Systems and/or methods for enabling cooperatively-completed rules-based data analytics of potentially sensitive data

• US 10,019,588 B2
• Filed: 01/15/2016
• Issued: 07/10/2018
• Est. Priority Date: 01/15/2016
• Status: Active Grant

• Current Assignee: Finlocker LLC
• Original Assignee: Finlocker LLC
• Inventors: Garcia, Bryan D., Esparrago, Peter P.
• Primary Examiner(s): Shaifer Harriman, Dant B
• Application Number:
  US14/996,550
• Publication Number:
  US 20170206365A1
• Time in Patent Office: 907 Days
• Field of Search: 726 1
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes

Abstract

Certain example embodiments relate to systems and/or methods for providing enhanced control over potentially sensitive data sharable among and/or between different parties. For example, certain example embodiments provide views into computer-enabled workflows managed by external parties, including views into what sensitive data has been accessed, who has accessed it, etc., e.g., throughout the lifecycle of a product granted on the basis of an analysis of such data. A computer-enabled system for automatically assessing received sensitive data in accordance with one or more digitized rule sets also is provided in certain example embodiments, as are computer-mediated tools for helping to automatically, semi-automatically, and/or manually resolve issues detected in the assessments, e.g., via enhanced communication and collaboration, among and/or between parties to a transaction, as well as third-parties who indirectly are involved in the transaction. The data remains secure and traceable, e.g., in accordance with its provider'"'"'s specifications.

Claims

1. A data analysis system, comprising:

processing resources, including at least one first hardware processor and a first memory operatively coupled thereto;

a first non-transitory data store comprising sensitive data about a user, as well as a set of data sharing rules, the set of data sharing rules indicating what sensitive data is sharable and one or more conditions identifying when such sensitive data is shareable, and the sensitive data comprising information elements; and

a second non-transitory data store comprising at least one set of analysis rules, the at least one set of analysis rules being system defined and/or defined by an external party separate from the user;

wherein the processing resources are configured to control the data analysis system to at least;

store, to the first data store, sensitive information received from the user and/or electronically retrieved from a data source external to the data analysis system in response to the user providing appropriate credentialing information and/or consent for the external data source;

receive, from the external party, a request to process a first predefined set of sensitive information; and

responsive to a request to process a first predefined set of sensitive information,

determine one or more sets of analysis rules to be applied to sensitive information in the first predefined set of sensitive information, based at least in part on the received request;

automatically and programmatically attempt to apply each rule from each determined set of analysis rules to sensitive information in the first predefined set of sensitive information;

store, to the second data store, information about an outcome of the rules that are successfully applied, the information being associated with the sensitive information on which the rules are run; and

for each rule or set of rules that indicates that further action is required;

re-assess an outcome of a respective rule or an outcome of a set of rules, responsive to at least one of;

(a) automatic retrieval of further information from the user performed in connection with applicable data sharing rules, (b) application of a heuristic to sensitive information already in and/or added to the first predefined set of sensitive information, (c) electronic receipt of further information from the user or the external party in response to a system-initiated electronic prompt for responsive information, and (d) a determination as to whether the indication that further action is required for the respective rule or set of rules can be ignored based on input from the external party; and

store, to the second data store, information about an outcome of the respective re-assessed rule or set of rules, the information being associated with the sensitive information on which the respective rule or set of rules is run; and

wherein the system further comprises a portal and/or application programming interface configured to enable the external party to update a given outcome provided by one or more analysis rules for a corresponding item of sensitive information by updating the given outcome to an updated outcome selected from a set of outcomes.

2. The system of claim 1, wherein the set of outcomes to which the given outcome can be provided includes a list of different predefined selectable follow-up statuses.

3. The system of claim 1, wherein the set of outcomes to which the given outcome can be updated includes an outcome requiring annotation by the external party.

4. The system of claim 1, wherein the processing resources are further configured to control the data analysis system to at least determine whether the request to process the first predefined set of sensitive information is authorized by the user and/or the data sharing rules;

and condition the response to the request on this determination.

5. The system of claim 1, wherein one or more of the rules in the at least one set of analysis rules relates to a heuristic.

6. The system of claim 1, wherein rules that are successfully applied are those rules for which results are provided, regardless of whether those results indicate that further action is required.

7. The system of claim 1, wherein rules that are successfully applied are those rules for which results are provided.

8. The system of claim 1, wherein the information about an outcome is one or more of a result of a calculation, output from a model, a score, and/or output from a machine-learned model, for one or more information elements processed by one or more calculations, rules, models, score, and/or machine-learned models.

9. The system of claim 8, wherein the outputs created by calculations, models, scores, and/or machine-learned models become input for and drive the application of rules, heuristics, and/or machine-learned rules.

10. The system of claim 1, wherein the processing resources are further configured to control the data analysis system to at least send an electronic message to the user and/or external party upon completion of the processing of the first predefined set of sensitive information in accordance with the request.

11. The system of claim 10, wherein the processing resources are further configured to control the data analysis system to at least send an electronic message to the user and/or external party upon completion of the automatic and programmatic attempt when all rules, heuristics, and/or machine learned-rules have completed processing.

12. The system of claim 1, wherein the processing resources are further configured to control the data analysis system to at least send an electronic message to the user and/or external party upon completion of the automatic and programmatic attempt at application of each rule from each determined set of analysis rules.

13. The system of claim 1, further comprising a data store configured to store an audit trail.

14. The system of claim 13, wherein the audit trail tracks rule applications.

15. The system of claim 13, wherein the audit trail tracks data accessions by users and/or external parties.

16. The system of claim 13, wherein the audit trail tracks actions taken by users and/or external parties.

17. The system of claim 13, wherein the audit trail tracks data retrieval from external data sources and/or internal data sources.

18. The system of claim 1, wherein the processing resources are further configured to control the data analysis system to at least apply a further set of heuristics to attempt to automatically and programmatically resolve problematic outcomes when new information becomes available regardless of how that information becomes available.

19. The system of claim 1, wherein the processing resources are further configured to control the data analysis system to reapply and/or re-assess rules without regard to outcomes of earlier-processed rules when new information becomes available regardless of how that information becomes available.

20. The system of claim 1, wherein the processing resources are further configured to control the data analysis system to at least apply a further set of heuristics to attempt to automatically and programmatically resolve problematic outcomes.

21. The system of claim 20, wherein the heuristic includes one or more machine-learned rules.

22. The system of claim 1, wherein the processing resources are further configured to control the data analysis system to at least continue attempting to apply and/or re-assess rules without regard to outcomes of earlier-processed rules.

23. The system of claim 1, wherein the processing resources are further configured to control the data analysis system to at least apply a further set of rules to attempt to automatically and programmatically resolve problematic outcomes.

24. The system of claim 1, wherein, as a part of (c), further sensitive information is electronically receivable responsive to the user providing contact information for another party from whom information is desired.

25. The system of claim 1, wherein, as a part of (c), further sensitive information is electronically receivable responsive to the user authorizing access to, and providing credentialing information for, one or more other external data sources.

26. The system of claim 1, wherein, as a part of (c), further sensitive information is electronically receivable responsive to the user providing access to additional sensitive information electronically available from one or more other external data sources.

27. The system of claim 1, wherein, as a part of (c), further sensitive information is electronically receivable responsive to the user providing access to additional sensitive information pre-stored to the first data store.

28. The system of claim 1, wherein the portal and/or application programming interface is configured to enable the external party to update the given outcome by annotating the given outcome with a note.

29. The system of claim 28, wherein the note correlates the given rule and/or sensitive information associated with the rule with other information about the user known to the external party.

30. The system of claim 28, wherein the portal and/or application programming interface is configured to enable the user to provide information responsive to the given outcome by annotating the given outcome with a note and/or supplemental documents and/or information.

31. The system of claim 1, wherein the portal and/or application programming interface is configured to enable the external party to update the given outcome for a corresponding rule by annotating the given outcome with a note.

32. The system of claim 1, wherein the set of outcomes is a predefined set of available outcomes, and wherein the portal and/or application programming interface is configured to enable the external party to update the given outcome by changing the outcome provided by one or more rules to an outcome that is provided by the external party that the external party determines is more appropriate and which is not selected from a predefined set of available outcomes but instead is selected by the external party from a set of system-wide predefined states to set the state of that outcome, in order to override the given outcome.

33. The system of claim 1, wherein the portal and/or application programming interface is configured to enable the external party to add a new outcome for the corresponding item of sensitive information by selecting the new outcome from a predefined set of available outcomes and setting an associated state to a state selected from a set of predefined states for that outcome or from a predefined states available system-wide.

34. The system of claim 1, wherein the portal and/or application programming interface is configured to enable the external party to remove the given outcome and any associated state for the corresponding item of sensitive information via the updating.

35. The system of claim 1, wherein the set of outcomes is a predefined set of available outcomes, and wherein the portal and/or application programming interface is configured to enable the external party to update the given outcome by changing that outcome to an outcome selected from among the predefined set of available outcomes and that the external party determines is more appropriate, in order to override the given outcome.

36. The system of claim 1, wherein an electronic message is sent to the user and/or external party(s) and conveys information indicating that (a) one or more rules have been applied, and (b) prompts the user and/or external party(s) to whom the electronic message is sent to access the system via a portal and/or an application programming interface to obtain the results of the rules that have been applied.

37. The system of claim 1, wherein an outcome of a first rule overrides an outcome of a second rule, provided that a heuristic applied to a broader set of information elements from the first predefined set of sensitive information indicates that the second rule should be overridden and even though the second rule relates to an information element having a state indicating that it is flagged for follow-up.

38. The system of claim 1, wherein information elements are organizable as hierarchical collections of entries in the first predefined set of sensitive information.

39. The system of claim 38, wherein the hierarchical collections of entries in the first predefined set of sensitive information include single information elements, groupings of related single information elements, one or more collections of single information elements or groupings related single information elements entries that are proper subsets of the information elements in the first predefined set of sensitive information, and the first predefined set of sensitive information itself.

40. The system of claim 38, wherein the hierarchical collections of entries in the first predefined set of sensitive information includes collections of collections in the first predefined set of sensitive information, and the first predefined set of sensitive information itself.

41. The system of claim 38, wherein an outcome of a first rule overrides an outcome of a second rule, provided that the first rule relates to a higher-order information element compared to the second rule.

42. The system of claim 38, wherein an outcome of a first rule overrides an outcome of a second rule, provided that the first rule is a higher-order rule compared to the second rule.

43. The system of claim 38, wherein an outcome of a subsequent rule is structured to override an outcome of a prior rule based on the information element or information elements available to it.

44. The system of claim 38, wherein an outcome of a first rule is structured to override an outcome of a second rule, provided that the first rule relates to a subsequent information element compared to the second rule.

45. The system of claim 38, wherein an outcome of a first rule is structured to override an outcome of a second rule, provided that the first rule considers a broader set of information elements compared to the second rule.

46. The system of claim 38, wherein an outcome of a first rule overrides an outcome of a second rule, provided that a heuristic applied to the first predefined set of sensitive information as a whole indicates that the second rule should be overridden and regardless of whether the second rule relates to an information element having a state indicating that it is flagged for follow-up.

47. The system of claim 38, wherein an outcome of a first rule overrides an outcome of a second rule, provided that a heuristic applied to a broader set of information elements from the first predefined set of sensitive information indicates that the second rule should be overridden and even though the second rule relates to an information element having a state indicating that it is not flagged for follow-up.

48. The system of claim 38, wherein the information elements that comprise the sensitive information about the user are definable as:

(a) singular information elements, (b) groupings of related and/or non-related information elements, (c) hierarchies of information elements, (d) hierarchies of hierarchies of information elements, (e) attributes of other information elements, and/or (f) attributes of hierarchies of information elements.

49. The system of claim 1, wherein the information about an outcome is representative of a state for an information element processed by a corresponding rule, the state being selected from a plurality of different predefined states.

50. The system of claim 49, wherein information about outcomes of rules is stored on a rule-by-rule basis.

51. The system of claim 49, wherein information about outcomes of rules is stored on an information element by information element basis.

52. The system of claim 49, wherein information about outcomes of rules relates to one or more levels of rules.

53. The system of claim 49, wherein information about outcomes of rules relates to one or more levels of information elements.

54. The system of claim 49, wherein a first predefined state is indicative of follow-up being needed, and a second predefined state is indicative of no follow-up being needed.

55. The system of claim 49, wherein applicable rules are hierarchical.

56. The system of claim 49, wherein an electronic message is sent to the user and/or external party(s) and conveys information about the outcome of each applied rule, if any, and each re-assessed rule or set of rules, if any.

57. The system of claim 49, wherein an electronic message is sent to the user and/or external party(s) and conveys information indicating that (a) one or more rules have been applied, and (b) one or more information elements have issues that the user and/or external party(s) to whom the electronic message is sent needs to review and potentially address through the system using a portal and/or application programming interface.

58. The system of claim 49, wherein a first predefined state is indicative of follow-up being needed, and a second predefined state is indicative of no follow-up being needed, and wherein the portal and/or application programming interface is configured to enable the external party to update a given outcome by selectively changing the corresponding state from a state indicating follow-up is needed to a state indicating no follow-up is needed, and vice versa.

59. The system of claim 49, wherein the portal and/or application programming interface is further configured to permit the user to provide additional information such as a note or notes, document or documents, access to a new source or sources of sensitive information usable by the rules, heuristics, and/or the external party, which address or help address the issue or issues identified with an information element by the rules, heuristics, and/or review by the external party to identify whether there is an issue or issues with that information element.

60. The system of claim 49, wherein details about an issue requiring further action identified with respect to a given information element are stored as an attribute of that information element.

61. The system of claim 60, wherein potential information needed to resolve the issue and/or potential resolutions associated with the issue identified are stored as an attribute of that information element.

62. The system of claim 1, wherein the processing resources are further configured to control the data analysis system to at least repeat the automatic and programmatic attempt at application of each rule from each determined set of analysis rules in response to an update to the first predefined set of sensitive information.

63. The system of claim 1, wherein the processing resources are further configured to control the data analysis system to at least repeat the automatic and programmatic attempt at application of each rule from each determined set of analysis rules based on further input from the user and/or the external party.

64. The system of claim 1, wherein the heuristic includes one or more machine-learned rules.

65. The system of claim 1, wherein the heuristic includes digitally processing sensitive information already in and/or added to the first predefined set of sensitive information, and checking the digitally processed sensitive information for one or more pre-identified values applicable to the respective rule being re-assessed.

66. The system of claim 1, wherein the heuristic includes performing optical character recognition of sensitive information already in and/or added to the first predefined set of sensitive information.

67. The system of claim 1, wherein a score is assignable to, and/or a model is applicable to sensitive information already in and/or added to the first predefined set of sensitive information, and consequently output of the score and/or model is added to the first predefined set of sensitive information for consideration by the rules.

68. The system of claim 1, wherein the heuristic includes natural language processing of sensitive information already in and/or added to the first predefined set of sensitive information.

69. The system of claim 1, wherein re-assessment is practiced by executing (a), (b), (c), and (d), in a predefined order, until re-assessment is deemed complete.

70. The system of claim 1, wherein re-assessment is practiced by executing (a), (b), (c), and (d) in order.

71. The system of claim 1, wherein a plurality of different sets of analysis rules to be applied to sensitive information in the first predefined set of sensitive information are identifiable based on the received request.

72. The system of claim 71, wherein at least one of the plurality of different sets of analysis rules to be applied to sensitive information in the first predefined set of sensitive information is system defined and at least one other of the plurality of different sets of analysis rules to be applied to sensitive information in the first predefined set of sensitive information is defined by an external party separate from the user.

73. The system of claim 71, wherein each of the plurality of different sets of analysis rules to be applied to sensitive information in the first predefined set of sensitive information is defined by an external party separate from the user.

74. The system of claim 71, wherein the sets of analysis rules to be applied to sensitive information in the first predefined set of sensitive information are system defined.

75. The system of claim 54, wherein applicable rules are hierarchical.

76. The system of claim 55, wherein an outcome of a first rule overrides an outcome of a second rule, provided that the first rule relates to a higher-order information element compared to the second rule, regardless of whether the second rule relates to an information element having a state indicating that it is flagged for follow-up.

77. The system of claim 75, wherein an outcome of a first rule overrides an outcome of a second rule, provided that the first rule relates to a higher-order information element compared to the second rule and even though the second rule relates to an information element having a state indicating that it is flagged for follow-up.

78. The system of claim 55, wherein an outcome of a first rule overrides an outcome of a second rule, provided that the first rule is a higher-order rule compared to the second rule.

79. The system of claim 55, wherein an outcome of a subsequent rule is structured to override an outcome of a prior rule.

80. The system of claim 55, wherein an outcome of a first rule is structured to override an outcome of a second rule, provided that the first rule relates to a subsequent information element compared to the second rule.

81. The system of claim 55, wherein an outcome of a first rule is structured to override an outcome of a second rule, provided that the first rule considers a broader set of information elements compared to the second rule.

82. A data analysis method for use with a data analysis system comprising processing resources, including at least one first hardware processor and a first memory operatively coupled thereto, a first non-transitory data store comprising sensitive data about a user, as well as a set of data sharing rules, the set of data sharing rules indicating what sensitive data is sharable and one or more conditions identifying when such sensitive data is shareable, and the sensitive data comprising information elements, and a second non-transitory data store comprising at least one set of analysis rules, the at least one set of analysis rules being system defined and/or defined by an external party separate from the user, the method comprising:

storing, to the first data store, sensitive information received from the user and/or electronically retrieved from a data source external to the data analysis system in response to the user providing appropriate credentialing information and/or consent for the external data source;

receiving, from the external party, a request to process a first predefined set of sensitive information;

responsive to a request to process a first predefined set of sensitive information,

determining one or more sets of analysis rules to be applied to sensitive information in the first predefined set of sensitive information, based at least in part on the received request;

automatically and programmatically attempting to apply each rule from each determined set of analysis rules to sensitive information in the first predefined set of sensitive information;

storing, to the second data store, information about an outcome of the rules that are successfully applied, the information being associated with the sensitive information on which the rules are run; and

for each rule or set of rules that indicates that further action is required;

re-assessing an outcome of a respective rule or an outcome of a set of rules, responsive to at least one of;

(a) automatic retrieval of further information from the user performed in connection with applicable data sharing rules, (b) application of a heuristic to sensitive information already in and/or added to the first predefined set of sensitive information, (c) electronic receipt of further information from the user or the external party in response to a system-initiated electronic prompt for responsive information, and (d) a determination as to whether the indication that further action is required for the respective rule or set of rules can be ignored based on input from the external party; and

storing, to the second data store, information about an outcome of the respective re-assessed rule or set of rules, the information being associated with the sensitive information on which the respective rule or set of rules is run; and

enabling the external party to update a given outcome provided by one or more analysis rules for a corresponding item of sensitive information by updating the given outcome to an updated outcome selected from a set of outcomes, via a portal and/or application programming interface.

83. A non-transitory computer readable storage medium tangibly storing instructions that, when executed by a hardware processor of a data analysis system that includes a first data store comprising sensitive data about a user, as well as a set of data sharing rules, the set of data sharing rules indicating what sensitive data is sharable and one or more conditions identifying when such sensitive data is shareable, and the sensitive data comprising information elements, and a second data store comprising at least one set of analysis rules, the at least one set of analysis rules being system defined and/or defined by an external party separate from the user, perform functionality comprising:

storing, to the first data store, sensitive information received from the user and/or electronically retrieved from a data source external to the data analysis system in response to the user providing appropriate credentialing information and/or consent for the external data source;

receiving, from the external party, a request to process a first predefined set of sensitive information;

responsive to a request to process a first predefined set of sensitive information,

determining one or more sets of analysis rules to be applied to sensitive information in the first predefined set of sensitive information, based at least in part on the received request;

automatically and programmatically attempting to apply each rule from each determined set of analysis rules to sensitive information in the first predefined set of sensitive information;

storing, to the second data store, information about an outcome of the rules that are successfully applied, the information being associated with the sensitive information on which the rules are run; and

for each rule or set of rules that indicates that further action is required;

re-assessing an outcome of a respective rule or an outcome of a set of rules, responsive to at least one of;

(a) automatic retrieval of further information from the user performed in connection with applicable data sharing rules, (b) application of a heuristic to sensitive information already in and/or added to the first predefined set of sensitive information, (c) electronic receipt of further information from the user or the external party in response to a system-initiated electronic prompt for responsive information, and (d) a determination as to whether the indication that further action is required for the respective rule or set of rules can be ignored based on input from the external party; and

storing, to the second data store, information about an outcome of the respective re-assessed rule or set of rules, the information being associated with the sensitive information on which the respective rule or set of rules is run; and

enabling the external party to update a given outcome provided by one or more analysis rules for a corresponding item of sensitive information by updating the given outcome to an updated outcome selected from a set of outcomes, via a portal and/or application programming interface.