Dynamically and customizably managing data in compliance with privacy and security standards

• US 20050192830A1
• Filed: 02/12/2005
• Published: 09/01/2005
• Est. Priority Date: 05/15/2002
• Status: Active Grant

• Current Assignee: Verisma Systems, Inc.
• Original Assignee: Verisma Systems, Inc.
• Inventors: Pugh, Michael D., Collins, David W., Dick, Richard S.
• Granted Patent: US 9,049,314 B2
• Time in Patent Office: Days
• US Class Current: 705/320
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: G06Q 10/101 Collaborative creation, e.g. joint development of products or services
• CPC Class Codes: G06Q 10/105 Human resources
• CPC Class Codes: H04N 1/00204 with a digital computer or a digital computer system, e.g. an internet server programmed control between transmitter and receiver or between image input and image output device H04N1/32561
• CPC Class Codes: H04N 2201/001 Sharing resources, e.g. processing power or memory, with a connected apparatus or enhancing the capability of the still picture apparatus
• CPC Class Codes: H04N 2201/0093 Facsimile machine H04N2201/0094 takes precedence
• CPC Class Codes: H04N 2201/3218 of a confirmation, acknowledgement or receipt

Abstract

Systems and methods for managing data in compliance with privacy, security and/or retention standards in business industries. A dynamic and customizable archival and retrieval system allows for information and documentation to be placed and made available in the system. The document type and identifying information for that document type are described. Definitions are established for the documents being managed, the data identifying the documents, and the retention policies for the documents. The documents are associated with the identifying data for a particular set of records. A single point of entry is provided for external and/or internal requests, and/or a single point of exit is provided for transmissions of information, wherein the transmissions to requestors include information that is individually approved. Moreover, digital authorizations and consents for retrieval from external data sources may be utilized.

Claims

1. In a system that includes a computer device, a method for managing business data in compliance with privacy, security and retention standards, the method comprising:

establishing on a computer readable medium archival business documentation in an electronic form that is associated with identifiable information that is dynamic and customizable;

receiving a request for information located on the computer readable medium;

determining whether the requested information is subject to a regulated requirement based on the content of the information that would preclude release of the information to the requester;

electronically locating the requested information based on the associated identifiable information; and

if the requested information is not subject to the requirement, releasing the requested information to the requester.

2. A method as recited in claim 1, further comprising:

determining whether consent of an individual of which the content pertains is required; and

determining whether the consent of the individual has been obtained, wherein the releasing of the requested information to the requester is performed if the requested information is not subject to the requirement and if the consent of the individual has been obtained when the consent is required.

3. A method as recited in claim 1, further comprising:

determining whether there exists a legal requirement to release the requested information; and

if there exists the legal requirement, releasing the requested information to the requester.

4. A method as recited in claim 1, wherein the regulated requirement is a federal regulation that precludes release of the requested information to the requestor based on the content of the requested information.

5. A method as recited in claim 1, wherein the regulated requirement is a state regulation that precludes release of the requested information to the requester based on the content of the requested information.

6. A method as recited in claim 1, wherein the regulated requirement is a local regulation that precludes release of the requested information to the requester based on the content of the requested information.

7. A method as recited in claim 1, wherein the regulated requirement is an internal regulation of the owner of the requested information that precludes release of the requested information to the requestor based on the content of the requested information.

8. A method as recited in claim 1, wherein the regulated requirement is a regulated archival time period, wherein expiration of the time period precludes release of the requested information to the requester.

9. A method as recited in claim 1, wherein the regulated requirement is a pre-established professional requirement that precludes release of the requested information to the requestor.

10. A method as recited in claim 1, wherein the regulated requirement is a pre-established ethical requirement that precludes release of the requested information to the requestor.

11. A method as recited in claim 1, further comprising

comparing a pre-established retention time deadline of the holder of the requested information with a retention time deadline of whom the requested information pertains;

and

releasing the requested information to the requestor if the requested information is not subject to the requirement and the retention time deadline of whom the requested information pertains has not expired.

12. A method as recited in claim 1, wherein the step for establishing comprises:

providing a business document;

establishing a business document definition;

defining identifying data associated with the business document;

defining a retention policy of the business document;

generating an input form based on the identifying data that is associated with the business document; and

preserving the business document based on the identifying data for dynamic retrieval and availability.

13. A method as recited in claim 1, wherein the business data relates to at least one of (i) a health care industry;

(ii) an automobile industry;

(iii) a real estate industry;

(iv) an insurance industry;

(v) a financial industry;

(vi) an energy industry;

(vii) a natural resources industry;

(viii) an academic industry;

(ix) a gaming industry;

(x) a transportation industry;

(xi) a manufacturing industry; and

(xii) a sales industry.

14. A method for managing business data in compliance with privacy, security and retention standards, the method comprising:

establishing on a computer readable medium archival business documentation in an electronic form that is associated with identifiable information that is dynamic and customizable, wherein the step of establishing the archival business documentation includes establishing a business document definition, defining identifying data associated with the business document, and preserving the business document on the computer readable medium based on the identifying data for dynamic retrieval and availability;

receiving a request for information located on the computer readable medium;

determining whether the requested information is subject to a regulated requirement based on the content of the information that would preclude release of the information to the requestor;

determining whether consent of an individual of which the content pertains is required and whether the consent of the individual has been obtained if the consent is required; and

if the requested information is not subject to the requirement and the consent of the individual has been obtained when the consent is required, obtaining the requested information based on the associated identifiable information and releasing the requested information to the requestor.

15. A method as recited in claim 14, further comprising:

determining whether there exists a legal requirement to release the requested information; and

if there exists the legal requirement, releasing the requested information to the requestor.

16. A method as recited in claim 14, wherein the regulated requirement that precludes release of the requested information to the requester based on the content of the requested information is at least one of (i) a federal regulation;

(ii) a state regulation;

(iii) a local regulation;

(iv) an internal regulation;

(v) a regulated retention time period;

(vi) a professional requirement; and

(vii) an ethical requirement.

17. A method as recited in claim 16, further comprising

comparing a pre-established retention time deadline of the holder of the requested information with a retention time deadline of whom the requested information pertains;

and

releasing the requested information to the requester if the requested information is not subject to the requirement and the retention time deadline of whom the requested information pertains has not expired.

18. A method as recited in claim 14, wherein the step of establishing further comprises defining a retention policy of the business document and generating an input form based on the identifying data that is associated with the business document.

19. A computer program product for implementing within a computer system a method for managing business data in compliance with privacy, security and retention standards, the computer program product comprising;

a computer readable medium for providing computer program code means utilized to implement the method, wherein the computer program code means is comprised of executable code for implementing the steps for;

establishing archival business documentation in an electronic form that is associated with identifiable information that is dynamic and customizable;

receiving a request for at least some information of the archival business documentation;

determining whether the requested information is subject to a regulated requirement based on the content of the information that would preclude release of the information to the requestor;

locating the requested information based on the associated identifiable information; and

if the requested information is not subject to the requirement, releasing the requested information to the requestor.

20. A computer program product as recited in claim 19, wherein the computer program code means is further comprised of executable code for implementing the steps of:

determining whether consent of an individual of which the content pertains is required; and

determining whether the consent of the individual has been obtained, wherein the releasing of the requested information to the requestor is performed if the requested information is not subject to the requirement and if the consent of the individual has been obtained when the consent is required.

21. A computer program product as recited in claim 19, wherein the computer program code means is further comprised of executable code for implementing the steps of:

determining whether there exists a legal requirement to release the requested information; and

if there exists the legal requirement, releasing the requested information to the requester.

22. A computer program product as recited in claim 19, wherein the regulated requirement that precludes release of the requested information to the requester based on the content of the requested information is at least one of (i) a federal regulation;

(ii) a state regulation;

(iii) a local regulation;

(iv) an internal regulation;

(v) a regulated retention time period;

(vi) a professional requirement; and

(vii) an ethical requirement.

23. A computer program product as recited in claim 19, wherein the computer program code means is further comprised of executable code for implementing the steps of:

comparing a pre-established retention time deadline of the holder of the requested information with a retention time deadline of whom the requested information pertains; and

releasing the requested information to the requestor if the requested information is not subject to the requirement and the retention time deadline of whom the requested information pertains has not expired.

24. A computer program product as recited in claim 19, wherein the business data relates to at least one of (i) a health care industry;

(ii) an automobile industry;

(iii) a real estate industry;

(iv) an insurance industry;

(v) a financial industry;

(vi) an energy industry;

(vii) a natural resources industry;

(viii) an academic industry;

(ix) a gaming industry;

(x) a transportation industry;

(xi) a manufacturing industry; and

(xii) a sales industry.