Patent Issued for Blockchain-based mechanisms for secure health information resource exchange (USPTO 11227675): BBM Health LLC

2022 FEB 08 (NewsRx) -- By a News Reporter-Staff News Editor at Insurance Daily News -- BBM Health LLC (Atlanta, Georgia, United States) has been issued patent number 11227675, according to news reporting originating out of Alexandria, Virginia, by NewsRx editors.

The patent’s inventors are Aluri, Bharat Chand (Atlanta, GA, US), Braunstein, Mark (Atlanta, GA, US), Bulleit, Douglas A. (Atlanta, GA, US), Danner, III, Fred Thomas (Colorado Springs, CO, US), Miller, III, Charles Clifton (Atlanta, GA, US).

This patent was filed on August 23, 2017 and was published online on January 18, 2022.

From the background information supplied by the inventors, news correspondents obtained the following quote: “Healthcare records containing vital information resources may be generated by a variety of entities, such as healthcare providers, pharmacies, patients, and others. These healthcare records, even if in electronic health record (EHR) form, may reside in a variety of locations, and may not be easily accessible to a variety of applications, current stakeholders, and/or other users of those healthcare records. At the same time, different systems for storing healthcare records may utilize their own mechanism for controlling and disbursing the health information resources (HIR) that are stored within their various EHRs. This may cause confusion among patients and other users of the healthcare data, as well as difficulty in accessing the healthcare data itself. In many cases, patients may have little to no control of their EHRs and/or HIRs that pertain to them. In some cases, new applications development that could benefit from accessing and managing HIR data may be effectively restricted within legacy EHR environments.

“Additionally, there are regulations and laws directed to the privacy of healthcare data. For example, regulations embodied in the Health Insurance Portability and Accountability Act (HIPAA) of 1996 regulates the extent to which certain kinds of patients’ protected health information (PHI) may be shared with third-parties and/or otherwise utilized without the patient’s permission. As a result, entities that store healthcare records containing PHI have implemented proprietary mechanisms for compliance to these regulations and for managing them. Accordingly, there are a variety of different systems for managing EHRs, most of which are not easily interoperable with each other.

“Furthermore, due to potential liability resulting from non-compliance with PHI handling regulations, practicing health systems (e.g., hospitals) often choose to control the full lifecycle of their EHRs, from birth to destruction of the HIR data within them. Thus, the HIRs, or the presentation thereof, may not be readily customized or otherwise accessible to patient needs or the needs of the users of the data. Further still, caretakers of the healthcare data, such as care providers within healthcare systems, may be burdened with the liability of managing and disbursing healthcare data, in many cases, distracting those entities from their core competencies, such as providing healthcare.

“It is with respect to these considerations and others that the disclosure made herein is provided.”

Supplementing the background information on this patent, NewsRx reporters also obtained the inventors’ summary information for this patent: “The technologies disclosed herein provide functionality for enabling electronic access to protected health information (PHI) according to the wishes of a patient and/or other authorized parties including, but not limited to, the healthcare provider to whom the healthcare data may belong or is otherwise authorized under existing regulation. The patient or provider may designate who (e.g., individuals, entities, applications, etc.) may have permission to access his or her PHI and/or other health information resources (HIRs), and may further place conditional stipulations (e.g., time periods, redactions, locations, number of views, device types, anonymity, etc.) by which a designee may access authorized PHI and/or other HIRs.

“According to example embodiments, electronic healthcare records (EHRs) may reside at a resource system of an entity that has generated the healthcare record or has received the healthcare record, such as a hospital’s resource system(s) for managing EHRs. These resource systems may be configured to provide PHI and/or other HIRs to an authorized user application according to a predefined standard. An application program interface (API) may reside on a front-end of the resource system to provide this predefined format for granular HIRs to a requesting and authorized user’s client system.

“According to example embodiments of the disclosure, a user (e.g., patient) may be able, via an application executing on his or her client system, set conditional permissions for his or her HIR. Through a user interface of the application, the user may be able to designate conditional permissions for a particular HIR, or collection of resources such as those typically contained in an existing EHR. These conditional permission(s) may be used to generate a permission grant that may be sent to a distributed ledger, or healthcare blockchain system, to invoke an executable smart contract within a healthcare blockchain. If the user is authorized to cause permissions to be written onto the blockchain’s smart contracts, then the blockchain systems may incorporate (e.g., hash with prior blocks) a new block containing new and/or modified permissions, such as in the form of one or more smart contracts.

“Smart contracts contained within the healthcare blockchain may operate using any suitable protocols to adjudicate and/or enable agreements between parties to execute according to those agreements as prescribed, specified, codified, verified, and/or enforced. These same smart contracts may be both self-executing and or self-enforcing. In example embodiments, a smart contract is used to determine whether access to an HIR should be granted to a requesting party. In this case, the smart contract may make this determination based upon, among other factors, the verification of a certified self-sovereign identity (CSI) of the requesting party, a CSI of the party owning the information, and permissions previously provided by the owning party.

“According to example embodiments of the disclosure, permissions may be expressed within one or more smart contract(s) in the blockchain that designates and/or enables the permissioning of others, such as in a conditional manner, to access the HIR for which the permissions in the blockchain were generated. Once incorporated into the healthcare blockchain, the smart contract(s) may generate and/or send an indication to a client system of a permissioned party that he, she or it may access the HIR for which permissions have been granted. In example embodiments, only the most recent permission states, as incorporated in the healthcare blockchain, may be able to authorize access tokens. As a result, an immutable record of all activity may recorded in the blockchain while preserving near real-time patient control and/or ability to correct any mistakes of information transfer to client and other systems.”

The claims supplied by the inventors are:

“1. A computer-implemented method, comprising: receiving, by a client systems module of a value-added certificate authorization system comprising one or more processors, from a client system, a request to certify a self-sovereign identity certificate (SIC) for access to a healthcare blockchain; requesting, by the client systems module of the value-added certificate authorization system, and from the client system, personal identification information associated with the SIC; receiving, by the client systems module of the value-added certificate authorization system, the personal identification information; requesting, by an identity authority module of the value-added certificate authorization system, from an independent identity authority system, verification of the personal identification information; receiving, from the independent identity authority system and by the identity authority module of the value-added certificate authorization system and further responsive to requesting the verification of the personal identification information, data indicative of the authenticity of the personal identification information; verifying, by the identity authority module of the value-added certificate authorization system and by using the data indicative of authenticity of the personal identification information, the personal identification information; certifying, by the identity authority module of the value-added certificate authorization system, responsive to the verification, the SIC; generating, by a certified sovereign identity (CSI) key module of the value-added certificate authorization system and based at least in part on certifying the SIC, a CSI; and instructing, by a blockchain module of the value-added certificate authorization system, a blockchain system to include a public key associated with the CSI on the healthcare blockchain.

“2. The computer-implemented method of claim 1, further comprising: receiving, by a patient identification module of the value-added certificate authorization system, a request to grant a permission to access a health information resource to a user associated with the CSI; determining, by the patient identification module of the value-added certificate authorization system and based at least in part on the CSI, that the user is authorized to gain permission to access the health information resource; and instructing, by the blockchain module the value-added certificate authorization system, a blockchain system to include a smart contract corresponding to the grant of the permission to the user to access the health information resource.

“3. The computer-implemented method of claim 1, further comprising: receiving, by an application download module of the value-added certificate authorization system, from an application download system, a request to bind the CSI to a healthcare application; and instructing, by the application download module of the value-added certificate authorization system and responsive to the request to bind the CSI to the healthcare application, storing the CSI in a digital wallet of the client system.

“4. The computer-implemented method of claim 1, wherein the CSI is a first CSI, the first CSI corresponding to a first user, the method further comprising: receiving, by a patient identification module of the value-added certificate authorization system, a request to grant a permission to access a health information resource to a second user, the second user having a second CSI; determining, by the patient identification module of the value-added certificate authorization system and based at least in part on the first CSI, that the first user is authorized to set permissions to access the health information resource; and instructing, by the blockchain module the value-added certificate authorization system, a blockchain system, to include a smart contract corresponding to the grant of the permission to the second user to access the health information resource.

“5. The computer-implemented method of claim 4, wherein the grant of the permission to access the health information resource comprises one or more conditions under which the second user is permitted to access the health record.

“6. The computer-implemented method of claim 4, wherein the client system is a first client system, and wherein the smart contract comprises instructions to issue an access token to the second user, the access token allowing a second client system corresponding to the second user to receive the health information resource from a resource server.

“7. A system, comprising: a non-transitory computer readable media that stores computer-executable instructions; at least one processor configured to access the memory, wherein the at least one processor is further configured to execute the computer-executable instructions to: receive, by a client systems module and from a client system, a request to certify a self-sovereign identity certificate (SIC) for access to a healthcare blockchain; request, by the client systems module from the client system, a plurality of personal identification information associated with the sovereign identity; receive, by the client systems module, the plurality of personal identification information; request, by an identity authority module and from an independent identity authority system, verification of the plurality of personal identification information; receive, from the independent identity authority system and responsive to requesting the verification of the plurality of personal identification information, data indicative of the authenticity of the plurality of personal identification information; verify, by the identity authority module and based at least in part on the data indicative of the authenticity of the plurality of personal identification information, the plurality of personal identification information; certify, by the identity authority module and responsive to the verification, the SIC; generate, by a certified sovereign identity (CSI) key module and based at least in part on certifying the SIC, a certified sovereign identity (CSI); and instruct, by a blockchain module and by the value-added certificate authorization system, a blockchain system to include a public key associated with the CSI on the healthcare blockchain.

“8. The system of claim 7, wherein the CSI comprises a public key that is included in the healthcare blockchain and a private key that is stored on the client system.

“9. The system of claim 7, wherein the at least one processor is further configured to execute the computer-executable instructions to: receive, by an application download module and from an application download system, a request to bind the CSI to a healthcare application; and instruct, by the application download module and responsive to the request to bind the CSI to the healthcare application, storing the CSI in a digital wallet of the client system.

“10. The system of claim 7, wherein the CSI is a first CSI, the first CSI corresponding to a first user, and wherein the at least one processor is further configured to execute the computer-executable instructions to: receive, by a patient identification module, a request to grant a permission to access a health information resource to a second user, the second user having a second CSI; determine, by the patient identification module and based at least in part on the first CSI, that the first user is authorized to set permissions for the health information resource; and instruct, a blockchain system, to include a smart contract corresponding to the grant of the permission to the second user to access the health information resource.

“11. The system of claim 10, wherein the grant of the permission to access the health information resource comprises one or more conditions under which the second user is permitted to access the health information resource.

“12. The system of claim 10, wherein the client system is a first client system, and wherein the smart contract comprises instructions to issue an access token to the second user, the access token allowing a second client system corresponding to the second user to receive the health information resource from a resource server.”

There are additional claims. Please visit full patent to read further.

For the URL and additional information on this patent, see: Aluri, Bharat Chand. Blockchain-based mechanisms for secure health information resource exchange. U.S. Patent Number 11227675, filed August 23, 2017, and published online on January 18, 2022. Patent URL: http://patft.uspto.gov/netacgi/nph-Parser?Sect1=PTO1&Sect2=HITOFF&d=PALL&p=1&u=%2Fnetahtml%2FPTO%2Fsrchnum.htm&r=1&f=G&l=50&s1=11227675.PN.&OS=PN/11227675RS=PN/11227675

(Our reports deliver fact-based news of research and discoveries from around the world.)