Dynamically and customizably managing data in compliance with privacy and security standards
Systems and methods for managing data in compliance with privacy, security and/or retention standards in business industries. A dynamic and customizable archival and retrieval system allows for information and documentation to be placed and made available in the system. The document type and identifying information for that document type are described. Definitions are established for the documents being managed, the data identifying the documents, and the retention policies for the documents. The documents are associated with the identifying data for a particular set of records. A single point of entry is provided for external and/or internal requests, and/or a single point of exit is provided for transmissions of information, wherein the transmissions to requestors include information that is individually approved. Moreover, digital authorizations and consents for retrieval from external data sources may be utilized.
1. A method, implemented by a computing system, for providing a single point of entry for accessing business documents obtained from a plurality of external sources in compliance with privacy, security and retention standards, the method comprising:
establishing, on one or more computer readable media accessible by the computer system, a repository of business documents that are obtained from a plurality of external sources such that the repository comprises a single point of entry for accessing the business documents, wherein access to the business documents is governed by one or more regulations based on the content of each business document, each business document stored in the repository including an associated identifier:
receiving, by the computer system, a request for a first business document stored in the repository, the request including the identifier associated with the first business document;
determining, by the computer system, whether the first business document is subject to a regulated requirement based on the content of the first business document that would preclude release of the first business document to the requestor, wherein the regulated requirement is a pre-established professional requirement that precludes release of the content of the first business document to the requestor;
determining, by the computer system, whether consent of an individual of which the content pertains is required and whether the consent of the individual has been obtained if the consent is required such that;
when the requested information is not subject to the requirement and the consent of the individual has been obtained when the consent is required, the computing system accesses the first business document from within the repository using the identifier associated with the first business document and releases the first business document to the requestor; and
when the requested information is subject to the requirement, the computing system fails to provide the first business document to the requestor.
2. A method as recited in claim 1 , the method further comprising:
determining, by the computing system and when the requested information is subject to the requirement, whether there exists a legal requirement to release the first business document; and
if there exists the legal requirement, releasing the first business document to the requestor.
3. A method as recited in claim 1 , wherein the regulated requirement that precludes release of the first business document to the requestor based on the content of the first business document is at least one of (i) a federal regulation; (ii) a state regulation; (iii) a local regulation; (iv) an internal regulation; (v) a regulated retention time period; (vi) a professional requirement; and (vii) an ethical requirement.
4. A method as recited in claim 3 , further comprising
comparing, by the computing system, a pre-established retention time deadline of the holder of the first business document with a retention time deadline of whom the content of the first business document pertains; and
releasing the first business document to the requestor if the content of the first business document is not subject to the requirement and the retention time deadline of whom the content of the first business document pertains has not expired.
5. A method as recited in claim 1 , wherein the step of establishing the repository further comprises defining a retention policy for each business document and generating an input form based on the identifier associated with each business document.