ESTABLISHING A PATIENT - PROVIDER CONSENT RELATIONSHIP FOR DATA SHARING

• US 20090326982A1
• Filed: 06/27/2008
• Published: 12/31/2009
• Est. Priority Date: 06/27/2008
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Hoof, Hubert Van, Nolan, Sean, Deobhakta, Kalpita
• Granted Patent: US 8,725,536 B2
• Time in Patent Office: Days
• US Class Current: 705/3
• CPC Class Codes: G06Q 10/10 Office automation; Time management
• CPC Class Codes: G16H 10/60 for patient-specific data, e.g. for electronic patient records

Abstract

A shared secret may be shared between a patient and the patient'"'"'s healthcare provider. The healthcare provider may submit the shared secret to the database system via a provider interface to generate a validation code. The validation code may be later submitted to the database system by the patient via a patient interface to cause the database system to prompt the patient to submit the shared secret. Upon submission of the shared secret to the database system, the patient may be prompted to approve or deny a request of the healthcare provider to access the electronic medical record of the patient. Access may be granted to the healthcare provider upon approval of the request by the patient.

Claims

1. A method of obtaining consent from a patient to access an electronic medical record of the patient stored at a database system, the method comprising:

prompting a patient to provide a healthcare provider a validation answer corresponding to a validation question;

receiving the validation answer from the patient;

submitting the validation answer and a patient identifier identifying the patient to the database system via a provider interface;

receiving a validation code from the database system upon submission of the validation answer and the patient identifier to the database system; and

providing the validation code to the patient, the database system permitting the healthcare provider to access an electronic medical record of the patient stored at the database system only after the validation code and the validation answer have been submitted to the database system by the patient via a patient interface.

2. The method of claim 1, further comprising, accessing the electronic medical record of the patient at the database system by receiving medical information from the electronic medical record only after the validation code and the validation answer have been submitted to the database system by the patient via the patient interface.

3. The method of claim 1, further comprising, accessing the electronic medical record of the patient at the database system by submitting medical information to the database system to cause the electronic medical record to be updated with the medical information only after the validation code and the validation answer have been submitted to the database system by the patient via the patient interface.

4. The method of claim 1, where the patient interface includes a webpage and where the method further comprises:

providing the patient with a uniform resource locator indicating the web page where the patient is to submit the validation code and the validation answer to the database system.

5. The method of claim 1, where providing the validation code to the patient further includes providing instruction materials to the patient including the validation code;

where the instruction materials further include instructions for the patient to submit the validation code to the database system via the patient interface.

6. The method of claim 5, where the instruction materials do not include the validation answer.

7. The method of claim 5, were providing the validation code to the patient further includes mailing the instruction materials to the patient.

8. The method of claim 5, where providing the validation code to the patient includes emailing the instruction materials to the patient.

9. The method of claim 1, where submitting the validation answer and the patient identifier to the database system via the provider interface includes submitting the validation answer and the patient identifier to a clinical system that exposes the provider interface via a graphical user interface, the clinical system communicating with the database system via an application programming interface.

10. The method of claim 1, where receiving the validation code from the database system includes receiving the validation code via the provider interface.

11. The method of claim 1, further comprising, submitting an access request to the database system via the provider interface, the access request specifying a medical information indicator identifying medical information to be accessed by the healthcare provider from the electronic medical record.

12. A database system, comprising:

a data store configured to store an electronic medical record of a patient;

a processing subsystem configured to execute instructions; and

computer readable storage media comprising instructions executable by the processing subsystem to;

receive from a clinical system via an application programming interface;

a patient identifier identifying the patient, a validation question, and a validation answer corresponding to the validation question;

return a validation code to the clinical system via the application programming interface upon receiving the patient identifier, the validation question, and the validation answer;

receive the validation code and the validation answer from the patient via a patient interface; and

submit medical information from the electronic medical record to the clinical system via the application programming interface only after the validation code and validation answer are received from the patient via the patient interface.

13. The database system of claim 12, where the computer readable storage media further comprises instructions executable by the processing subsystem to:

present the patient with an access request via the patient interface, the access request specifying a medical information identifier identifying the medical information to be submitted to the clinical system via the application programming interface;

receive a request response from the patient via the patient interface upon presentation of the access request to the patient, the request response approving the access request or denying the access request; and

submit the medical information identified by the medical information identifier from the electronic medical record to the clinical system via the application programming interface only after the request response approving the access request has been received from the patient via the patient interface.

14. The database system of claim 13, where the computer readable storage media further comprises instructions executable by the processing subsystem to:

receive the access request from the clinical system via the application programming interface; and

store the access request at the data store before the access request is presented to the patient via the patient interface.

15. The database system of claim 13, where the computer readable storage media further comprises instructions executable by the processing subsystem to:

submit a consent notification to the clinical system via the application programming interface upon receiving the request response from the patient, the consent notification specifying an approval or a denial of the access request by the patient as indicated by the request response.

16. The database system of claim 15, where the computer readable storage media further comprises instructions executable by the processing subsystem to:

submit the medical information identified by the medical information identifier to the clinical system via the application programming interface only after the consent notification specifying the approval of the access request by the patient is submitted to the clinical system via the application programming interface.

17. The database system of claim 13, where the computer readable storage media further comprises instructions executable by the processing subsystem to:

receive medical information identified by the medical information indicator from the clinical system via the application programming interface; and

update the electronic medical record of the patient at the data store with the medical information received from the clinical system via the application programming interface only after the request response approving the access request is received from the patient via the patient interface.

18. The database system of claim 12, where the computer readable storage media further comprises instructions executable by the processing subsystem to:

present the validation question to the patient via the patient interface after the validation code is received from the patient and before the validation answer is received from the patient, the validation question prompting the patient to submit the validation answer corresponding to the validation question via the patient interface.

19. A method of facilitating access to an electronic medical record of a patient by a healthcare provider, the method comprising:

Receiving a validation code request from a healthcare provider, the validation code request specifying a patient identifier identifying a patient, a validation question, and a validation answer corresponding to the validation question;

submitting a validation code to the healthcare provider upon receiving the validation request from the healthcare provider;

storing at least the validation code, the validation question, and the validation answer at a data store;

receiving the validation code from the patient via a patient interface;

retrieving the validation question stored at the data store based on the validation code received from the patient;

presenting the validation question retrieved from the data store to the patient;

receiving the validation answer from the patient via the patient interface upon presentation of the validation question to the patient; and

permitting the healthcare provider to access the electronic medical record of the patient stored at the data store only after the validation code and the validation answer have been received from the patient via the patient interface.

20. The method of claim 19, further comprising:

receiving an access request from the healthcare provider, the access request specifying medical information to be accessed by the healthcare provider from the electronic medical record;

presenting the patient with the access request, including the medical information requested by the healthcare provider;

receive a request response from the patient via the patient interface upon presentation of the access request to the patient, the request response approving the access request or denying the access request; and

permitting the healthcare provider to access the medical information from the electronic medical record only after the request response approving the access request is received from the patient via the patient interface.