Electronic health records

• US 10,249,386 B2
• Filed: 12/31/2014
• Issued: 04/02/2019
• Est. Priority Date: 08/01/2002
• Status: Active Grant

• Current Assignee: Prosocial Applications, Inc.
• Original Assignee: Prosocial Applications, Inc.
• Inventors: Blechman, Elaine
• Primary Examiner(s): Burgess, Joseph D
• Application Number:
  US14/588,304
• Publication Number:
  US 20150213195A1
• Time in Patent Office: 1,553 Days
• CPC Class Codes: G06Q 2220/10 Usage protection of distributed data files
• CPC Class Codes: G16H 10/60 for patient-specific data, e.g. for electronic patient records

Abstract

The system disclosed herein provides a method of populating an exclusively patient controlled record in a patient controlled electronic health record (PCHR) record repository, the method comprising: processing a request from a patient for a health information artifact; determining a supplier of the health information artifact; generating one or more information request templates required by the supplier of the health information artifact; generating an information request document using one or more of the information request templates; encrypting the information request document; sending the encrypted information request document to the supplier of the health information artifact; receiving the health information artifact; adding the health information artifact to the exclusively patient controlled record stored in the PCHR record repository; and controlling access of a user, human or machine, to the exclusively patient controlled record in the PCHR record repository based on (a) patient authorization of the user for future record access and (b) on consent from a registered device in response to the request of a patient-authorized user for current record access.

Claims

1. A method of populating an exclusively patient controlled record in a patient controlled electronic health record (PCHR) record repository, the method comprising:

processing a request from a patient for a health information artifact;

determining a supplier of the health information artifact;

generating one or more information request templates required by the supplier of the health information artifact;

generating an information request document using one or more of the information request templates;

encrypting the information request document;

sending the encrypted information request document to the supplier of the health information artifact;

receiving the health information artifact;

adding the health information artifact to the exclusively patient controlled record stored in the PCHR record repository; and

controlling access of a user, human or machine, to the exclusively patient controlled record in the PCHR record repository based on (a) patient authorization of the user for future record access and (b) consent from a registered device in response to the request of a patient-authorized user for current record access, wherein the registered device is a mobile device;

receiving a request from the user for access to the exclusively patient controlled record in the PCHR record repository;

determining if the user has previously been authorized by the patient for record access and patient-authorized user permissions associated with the record;

sending the access request of the patient-authorized user to the registered device; and

receiving a consent reply from the registered device.

2. The method of claim 1, wherein controlling access to the exclusively patient controlled record in the PCHR record repository further comprises:

validating the consent reply; and

if the consent reply is validated, granting user access to the record governed by the patient-authorized permissions.

3. The method of claim 2, wherein validating the consent reply further comprises evaluating a private key and a digital signature received from the registered device.

4. The method of claim 2, wherein the registered device is registered to the patient.

5. The method of claim 2, wherein the registered device is registered to a patient proxy that is designated by the patient.

6. The method of claim 2, further comprising:

if the consent reply is not validated, denying the user access request, sending an encrypted message including contents of the exclusively patient controlled record to a patient-designated storage device such as the patient registered device, and deleting contents of the exclusively patient controlled record from the PCHR record repository.

7. The method of claim 2, wherein the registered device is a patient registered device, and the method further comprising:

if no consent is received from the patient registered device, communicating the access request to a registered device of a next patient proxy.

8. The method of claim 7, wherein next patient proxy is determined from a patient ordered set of proxies.

9. The method of claim 2, wherein the registered device is a patient registered device and receiving the patient consent further comprises receiving the patient consent from a PCHR app resident on the patient registered mobile device.

10. The method of claim 2, wherein the registered device is a patient registered device, the method further comprising:

receiving a consent from a patient registered device for access by the patient-authorized user to the exclusively patient controlled record in the PCHR record repository;

validating the consent; and

in response to validation of the consent, granting access of the user, consistent with patient-authorized permissions, to the exclusively patient controlled record.

11. The method of claim 10, further comprising:

receiving an annotation to a health information artifact contained in the exclusively patient controlled record in the PCHR record repository without tampering with the original artifact; and

storing an annotated version of the original health information artifact in the exclusively patient controlled record in the PCHR record repository.

12. The method of claim 2, wherein the registered device is a patient registered device and the method further comprising:

receiving a request from the patient registered device authorizing a patient proxy to register a device for managing access, consistent with patient-authorized permissions, to the exclusively patient controlled record in the PCHR record repository, the authorization request further comprising identification of the device of the patient proxy;

validating the authorization request; and

registering the device of the patient proxy as a proxy registered device to manage access to the exclusively patient controlled record in the PCHR record repository.

13. The method of claim 12, wherein the authorization request further comprises a set ordered by the patient of proxies and their proxy registered devices.

14. The method of claim 2, wherein the registered device is a patient registered device and the method further comprising:

determining a security breach at the PCHR record repository; and

in response to the determination of the security breach, sending a notification of the security breach to the patient registered device, transmitting the contents of the exclusively patient controlled record from the PCHR record repository to a patient-selected storage location such as the patient registered device, and deleting all contents of the exclusively patient controlled records from the PCHR record repository.

15. The method of claim 14, further comprising deregistering all proxy registered devices in response to the security breach.

16. One or more tangible computer-readable storage media storing computer executable instructions for performing a computer process on a computing system for populating an exclusively patient controlled record in a patient controlled electronic health record (PCHR) record repository, the computer process comprising:

receiving a request from a patient for a health information artifact;

determining a supplier of the health information artifact;

generating one or more information request templates required by the supplier of the health information artifact;

generating an information request document using one or more of the information request templates;

encrypting the information request document;

sending the encrypted information request document to the supplier of the health information artifact;

receiving the health information artifact;

adding the health information artifact to the exclusively patient controlled record in the PCHR record repository;

storing the updated version of the exclusively patient controlled record in the PCHR record repository; and

controlling access of a user, human or machine, to the exclusively patient controlled record in the PCHR record repository based on patient authorization of a user for future record access and on patient consent from a registered device, wherein the registered device is a mobile device registered by the patient, to the request of a patient-authorized user for current record access.

17. The one or more tangible computer-readable storage media of claim 16, wherein the computer process comprising:

receiving a request from the user for access to the exclusively patient controlled record in the PCHR record repository;

determining if the user has previously been authorized by the patient for record access and patient-authorized user permissions associated with the record;

sending the access request of the patient-authorized user to the registered device;

receiving the consent reply from the registered device;

validating the consent reply; and

if the consent reply is validated, granting the user access to the record governed by the patient-authorized permissions.

18. A patient controlled electronic health record (PCHR) system for populating an exclusively patient controlled record in a patient controlled electronic health record (PCHR) repository, the system comprising one or modules implemented using a hardware processor, the one or more modules comprising:

an interoperability module configured to;

receive a request from a patient-authorized user, human or machine, for a health information artifact,

determine a supplier of the health information artifact,

determine one or more information request templates required by the supplier of the health information artifact,

generate an information request document using one or more of the information request templates,

encrypt the information request document,

communicate the encrypted information request document to the supplier of the health information artifact,

receive the health information artifact,

add the health information artifact to the exclusively patient controlled record in the PCHR record repository, and

store the updated version of the exclusively patient controlled record in the PCHR record repository; and

an access control module configured to control access to the exclusively patient controlled record in the PCHR record repository based on patient authorization of user permissions for future record access and on a consent reply to current record access by the patient-authorized user received from a registered device, wherein the registered device is a mobile device.

19. The patient controlled electronic health record (PCHR) system of claim 18, wherein the access control module is further configured to:

receive a request from a user, human or machine, for access to an exclusively patient controlled record in the PCHR record repository;

determine if the user has been previously authorized by the patient for record access and with what permissions in the hierarchy of patient-authorized user permissions associated with the record;

send the access request of a patient-authorized user to the registered device;

receive a consent reply from the registered device;

validate the consent reply; and

if the consent reply is validated, grant the user access to the exclusively patient controlled record in the PCHR record repository, governed by patient-authorized permissions.

20. The patient controlled electronic health record (PCHR) system of claim 18, further comprising a breach detection module configured to:

detect an episode of unauthorized access to an exclusively patient controlled record in the PCHR record repository;

notify a patient registered device associated with the exclusively patient controlled record of the episode of unauthorized access;

transmit contents of the exclusively patient controlled record from the PCHR record repository to a patient-selected storage location such as the patient registered device; and

delete the contents of the exclusively patient controlled record from the PCHR record repository.

21. The patient controlled electronic health record (PCHR) system of claim 18, further comprising a permissions management module configured to:

assist a patient in creating and managing permissions of an individualized hierarchy of users;

require all authorized human users to be identified as individuals; and

require all authorized machine users to be associated with an individually identified human user.

22. The patient controlled electronic health record (PCHR) system of claim 18, further comprising a proxy management module configured to:

receive an authorization request from a patient registered device authorizing a patient proxy to register a device for managing access to an exclusively patient controlled record in the PCHR record repository, the authorization request further comprising identification of a proxy registered device;

validate the authorization request; and

register the device of the proxy to manage access to the exclusively patient controlled record in the PCHR record repository.

23. The patient controlled electronic health record (PCHR) system of claim 18, further comprising an annotation module configured to:

receive an annotation to a health information artifact contained in the exclusively patient controlled record in the PCHR record repository without tampering with the original artifact; and

store an annotated version of the original health information artifact in the exclusively patient controlled record in the PCHR record repository.