SECURE ACCESS TO HEALTHCARE INFORMATION

• US 20120124637A1
• Filed: 11/11/2010
• Published: 05/17/2012
• Est. Priority Date: 11/11/2010
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: DUNAWAY, Frederick T.
• Granted Patent: US 9,032,512 B2
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: G06F 21/00 Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: G16H 10/60 for patient-specific data, e.g. for electronic patient records

Abstract

A system and method for providing or exchanging healthcare information (e.g., medical information) to authorized users in a secure manner. The method is implemented in a computer infrastructure having computer executable code tangibly embodied on a computer readable storage medium having programming instructions operable to: assign identification information to a plurality of users and a plurality of items; associate the identification information of a user of the plurality of users with one or more items of the plurality of items; set-up security policies including predetermined locations, within predetermined stages within a sequence and during predetermined times; and provide the user access to the one or more items when there is a matching between the identification information of the user and the one or more items, and all of the security policies associated with the user and the one or more of the plurality of items are met.

Claims

1. A method implemented in a computer infrastructure having computer executable code tangibly embodied on a computer readable storage medium having programming instructions operable to:

assign identification information to a plurality of users and a plurality of items;

associate the identification information of a user of the plurality of users with one or more items of the plurality of items;

set-up security policies including predetermined locations, within predetermined stages within a sequence and during predetermined times; and

provide the user access to the one or more items when there is a matching between the identification information of the user and the one or more items, and all of the security policies associated with the user and the one or more of the plurality of items are met.

2. The method of claim 1, wherein the plurality of items is encrypted digital medical information.

3. The method of claim 2, wherein a client side system is authenticated prior to the providing access of the encrypted digital medical information, and the client side system decrypts the encrypted digital medical information.

4. The method of claim 1, further comprising determining that the identification information is not duplicate or incorrect prior to providing the access.

5. The method of claim 4, further comprising sending alerts when the identification information is duplicate or incorrect.

6. The method of claim 1, wherein the identification information is a radio frequency identification (RFID) tag associated with the user, and the method further comprises activating the RFID tag, prior to the associating.

7. The method of claim 6, further comprising determining that the RFID tag is active and is in a designated location prior to the providing the user access to the one or more items.

8. The method of claim 6, further comprising recording a location of the RFID tag of the user and the one or more items or a system that displays digital media of the one or more items.

9. The method of claim 1, further comprising managing the one or more items, including at least one of:

encrypting all digital media representative of the one or more items;

checking with a Security Manager if the user may access the one or more items;

recording all users that requested any of the plurality of items and what items of the plurality of items was requested;

destroying any of the plurality of items per security policies; and

sending alerts when the security policies have been violated.

10. The method of claim 1, wherein the setting up security policies is performed by a third party service provider that does not assign the identification information to the plurality of users.

11. The method of claim 10, wherein the security policies can be removed, altered or modified by the third party service provider.

12. The method of claim 1, further comprising providing authentication and authorization rights to all registered medical information that meet the security policies.

13. The method of claim 1, wherein a service provider at least one of creates, maintains, deploys and supports the computer infrastructure.

14. The method of claim 1, wherein steps of claim 1 are provided by a service provider on a subscription, advertising, and/or fee basis.

15. A system implemented in hardware, comprising a computing infrastructure operable to set up security polices in order to provide access to medical information to one or more requesting users, in compliance with the security policies, and authorizing or providing access to the medical information when all security policies are met including identification information of the one or more requesting users matches with identification of requested medical information, and the one or requesting users and the requested medical information are at a set location, during a set time period at a defined event in a sequence of events.

16. The system of claim 15, wherein the computing infrastructure authenticates and authorizes the requesting user to access the medical information.

17. The system of claim 15, further comprising a client computing device that communicates with the computing infrastructure and is provided with identification information, wherein a location of the client computing device is recorded by the computing infrastructure.

18. A computer program product comprising a computer usable storage medium having readable program code embodied in the storage medium, the computer program product includes at least one component operable to:

assign identification information to a plurality of users and a plurality of items;

activate a radio frequency identification tag having the identification information;

associate the activated radio frequency identification tag of at least one user of the plurality of users with one or more items of the plurality of items;

set-up security policies to allow access to the one or more items of the plurality of items which include providing access only at predetermined locations, within a certain sequence and at predetermined times;

provide the at least one user access to the one or more of the plurality of items when there is a match between the activated radio frequency identification tag of the at least one user and the identification information of the one or more of the plurality of items, and all of the security policies associated with the at least one user and the one or more of the plurality of items are met.

19. A computer system for providing secure access to medical information, the system comprising:

a CPU, a computer readable memory and a computer readable storage media;

first program instructions to assign and manage radio frequency identification (RFID) information for one or more users and one or more items;

second program instructions to manage the one or more items;

third program instructions to set and maintain security policies comprising setting access permissions to the one or more items when the RFID information for one or more users match with the one or more items, and the matched one or more users and the one or more items are at predetermined locations, within predetermined stages within a sequence and during predetermined times in accordance with the security policies,

wherein the first, second and third program instructions are stored on the computer readable storage media for execution by the CPU via the computer readable memory.

20. The computer system of claim 19, wherein the third program instructions provide authentication, authorization and access rights to registered medical information, and provides key structures for encryption and computes hash values for the medical information for data integrity.

21. The computer system of claim 20, wherein the security policies define who is allowed to view certain medical information, at certain times and at certain locations.

22. The computer system of claim 20, further comprising:

fourth program instructions to determine the location of the one or more users and the one or more items,

wherein the fourth program instructions receive location information from RFID readers as the one or more user and the one or more items enter and exit certain areas,

wherein the fourth program instructions provide the location information to the third program instructions, in order for the third program instructions to determine whether all of the security policies have been met and to allow access to the one or more items.

23. The computer system of claim 20, further comprising fifth program instructions to determine that a given RFID tag is a duplicate tag or being used by an unauthorized user and disable the RFID tag and deny access to the one or more items.

24. The computer system of claim 20, wherein the second program instructions at least one of:

encrypt the one or more items that are in digital media, records media;

record all users that requested the digital media and what digital media was requested;

destroy any digital media per security policies; and

sends alerts when a given digital media security policy has been violated.

25. A method of deploying a system for securing medical information comprising:

providing a computer infrastructure, being operable to;

assign identification information to a plurality of users and a plurality of items;

set-up security policies including predetermined locations, within predetermined stages within a sequence and during predetermined times; and

provide a user access to one or more of the plurality of items when there is a match between the identification information of the user and the one or more of the plurality of items, and all of the security policies associated with the user and the one or more of the plurality of items are met.