Checkbook to control access to health record bank account

• US 20070075135A1
• Filed: 09/30/2005
• Published: 04/05/2007
• Est. Priority Date: 09/30/2005
• Status: Active Grant

• Current Assignee: International Business Machines Corporation, ServiceNow Incorporated
• Original Assignee: International Business Machines Corporation
• Inventors: Dettinger, Richard, Stevens, Richard, Kolz, Daniel
• Granted Patent: US 8,620,688 B2
• Time in Patent Office: Days
• US Class Current: 235/382.500
• CPC Class Codes: G06Q 10/087 Inventory or stock management, e.g. order filling, procurement or balancing against orders
• CPC Class Codes: G16H 10/60 for patient-specific data, e.g. for electronic patient records

Abstract

A method, apparatus, and article of manufacture for controlling access to electronic health records associated with an individual are provided. Individuals are provided with an electronic health records account (EHR account), wherein the EHR account is available to store electronic health records associated with the individual, in a network accessible storage repository. Additionally, an individual may be provided with plurality of disposable access devices, wherein the access devices may be presented to an entity. In turn, the entity may access the individual'"'"'s EHR account, based on a predefined authorization specified for a particular access device.

Claims

1. A computer-implemented method of controlling access to a plurality of electronic medical records related to a plurality of individuals, comprising:

configuring a network-accessible storage repository to store the plurality of electronic medical records, wherein the electronic records for a given individual are associated with an electronic health records account (EHR account);

providing the individual with at least one portable, transferable EHR account access device, wherein the access device authorizes an entity presented with the access device with access to the EHR account;

receiving, over a data-communications network, a request from the entity presented with the access device to access the EHR account; and

based on a predefined authorization specified for the access device, performing at least one transaction for the EHR account.

2. The method of claim 1, wherein the access device provides a cryptographic key used to identify the access device and to identify the predefined authorization established for the access device.

3. The method of claim 1, wherein the predefined authorization specifies a period of time to grant access to the EHR account to the entity presented with the access device.

4. The method of claim 1, wherein the at least one access device comprises a plurality of preprinted paper slips that may be individually presented to different entities, and wherein each slip includes a different cryptographic key used to distinguish the preprinted paper slips from one another, and wherein each of the preprinted paper slips identifies the predefined authorization specified for a given slip.

5. The method of claim 1, wherein the access deceive authorizes the entity presented with the access device to perform a deposit transaction, wherein the deposit transaction submits additional electronic records associated with the individual stored in the network-accessible storage repository.

6. The method of claim 1, wherein the access device authorizes the entity presented with the access device to retrieve electronic records associated with the individual from the network-accessible repository.

7. The method of claim 1, wherein the access device includes a machine-readable access key selected form at least one of a bar-code, magnetic ink, magnetic strip, or character sequence.

8. The method of claim 1, wherein the access device provided to an individual specifies the predefined authorization for the access device.

9. The method of claim 1, wherein the individual selects the predefined authorization for a given access device, prior to presenting the given access device to the entity.

10. The method of claim 1, wherein the access device is revocable, and wherein a revoked access device will fail to provide the entity presented with the revoked access device access to the EHR account.

11. The method of claim 1, wherein at least one account device comprises a token device with an embedded electronic device that is used to encode the account identifier and access key.

12. The method of claim 1, wherein at least one account device may be used by certain predetermined entities to obtain access to the EHR account.

13. A computer-readable medium containing a program, which when executed by a processor performs operations for managing access to a plurality of electronic medical records related to a plurality of individuals, the operations comprising:

configuring a network-accessible storage repository to store the plurality of electronic medical records, wherein the electronic records for a given individual are associated with an electronic health records account (EHR account);

providing the individual with at least one portable, transferable EHR account access device, wherein the access device is used to authorize an entity presented with the access device with access to the EHR account;

receiving, over a data-communications network, from the entity presented with the access device, a request to access the EHR account; and

based on a predefined authorization specified for the access device, performing at least one transaction for the EHR account.

14. The computer-readable medium of claim 13, wherein the access device provides a cryptographic key used to identify which particular access device is presented to the entity and to identify the predefined authorization established for the access device.

15. The computer-readable medium of claim 13, wherein the predefined authorization specifies a period of time to grant access to the EHR account to the entity presented with the access device.

16. The computer-readable medium of claim 13, wherein the at least one access device comprises a plurality of preprinted paper slips that may be individually presented to different entities, and wherein each slip includes a different cryptographic key used to distinguish the preprinted paper slips from one another, and wherein each of the preprinted paper slips identifies the predefined authorization specified for a given slip.

17. The computer-readable medium of claim 13, wherein the access deceive authorizes the entity presented with the access device to perform a deposit transaction, wherein the deposit transaction submits additional electronic records associated with the individual stored in the network-accessible storage repository.

18. The computer-readable medium of claim 13, wherein the access device authorizes the entity presented with the access device to retrieve electronic records associated with the individual from the network-accessible repository.

19. The computer-readable medium of claim 13, wherein the access device includes a machine-readable access key selected form at least one of a bar-code, magnetic ink, magnetic strip, or character sequence.

20. The computer-readable medium of claim 13, wherein the access device provided to an individual specifies the predefined authorization for the access device.

21. The computer-readable medium of claim 13, wherein the individual selects the predefined authorization for a given access device, prior to presenting the given access device to the entity.

22. The computer-readable medium of claim 13, wherein the access device is revocable, and wherein a revoked access device will fail to provide the entity presented with the revoked access device access to the EHR account.

23. The computer-readable medium of claim 13, wherein at least one account device comprises a token device with an embedded electronic device that is used to encode the account identifier and access key in a machine readable form.

24. The computer-readable medium of claim 13, wherein at least one account device may be used by certain predetermined entities to obtain access to the EHR account.

25. A portable, transferable access device used to grant access to a network-accessible storage repository of electronic health records, comprising:

an electronic health records account (EHR Account) identifier, wherein the identifier specifies an individual associated with the EHR account;

an access key for confirming that an entity requesting access to the network-accessible storage repository has been presented with access device by the individual, wherein the access key is included in a request, transmitted over a data-communications network, to access the EHR account; and

an indication of the network location of the network-accessible storage repository.

26. The access device of claim 25, wherein the access key comprises a machine-readable access key selected form at least one of a bar-code, magnetic ink, magnetic strip, or character sequence.

27. The access device of claim 25, wherein the access device is revocable, and wherein a revoked access device will fail to provide the entity presented with the revoked access device access to the EHR account.