Privacy and security method and system for a world-wide-web site

• US 7,526,485 B2
• Filed: 07/07/2005
• Issued: 04/28/2009
• Est. Priority Date: 12/21/1999
• Status: Expired due to Fees

• Current Assignee: Alere Health Systems, Inc. (UnitedHealth Group Incorporated)
• Original Assignee: Alere Health Systems, Inc. (UnitedHealth Group Incorporated)
• Inventors: Levy, David, Kamerman, Matthew, Hagan, Thomas
• Primary Examiner(s): Vital; Pierre M
• Assistant Examiner(s): Vo; Truong V
• Application Number:
  US11/175,402
• Publication Number:
  US 20060004772A1
• Time in Patent Office: 1,391 Days
• Field of Search: 707/10
• US Class Current: 1/1
• CPC Class Codes: G06F 21/6254 by anonymising data, e.g. decorrelating personal data from the owner's identification
• CPC Class Codes: G06Q 10/10 Office automation; Time management
• CPC Class Codes: G06Q 20/4014 Identity check for transactions
• CPC Class Codes: G06Q 40/08 Insurance
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/306 User profiles
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]

Abstract

Personal information of users is used to customize the browsing experiences of the users on a World-Wide-Web site. To ensure privacy of the users'"'"' personal information, each user is assigned a unique Universal Anonymous Identifier (UAI). The UAI is generated by a trusted third party and provided to the Web site operator. The Web site operator then indexes the users'"'"' personal information by UAI. Only the user has the ability to correlate his/her true identity with his/her personal information.

Claims

1. A method of making clinical information of a plurality of users accessible for use in an enhanced browsing application, while maintaining the security and privacy of the clinical information, said method comprising the steps:

transferring de-identified clinical information of said users from said first computer to said second computer, said de-identified clinical information being associated with a surrogate ID;

transferring identifiable personal information which lack clinical information from said first computer to a third computer, wherein said third computer does not receive said de-identified clinical information and said second computer does not receive said identifiable personal information;

generating on said third computer an anonymous ID for each user which anonymously identifies the user, each anonymous ID being correlated or correlatable with a surrogate ID;

transferring said anonymous IDs from said third computer to said second computer and assuring that the anonymous IDs are not provided to said first computer; and

storing in a database accessible to said second computer said de-identified clinical information of said users indexed by said anonymous IDs, wherein said de-identified clinical information is used when a browser browses information on a web server associated with said second computer;

wherein said surrogate IDs are encrypted using an encryrption key maintained by said first computer;

said identifiable personal information transferred from said first computer to said third computer is indexed by unencrypted surrogate IDs;

said encryption key is transferred to said third computer from said first computer;

said third computer encrypts said surrogate IDs using said encryption key and transfers said encrypted surrogate IDs to said second computer with said anonymous IDs; and

said second computer uses said encrypted surrogate IDs transferred from said third computer to correlate said anonymous IDs with said de-identified personal information received from said first computer.

2. The method according to claim 1 wherein said anonymous IDs transferred from said third computer to said second computer are encrypted under an encryption key maintained by said third computer.

3. The method according to claim 2 wherein said de-identified clinical information of said users is indexed by encrypted anonymous ID.

4. The method according to claim 1 wherein said anonymous IDs are transferred from said third computer to said second computer via a virtual private network within the public Internet.

5. The method according to claim 1 including the additional step of transferring said indexed de-identified clinical information from said database to a data warehouse.

6. The method according to claim 5 including the additional step of transferring said indexed de-identified clinical information from said data warehouse to a World-Wide-Web (WWW) site.

7. The method according to claim 1 wherein said first computer is operated by a health plan and wherein said users are members of said health plan.

8. The method according to claim 1 wherein said second computer is operated by an operator of a WWW site.

9. The method according to claim 1 wherein said third computer is operated by a registration authority.

10. The method according to claim 1 wherein said de-identified clinical information includes medical claims data and wherein said identifiable personal information includes eligibility data of said users.

11. The method according to claim 1 wherein said de-identified clinical information of said users includes financial information of said users.

12. The method according to claim 1 wherein said de-identified clinical information of said users includes employee benefits information of said users.

13. A system for making clinical information of a plurality of users accessible for use in an enhanced browsing application, while maintaining the security and privacy of the clinical information, said system comprising:

a first computer containing clinical information of said users;

a second computer for receiving de-identified clinical information of said users transferred from said first computer together with surrogate IDs;

a third computer for receiving identifiable personal information which lacks clinical information transferred from said first computer, wherein said third computer does not receive said de-identified clinical information, and wherein said second computer does not receive said identifiable personal information,

said third computer being configured to generate an anonymous ID for each user which anonymously identifies the user, each anonymous ID being correlated or correlatable with a surrogate ID, said third computer transferring said anonymous IDs to said second computer and assuring said anonymous IDs are not provided to said first computer; and

a database accessible to said second computer for storing said de-identified clinical information of said users indexed by said anonymous IDs, wherein said database is used when a browser browses information on a web server associated with said second computer;

wherein said surrogate IDs are encrypted using an encryption key maintained by said first computer;

said first computer transfers said encryption key to said third computer;

said third computer encrypts said surrogate IDs using said encryption key and transfers said encrypted surrogate IDs to said second computer with said anonymous IDs; and

said second computer uses said encrypted surrogate IDs transferred from said third computer to correlate said anonymous IDs with said de-identified clinical information received from said first computer.

14. The system according to claim 13 wherein said third computer is configured to encrypt said anonymous IDs under an encryption key maintained by said third computer prior to transferring said anonymous IDs to said second computer.

15. The system according to claim 14 wherein said de-identified clinical information of said users is indexed in said database by encrypted anonymous ID.

16. The system according to claim 13 wherein said anonymous IDs are transferred from said third computer to said second computer via a virtual private network within the public Internet.

17. The system according to claim 13 wherein said second computer is configured to transfer said indexed de-identified clinical information from said database to a data warehouse.

18. The system according to claim 17 wherein said indexed de-identified clinical information is transferred from said data warehouse to a World-Wide-Web (WWW) site.

19. The system according to claim 13 wherein said first computer is operated by a health plan and wherein said users are members of said health plan.

20. The system according to claim 13 wherein said second computer is operated by an operator of a WWW site.

21. The system according to claim 13 wherein said third computer is operated by a registration authority.

22. The system according to claim 13 wherein said de-identified clinical information of said users includes medical claims data.

23. The system according to claim 13 wherein said de-identified clinical information of said users includes financial information of said users.

24. The system according to claim 13 wherein said de-identified clinical information of said users includes employee benefits information of said users.