Data-driven integrated HIPAA-compliant computer security system for verifying and billing long term services, including data collection from multiple sources

Inventors

Brockie, Justin Mark • Ali, Md. Asif • Faruq, A. S. M. Omar • Kelly, James Michael • Rafique, Sazzad • Robbins, Richard Allen

Assignees

Therap Services LLC

Abstract

Systems and methods for sharing the information of an individual under care across at least two organizations in an integrated manner are described. These include systems and methods of data collection from multiple sources relating to the individual's care, where the data collection is driven by one or more preset orders. The preset orders may be preset by a user. A physical node may receive a request for authorization for a user in an organization to access an individual's information in another organization. The request may be logged. The physical node may determine whether the user is authorized to access the individual's information and, if it is, provide appropriate access.

Core Innovation

The invention provides a HIPAA-compliant computer security method of sharing service, budget, and billing information associated with personal health information of one or more individuals among at least a first organization and a second organization in an integrated manner, while preventing unauthorized access to the billing information. The method is based on receiving a first request for authorization for a user in the first organization to access service and budget information in the second organization, in a security domain context in which the organizations are associated with different security domains and the second organization has an access profile associated with the first security domain.

The method includes logging the user's first request for authorization in an activity log associated with at least the first organization or the second organization, and determining whether the user is authorized to access the service and budget information in the second organization. The authorization determination is based on at least the access profile, the one or more caseloads, the one or more roles associated with the user, and the type of service and budget information pertaining to the one or more individuals.

Responsive to a determination that the user is authorized, the method transfers the service and budget information from the second organization in compliance with HIPAA and logs the transferring to the user in compliance with HIPAA. Responsive to a determination that the user is not authorized, the method prevents the requested access in compliance with HIPAA. The method also includes receiving information pertaining to services provided by the first organization and billing information generated by the first organization pertaining to the provided services.

Correspondingly, the invention provides a HIPAA-compliant computer security system that implements the same integrated sharing and unauthorized-access prevention concept through means for receiving, logging, determining authorization, transferring and logging authorized information in compliance with HIPAA, and preventing access when not authorized. The system supports sharing service, budget, and billing information associated with personal health information between organizations while using access profile, roles, caseloads, and service and budget types to govern authorization.

Claims Coverage

The document includes two independent claims, covering a HIPAA-compliant computer security method and a HIPAA-compliant computer security system for integrated sharing of service, budget, and billing information tied to personal health information, with authorization control and prevention of unauthorized access. Each independent claim emphasizes the same inventive authorization framework based on security domains, access profiles, roles, caseloads, and service and budget types.

Across the independent claims, the coverage focuses on HIPAA-compliant integrated sharing of service, budget, and billing information associated with personal health information between organizations, with authorization governed by access profiles, roles, caseloads, and service and budget types. The claims further require logging in an activity log, HIPAA-compliant transfer and logging for authorized users, HIPAA-compliant prevention for unauthorized users, and receiving services-provided information and billing information generated by the first organization.

Stated Advantages

Documented Applications

No documented applications found