Data driven schema for patient data exchange system

• US 9,467,450 B2
• Filed: 08/20/2014
• Issued: 10/11/2016
• Est. Priority Date: 08/21/2013
• Status: Active Grant

• Current Assignee: Medtronic Incorporated (Medtronic Plc)
• Original Assignee: Medtronic Incorporated (Medtronic Plc)
• Inventors: Paffel, Timothy D., Harding, William C.
• Primary Examiner(s): Schwartz, Darren B
• Application Number:
  US14/464,357
• Publication Number:
  US 20150058627A1
• Time in Patent Office: 783 Days
• US Class Current: 1/1
• CPC Class Codes: G16H 10/60 for patient-specific data, e.g. for electronic patient records
• CPC Class Codes: G16Z 99/00 Subject matter not provided for in other main groups of this subclass
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A patient data exchange system comprises at least one device. Each of the devices implements an interface. When a device in the patient data exchange system publishes patient data, the device generates a metadata envelope that encapsulates the patient data. The metadata envelope conforms to a schema that defines allowable metadata attributes of the metadata envelope. When a device in the patient data exchange system receives a metadata envelope that conforms to the schema, the device determines, based at least in part on a metadata attribute of the metadata envelope, a particular patient data handling policy to apply to patient data encapsulated by the metadata envelope. In some instances, the metadata attribute indicates that authorization is required from an authorization service to access the patient data encapsulated by the metadata envelope.

Claims

1. A system for exchanging patient data, the system comprising:

at least one device that implements an interface, wherein the interface includes a software structure acting as a point of interaction, the at least one device includes at least one of;

an implantable medical device or a programmer device for an implantable medical device, and when the interface receives a metadata envelope that conforms to a schema that defines each allowable metadata attribute of the metadata envelope;

the interface determines, based at least in part on a first metadata attribute of the received metadata envelope, a particular patient data handling policy from among a plurality of available patient data handling policies that the interface is configured to apply, wherein each of the available patient data handling policies prescribes a different way of handling patient data;

the interface applies the particular patient data handling policy with regard to a particular set of patient data encapsulated within the received metadata envelope; and

when the particular patient data handling policy indicates that receiving authorization is required in order to access the particular set of patient data, the interface requests, to receive from an authorization service identified by a second metadata attribute of the received metadata envelope, the authorization to access the particular set of patient data,

wherein the interface receives the authorization to access the particular set of patient data only when the interface provides evidence to the authorization service that the interface is configured such that the interface does not transmit the particular set of patient data in encrypted or unencrypted form outside the metadata envelope and does not generate copies of the particular set of patient data in unencrypted form that persist after termination of the interface.

2. The system of claim 1, wherein:

the evidence comprises authorization data encrypted according to an encryption key, and

a requirement to receive a decryption key for the particular set of patient data to the interface from the authorization service is that the authorization service is able to successfully decrypt the authorization data.

3. The system of claim 1, wherein the particular set of patient data comprises clinical study data.

4. The system of claim 1, wherein the first metadata attribute indicates a governmental regulation applicable to the particular set of patient data.

5. The system of claim 1, wherein the first metadata attribute indicates a type of consent given by a patient regarding sharing of the particular set of patient data.

6. The system of claim 1, wherein the first metadata attribute indicates a country in which consent was given by a patient regarding sharing of the particular set of patient data.

7. The system of claim 1, wherein the interface is further configured to:

determine, based on the particular patient data handling policy, whether to delete the particular set of patient data; and

delete, based on the determination, the particular set of patient data.

8. The system of claim 1, wherein the metadata envelope includes a third metadata attribute, the third metadata attribute indicating a type of encryption applied to the particular set of patient data.

9. The system of claim 1, wherein the metadata envelope includes a third metadata attribute, the third metadata attribute indicating a source of the particular set of patient data.

10. The system of claim 1, wherein:

the particular set of patient data is a first set of patient data and the metadata envelope is a first metadata envelope, and

when the interface publishes a second set of patient data, the interface encapsulates the second set of patient data within a second metadata envelope that includes one or more metadata attributes, wherein the second metadata envelope conforms to the schema.

11. The system of claim 1, wherein the schema is an extension of a Study Data Tabulation Model.

12. A method of handling patient data, the method comprising:

receiving, at an interface implemented by a device, a metadata envelope that encapsulates a particular set of patient data associated with a patient, wherein the interface includes a software structure acting as a point of interaction, the device includes at least one of;

an implantable medical device or a programmer device for an implantable medical device, and the metadata envelope conforms to a schema that defines each allowable metadata attribute of the metadata envelope;

determining, by the interface, based at least in part on a first metadata attribute of the received metadata envelope, a particular patient data handling policy from among a plurality of available patient data handling policies that the interface is configured to apply, wherein each of the available patient data handling policies prescribes a different way of handling patient data;

applying, by the interface, the particular patient data handling policy with regard to the particular set of patient data; and

when the particular patient data handling policy indicates receiving authorization is required in order to access the particular set of patient data, requesting, by the interface, from an authorization service identified by a second metadata attribute of the received metadata envelope, to receive the authorization to access the particular set of patient data,

wherein the interface receives the authorization to access the particular set of patient data only when the interface provides evidence to the authorization service that the interface is configured such that the interface does not transmit the particular set of patient data in encrypted or unencrypted form outside the metadata envelope and does not generate copies of the particular set of patient data in unencrypted form that persist after termination of the interface.

13. The method of claim 12, wherein:

the evidence comprises authorization data encrypted according to an encryption key, and

a requirement for receiving a decryption key for the particular set of patient data to the interface from the authorization service is that the authorization service is able to successfully decrypt the authorization data.

14. The method of claim 12, wherein the particular set of patient data comprises clinical study data.

15. The method of claim 12, wherein the first metadata attribute indicates a governmental regulation applicable to the particular set of patient data.

16. The method of claim 12, wherein the first metadata attribute indicates a type of consent given by a patient regarding sharing of the particular set of patient data.

17. The method of claim 12, wherein the first metadata attribute indicates a country in which consent was given by a patient regarding sharing of the particular set of patient data.

18. The method of claim 12, wherein the interface is further configured to:

determine, based on the particular patient data handling policy, whether to delete the particular set of patient data; and

delete, based on the determination, the particular set of patient data.

19. The method of claim 12, wherein the metadata envelope includes a third metadata attribute, the third metadata attribute indicating a type of encryption applied to the particular set of patient data.

20. The method of claim 12, wherein the metadata envelope includes a third metadata attribute, the third metadata attribute indicating a source of the particular set of patient data.

21. The method of claim 12, wherein the schema is an extension of a Study Data Tabulation Model.

22. A non-transitory computer-readable data storage medium having instructions stored thereon that, when executed, configure an interface implemented by a device to:

receive a metadata envelope that encapsulates a particular set of patient data associated with a patient, wherein the interface includes a software structure acting as a point of interaction, the device includes at least one of;

an implantable medical device or a programmer device for an implantable medical device, and the metadata envelope conforms to a schema that defines each allowable metadata attribute of the metadata envelope;

determine based at least in part on a first metadata attribute of the received metadata envelope, a particular patient data handling policy from among a plurality of available patient data handling policies that the interface is configured to apply, wherein each of the available patient data handling policies prescribes a different way of handling patient data;

apply the particular patient data handling policy with regard to the particular set of patient data; and

when the particular patient data handling policy indicates receiving authorization is required in order to access the particular set of patient data, request, to receive from an authorization service identified by a second metadata attribute of the received metadata envelope, the authorization to access the particular set of patient data,

wherein the interface receives the authorization to access the particular set of patient data only when the interface provides evidence to the authorization service that the interface is configured such that the interface does not transmit the particular set of patient data in encrypted or unencrypted form outside the metadata envelope and does not generate copies of the particular set of patient data in unencrypted form that persist after termination of the interface.