System and method for controlling communication of private information over a network

• US 9,032,544 B2
• Filed: 12/22/2011
• Issued: 05/12/2015
• Est. Priority Date: 12/22/2010
• Status: Active Grant

• Current Assignee: Private Access Incorporated
• Original Assignee: Private Access Incorporated
• Inventors: Shelton, Robert
• Primary Examiner(s): BAYOU, YONAS A
• Application Number:
  US13/334,982
• Publication Number:
  US 20120331567A1
• Time in Patent Office: 1,237 Days
• Field of Search: 726/28
• US Class Current: 726/28
• CPC Class Codes: G06F 16/951 Indexing; Web crawling techniques
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: G06Q 10/00 Administration; Management
• CPC Class Codes: G06Q 20/102 Bill distribution or payments
• CPC Class Codes: G06Q 50/265 Personal security, identity or safety
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A system and method for controlling access to private information over a network is provided including a privacy preference repository accessible by one or more subjects of the private information and by a private access bureau. The privacy preference repository stores privacy preferences configured by the subjects to indicate conditions for disclosure of said private information. A policy repository that stores legal criteria for accessing the private information is also accessible by the private access bureau. The private access bureau is configurable to receive requests from privacy-enabled systems for privacy directives that take into account the privacy preferences and legal criteria required to release particular documents on said privacy enabled system in response to the privacy-enabled systems.

Claims

1. A system for controlling access to private information, comprising:

a privacy preference repository accessible by one or more subjects of said private information and by a private access bureau, said privacy preference repository storing privacy preferences configured by said subjects to indicate conditions for disclosure of said private information;

a policy repository accessible by said private access bureau, said policy repository storing legal criteria for accessing said private information;

wherein said private access bureau is configured to receive requests from privacy enabled systems for said privacy preferences and legal criteria required to release particular documents on said privacy enabled system in response to said privacy-enabled systems receiving a request for access to said private information.

2. The system of claim 1, wherein said private access bureau is configured to compare said request to said legal criteria and said privacy preferences in response to said request to determine which portions of said private information are authorized for viewing by a requestor in accordance with both said legal criteria and said privacy preferences.

3. The system of claim 2, wherein said private access bureau is configured to send to said privacy-enabled systems, an indication of which portions of said private record are authorized for viewing in response to completing said comparison.

4. The system of claim 3, wherein said policy repository storing institutional policy criteria for accessing said private information.

5. The system of claim 4, wherein said private access bureau further configured to adjudicate conflicts between said privacy preferences, said legal criteria, and said institutional policy criteria.

6. The system of claim 3, further comprising an audit database accessible by said private access bureau and by said one or more subjects, said audit database receiving audit records of information sent by said private access bureau to said privacy-enabled systems.

7. The system of claim 3, further comprising a transaction database accessible by said private access bureau and by said one or more users of the private access bureau, said transaction database being configured to receive payments by said parties requesting access to said private information in return therefore.

8. The system of claim 7, wherein said private access bureau being configured to disburse proceeds of such payments collected to the parties to whom such payments are obligated.

9. The system of claim 2, wherein said requester being a search engine, and the affected view being the search results page to an inquiry initiated by a user of such search engine.

10. The system of claim 2, wherein when said legal criteria are insufficient to permit such comparison and render a determination as to which portions of said private information are authorized for viewing, for reporting this to the appropriate governing body so that it may consider changes or clarifications in the legal criteria to enable such comparison.

11. The system of claim 1, wherein said subjects are able update said indicated conditions for disclosure of said private information using a mobile device.

12. The system of claim 11, wherein said updates by said subjects being in response to a specific request for approval initiated by said private access bureau.

13. The system of claim 12, wherein said request for approval by said private access bureau occurring in the event that the private access bureau is unable to successfully adjudicate conflicts between said privacy preferences, said legal criteria, and said institutional policy criteria.

14. A computer implemented method for controlling access to private information, comprising:

receiving, by a computer implemented private access bureau having at least one processor, a request for parameters governing opening a private record from a privacy-assured application;

reading legal criteria related to said private record from a policy repository of said private access bureau by said at least one processor in response to said request;

reading privacy preferences related to said private record from a privacy preference repository of said private access bureau by said at least one processor in response to said request;

comparing said request to said legal criteria and said privacy preferences by said at least one processor in response to said request to determine which portions of said private record are authorized for viewing by a requestor in accordance with both said legal criteria and said privacy preferences; and

sending, by said private access bureau to said privacy-enabled application, an indication of which portions of said private record are authorized for viewing in response to completing said comparison.