Abstract:
To authenticate a user and create an account for a web-based portal, an electronic medical record system generates a unique activation code and uses SMS gateways to send encrypted an activation code in an embedded URL to a user&#39;s mobile communication device. The user then authenticates with a custom web application and creates account on a patient web portal to the EMR system.

Description:
BACKGROUND OF THE INVENTION 
       [0001]    The present invention relates generally to electronic record access and retrieval systems, and in particular relates to patient access to personal electronic medical or healthcare records (EMRs or EHRs) via a mobile communication device such as a smartphone. 
         [0002]    MyChart by Epic Systems Corporation is an integrated patient health record (PHR) system that gives patients controlled access to their medical records through an internet browser. MyChart provides a number of functions, such as allowing patients to view test results, view upcoming and past medical appointments, fill out pre-visit questionnaires, schedule appointments, view paperless statements and pay bills online, upload photos, update medications and allergies, connect to home devices, refill prescriptions, message securely with providers, view a child&#39;s records and print growth charts, manage the care of elderly parents, and view education topics triggered by EHR data. 
         [0003]    While MyChart also provides a mobile application, privacy and security concerns require pre-authentication and authorization of a patient&#39;s smartphone before the patient is able to use the mobile application. Also, many functions of the MyChart application are not available on the mobile application version. What is needed is a method for secure activation of a patient account from a smartphone, wherein a patient may establish a web portal account and download a mobile PHR application directly from their smartphone or other mobile communication device. 
       SUMMARY OF THE INVENTION 
       [0004]    In accordance with the invention, a method, system and computer program product are provided to authenticate a user and create an account for a web-based portal. An electronic medical record system generates a unique activation code and uses SMS gateways to send an encrypted activation code in an embedded URL to a user&#39;s mobile device. The user then authenticates with a custom web application on their healthcare provider&#39;s server, and creates an account on a patient portal. The user then may download a mobile PHR application to obtain access to their personal health and medical records from their healthcare provider. 
         [0005]    In particular, in accordance with one aspect of the invention, a method is provided for activating a mobile communication device of a patient to have access to electronic medical records of the patient, comprising: receiving a request for activation of a mobile communication device of a patient, said request being initiated through a link in a medical report of said patient; in response to said request, creating an activation code and associating said activation code with a telephone number of said mobile communication device; sending said activation code to said mobile communication device using said telephone number; receiving a communication from said mobile communication device in response to sending said activation code; and in response to verification of the validity of said response, creating a user account for said patient and associating the user account with said mobile communication device; whereby said patient is provided with access to said patient&#39;s electronic medical records through said mobile communication device. 
         [0006]    In accordance with another aspect of the invention, a system is provided for activating a mobile communication device of a patient to have access to electronic medical records of the patient, comprising: an electronic medical record application server, configured to receive a request for activation of a mobile communication device of a patient, said request being initiated through a link in a medical report of said patient; an electronic medical record database configured to generate, in response to a query from said application server, activation code data and associate said activation code with a telephone number of said mobile communication device; a message gateway server configured to send said activation code to said mobile communication device using said telephone number; a Web server configured to receive a communication from said mobile communication device in response to sending said activation code; and a Web Services gateway server configured to create a user account for said patient and associate the user account with said mobile communication device; whereby said patient is provided with access to said patient&#39;s electronic medical records through said mobile communication device. 
         [0007]    In accordance with yet another aspect of the invention, a non-transitory computer-readable medium is provided having stored thereon computer-executable instructions for activating a mobile communication device of a patient to have access to electronic medical records of the patient, comprising instructions for causing a computer to: receive a request for activation of a mobile communication device of a patient, said request being initiated through a link in a medical report of said patient; generate, in response to a query from said application server, activation code data and associate said activation code with a telephone number of said mobile communication device; send said activation code to said mobile communication device using said telephone number; receive a communication from said mobile communication device in response to sending said activation code; and create a user account for said patient and associate the user account with said mobile communication device; whereby said patient is provided with access to said patient&#39;s electronic medical records through said mobile communication device. 
     
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         [0008]      FIG. 1  is a schematic diagram illustrating one example of a process flow for smartphone activation of a patient health record account and smartphone authentication in accordance with one aspect of the invention; 
           [0009]      FIG. 2  is a screenshot of a user&#39;s smartphone display, showing a text message with embedded link for smartphone activation in accordance with the invention; 
           [0010]      FIG. 3  is a screenshot of a user&#39;s smartphone display, showing a patient activation window for creation of a patient PHR account in accordance with the invention; 
           [0011]      FIG. 4  is a schematic diagram of an example system structure in accordance with another aspect of the invention; and 
           [0012]      FIG. 5  is a flow diagram illustrating a workflow process for patient account establishment and smartphone authentication in accordance with another aspect of the invention. 
       
    
    
     DETAILED DESCRIPTION OF THE INVENTION 
       [0013]      FIG. 1  illustrates a process flow for PHR smartphone authentication and activation in accordance with one aspect of the invention. A user initiates a smartphone activation request for the smartphone of a patient  11 , from within an EMR in a PHR system  12  (such as Epic for example), at step  1 . The request redirects to a custom ASP page on a PHR server  13  (such as e.g. MyChart). The custom ASP page then generates an activation code and a creation time for the activation code, encrypts the activation code (using, for example, BASE64), and sends it to an SMS gateway such as Nexmo Gateway  14 , at step  2 . The SMS gateway then sends to the smartphone of the patient  11  a text message containing a link, and the encoded activation code and creation time, to the user&#39;s smartphone. An example of the text message is shown in  FIG. 2 . 
         [0014]    The patient  11  then clicks on the link in the text message displayed on the patient&#39;s smartphone, and is thereby redirected to the custom ASP page on the server  13 , at step  3 . The patient is then directed on the custom ASP page to enter authentication information, such as the last four digits of the patient&#39;s Social Security Number (SSN), the patient&#39;s date of birth (DOB), or other secure information. If the patient&#39;s access to the server  13  is within a predefined period of time after the creation time (such as, for example, 3 hours), at step  4  the ASP sends the patient&#39;s credentials via a CreatePatientAccount web service to an Interconnect server  15 . The web service submits an XML object containing the activation code and the patient&#39;s authentication data to the server. The Interconnect server  15  returns to the ASP on server  13  a validation response if all the information is valid. All communications with the Interconnect server are done via reverse proxy server such as Coyote Point LB. At step  5 , the custom ASP page collects a user name and password from the patient  11  via the patient&#39;s smartphone as shown in  FIG. 3 , and sends this information back to the Interconnect server  15  via an ActivateAccount web service. The service then establishes a patient account with the user name and password and associates the account with the telephone number of the patient&#39;s smartphone. The patient may then open or download a mobile application providing access to the patient&#39;s personal medical records directly from the PHR server. 
         [0015]      FIG. 4  shows an example system structure in accordance with another aspect of the invention. A staff member initiates a request from a patient&#39;s electronic medical record in EMR server  41  to send a message to the patient. A query (A) is sent to the database  42  for an activation code and the telephone number(s) of the patient&#39;s mobile communication device(s). The database  42  returns a unique activation code (B) specific to the patient as well as any mobile numbers on file, to the application server  41 . The application server  41  then generates a JavaScript Object Notation (JSON) message containing the unique activation code, a link to a Web server  45 , and the time that the message was generated, encoded in BASE64, and sends it to the Web short message service (SMS) gateway  43  via HTTP post using secure socket layers (SSL). 
         [0016]    The web SMS gateway  43  then sends an SMS message (D) to a telephone number of a patient&#39;s mobile communication device  44  as returned from the EMR database  42 . The patient then taps the touch-sensitive phone display to open the link. This generates a request (E) to the Web server  45 , which contains the unique activation code and the time of generation. The Web server  45  validates the code if it is not expired according to the received creation time. The Web server  45  then forwards the activation code (F) to the reverse proxy server  47  as an XML SOAP request. The reverse proxy server  47  then forwards the SOAP request (G) to Web services gateway server  46  (behind the firewall). The Web services gateway server  46  then forwards the activation code (H) to the electronic medical record database server  42 . The database  42  then checks the code and returns either an “invalid” message or a patient ID (I) to the Web services gateway server  46 . The Web services gateway server  46  then creates an XML SOAP response containing either the invalid error message or patient ID (J) and forwards it to the reverse proxy server  47 . 
         [0017]    The reverse proxy server  47  then forwards the XML SOAP response (K) to a JSON object on Web server  45  and returns it to the patient&#39;s smartphone  44  (L). The smartphone  44  shows either the error message or a screen (see  FIG. 3 ) to create a username and password. The patient&#39;s inputted username, password, and security questions are then sent as JSON (M) to Web server  45 . Web server  45  then creates an XML SOAP request containing the patient&#39;s inputted username, password and security questions and sends it (N) to the reverse proxy server  47 . The reverse proxy server  47  then forwards the XML SOAP request (O) to the Web services gateway server  46  behind the firewall. The Web services gateway server  46  then forwards the patient&#39;s requested username, password and security questions (P) to the database  42 . The database  42  attempts to create a patient account and returns either an error or an account successful message (Q) and forwards it to the EMR Web services server  46 , which forwards it to the reverse proxy server  47  (R). Reverse proxy server  47  then forwards the XML SOAP response to the web server  45  (S). Web server  45  then creates a JSON object containing the error message or activation successful message and returns it (T) to the patient&#39;s smartphone  44 . If activation was successful, the patient is redirected to the EMR server  41  and prompted to either open or download the PHR mobile application. 
         [0018]      FIG. 5  shows a flow diagram according to another aspect of the invention. The steps are self-explanatory and analogous to the procedures explained above with respect to  FIG. 4 .