Managing secure sharing of private information across security domains by individuals having a service authorization
Inventors
Robbins, Richard Allen • Gifford, Warren Staten • Hassanat, Mojahedul Hoque Abul • Turock, Bradley Drew • Brockie, Justin Mark • Kelly, James Michael • Rahman, Zaiur
Assignees
Interested in licensing this patent?
MTEC can help explore whether this patent might be available for licensing for your application.
Publication Number
US-9794257-B2
Publication Date
2017-10-17
Expiration Date
Abstract
A system and method of granting a service authorization to a service provider in a regulating or funding agency of a first organization to access one or more individual's information in a second organization, where a service authorization comprises an authorization to access information and to provide specific services from said regulating or funding agency, the request for service authorization coming from an organization from an individual, patent or guardian of the individual, or regulating or funding organization, for service to be provided to an individual whose private information is stored within the second organization. A system for approving or rejecting the service authorization requests is provided based on authorization of the service provider, as well as a system and method for recording and sharing the outcomes of all decisions with the organization. If a service authorization is approved, it may be integrated into the organization's own workflow.
Core Innovation
The document describes a healthcare-focused secure information-sharing platform that supports sharing across multiple security domains and organizations. It requests and manages service authorization from a regulating or funding organization for a service provider in at least a first organization to provide service to one or more individuals in a second organization. Authorization is tied to specific services and is determined using access profiles associated with security domains together with roles, caseloads, and types of individual information in the second organization.
A key part of the system is the use of sharing access profiles that include caseloads and security access roles to govern what services and private information may be shared. The platform receives authorization requests, logs requests and authorization decisions in activity logs associated with at least the first organization or the second organization, and conditionally transfers one or more individuals’ information from the second organization to the service provider when access is granted. The access determination uses the access profile, the roles, the caseloads, and the type of the one or more individuals’ information in the second organization.
The document further describes mechanisms for matching common individuals across organizations using multiple identifiers or fields, and it supports inter- and intra-domain access with archived data and emergency-limited access. It includes secure communications, notifications via user-configured notification profiles, and security monitoring and auditing to detect suspicious patterns and generate detailed audit logs. It also discusses distributed or replicated system architecture for reliability and redundancy and uses mechanisms for secure operation including archiving, emergency access, and activity tracking across domains.
Claims Coverage
The partial content includes multiple independent claims: clm-00001, clm-00007, clm-00013, clm-00019, clm-00025, and clm-00031. Collectively, these claims cover requesting service authorization from a regulating or funding organization, determining authorization using access profile, roles, caseloads, and information types, logging activity in activity logs, and, when authorized, transferring individuals’ information between security domains.
Requesting service authorization with access-profile-based determination
Requesting a service authorization from a regulating or funding organization for a service provider in at least a first organization to provide service to one or more individuals in a second organization; wherein the first and second organizations are associated with first and second security domains, the second organization has an access profile associated with the first security domain, the service provider is associated with one or more roles and one or more caseloads, the one or more individuals’ information in the second organization has at least one type, the one or more roles includes access privilege information, and the one or more caseloads includes access privilege information for at least one individual or medical services program.
Activity logging of service authorization requests and decisions
Logging, in an activity log associated with at least the first organization or the second organization, the first request for said service authorization and logging, in the activity log, the granting of said service authorization.
Conditional transfer of individuals’ information upon granted authorization
Responsive to determining that the service provider associated with the first organization has been granted a service authorization to provide said service to the one or more individuals in the second organization, transferring the one or more individuals’ information in the second organization to the service provider associated with the first organization.
Cross-domain authorization using roles, caseloads, and information types
Determining whether the service provider associated with the first organization has been granted a service authorization to provide said service to the one or more individuals in the second organization based on at least the access profile, the one or more caseloads and the one or more roles associated with the service provider and the type of the one or more individuals’ information in the second organization.
Identifier-based accessibility gating for individual information
Determining whether the one or more individual’s information in the second organization is accessible based on the one or more of the one or more individual’s name, social security number, state identification number, birth date, and Medicaid number.
Code and system implementations for requesting service authorization
Providing non-transitory computer-readable storage media having computer executable code, and/or a system with a computer program stored in memory executed by a processor, performing storing of service and service-provider databases, receiving a first request for service authorization, logging in an activity log, determining and granting service authorization, and transferring individuals’ information while logging the granting and transferring.
Across the independent claims, the core claim coverage centers on service authorization requests to a regulating or funding organization, authorization determination using access profiles with roles and caseloads and the type of individual information, followed by logging and conditional transfer of individuals’ information between organizations associated with different security domains.
Stated Advantages
Not explicitly described in patent.
Documented Applications
Not explicitly described in patent.
Interested in licensing this patent?