Segregation of electronic personal health information

• US 10,735,487 B2
• Filed: 10/30/2018
• Issued: 08/04/2020
• Est. Priority Date: 08/07/2015
• Status: Active Grant

• Current Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Original Assignee: AT&T Mobility II LLC (AT&T, Inc.)
• Inventors: Dowlatkhah, Sangar, Lau, Erie Lai Har
• Primary Examiner(s): Rubin, Blake J
• Application Number:
  US16/174,604
• Publication Number:
  US 20190068675A1
• Time in Patent Office: 644 Days
• CPC Class Codes: G16H 10/60 for patient-specific data, e.g. for electronic patient records
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 65/762 at the source reformatting of additional data in video distribution servers H04N21/2355
• CPC Class Codes: H04L 65/80 Responding to QoS
• CPC Class Codes: H04L 67/2876 Pairs of inter-processing entities at each side of the network, e.g. split proxies
• CPC Class Codes: H04L 67/561 Adding application-functional data or data for application control, e.g. adding metadata
• CPC Class Codes: H04W 12/02 Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• CPC Class Codes: H04W 12/03 Protecting confidentiality, e.g. by encryption

Abstract

A dynamic secure mobile network is provided to enable the transfer and storage of private data. The dynamic secure mobile network can provide secured communication channels that segregates different types of data and allows for protected data streams to be sent via different secured channels than non-protected data. The enhanced wireless mobile network can support consistent compliancy/privacy and security policies across all networks.

Claims

1. A system, comprising:

a processor; and

a memory that stores executable instructions that, when executed by the processor, facilitate performance of operations, comprising;

determining that a first data stream comprises protected information based on an indication of a type of application associated with the first data stream, the determining further being a function of a location of a first device associated with the first data stream, a time that the first data stream is received, and a user profile active on the first device, wherein the protected information is electronic personal healthcare information;

in response to determining that the first data stream comprises the protected information, encrypting the first data stream resulting in an encrypted data stream; and

transmitting, via a network device of a mobile network, the encrypted data stream and a second data stream that does not comprise the electronic personal healthcare information, wherein the encrypted data stream is transmitted via a first communication channel, and the second data stream is transmitted via a second communication channel segregated from the first communication channel.

2. The system of claim 1, wherein the operations further comprise:

adding metadata to the encrypted data stream indicating that the encrypted data stream comprises the protected information resulting in a modified first data stream.

3. The system of claim 2, wherein the metadata comprises information relating to the application and a profile preference related to the application.

4. The system of claim 2, wherein the operations further comprise:

performing a network function related to a quality of service and a quality of experience on the encrypted data stream based on the metadata.

5. The system of claim 1, wherein the first data stream and the second data stream are associated with different applications on the first device, wherein a first application associated with the first data stream generates protected information and a second application associated with the second data stream does not generate the protected information.

6. The system of claim 1, wherein the operations further comprise:

transmitting the encrypted data stream to a second device.

7. The system of claim 6, wherein the operations further comprise:

facilitating an encrypted connection between a first secure application of the first device and a second secure application of the second device.

8. The system of claim 1, wherein the operations further comprise:

transmitting the encrypted data stream to a remote patient monitoring database.

9. The system of claim 1, wherein the operations further comprise:

authenticating the first device based on authentication triplets and a virtual subscriber identity module card.

10. The system of claim 1, wherein the user profile is associated with a policy for management of electronic personal healthcare information.

11. A method, comprising:

determining, by a device comprising a processor, that a first data stream from a user equipment device comprises private information based on a determination of an application on the user equipment device associated with the first data stream, a location of the user equipment device, a time that the first data stream was received, and a policy associated with a user profile active on the user equipment associated with the first data stream, wherein the application is associated with electronic personal healthcare information;

in response to determining that the first data stream comprises the private information, encrypting, by the device, the first data stream resulting in an encrypted data stream; and

transmitting, by the device, the encrypted data stream and a second data stream that does not comprise the electronic personal healthcare information, wherein the encrypted data stream is transmitted via a first communication channel, and the second data stream is transmitted via a second communication channel segregated from the first communication channel.

12. The method of claim 11, further comprising:

generating, by the device, metadata that indicates that the encrypted data stream comprises the private information; and

attaching, by the device, the metadata to the encrypted data stream resulting in an updated first data stream.

13. The method of claim 12, wherein the metadata comprises information relating to profile preference information associated with the application.

14. The method of claim 11, wherein the user equipment device is a first user equipment device, and wherein the transmitting further comprises transmitting the updated first data stream to a second user equipment device.

15. The method of claim 14, further comprising:

enabling, by the device, an encrypted connection between respective secure applications of the first user equipment device and the second user equipment device.

16. The method of claim 11, wherein the transmitting further comprises transmitting the updated first data stream to a remote monitoring database.

17. The method of claim 11, wherein the first data stream and the second data stream are associated with different applications on the user equipment device.

18. A non-transitory machine-readable storage medium, comprising executable instructions that, when executed by a processor, facilitate performance of operations, comprising:

based on an application on the user equipment associated with the data stream, a location of the user equipment, a time that the data stream is received from the user equipment, and a policy associated with a user profile active on the user equipment, determining that a data stream associated with a user equipment device comprises private information representative of electronic personal healthcare information;

encrypting the data stream resulting in an encrypted data stream;

based on the policy associated with the user profile, performing a network function related to a quality of service and a quality of experience on the encrypted data stream; and

transmitting the encrypted data stream and a second data stream that does not comprise any electronic personal healthcare information, wherein the encrypted data stream is transmitted via a first communication channel, and the second data stream is transmitted via a second communication channel segregated from the first communication channel.

19. The non-transitory machine-readable storage medium of claim 18, wherein the application is a first application, and wherein the second data stream originates from a second application that does not generate any electronic personal healthcare information.

20. The non-transitory machine-readable storage medium of claim 18, wherein the encrypted data stream comprises metadata indicating information relating to profile preference information associated with the application.