Segregation of electronic personal health information

• US 10,171,537 B2
• Filed: 08/07/2015
• Issued: 01/01/2019
• Est. Priority Date: 08/07/2015
• Status: Active Grant

• Current Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Original Assignee: AT&T Intellectual Property I LP (AT&T, Inc.), AT&T Mobility II LLC (AT&T, Inc.)
• Inventors: Dowlatkhah, Sangar, Lau, Erie Lai Har
• Primary Examiner(s): Etienne, Ario
• Assistant Examiner(s): Rubin, Blake J
• Application Number:
  US14/821,425
• Publication Number:
  US 20170041366A1
• Time in Patent Office: 1,243 Days
• CPC Class Codes: G16H 10/60 for patient-specific data, e.g. for electronic patient records
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 65/762 at the source reformatting of additional data in video distribution servers H04N21/2355
• CPC Class Codes: H04L 65/80 Responding to QoS
• CPC Class Codes: H04L 67/2876 Pairs of inter-processing entities at each side of the network, e.g. split proxies
• CPC Class Codes: H04L 67/561 Adding application-functional data or data for application control, e.g. adding metadata
• CPC Class Codes: H04W 12/02 Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• CPC Class Codes: H04W 12/03 Protecting confidentiality, e.g. by encryption

Abstract

A dynamic secure mobile network is provided to enable the transfer and storage of private data. The dynamic secure mobile network can provide secured communication channels that segregates different types of data and allows for protected data streams to be sent via different secured channels than non-protected data. The enhanced wireless mobile network can support consistent compliancy/privacy and security policies across all networks.

Claims

1. A system, comprising:

a processor; and

a memory that stores executable instructions that, when executed by the processor, facilitate performance of operations, comprising;

receiving a first data stream from a device;

determining that the first data stream comprises protected information based on an indication of a type of application associated with the first data stream, and a function of a location of the device, a time that the first data stream is received, and a user profile active on the device, wherein the protected information is electronic personal healthcare information;

in response to determining that the first data stream comprises the protected information, encrypting the first data stream resulting in an encrypted data stream;

adding metadata to the encrypted data stream indicating that the encrypted data stream comprises the protected information resulting in a modified first data stream;

segregating, based on the metadata of the modified first data stream, the modified first data stream from a second data stream provided by the device, the second data stream not comprising the electronic personal healthcare information; and

transmitting the modified first data stream and the second data stream via a network device of a mobile network.

2. The system of claim 1, wherein the first data stream and the second data stream are associated with different applications on the device, wherein a first application associated with the first data stream generates protected information and a second application associated with the second data stream does not generate protected information.

3. The system of claim 1, wherein the operations further comprise:

transmitting the modified first data stream to a second device.

4. The system of claim 3, wherein the operations further comprise:

facilitating an encrypted connection between a first secure application of the first device and a second secure application of the second device.

5. The system of claim 1, wherein the operations further comprise:

transmitting the modified first data stream to a remote patient monitoring database.

6. The system of claim 1, wherein the operations further comprise:

authenticating the device based on authentication triplets and a virtual subscriber identity module card.

7. The system of claim 1, wherein the metadata comprises information relating to the application and a profile preference related to the application.

8. The system of claim 7, wherein the operations further comprise:

performing a network function related to a quality of service and a quality of experience on the modified first data stream based on the metadata.

19. The system of claim 1, wherein the user profile is associated with a policy for management of electronic personal healthcare information.

20. The system of claim 19, wherein the segregation the modified first data stream is based on the policy for management of electronic personal healthcare information.

9. A method, comprising:

receiving, by a device comprising a processor, a first data stream from a user equipment;

determining, by the device, that the first data stream comprises private information based on a determination of an application on the user equipment associated with the first data stream, a location of the user equipment, a time that the first data stream is received, and a policy associated with a user profile active on the user equipment associated with the first data stream, wherein the application is associated with electronic personal healthcare information;

in response to determining that the first data stream comprises the private information,

encrypting, by the device, the first data stream resulting in an encrypted data stream;

generating, by the device, metadata that indicates that the encrypted data stream comprises the private information;

attaching the metadata to the encrypted data stream resulting in an updated first data stream;

segregating the updated first data stream from a second data stream provided by the user equipment based on the policy, the second data stream not comprising the electronic personal healthcare information and the metadata of the updated first data stream; and

transmitting, by the device, the updated first data stream and the second data stream via a network device of a mobile network.

10. The method of claim 9, wherein the transmitting further comprises transmitting the updated first data stream to another user equipment.

11. The method of claim 10, further comprising:

enabling, by the device, an encrypted connection between respective secure applications of the user equipment and the other user equipment.

12. The method of claim 9, wherein the transmitting further comprises transmitting the updated first data stream to a remote monitoring database.

13. The method of claim 9, wherein the first data stream and the second data stream are associated with different applications on the user equipment.

14. The method of claim 9, wherein the metadata comprises information relating to profile preference information associated with the application.

15. The method of claim 14, further comprising:

applying, by the device, a network function to the updated first data stream relating to a quality of service or a quality of experience based on the profile preference information.

16. A non-transitory machine-readable storage medium, comprising executable instructions that, when executed by a processor, facilitate performance of operations, comprising:

receiving a data stream from a user equipment;

determining that the data stream comprises private information representative of electronic personal healthcare information based on an application on the user equipment associated with the data stream, a location of the user equipment, a time that the data stream is received from the user equipment, and a policy associated with a user profile active on the user equipment;

encrypting the data stream resulting in an encrypted data stream;

adding metadata to the encrypted data stream that indicates that the encrypted data stream comprises the private information representative of the electronic personal healthcare information;

maintaining the data stream separate from another data stream received from the user equipment, the other data stream not comprising the private information representative of electronic personal healthcare information, based on the metadata of the data stream;

performing a network function related to a quality of service and a quality of experience on the encrypted data stream based on the policy associated with the user profile; and

transmitting the data stream and the other data stream via a network device of a network.

17. The non-transitory machine-readable storage medium of claim 16, wherein the other data stream originates from another application that does not generate the electronic personal healthcare information.

18. The non-transitory machine-readable storage medium of claim 16, wherein the metadata comprises information relating to profile preference information associated with the application.