Patent ID: 8275632
Filing Date: 2012-09-25
Classification: G06F,G06Q,G16H,H04L

Abstract:
1. A non-transitory computer readable medium for managing medical record information in a privacy compliant manner, comprising data that, when accessed by a machine, cause the machine to perform operations comprising: storing in a database a plurality of medical records, each including an identification of a corresponding client, each further including a plurality of transaction records; separately and uniquely encrypting a new transaction record before storage in said database to control and enforce: receiving in a computer system under the control of a third-party trusted information broker, via a communication medium, a first request initiated by a service provider for access to at least one of said medical records in said database, said first request including the identification of the service provider, the service provider being an external entity not affiliated with the third-party trusted information broker; transmitting from said computer system under the control of said third-party trusted information broker a request for consent to said client; receiving in said computer system under the control of said third-party trusted information broker, in response to said request for consent, an indication from said client that said client consents or does not consent to access to said medical record by said service provider; using information indicating said right of access stored in said transaction record to grant or deny access to said at least one medical record based upon said indication from said client, or from a different service provider; receiving in said computer system under the control of said third party trusted information broker, via said communication medium, a second request initiated by a second service provider to enter at least one second transaction record to said database, said request including the identification of the second service provider, the second service provider being an external entity not affiliated with the trusted information broker; using an access control list determined by the client to grant entering of one or more new medical records by said second service provider based upon an indication from said client that said client authorizes the second service provider to create such records, said access control list indicating rights of a plurality of service providers to create new records in the database, whereby multi-way communication of transaction records to and from the database is provided in a privacy compliant manner; receiving in said computer system under the control of said third-party trusted information broker, via said communication medium, a third request initiated by a third service provider to enter at least one third transaction record to said database, said third request including the identification of the third service provider, the third service provider being an external entity not affiliated with the trusted information broker; and, using said access control list determined by the client to deny entering of one or more new medical records by said third service provider based upon a lack of an indication from said client that said client authorizes the third service provider to create such records.