Multi-source longitudinal patient-level data encryption process

• US 8,275,850 B2
• Filed: 05/05/2005
• Issued: 09/25/2012
• Est. Priority Date: 05/05/2004
• Status: Active Grant

• Current Assignee: IMS Software Services Ltd. (IQVIA Holdings, Inc.)
• Original Assignee: IMS Software Services Ltd. (IQVIA Holdings, Inc.)
• Inventors: Kohan, Mark E., Wolfe, Clinton J.
• Primary Examiner(s): Zand, Kambiz
• Assistant Examiner(s): Sanders, Stephen
• Application Number:
  US11/122,589
• Publication Number:
  US 20050268094A1
• Time in Patent Office: 2,700 Days
• Field of Search: 713/165, 709/212
• US Class Current: 709/212
• CPC Class Codes: G06F 21/6254 by anonymising data, e.g. decorrelating personal data from the owner's identification
• CPC Class Codes: G06Q 10/10 Office automation; Time management
• CPC Class Codes: G16H 10/60 for patient-specific data, e.g. for electronic patient records

Abstract

Systems and processes for assembling de-identified patient healthcare data records in a longitudinal database are provided. The systems and processes may be implemented over multiple data suppliers and common database facilities while ensuring patient privacy. At the data supplier locations, patient-identifying attributes in the data records are placed in standard format and then doubly encrypted using a pair of encryption keys before transmission to a common database facility. The pair of encryption keys includes a key specific to the data supplier and a key specific to the common database facility. At the common database facility, the encryption specific to the data supplier is removed, so that multi-sourced data records have only the common database encryption. Without direct access to patient identifying-information, the encrypted data records are assigned dummy labels or tags by which the data records can be longitudinally linked in the database. The tags are assigned based on statistical matching of the values of a select set of encrypted data attributes with a reference database of tags and associated encrypted data attribute values.

Claims

1. A method for assembling a longitudinally-linked database from individual patient healthcare transaction data records, the method comprising:

at a central facility (LDF),

receiving data records including at least one patient non-identifying attribute and at least one individually encrypted patient-identifying attribute, the at least one patient-identifying attribute first encrypted using a first encryption key specific to the LDF and further encrypted with a second encryption key unique to a data source so that original unencrypted patient identification information in the at least one patient-identifying attribute remains secret with respect to other data sources;

partially decrypting the received data records using a decryption key complementary to the second encryption key so that the at least one patient-identifying attribute retains only the encryption by the first encryption key specific to the LDF;

using an attribute-matching algorithm to assign an LDF identifier (ID) to the encrypted data records; and

linking the encrypted data records ID by ID, whereby the longitudinally-linked data base is formed.

2. The method of claim 1 wherein the at least one patient-identifying attribute is encrypted using a third encryption key specific to the LDF.

3. The method of claim 1 wherein the acquired data records are processed to place their data fields in a standard content format.

4. The method of claim 1 wherein the at least one patient-identifying attribute and the at least one patient non-identifying attribute are separated in the data records, and the separated at least one patient-identifying attribute is encrypted.

5. The method of claim 4 wherein the encrypted at least one patient-identifying attribute is merged with the separated at least one non-identifying attribute in the data records.

6. The method of claim 1 further comprising processing the received data records to separate the at least one encrypted patient-identifying attribute and the at least one non-identifying attribute in the data records, and partially decrypting the separated at least one patient-identifying attribute.

7. The method of claim 6 further comprising merging the at least one partially decrypted patient-identifying attribute with the at least one separated non-identifying attribute in the data records.

8. The method of claim 1 wherein the attribute-matching algorithm assigns an ID to an encrypted data record based on a statistical match of a select set of data attributes.

9. The method of claim 8 wherein the select set of data attributes comprises at least one of a patient'"'"'s date of birth, cardholder identification, record number, zip code, first name, last name, street address, and an industry standard patient identifier.

10. The method of claim 1 wherein the attribute-matching algorithm assigns an ID to an encrypted data record by referencing a cross database of IDs and corresponding attributes.

11. The method of claim 1 wherein the receiving the data records and the partially decrypting are performed in a secure environment that limits unauthorized access to patient-identifying attribute information in the data records.

12. A system for longitudinally-linking individual patient healthcare transaction data records obtained from multiple data suppliers, the system comprising:

at a central facility (LDF), a first component configured to;

receive data records including at least one patient non-identifying attribute and at least one individually, doubly encrypted patient-identifying attribute encrypted with a first encryption key specific to an LDF and further encrypted with a second encryption key unique to a data source so that original unencrypted patient identification information in the at least one patient-identifying attribute remains secret with respect to other data sources;

partially decrypt the received data records using a decryption key complementary to the second encryption key so that the at least one patient-identifying attribute retains the encryption by the first encryption key specific to the LDF;

perform an additional layer of encryption on the data records; and

a second component configured to;

assign an LDF identifier (ID) to the encrypted data records by matching attributes in the encrypted data records; and

link the encrypted data records ID by ID, whereby a longitudinal database is formed.

13. The system of claim 12 wherein the at least one patient-identifying attribute and the at least one patient non-identifying attribute in the data records are separated and the separated at least one patient-identifying attribute is encrypted.

14. The system of claim 13 wherein the encrypted at least one patient-identifying attribute is merged with the separated at least one patient non-identifying attribute in the data records.

15. The system of claim 12 wherein the acquired data records are processed to place their data fields in a standard format.

16. The system of claim 12 wherein the first component is further configured to separate the encrypted at least one patient-identifying attribute and the at least one non-identifying attribute in the received data records, and to partially decrypt the separated at least one patient-identifying attribute.

17. The system of claim 16 wherein the first component is further configured to merge the at least one partially decrypted patient-identifying attribute with the separated at least one non-identifying attribute in the data records.

18. The system of claim 12 wherein the second component is further configured to assign an LDF identifier (ID) to the encrypted data records based on a statistical match of a select set of data attributes.

19. The system of claim 18 wherein the select set of data attributes comprises at least one of a patient'"'"'s date of birth, cardholder identification, record number, zip code, first name, last name, street address, and an industry standard patient identifier.

20. The system of claim 18 wherein the second component is further configured to assign an LDF identifier (LI) to the encrypted data records by referencing a cross database of LIs and corresponding attributes.

21. The system of claim 12 wherein the first component is configured for operation in a secure environment that limits unauthorized access to patient-identifying attribute information in the data records.

22. The system of claim 12 whose functions are implemented using software applications.

23. A longitudinally-linked electronic database assembled from individual patient healthcare transaction data records, the electronic database comprising:

multi-sourced data records in which patient identifying attributes are encrypted to preserve patient privacy,

wherein each encrypted data record is assigned an identifier based on a statistical match of a select set of data attributes with a reference set of values,

wherein the data records are linked by the assigned identifiers

wherein, when received, the patient-identifying attributes are doubly encrypted on an individual attribute basis with a first encryption key specific to a central facility (LDF) and a second encryption key specific to a data supplier so that original unencrypted patient identification information in the patient-identifying attributes remains secret with respect to other data suppliers and

wherein the electronic database is coupled to a hardware security module comprising an encryption application programmed to partially decrypt the received attributes using a decryption key complementary to the second encryption key so that the attributes retain only the encryption by the first encryption key specific to the LDF.

24. The longitudinally-linked electronic database of claim 23, wherein the select set of data attributes comprises at least one of a patient'"'"'s date of birth, cardholder identification, record number, zip code, first name, last name, street address, and an industry standard patient identifier.