DATA DRIVEN SCHEMA FOR PATIENT DATA EXCHANGE SYSTEM

• US 20150058627A1
• Filed: 08/20/2014
• Published: 02/26/2015
• Est. Priority Date: 08/21/2013
• Status: Active Grant

• Current Assignee: Medtronic Incorporated (Medtronic Plc)
• Original Assignee: Medtronic Incorporated (Medtronic Plc)
• Inventors: Harding, William C., Paffel, Timothy D.
• Granted Patent: US 9,467,450 B2
• Time in Patent Office: Days
• US Class Current: 713/168
• CPC Class Codes: G16H 10/60 for patient-specific data, e.g. for electronic patient records
• CPC Class Codes: G16Z 99/00 Subject matter not provided for in other main groups of this subclass
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A patient data exchange system comprises at least one device. Each of the devices implements an interface. When a device in the patient data exchange system publishes patient data, the device generates a metadata envelope that encapsulates the patient data. The metadata envelope conforms to a schema that defines allowable metadata attributes of the metadata envelope. When a device in the patient data exchange system receives a metadata envelope that conforms to the schema, the device determines, based at least in part on a metadata attribute of the metadata envelope, a particular patient data handling policy to apply to patient data encapsulated by the metadata envelope. In some instances, the metadata attribute indicates that authorization is required from an authorization service to access the patient data encapsulated by the metadata envelope.

Claims

1. A system for exchanging patient data, the system comprising:

at least one device that implements an interface, wherein when the interface receives a metadata envelope that conforms to a schema that defines each allowable metadata attribute of the metadata envelope;

the interface determines, based at least in part on a first metadata attribute of the received metadata envelope, a particular patient data handling policy from among a plurality of available patient data handling policies that the interface is configured to apply, wherein each of the available patient data handling policies prescribes a different way of handling patient data; and

the interface applies the particular patient data handling policy with regard to a particular set of patient data encapsulated within the received metadata envelope, wherein when the particular patient data handling policy indicates that receiving authorization is required in order to access the particular set of patient data, the interface requests, to receive from an authorization service identified by a second metadata attribute of the received metadata envelope, the authorization to access the particular set of patient data.

2. The system of claim 1, wherein the at least one device includes at least one implantable medical device.

3. The system of claim 1, wherein the at least one device includes at least one programmer device for an implantable medical device.

4. The system of claim 1, wherein the interface receives the authorization to access the particular set of patient data only when the interface provides evidence to the authorization service that the interface is configured such that the interface does not transmit the particular set of patient data in encrypted or unencrypted form outside the metadata envelope and does not generate copies of the particular set of patient data in unencrypted form that persist after termination of the interface.

5. The system of claim 4, wherein:

the evidence comprises authorization data encrypted according to an encryption key, and

a requirement to receive a decryption key for the particular set of patient data to the interface from the authorization service is that the authorization service is able to successfully decrypt the authorization data.

6. The system of claim 1, wherein the particular set of patient data comprises clinical study data.

7. The system of claim 1, wherein the first metadata attribute indicates a governmental regulation applicable to the particular set of patient data.

8. The system of claim 1, wherein the first metadata attribute indicates a type of consent given by a patient regarding sharing of the particular set of patient data.

9. The system of claim 1, wherein the first metadata attribute indicates a country in which consent was given by a patient regarding sharing of the particular set of patient data.

10. The system of claim 1, wherein the interface is further configured to:

determine, based on the particular patient data handling policy, whether to delete the particular set of patient data; and

delete, based on the determination, the particular set of patient data.

11. The system of claim 1, wherein the metadata envelope includes a third metadata attribute, the third metadata attribute indicating a type of encryption applied to the particular set of patient data.

12. The system of claim 1, wherein the metadata envelope includes a third metadata attribute, the third metadata attribute indicating a source of the particular set of patient data.

13. The system of claim 1, wherein:

the particular set of patient data is a first set of patient data and the metadata envelope is a first metadata envelope, and

when the interface publishes a second set of patient data, the interface encapsulates the second set of patient data within a second metadata envelope that includes one or more metadata attributes, wherein the second metadata envelope conforms to the schema.

14. The system of claim 1, wherein the schema is an extension of a Study Data Tabulation Model.

15. A method of handling patient data, the method comprising:

receiving, at an interface implemented by a device, a metadata envelope that encapsulates a particular set of patient data associated with a patient, wherein the metadata envelope conforms to a schema that defines each allowable metadata attribute of the metadata envelope;

determining, by the interface, based at least in part on a first metadata attribute of the received metadata envelope, a particular patient data handling policy from among a plurality of available patient data handling policies that the interface is configured to apply, wherein each of the available patient data handling policies prescribes a different way of handling patient data; and

applying, by the interface, the particular patient data handling policy with regard to the particular set of patient data,

wherein when the particular patient data handling policy indicates receiving authorization is required in order to access the particular set of patient data, requesting, by the interface, from an authorization service identified by a second metadata attribute of the received metadata envelope, to receive the authorization to access the particular set of patient data.

16. The method of claim 15, wherein the device is an implantable medical device.

17. The method of claim 15, wherein the device is a programmer device for an implantable medical device.

18. The method of claim 15, wherein the interface receives the authorization to access the particular set of patient data only when the interface provides evidence to the authorization service that the interface is configured such that the interface does not transmit the particular set of patient data in encrypted or unencrypted form outside the metadata envelope and does not generate copies of the particular set of patient data in unencrypted form that persist after termination of the interface.

19. The method of claim 18, wherein:

the evidence comprises authorization data encrypted according to an encryption key, and

a requirement for receiving a decryption key for the particular set of patient data to the interface from the authorization service is that the authorization service is able to successfully decrypt the authorization data.

20. The method of claim 15, wherein the particular set of patient data comprises clinical study data.

21. The method of claim 15, wherein the first metadata attribute indicates a governmental regulation applicable to the particular set of patient data.

22. The method of claim 15, wherein the first metadata attribute indicates a type of consent given by a patient regarding sharing of the particular set of patient data.

23. The method of claim 15, wherein the first metadata attribute indicates a country in which consent was given by the patient regarding sharing of the particular set of patient data.

24. The method of claim 15, wherein the interface is further configured to:

determine, based on the particular patient data handling policy, whether to delete the particular set of patient data; and

delete, based on the determination, the particular set of patient data.

25. The method of claim 15, wherein the metadata envelope includes a third metadata attribute, the third metadata attribute indicating a type of encryption applied to the particular set of patient data.

26. The method of claim 15, wherein the metadata envelope includes a third metadata attribute, the third metadata attribute indicating a source of the particular set of patient data.

27. The method of claim 15, wherein the schema is an extension of a Study Data Tabulation Model.

28. A computer-readable data storage medium having instructions stored thereon that, when executed, configure an interface implemented by a device to:

receive a metadata envelope that encapsulates a particular set of patient data associated with a patient, wherein the metadata envelope conforms to a schema that defines each allowable metadata attribute of the metadata envelope;

determine based at least in part on a first metadata attribute of the received metadata envelope, a particular patient data handling policy from among a plurality of available patient data handling policies that the interface is configured to apply, wherein each of the available patient data handling policies prescribes a different way of handling patient data; and

apply the particular patient data handling policy with regard to the particular set of patient data,

wherein when the particular patient data handling policy indicates receiving authorization is required in order to access the particular set of patient data, request, to receive from an authorization service identified by a second metadata attribute of the received metadata envelope, the authorization to access the particular set of patient data.