issues facing developers of privacy- aware ubiquitous computing systems. In particular, their focus on the development of privacy risk models that provide a reasonable level of privacy protection for the application's target users is extremely insightful, as are the questions Hong et al. propose for privacy risk analysis and social context awareness.

[0017] Buennemeyer et al. (Buennemeyer, T., Marchany, R., Tront, J.: Ubiquitous

Security: Privacy versus Protection, Proc. of the 2006 International Conf. on Pervasive Systems, 71-77 (2006)) discuss conventionally known best practices and security development for ubiquitous computing systems. In particular, they note that conventionally known, ubiquitous computing development parallels that of the early Internet — functionality and deployment concerns are paramount, with security and privacy being considered distant thirds, if considered at all. Like Froomkin and Jiang, Buennemeyer et al. express concern with the business-focused development of these systems and the lack of legislation that addresses them. Buennemeyer et al. propose a strategy referred to as "Defense in Depth," wherein each part of an overall ubiquitous computing system deploys its own privacy protection mechanisms, and these mechanisms are designed to work together to achieve the security of the whole system. [0018] Camp et al. also discusses the implications of ubiquitous computing systems in eldercare, noting that the elderly are assured of losing substantial privacy if they move into a nursing home or shared assisted living space. For this reason, they are often more willing to assume the unknown privacy risks of many current ubiquitous computing systems, which often do not permit the elderly or their caregivers to conduct a detailed analysis of their designs. Caregivers especially face a difficult choice in this area; while they may initially rely on input from their charges, the nature of many of their charge's disabilities means that eventually the decision to move the elderly individual into a nursing home may be inevitable. [0019] Ho et al. (Ho, L., Moh, M., Walker, Z., Hamada, T., Su, C: A Prototype on

RFID and Sensor Networks for Elder Healthcare: Progress Report, Proceedings of the ACM SIGCOMM workshop on Experimental Approaches to Wireless Network Design and Analysis, 70-75 (2005)) discuss a prototype system they developed to assist the elderly in taking correct dosages of medications. This system makes use of a common tracking technology, Radio Frequency IDentification (RFID) tags. However, many systems that use RFID fail to consider the privacy implications of this technology, which often enables unwanted tracking due to RFID tags lacking the computational capability to support a mechanism for access control. Ho et al. address this problem by primarily proposing to tag medications within a home and having elderly individuals wear a removable RFID tagged badge. RFID tags also have small transmission ranges; therefore, the reasoning is that the system is "privacy sensitive" because an assailant able to read the signals would have to be inside a residence. Therefore, such an assailant would be able to access the medication and associated information anyway. However, this assumption fails in two important ways.

[0020] First, an elderly individual may forget to interact safely with their RFID tagged badges; for example, by forgetting to don the badge, they may defeat the system's purpose. Secondly, by forgetting to remove the badge before leaving the house, an elderly individual may actually expose themselves to more security risk by RFID tracking by a third party. This issue is of a particular problem in association with medicine containers. Ho et al. do not mention the way in which identifiers are assigned to medications; however, if there is some standard way of doing so, a security risk exists. If these containers are disposed of, the RFID tags on them would also need to be destroyed. Thus, an assailant need only drive by an individual's trash receptacle with the proper equipment to obtain a profile of the medications they are taking. This might be done for the purposes of medication theft (some medications being quite valuable and stolen and sold illegally for profit) or for targeting fraud schemes at the elderly individual (the elderly individual's vulnerability to fraud might be disclosed by the revelation that they are taking several medications for advanced Alzheimer's, for example). [0021] Floerkemeier et al. (Floerkemeier, C, Siegemund, F.: Improving the

Effectiveness of Medical Treatment with Pervasive Computing Technologies, Workshop on Ubiquitous Computing for Pervasive Healthcare Applications at Ubicomp 2003, (2003)) propose another system for medication dispensing and monitoring, consisting of medication packaging (blister packs) with embedded sensors. Several difficulties arise when specifically applying their general-purpose model (designed for patients of all ages) to the elderly population. First, the Floerkemeier et al. system requires additional monitoring hardware to be attached to medication containers, which may increase the weight of the containers to an extent that the elderly are unable to properly dispense the medication.

[0022] Secondly, the Floerkemeier et al. system is designed to send reminders and alerts for conditions such as lapses in medication regimes or medication recalls to a patient's mobile phone. The elderly may not possess or make much use of such mobile phones, but might benefit from this information being sent to a location they are more likely to access, e.g., a television. Their caregivers, on the other hand, would more likely benefit from receiving duplicates of these alerts transmitted to their mobile phones; moreover, some of these alerts may only be appropriate for caregivers, such as when the elderly individual suffers from cognitive impairment to such a degree that they may not be able to take proper action for an alert such as a recall.

[0023] Dishman (Dishman, E.: Inventing Wellness Systems for Aging in Place, IEEE

Computer 37, 34-41 (2004)) discusses several systems in development by Intel's Proactive Health lab that implement the concept of "Aging in Place." Citing the increased caregiver load (e.g., one third of American adults serve as caregivers), Dishman also discusses several solutions to help manage this difficulty. Dishman also cites the need to remotely be notified of important events as the primary caregiver desires. Dishman discusses systems designed to monitor resource usage with RFID tags, and to prompt the elderly to participate in these tasks if they forget to do so themselves. Aside from medication dispensing, Dishman also suggests simple tasks such as obtaining proper hydration or making phone calls to relatives and friends. [0024] However, as with Ho et al's system, the heavy use of RFID tags and other sensors requires a thorough examination of associated privacy risks; while Dishman notes that privacy is a concern, Dishman does not address the specific ways in which this concern informs the labs' designs.

[0025] Wolfe et al. (Wolfe, E., Chisholm, E.: System and Method for Providing Home

Awareness, United States Patent # 7342488, (2008)) propose a similar system for general home awareness. However, that system is designed for general home awareness for an average person, and does not focus on assisting caregivers of elderly. Thus, in Wolfe et al., sensor- enabled objects in a house are triggered by use events, and trigger transmission of wireless messages to a central display station (proposed to be a household's main television), where the messages are superimposed on live video. However, such a configuration is not useful in the context of eldercare and creates the risk of data leakage via unnecessary wireless transmission. [0026] Corporate solutions exist that attempt to solve similar problems. Xanboo (The

Premier Platform for Remote Monitoring, Control and Security, http://www.xanboo.com/), for example, markets itself as "the premier platform for remote monitoring, control and security." However, Xanboo is deficient in a number of aspects for the purpose of providing a solution for eldercare monitoring. [0027] For example, Xanboo's system employs live video streams, which are made available to anyone with Internet access and the correct password. While this grants the ability to have more than one person share the burden of monitoring, this results in all the security weaknesses traditionally associated with password protected web sites; moreover, 24-hour monitoring of a charge requires that a caregiver be proactive (i.e., requiring constant monitoring of video feeds) rather than reactive. Additionally, the video streams appear to be stored for unlimited duration on a central web server, creating a potential single point of security failure. Moreover, Xanboo's video streams are sent without encryption or other protection to the site. Most troubling, perhaps, is the Xanboo privacy policy, which states that data collected by the service may be aggregated and sold for marketing purposes. Xanboo also charges its users with maintaining their own security policy, and provides no suggestions for recovering from password compromise other than to change the current password. Thus, system designs such as that employed by Xanboo are particularly lacking for the purposes of eldercare.

SUMMARY

[0028] The following presents a simplified summary in order to provide a basic understanding of some aspects of various invention embodiments. The summary is not an extensive overview of the invention. It is neither intended to identify key or critical elements of the invention nor to delineate the scope of the invention. The following summary merely presents some concepts of the invention in a simplified form as a prelude to the more detailed description below.

[0029] A monitoring system and methodologies are designed for use in conjunction with the care of elderly individuals. In accordance with at least one embodiment, a monitoring system and methodologies may be configured to be event-driven in nature and focus on protecting user privacy.

[0030] In accordance with at least one embodiment, the monitoring system may be implemented using ubiquitous computing and the system may be hardened against privacy invasion issues.

[0031] In accordance with at least one embodiment, the monitoring system and methodologies may be event-driven and may be configured to reduce cognitive load required for caregivers to utilize the system. As a result, such a system and methodologies may enable a caregiver to react more effectively than with passive monitoring technologies such as traditional security cameras. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] A more compete understanding of the present invention and the utility thereof may be acquired by referring to the following description in consideration of the accompanying drawings, in which like reference numbers indicate like features, and wherein:

[0033] FIGURE 1 illustrates an environment wherein embodiments of the invention may be utilized and illustrating various components utilized in the system.

[0034] FIGURE 2 illustrates an operational flow charge illustrating functional operations performed by various monitoring system components and other components with which the system components communicate to provide various points of utility of the disclosed embodiments.

DETAILED DESCRIPTION

[0035] In the following description of various invention embodiments, reference is made to the accompanying drawings, which form a part hereof, and in which is shown, by way of illustration, various embodiments in which the invention may be practiced. It is to be understood that other embodiments may be utilized and structural and functional modifications may be made without departing from the scope and spirit of the present invention. [0036] Moreover, it should be understood that various connections are set forth between elements in the following description; however, these connections in general, and, unless otherwise specified, may be either direct or indirect, either permanent or transitory, and either dedicated or shared, and that this specification is not intended to be limiting in this respect. [0037] With the above-described understanding of the strengths of ubiquitous computing and the associated security risks in mind, it should be appreciated that security and ubiquitous computing go hand in hand; without proper security and privacy measures, ubiquitous computing devices and systems can become more of a danger than a benefit to those they are meant to assist. Devices designed to assist in monitoring the elderly must be carefully examined in light of their security properties because the population they are designed to assist is particularly vulnerable.

[0038] It should also be appreciated that there is a great need for systems to increase the effectiveness and reduce the cost of elder monitoring. Estimates place the amount of American elderly with Alzheimer's disease and other forms of dementia at 5-10% of the elderly population. The demands made on caregivers for these elderly are substantial. The value of the unpaid time associated with volunteer family care is often higher than all other aspects of care. For example, patients with severe dementia often require upwards of 40 hours a week of care. [0039] Studies have also found negative health impacts on caregivers; the constant care and attention they must devote to their charges leads to increased rates of depression and early mortality. Of the problems that confront these caregivers, wandering of their patients has been specifically highlighted as a problem.

[0040] Thus, in accordance with at least one disclosed embodiment, a system and methodologies are provided that utilize signals from one or more sensors located at a residence premises to identify actual or potential safety or security problems while minimizing data leakage to the outside of the residence. Additionally, still images (image data) are captured by one or more cameras triggered by the one or more sensors. This image data is then transmitted to a remote device of a caregiver's choice, such as a mobile phone, etc. Still images may be used rather than live video because streaming live video may create more privacy risks for an elderly charge. Transmission of the image data to a caregiver's device is performed rather than simply displaying events on a monitoring station such as a television within a charge's residence itself because the latter makes no provision for ensuring that a caregiver is made aware of the triggering event(s) in a timely manner.

[0041] Moreover, in accordance with illustrated embodiments, a privacy-enhanced, event-driven monitoring system and methodologies are provided. This system and these methodologies may be implemented using ubiquitous computing, which can be used to improve the care and quality of life for the elderly without sacrificing their privacy. Therefore, in accordance with at least one embodiment, a monitoring system and associated methodologies are provided to assist in monitoring and ensuring the safety and security of the elderly, in particular, those elderly individuals living alone and potentially having some debilitating condition.

[0042] Evidence suggests that the current quality of eldercare is lacking, in part, due to lack of time and resources available to caregivers who are often unpaid family members volunteering their time. In recognition of this deficiency, physicians are increasingly encouraged to advocate elder "self-care" where possible. This self-care relies more significantly on the elderly themselves and is meant to decrease the burden of care giving on caregivers.

[0043] The burden of care giving may be conceptually thought of as being composed of two main areas: "work load," which pertains to physical tasks associated with care giving including cooking, cleaning, etc.; and "cognitive load," which pertains to the continuous or periodic monitoring of the elderly to ensure the health, happiness and safety of the elderly. While care giving workload can be outsourced to trusted third parties, the same is less true and may be perceived as less acceptable to caregivers. By decreasing the cognitive load on caregivers, caregivers are enabled to make more efficient use of their time and provide a better quality of care.

[0044] Therefore, in practical terms, the work load associated with care giving can be shifted to some extent or another to qualified third parties other than a primary caregiver. Thus, where an adult daughter is the primary caregiver for her elderly (and potentially infirmed) father, she can engage a third party to assist with cleaning of her father' s residence, shopping for groceries for her father and/or providing other house keeping services for her father. However, in such a situation, it is often more difficult and less acceptable to shift the cognitive load associated with care giving; this is because, for example, the ability to determine the physical and mental health status of the father may be more difficult to gauge by a third party regardless of their professional training. This is particularly true when, for example, an elderly charge (e.g., in this example, the father) has a mental health condition that provides moments of lucidity and moments of dementia. This is also a problem when, for example, an elderly charge recognizes that they are experiencing periods of mental or physical impairment and is actively hiding evidence of this impairment because of shame or fear. In such situations, often only a primary caregiver that has known the charge for an extended period of time or in a familiar way is capable of accurately determining a charge's true state of wellbeing. However, a caregiver's other daily responsibilities and obligations may often require that the caregiver be physically apart from the charge (for example, due to work or familial obligations). [0045] Thus, in accordance with at least one embodiment, a monitoring system and associated methodologies are provided that may utilize what has been termed as "ubiquitous computing." Such a ubiquitous computing implementation may be designed to be placed inside an elderly individual's place of residence (e.g., home, house, apartment, etc.) and be configured to monitor activity across one or more portals, most likely the front or back door for the residence.

[0046] Thus, opening such a door may trigger a sensor module of the system, e.g., to trigger operation of one or more pre-positioned cameras that capture image data showing images of both sides of the door. This provision and operation may be designed to enable capture of the most salient visual features associated with this event, e.g., the physical status of -lithe residence occupant (clothing and health) and the identity of the individual on the outside of the residence. This visual image data may then be transmitted via message attachments (e.g., using electronic mail or one of various text message protocols that support transmission of images and other data, such as Enhanced Short Messaging Service (EMS) or Multi-media Messaging Service (MMS) protocols; this capability is also known generally as "picture messaging") to a pre-designated device.

[0047] It should be understood that, optionally, the image data may be transmitted along with data indicating a time and date that the image data was acquired. Additionally, depending on the configuration of the monitoring system, the image data may also be transmitted with data indicating the identity of the charge who's residence is being monitored ("Mr. Russell Parks) and/or the geographic location of that residence (e.g., "Apartment 4B"). [0048] FIGURE 1 illustrates one example of a system 100 designed in accordance with at least one disclosed embodiment. It should be appreciated that the illustration of FIG. 1 depicts the system 100 from a functional perspective and, therefore, the number of components illustrated is not determinative of the actual implementation. As illustrated in FIG. 1, a monitoring management module 110 is configured to be coupled to both a sensor 120 and one or more cameras including camera A 130 and camera B 140. These cameras 130, 140 may be positioned inside and outside a residence portal 150 so as to provide image data showing images of the outside and inside of the residence portal 150. It should be appreciated that the portal 150 may be, for example, a front or back door to a residence such as a free standing house, townhouse, apartment or other residence inhabited by one or more elderly individuals. [0049] Thus, the camera A 130 may be positioned within the residence and angled such that it provides images of the view seen when an individual is looking outside the portal 150. Likewise, the camera B 140 may be positioned outside the residence and angled such that it provides images of the view seen when an individual is looking inside the portal 150. [0050] Such an implementation may have particular utility when the security of the camber B 140 is in question because, for example, an image associated with the outside of the portal 150 may provide evidence or an indication of an assailant attempting to breach the residence or harm an occupant of the resident; by positioning the camera that provides images of such an assailant inside the residence, there is, potentially, an increased level of security and decreased risk of tampering with that camera and/or image data.

[0051] It should be appreciated, however, that, alternatively, the camera B 140 may be positioned to provide the outside view of the portal 150 and the camera A 130 may be positioned to provide the inside view of the portal 150; such an implementation may be acceptable when, for example, security of the camera B 140 located on the outside of the residence portal is not a significant concern and such positioning serves other purposes. [0052] It should also be appreciated that the monitoring management module 110, the sensor 120 and the cameras 130, 140 may be coupled together so as to enable communication of control instructions and acquired image data there between. Therefore, although the illustrated connections between those components do not illustrate bidirectional communication, it should be understood that bidirectional communication between these components may be possible. [0053] Sensor 120 may be implemented in various forms and in alternative designs including for example, a sensor 120 coupled to a doorbell associated with the portal 150 such that, when the door bell is rung by an individual on the outside of the portal 150, the cameras 130, 140 are controlled to begin acquisition of image data. Alternatively, the sensor 120 may be implemented as a contact sensor configured and positioned to sense when the portal 150 is open, e.g., when the door in the doorway has been opened to provide access to the residence. Such an implementation for the sensor 120 may have particular utility in that the sensor 120 can acquire image data when an individual is entering or exiting the portal 150 as well as acquiring image data when the door is not fully closed (which would potentially pose a security threat to the resident who may not be aware of this status); thus, such an implementation may enable a caregiver to receive image data showing no individual on the exterior or interior of the portal 150, thereby indicating a need for someone (for example, the elderly charge) to check the door to ensure that it is properly closed.

[0054] It should be appreciated that the monitoring management module 110 may be implemented in a variety of different configurations. Therefore, the monitoring management module 110 may be, for example, a software application running on a general or special purpose computer and configured to provide instructions to the components 120-150 to provide at least some of the operations illustrated in FIGURE 2. For example, the monitoring management module 110 may be implemented on a personal computer present in the residence or on the premises of the residence (i.e., the land associated with the residence, for example, when more than one residence is present in an assisted living facility or senior living community); in such an implementation the module 110 could be software running on a desk top computer, a Personal Data Assistant (PDA) or mobile phone. When implemented using a mobile phone or other mobile device, one particular benefit may be that image data may be received from the one or more cameras 130, 140 and transmitted to a recipient device 170 via the communication networks 160 without the need for a modem and hardwired connections; this is because the mobile device may optionally be configured to provide communication without hardwired connections.

[0055] Alternatively, the monitoring management module 110 may be implemented in software code running on one or more servers coupled to the components 120-140 via one or more networks that may include two or more computers that are linked in order to share resources (such as memory, interfaces, or peripherals), exchange files, or allow electronic communications via cables, telephone lines, radio waves, satellites, or infrared light beams linking the computers. In such an implementation, the monitoring management module 110 may be directly coupled to the cameras 130, 140, sensor 120 via hardwired connections or via a localized wireless network that enables those components to communicate over the network. Such implementations may have particular benefit, for example, when the monitoring management module 110 is implemented on one or more servers and is used to control monitoring of a number of residences in a particular area, e.g., in an assisted living or senior living community. In such a situation, it is conceivable that one monitoring management module 110 may be configured to manage monitoring of many residence portals simultaneously by, for example, assigning IP addresses to the coupled components (e.g., sensors 120 and cameras 130, 140) for each residence and maintaining or having access to a database that associated the IP addresses with particular residences and, in turn, one or more recipient devices 170 to receive image data for the particular residences. It should be appreciated that alternative configurations for providing this data are also foreseeable.

[0056] As a further alternative, the monitoring management module 110 may be implemented using one or more Application Specific Integrated Circuits (ASICs) to provide operational functionality (see FIG. 2) and other hardware including, for example, a modem or similar communication device to gather image data from the camera(s) 130, 140 and transmit the image data to communication network(s) 160. For example, the monitoring management module may be implemented using a Central Processing Unit (CPU) and circuit board (e.g., commercially available FOX Board LX832) and a GSM/MMS module (e.g., commercially available FOXGM expansion board with Telit GM862-QUAD Modem) as well as other conventionally available parts.

[0057] Therefore, as discussed in further detail herein with regard to security issues, it should be understood that various implementations of the disclosed embodiments are contemplated. Thus, for example, the monitoring management module 110 may be implemented using one or more servers coupled to cameras and sensors via a hub. Alternatively, the monitoring management module 110 may be implemented using a PDA or mobile device.

[0058] Moreover, it should be understood that the monitoring management module 110 may be implemented via a combination of hardware and software provided in a function specific configuration specifically designed to control operation of the cameras 130, 140 in response to stimulus from one or more sensors 120 and output the image data provided by those cameras 130, 140 to one or more communication networks 160 for subsequent delivery to one or more recipient devices.

[0059] It should also be appreciated that, in accordance with at least one disclosed embodiment, image data transmission may occur only in a single direction, i.e., from the monitoring management module 110 to the device 170 via the communication network(s). Therefore, although FIG. 1 illustrated that there is bidirectional communication between the monitoring management module 110 and the communication network(s) 160, the downstream communication (i.e., from the communication network(s) 160 to the monitoring management module 110) may consist of only signaling communication that enables the transmission of the image data from the monitoring management module 110. Optionally, the downstream communication may also include remote configuration data transmission generated by the device 170 or from an entity associated with the provisioning of the monitoring system 100. Such an option to enable remote configuration data may, in at least one disclosed embodiment, enable a caregiver or an entity supporting the monitoring system 100 to remotely program certain parameters associated with the monitoring, e.g., pausing monitoring for a period of time when, for example, the charge has been temporarily transferred to an interim care facility, altering lighting or image capture settings based on changing environmental conditions near the portal 150, performing remote diagnostic tests on components of the system to eliminate or reduce the need for a service call to the charge's residence, etc. However, the capability to remotely manage system parameters may create associated security risks discussed below. [0060] The image data may be transmitted to the recipient device(s) 170 in one or more different formats including one or more picture messaging (sometimes referred to as "photo messaging"). One of the early uses of MMS, picture messaging works through an extension to SMS protocol that makes it possible to send images, animations, and audio to mobile recipients and enable streaming video transmission on capable devices. [0061] The communication network(s) 160 used to deliver the image data transmitted from the monitoring management module 110 to the recipient device(s) 170 may be of various types and are not central to the utility of the disclosed embodiments. Therefore, it should be appreciated that the communication network(s) 160 may be comprised of one or more private and public communication networks including but not limited to the Internet, one or more mobile communication networks, and/or one or more Plain Old Telephone Service (POTS) or landline networks (for example, to provide long distance transmission of image data via originating mobile networks). Thus, the communication network(s) 160 need simply be configured to enable transmission of image data to a recipient device 170 in one or more formats and using one or more different transmission protocols.

[0062] The recipient device 170 that receives image data (e.g., one or more visual images) in response to a triggering event may be, for example, a mobile communication device, e.g., a mobile phone, smart phone, personal data assistant, a computer terminal, etc. A guardian or caretaker can monitor this device 170 to ensure the safety and wellbeing of elderly individual, e.g., that the elderly individual has not left the residence in a vulnerable state, had an encounter with a known threat or been approached by an unknown party. It should also be appreciated that the recipient device 170 may be a personal computer or the like, accessible to a caregiver.

[0063] In accordance with at least one disclosed embodiment, the configuration of the event-driven system is such that utility is provided by the implementation of what may be thought of as an "active" or "reactive" event-driven monitoring system, wherein a monitoring individual is prompted to respond to transmitted data; this differs significantly from what may be considered to be a "passive" monitoring system. More specifically, passive monitoring systems are conventionally known and provide a continuous feed of data to a monitoring individual or organization; in such system configurations, the monitoring individual or organization is relied upon to review the provided data in a conscientious and timely basis to detect events of interest. Such systems are conventionally known in high-level security premises wherein a security guard is charged with continuously monitoring video data provided on one or more monitors to detect any unusual or unwanted activity. Other examples of such passive systems include the use of one or more security cameras configured to record video data on a premises wherein the recorded video data is stored and available for later playback if theft or damage occurs on the premises. [0064] As explained above, such passive systems do not effectively serve the needs of an elderly individual or their caregiver who would benefit from the ability to receive alerts when particular events of interest occur but who also lack the ability to provide 24 hour personnel charged with monitoring passive feeds of video data. The disclosed embodiments address these deficiencies by providing event-driven monitoring that enables a caregiver to be notified when a particular triggering event occurs, e.g., the opening of an entrance/exit portal for their charge's residence. Such triggering events are recognized as a potential source of heightened risk for their charges based on the charges' potential susceptibility to nefarious individuals, propensity to wander, etc. Thus, by alerting a caregiver(s) of such events, the caregiver is empowered with the opportunity to be vigilant while reducing the cognitive load associated with monitoring their charge.

[0065] FIGURE 2 illustrates one example of a methodology provided by at least one of the disclosed embodiments. As shown in FIG. 2, the methodology begins at 200 and control proceeds to 205, at which one or more sensors detect at least one triggering event. Subsequent to that detection, control proceeds to 210, at which the one or more sensors transmit data indicating the existence of the triggering event(s) to premises hardware to trigger operation of one or more cameras. It should be appreciated that such premises hardware may simply be incorporated into the monitoring management module and/or cameras and be configured to trigger operation of the cameras.

[0066] Thus, at 215, image data is acquired via the one or more cameras; as explained above, the image data may incorporate a plurality of images taken from one or more cameras and showing multiple views of the charge's residence environment around a residence portal. Control then proceeds to 220, at which the image data is transmitted from the cameras to a monitoring management module; as explained in detail above, the monitoring management module may have various different hardware and software implementation configurations. [0067] At 225, the image data is configured for transmission to one or more recipient devices and transmission of that image data is initiated by the monitoring management module. It should be understood that, as part of the configuration of the image data, a text message, electronic mail message or other type of transmission media is formulated; that transmission media may optionally include data indicating a time and/or date associated with the capture of the image data, a location of the image data and/or the identity of an individual associated with the residence at which the image data was captured. Operations performed as part of the initiation of the transmission of the image data may differ significantly depending on the selected transmission media; for example, the operations performed by the monitoring management module to initiate transmission of an MMS message providing image data differ significantly from the operations performed to initiate transmission of an electronic mail message providing the image data.

[0068] Control then proceeds to 230, at which the image data is delivered to one or more recipient devices. Such delivery is performed using one or more communication networks; therefore, it should be appreciated that the entities controlling or administering one or more of those communication networks may or may not have an association or affiliation with an entity providing the components or associated services in conjunction with the disclosed embodiments. Therefore, it should be understood that the transmission of image data from the monitoring management module to one or more recipient devices may not be required to constitute practicing of the technology of the disclosed embodiments.

[0069] Control proceeds to 235, at which the image data transmitted to the one or more recipient devices is output to the recipient device(s) and optionally stored thereon. As at 230, it should be understood that the output and storage of the transmitted image data is not necessarily under the control of an entity providing the components or associated services in conjunction with the disclosed embodiments.

[0070] Control then proceeds to 240 at which the reactive methodology operations end until a triggering event is again detected by one or more sensors to trigger the reactive operations again.

[0071] It should be appreciated that the operations performed by the monitoring management module are performed under the control of hardware and/or software included in that module; therefore, it should be understood that the module may by implemented in various implementations, as discussed herein. Therefore, it should be understood that the monitoring management module may include hardware and/or software sufficient for the module to perform the functionality described herein; accordingly, it is foreseeable that the hardware implementing the module may include one or more computer processing units and one or more memory devices configured to store computer program instructions that control and facilitate the above-described operations.

[0072] Returning to the various points of utility provided by the disclosed embodiments, it should be appreciated that the selective monitoring provided by the event-driven monitoring system reduces the amount of monitoring data transmitted outside of the charge's residence. Accordingly, the system also has improved sensitivity for a charge's privacy. [0073] In this regard, the use of still images rather than video may also improve the privacy sensitivity of the monitoring system. This is because video data provides more information than still images; for example, video data provides information regarding the way in which an individual is moving, the period of time that is required for an individual to perform certain tasks, etc. However, such information may be a source of sensitivity and potential embarrassment to the charge because, for example, the charge's physical prowess may be deteriorating and recording of the diminished ability of the charge may be offensive or shame- inducing to the charge. Moreover, such information may not be necessary for the effective monitoring of a charge's wellbeing; this is particularly true when a triggering event is the activation of a portal to facilitate interaction with the environment outside the charge's residence and/or to facilitate interaction with one or more individuals in that environment. What may be of primary importance for such an event is the presence and appearance of the charge and the presence, appearance and identification of an individual interacting with the charge via the portal. Such data are discernable via still images; as a result, the use of video data may not be beneficial or necessary in the monitoring system. When no triggering events occur, the system may be configured to conduct no other surveillance; as a result, the system is configured to avoid a conventional problem of "dead air" (i.e., wherein a monitoring system is providing no meaningful information because no activity is occurring to be monitored) that affects many continuous monitoring systems.

[0074] In accordance with at least one disclosed embodiment, the monitoring system provides utility in that the security configuration of the system and protection against system intrusion by an assailant is both simply implemented and effective. The security of the system may rely largely on physical security (for the sensors and cameras) and conventional security practices for the various implementations of the monitoring management module discussed above. More specifically, it should be appreciated that a system assailant may be motivated to: (1) obtain monitoring capability of his own; or (2) damage or render inoperable the monitoring capability of the system.

[0075] If an assailant desires to exploit the system to obtain monitoring capability of his own, there may be two potential entry points into the monitoring system. First, the assailant may attempt to physically splice into the cameras and gain access at this point; alternatively, the assailant may attempt to compromise the monitoring management module through its connection to the communication network(s) (see 160 illustrated in FIG. 1). [0076] Attempting to physically attack the cameras may be the most direct attack and the easiest to implement; however, as a result, such an attack may also be the easiest to address. For example, if the physical design of the system has one camera located inside a residence portal and one camera located outside the residence portal (for example, in a weather-resistant housing), both cameras may transmit image data over physical lines to the monitoring management module. In one implementation, this transmission could be provided for example, via a hub, which may be connected to a server running software that provides the functionality of the monitoring management module; thus, in such an implementation all system components (with the exception of one of the cameras) on the premises could be located inside the charge's residence. Therefore, the camera located outside the residence portal would be the most susceptible to attack due to its vulnerable outside location.

[0077] However, in such an implementation, a would-be assailant would need to be physically present to tamper with the camera itself or the wiring leading to the other system components located in the charge's residence. Moreover, once the assailant had physically compromised the equipment located on the outside of the residence portal, the assailant would need to include hardware of their own to retrieve and transmit the image from that camera. Thus, such an attack is unlikely to occur because the assailant would gain little and would be required to expend a large amount of effort to successfully complete the attack. In reality, it might be less expensive for a nefarious individual to simply install his own covert external camera, as neither the vector nor the value gained is favorable to the assailant. [0078] In an alternative implementation of the system where image data is transmitted from the cameras to the monitoring management module wirelessly, it should be appreciated that a wireless network (e.g., a Wireless Local Area Network (WLAN) or the like) used to provide this transmission may be secured (e.g., using various encryption technologies available such as Wi-Fi Protected Access (WPA)) to protect the data transmitted in the system from being accessed by an unauthorized third party.

[0079] Thus, it should be understood that attacking the components on the inside of the charge's residence portal is deterred because of the physical security associated with the charge's residence, e.g., hardware locks, a security system, etc. Theoretically, a would-be assailant who can safely access the inside of charge's residence could install their own monitoring equipment without needing to use the monitoring system's components. Thus, a system attack of this type is similarly unlikely. [0080] In one implementation of the system, wherein the monitoring management module is implemented in whole or in part using a server, the system is susceptible to conventionally known security concerns for networked systems. Thus, conventionally known best practices for system software installation and maintenance may be implemented. In particular, strong passwords and authentication may be used (and optionally and beneficially changed frequently) to protect against attacks on a system administrator's account that controls the system settings on the server; theoretically, an assailant who gains the ability to alter system configuration settings could direct image data to be sent to additional or different recipient devices, disable the collection of image data partially or entirely, or use the cameras of the monitoring system for non-approved purposes (e.g., as live video cameras). [0081] Moreover, in an implementation wherein the system is utilizing a server to implement the monitoring management module functionality , a situation may occur when there is an actual or perceived threat of a Denial of Service (DoS) attack on the system via, for example, a physical or software based attack on a camera or the server implementing the monitoring management module. For example, a technically savvy assailant may attempt to saturate a server's bandwidth, preventing it from carrying out desired functions. One mechanism for minimizing a server's vulnerability would be to restrict alteration of system parameters to on-site users. Doing so makes management and maintenance of the system components more difficult; however, such an approach also enables the system to be hardened against incoming data traffic; thus, the equipment provided at the charge's residence may be configured to ignore any incoming data traffic from outside the premises. [0082] Nevertheless, it should be appreciated that, when a single server or group of servers is being used to implement the monitoring management module functionality as well as other software programs, the ability to harden the server(s) against incoming traffic may not be available because other applications may require bidirectional communication outside the charge's premises.

[0083] Such security concerns regarding a server implementation of the monitoring management module may be sufficient to warrant selection of an alternative system implementation that provides additional isolation of image data from unauthorized parties. In particular, it should be appreciated (as explained above) that the monitoring management module may be implemented using dedicated hardware with minimal functionality to capture and transmit image data with highly limited storage. For example, the monitoring management module may be implemented using a PDA or mobile device that may be programmed or run a software application configured to provide the functionality of the monitoring management module. In such an implementation the PDA or mobile device could be installed inside the house and draw power via connection to a wall outlet. Sensors and/or cameras could be connected to a data input port of the PDA or mobile device using special adapters (or alternatively, the components may be configured to transmit data and image data to the PDA or mobile device via wirelessly).

[0084] Such an implementation may provide the same or similar functionality provided in a server implemented monitoring management module configuration but potentially has a much smaller security impact because of the device isolation available with the PDA or mobile device. More specifically, by replacing a server with a dedicated piece of communication equipment running an application that enables only upstream data communication, security risks associated with server(s) implementation are mitigated. The PDA or mobile device may be configured such that incoming call functions are disabled, thereby removing the threat of DoS attacks and data leakage through a network compromise. In such an implementation, physical security measures may remain the same; thus, an assailant must physically penetrate the charge's residence to disable the monitoring system.

[0085] An added point of utility for a PDA or mobile device implementation is that the amount of memory available for storage of image data will be limited, thereby reducing potential issues related to long-term data retention on system components. It should be appreciated, however, that one or more caregiver(s) may request transmission of image data and associated time/date stamp data to one or more recipient devices for the purposes of archiving the data for their individual future use. As a result, the monitoring system enables the capability to archive monitoring data but does not require that the system itself archive such data to provide the monitoring functionality.

[0086] It should be appreciated that systems and methodologies designed in accordance with the disclosed embodiments provide various areas of utility including for example, the ability to provide truly privacy- sensitive monitoring. In order to do this, the frequency, granularity, and storage of private data may be reduced to a minimum acceptable level required to allow system functionality. Data may be captured only during triggering events. The data captured may consist only of still images and time and date data and this data is made available to one or more remote viewers (e.g., caregivers).

[0087] Moreover, in accordance with at least one disclosed embodiment, the system may use no permanent local storage, eliminating the possibility of compromise of a central data vault. Optionally, conditional consent may be obtained by empowering those who are entrusted with the care of the elderly to decide how to act on information provided via the monitoring. [0088] While this invention has been described in conjunction with the specific embodiments outlined above, it is evident that many alternatives, modifications and variations will be apparent to those skilled in the art. Accordingly, the various embodiments of the invention, as set forth above, are intended to be illustrative, not limiting. Various changes may be made without departing from the spirit and scope of the invention. [0089] For example, although the utility of the disclosed embodiments have been described in conjunction with the care of the elderly, it should be appreciated that the disclosed embodiments have utility for care giving for any individual that actually or is perceived as suffering from intermittent, constant and/or deteriorating/improving impairment of physical and/or mental abilities. Therefore, it should be understood that the disclosed embodiments may have particular utility in care giving for individuals who are susceptible to intermittent lapses of lucidity, individuals who are recuperating from a physical accident and are temporarily incapacitated, and/or individuals that suffer from long term disabilities (e.g., blindness). Moreover, it should be appreciated that the disclosed embodiments may have utility in providing piece of mind to potentially fully functioning individuals (or caregivers of such individuals) who live alone in a residence that is geographically isolated from others and/or caregivers; in such a situation, the caregiver or the isolated individual may perceive a sense of comfort from the monitoring of their residence portals that would justify the limited invasion of the individual's privacy resulting from the implementation of the system. [0090] Additionally, although the illustrated embodiments have been disclosed with reference to the capture of only still image data and associated time and date indicia, it is foreseeable that the system may be configured to provide some amount of video data and/or audio data in association with a triggering event.

[0091] Similarly, it should be appreciated that the sensor described in connection with a charge's residence portal may be replaced or augmented with other sensors including, for example, sensors connected to door knockers, door bells or an charge-operated button; thus, triggering of such sensors may trigger data capture in the same manner as described above. [0092] Moreover, in accordance with at least one disclosed embodiment, components of the system provided at a charge's residence may include an override unit with a cognitive indicator. Such an override unit may be configured to prevent signals generated from one or more trigger event sensors from triggering operation of the cameras to capture image data. Depending on the implementation of the monitoring management module, this may be performed by preventing a triggering event sensor signal from reaching the camera(s) or reaching the management module (if the module is configured to control operation of the camera(s). In implementation, the override module may be a wired component of the system and may have a timeout period, which is determined during installation. To activate the override unit, the charge must indicate cognitive awareness the performance of one or more cognitive activities, e.g., simple games, answering queries, etc. [0093] The software and/or hardware implementing the override unit may be incorporated in whole, in part or completely separately from the monitoring management module. The override unit may include a keypad, button pad and/or other user input/output interface device components necessary to support the evaluation of a charge's mental state. [0094] In operation of such an embodiment, when a residence door opens, if the override unit is not engaged, a sensor associated with the door signals the monitoring management module, which is configured to trigger operation of one or more cameras to capture image data from both sides of the portal (e.g., door). Transmission of this image data is then, as disclosed above, initiated by the monitoring management module to one or more recipient devices.

[0095] Further, although the monitoring system may be configured to provide time and date information associated with transmitted image data, the system may also capture and transmit to a recipient device associated information indicating, for example, the time between arrival of a visitor to a charge's residence and the residence door opening, and/or the time between arrival of the charge at the door and the door opening; such information may be considered sufficiently valuable to a care giver in determining the status of their charge while taking into consideration the sensitivity of the information provided to the caregiver for the purposes of maintaining the charge's personal privacy.

[0096] Moreover, a monitoring system provided in accordance with at least one disclosed embodiment may be integrated with another system or system components to permit a caregiver to remotely grant or deny access through the charge's residence portal based on captured image data. Such additional components or functionality may have particular utility when a charge suffers from an impairment that results in temporary and potential serious incapacitation events (e.g., epileptic attacks, recurrent strokes, etc.) or that results in intermittent delusions and/or paranoia (which may result in the charge refusing to grant entry to caregivers, professional safety or medical personnel, etc.) An additional camera, mounted on the outside of the residence door may be recommended in such an implementation, if for example, an interior mounted camera configured to provide a view of the outside of the door would have its view blocked when the residence door is shut. Further, in such a configuration, sensing of a visitor ringing a doorbell, attempting to use the doorknob for the door, or using a door knocker associated with the residence door may trigger image capture by the auxiliary camera to enable capture and transmission of image data and associated time/date indicia to the charge's caregiver(s). If access control is desired, the system components may be configured to receive an authorization signal and/or code that enables entry to the residence through the door. [0097] Additionally, to assist charges with vision impairments, a system configured in accordance with at least one disclosed embodiment may include and be triggered by one or more doorbell sensors. In such an implementation, the system may include a digital display on the inside of the residence door that transmits live video data provided by an auxiliary camera providing image data showing the outside of the door; in such a way, the residence door may be made effectively transparent, aiding the visually impaired individual in identifying a visitor on the outside of the door. It is foreseeable that this digital display may also be coupled with a system or computer application providing face recognition and a suitable database of friends and hostile parties could enable the system to automatically recognize and deny entry to threats, while broadcasting the arrival of known friendly parties, enabling the elderly with complete visual loss to recognize arrivals prior to opening the door. Again, an additional, door-mounted, outward-facing camera may be needed for this system.

[0098] In accordance with at least one disclosed embodiment, the monitoring system may optionally also include hardware that is configured to provide simple and quick connection to public safety infrastructure such as the 911 system; such an implementation may be of particular utility where a charge or resident of a resident has a history of instigating or becoming victim to domestic violence situations or threats thereof. In such an implementation the components may also include hardware and/or software that may be configured to transmit image data (still image and/or video and/or audio) as part of an automated police request. [0099] Further, it should be understood that image data may be transmitted to a caregiver's recipient device in many different formats and using various different protocols; therefore, although electronic mail and messaging protocols have been discussed, it should be understood that other formats and protocols may be used including Instant Messaging (IM). [00100] It should be understood that the cameras may be controlled to capture image data for a finite period of time once their operation has been triggered by the output signal output by the sensor located at the residence portal; alternatively, the cameras may be configured or controlled to capture image data as long as the sensor detects that the residence portal is open. [00101] Additionally, it should be understood that the functionality described in connection with various described components of various invention embodiments may be combined or separated from one another in such a way that the architecture of the invention is somewhat different than what is expressly disclosed herein. Moreover, it should be understood that, unless otherwise specified, there is no essential requirement that methodology operations be performed in the illustrated order; therefore, one of ordinary skill in the art would recognize that some operations may be performed in one or more alternative order and/or simultaneously. [00102] Finally, it should be understood that, although the disclosed embodiments have been described in conjunction with the use of one or more camera configured to capture image data, it should be understood that the disclosed embodiments may be implemented using various other types of data collection devices that may collect various different types of data including, for example, still image data, video data, audio data, data indicating that a charge has interacted with the system by pressing a button or the like to trigger a specified operation, etc. Likewise, it should be understood that a triggering event that triggers data collection may be one of various potential events associated with a charge's location and is not limited to the opening of a door. Thus, disclosed embodiments may be useful in collecting data indicating the status of a charge and/or an identity of a threat source actually or potentially interacting with the charge (whether that threat source is a human being, a piece of physical equipment, physical circumstance, environmental condition or event). For example, triggering events may include a charge's use of a major appliance such as a stove, the charge's entry to a bathroom or other confined space that may be difficult to maneuver into or out of without falling, etc. In such examples, the limited collection of remote data indicating the status of the charge may be beneficial to a caregiver; by providing this capability while safeguarding a charge's privacy, a beneficial balance may be established.

[00103] Various components of the invention may be provided in alternative combinations operated by, under the control of or on the behalf of various different entities or individuals.

[00104] Further, it should be understood that, in accordance with at least one embodiment of the invention, system components may be implemented together or separately and there may be one or more of any or all of the disclosed system components. Further, system components may be either dedicated systems or such functionality may be implemented as virtual systems implemented on general purpose equipment via software implementations. [00105] Although the utility of various invention embodiments has been described in connection with the distribution of promotional content, it should be understood that distributed information is not limited to promotional content but may also or alternatively include non- promotional material.

[00106] As a result, it will be apparent for those skilled in the art that the illustrative embodiments described are only examples and that various modifications can be made within the scope of the invention as defined in the appended claims.