System, method and computer program product for controlling access to protected personal information
View Patent ↗A computer-based system, method and computer program product for controlling access to protected personal information is disclosed. Protected personal information that is accessible by an information management application program is stored in a computer memory. In response to a request from an authenticated user for information, which includes protected personal information, information is displayed indicating that user has requested protected personal information, but the protected personal information is not displayed. In response to receiving user input requesting access to the protected personal information, a determination is made as to whether the user is authorized to access the requested protected personal information. If so, requested protected personal information is displayed to the user and information is stored relating to the user's access to protected personal information. Otherwise, requested protected personal information is not displayed to the user and information relating to the user's access to protected personal information is not stored.
1. A computer implemented method of controlling access to protected personal information by a user of an information management application program that has access to the protected personal information, the method comprising:
storing in a computer memory the protected personal information that is accessible by the information management application program;
authenticating the user of the information management application program;
receiving a first request from the authenticated user to access information accessible by the information management application program;
determining whether the information requested by the user is comprised of the protected personal information;
if the information requested by the user is comprised of the protected personal information, displaying information indicating that the information requested by the user is comprised of the protected personal information, but not displaying the requested protected personal information;
in response to displaying information indicating that the information requested by the user is comprised of the protected personal information, receiving from the user input requesting access to the protected personal information;
determining whether the user is authorized to access the requested protected personal information;
if the user is authorized to access the requested protected personal information, displaying the requested protected personal information to the user;
storing information i) indicating that the user accessed the requested protected personal information, and ii) identifying the protected personal information accessed by the user;
providing a graphical user interface for receiving user input requesting access to the protected personal information; and
displaying a button via the graphical user interface for receiving user input via a user input device for toggling between a first state in which protected personal information is not accessible to the user through search and display capabilities and a second state in which protected personal information is accessible to the user through search and display capabilities.
2. The method of claim 1 , wherein displaying the button is further comprised of:
displaying information indicating whether protected personal information is being displayed via the graphical user interface.
3. The method of claim 1 , wherein the information management application program is a health care information management application program or an insurance claim information management application program and the protected personal information is comprised of protected health information.
4. The method of claim 3 , wherein the protected health information is at least one item of information selected from a group consisting of Name, Address, Social Security Number, Medical Record Number, and Cardholder Identifier.
5. The method of claim 3 , wherein the protected health information is at least one item of information selected from a first group consisting of Name, Address, Social Security Number, Medical Record Number, and Cardholder Identifier, and one or more items selected from a second group consisting of Date of Birth, Sex, Relationship (to cardholder), Diagnosis Code, National Drug Code (NDC), NDC Description, Generic Code Number (GCN), GCN Description.
6. The method of claim 1 , wherein storing information indicating that the user accessed the requested protected personal information is further comprised of storing information identifying one or more items of information selected from a group consisting of: Information Viewed or Accessed; Date and Time of View or Access User Name, User Identifier, Application Program, Insurance Carrier Name, Insurance Carrier Identifier, Insurance Plan Name, Insurance Plan Identifier, Insurance Group, Store Group Identifier, National Council for Prescription Drug Programs (NCPDP) or National Provider Identifier (NPI) Quantity Dispensed, Days Supply, Prescription Number, Fill Date, Coordination of Benefits (COB).
7. The method of claim 1 , wherein the information management application program is a financial information management application program and the protected personal information is comprised of financial information.
8. The method of claim 1 further comprising:
in response to receiving from the user input requesting access to the protected personal information and determining that the user is authorized to access the requested protected personal information, storing information indicating that the user has requested access to and is authorized to access protected personal information for use in responding to the user's next request for information.
9. The method of claim 8 , further comprising:
receiving a second request from the authenticated user to access information accessible by the information management application program;
if the information requested by the user is comprised of protected personal information, displaying the protected personal information without requiring further user input requesting access to the protected personal information.
10. The method of claim 8 , further comprising:
receiving input from the user via the user input device indicating that displayed protected personal information should be concealed;
in response to receiving the input that displayed protected personal information should be concealed, concealing the previously displayed protected personal information.
11. The method of claim 10 , further comprising:
in response to receiving from the user input requesting that displayed protected personal information should be concealed, storing information indicating that the user has requested that protected personal information be concealed for use in responding to the user's next request for information.
12. The method of claim 11 , further comprising:
receiving a third request from the authenticated user to access information accessible by the information management application program;
if the information requested by the user is comprised of protected personal information, concealing the protected personal information without requiring further user input requesting that the protected personal information be concealed.
13. A system, comprising:
a processor; and
a memory coupled to the processor, wherein the memory comprises program instructions executable by the processor to implement an information management application program that has access to protected personal information and to control access to the protected personal information by a user of the information management application program, wherein the information management application program is configured to:
store the protected personal information that is accessible by the information management application program;
authenticate the user of the information management application program;
receive a request from the authenticated user to access information accessible by the information management application program;
determine whether the information requested by the user is comprised of the protected personal information;
if the information requested by the user is comprised of the protected personal information, display information indicating that the information requested by the user is comprised of the protected personal information, but not display the requested protected personal information;
in response to the display of information indicating that the information requested by the user is comprised of the protected personal information, receive from the user input requesting access to the protected personal information;
determine whether the user is authorized to access the requested protected personal information;
if the user is authorized to access the requested protected personal information, display the requested protected personal information to the user;
store information i) indicating that the user accessed the requested protected personal information, and ii) identifying the protected personal information accessed by the user;
provide a graphical user interface for receiving user input requesting access to the protected personal information; and
display a button via the graphical user interface for receiving user input via a user input device for toggling between a first state in which protected personal information is not accessible to the user through search and display capabilities and a second state in which protected personal information is accessible to the user through search and display capabilities.
14. A computer-readable non-transitory storage medium, comprising program instructions configured to implement an information management application program that has access to protected personal information and to control access to the protected personal information by a user of the information management application program, wherein the information management application program is configured to:
store the protected personal information that is accessible by the information management application program;
authenticate the user of the information management application program;
receive a request from the authenticated user to access information accessible by the information management application program;
determine whether the information requested by the user is comprised of the protected personal information;
if the information requested by the user is comprised of the protected personal information, display information indicating that the information requested by the user is comprised of the protected personal information, but not display the requested protected personal information;
in response to the display of information indicating that the information requested by the user is comprised of the protected personal information, receive from the user input requesting access to the protected personal information;
determine whether the user is authorized to access the requested protected personal information;
if the user is authorized to access the requested protected personal information, display the requested protected personal information to the user; store information i) indicating that the user accessed the requested protected personal information, and ii) identifying the protected personal information accessed by the user;
provide a graphical user interface for receiving user input requesting access to the protected personal information; and
display a button via the graphical user interface for receiving user input via a user input device for toggling between a first state in which protected personal information is not accessible to the user through search and display capabilities and a second state in which protected personal information is accessible to the user through search and display capabilities.