INFORMATION RECORD INFRASTRUCTURE, SYSTEM AND METHOD

• US 20080306872A1
• Filed: 08/19/2008
• Published: 12/11/2008
• Est. Priority Date: 07/06/2000
• Status: Active Grant

• Current Assignee: RPX Corporation
• Original Assignee: David Paul Felsher
• Inventors: Felsher, David Paul
• Granted Patent: US 7,805,377 B2
• Time in Patent Office: Days
• US Class Current: 705/51
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: G06Q 10/10 Office automation; Time management
• CPC Class Codes: G06Q 20/367 involving electronic purses or money safes
• CPC Class Codes: G06Q 20/3674 involving authentication
• CPC Class Codes: G06Q 20/382 insuring higher security of transaction
• CPC Class Codes: G16H 10/60 for patient-specific data, e.g. for electronic patient records

Abstract

A method for controlling access to a medical record of a patient hosted by at least one medical record repository, comprising a plurality of sub-records, each sub-record having an associated different patient-controlled access control criteria, comprising: receiving, by an intermediary, a request for a medical record from a requester, said request comprising a medical record identifier, a requester identifier, requester authentication information, and patient-provided access control authorization; automatically processing, by the intermediary, the request for the medical record to authenticate the requester and determine sufficiency of the patient-provided access control authorization to meet the patient-controlled access control criteria for each respective sub-record encompassed by the request; and selectively communicating, from the intermediary to the at least one medical record repository, an identification of each sub-record for which access control criteria are determined to be sufficient for access by the requestor. An electronic payment authorization associated with the request may be generated, for compensation of at least one of the intermediary and a medical record repository.

Claims

1. A method for controlling access to a medical record of a patient hosted by at least one medical record repository, comprising a plurality of sub-records, each sub-record having an associated different patient-controlled access control criteria, comprising:

(a) receiving, by an intermediary, a request for a medical record from a requester, said request comprising a medical record identifier, a requestor identifier, requestor authentication information, and patient-provided access control authorization;

(b) automatically processing, by the intermediary, the request for the medical record to authenticate the requestor and determine sufficiency of the patient-provided access control authorization to meet the patient-controlled access control criteria for each respective sub-record encompassed by the request; and

(c) selectively communicating, from the intermediary to the at least one medical record repository, an identification of each sub-record for which access control criteria are determined to be sufficient for access by the requester.

2. The method according to claim 1, further comprising generating an electronic payment authorization associated with the request, for compensation of at least one of the intermediary and a medical record repository.

3. The method according to claim 1, further comprising the step of persistently storing at least each request for which access control criteria are determined to be sufficient for access by the requester.

4. The method according to claim 1, further comprising the step of determining a role of a requestor in a medical care of a patient, and determining a sufficiency of the patient-provided access control authorization to meet the patient-controlled access control criteria at least in dependence on the determined role.

5. The method according to claim 1, further comprising accounting by the intermediary, in a financial accounting database, for the request transaction.

6. The method according to claim 1, wherein the intermediary ensures that the requestor has entered into a restriction limiting retransmission of the medical record.

7. A system adapted to control access to a patient medical record hosted by at least one medical record repository comprising a plurality of sub-records, each sub-record being associated with different patient-controlled access control criteria, said system comprising an automated processor, a database adapted to store information for authenticating requesters, a database adapted to store information for determining patient-controlled access control criteria for respective sub-records of a patient medical record, and a computer network interface, said processor being controlled by instructions stored on a computer readable storage medium to:

(a) receive a request for a medical record from a requester, said request comprising a medical record identifier, a requestor identifier, requestor authentication information, and patient-provided access control authorization;

(b) process the request for the medical record, to authenticate the requestor and determine sufficiency of the patient-provided access control authorization to meet the patient-controlled access control criteria for each respective sub-record encompassed by the request; and

(c) selectively communicate through the computer network interface to the at least one medical record repository, an identification of each sub-record for which access control criteria are determined to be sufficient for access by the requestor.

8. The system according to claim 7, wherein said processor is further controlled by instructions to generate an electronic payment authorization associated with the request, for compensation of at least one of the intermediary and a medical record repository.

9. The system according to claim 7, wherein said processor is further controlled by instructions to persistently store at least each request for which access control criteria are determined to be sufficient for access by the requestor.

10. The system according to claim 7, wherein said processor is further controlled by instructions to determine a role of a requester in a medical care of a patient, and determining a sufficiency of the patient-provided access control authorization to meet the patient-controlled access control criteria at least in dependence on the determined role.

11. The system according to claim 7, wherein said processor is further controlled by instructions to account, in a financial accounting database, for the request transaction.

12. The system according to claim 7, wherein said processor is further controlled by instructions to ensure that the requester has entered into a restriction limiting retransmission of the medical record.

13. A method for controlling access to a medical record of a patient hosted by at least one medical record repository, comprising:

(a) receiving, by an intermediary, a request for a medical record from a requestor, said request comprising a medical record identifier, a requester identifier, and requester authentication information;

(b) automatically processing, by the intermediary, the request for the medical record to authenticate the requestor;

(c) selectively communicating, from the intermediary to the at least one medical record repository, an authenticated request for access to the medical record by the requestor; and

(d) generating an electronic payment authorization associated with the request, for compensation of at least one of the intermediary and a medical record repository.

14. A method according to claim 13, wherein the medical record comprises a plurality of sub-records, each sub-record having an associated different patient-controlled access control criteria, further comprising:

receiving, by an intermediary, patient-provided access control authorization associated with the a request for a medical record from a requestor;

automatically processing, by the intermediary, the request for the medical record, to further determine sufficiency of the patient-provided access control authorization to meet the patient-controlled access control criteria for each respective sub-record encompassed by the request; and

selectively communicating, from the intermediary to the at least one medical record repository, an identification of each sub-record for which access control criteria are determined to be sufficient for access by the requester.

15. The method according to claim 13, further comprising the step of persistently storing at least each request for which access control criteria are determined to be sufficient for access by the requestor.

16. The method according to claim 13, further comprising the step of determining a role of a requester in a medical care of a patient, and determining a sufficiency of the patient-provided access control authorization to meet the patient-controlled access control criteria at least in dependence on the determined role.

17. The method according to claim 13, further comprising accounting by the intermediary, in a financial accounting database, for the request transaction.

18. The method according to claim 13, wherein the intermediary ensures that the requester has entered into a restriction limiting retransmission of the medical record.

19. The method according to claim 13, further comprising a context of a request for access to the medical record by the requester, and determining a sufficiency of the patient-provided access control authorization to meet the patient-controlled access control criteria at least in dependence on the determined context.

20. The method according to claim 13, further comprising encrypting at least a portion of the medical record for which the request for access is authenticated for secure transmission over a public communications network.