Granted Patent B2

US 9,053,338 · App. 13/236,715 · Granted Jun 9, 2015

Abstract

Claims (54)

1. A method for exception handling, the method comprising:

detecting attempted performance of a prohibited action involving protected data by at least detecting an attempt to send an email including protected data to an external recipient of the email;

determining, by a processor, based at least in part on a role associated with a user associated with the prohibited action whether the user has rights permitting performance of the prohibited action;

permitting an exception allowing performance of the prohibited action only in an instance in which it is determined that the user does have rights permitting performance of the prohibited action;

prohibiting performance of the prohibited action in an instance in which it is determined that the user does not have rights permitting performance of the prohibited action;

determining whether the external recipient is authorized to receive the protected data based at least in part on a role associated with the external recipient, wherein the role associated with the external recipient indicates whether the external recipient is authorized to receive the protected data via the email; and

permitting an exception allowing sending of the email including protected data to the external recipient only in an instance in which the role associated with the external recipient indicates that the external recipient is authorized to receive the protected data via the email.

2. The method of claim 1 , wherein determining whether the user has rights permitting performance of the prohibited action comprises determining whether the role associated with the user is mapped to an exception allowing performance of the prohibited action.

3. The method of claim 1 , wherein permitting an exemption allowing performance of the prohibited action in an instance in which it is determined that the user does have rights permitting performance of the prohibited action comprises automatically permitting an exception allowing performance of the prohibited action without requiring approval by an administrator.

4. The method of claim 1 , further comprising:

determining whether an identity of the user has been validated; and

permitting an exception allowing performance of the prohibited action only in an instance in which the identity of the user has been validated.

5. The method of claim 1 , further comprising:

determining whether a condition associated with a result of performance of the prohibited action is satisfied; and

permitting an exception allowing performance of the prohibited action only in an instance in which it is determined that the condition associated with a result of performance of the prohibited action is satisfied.

6. The method of claim 1 , wherein detecting attempted performance of a prohibited action involving protected data comprises detecting an attempt to save protected data to a prohibited memory.

7. The method of claim 6 , further comprising:

determining whether the prohibited memory is encrypted; and

permitting an exception allowing saving of the protected data to the prohibited memory only in an instance in which it is determined that the prohibited memory is encrypted.

8. The method of claim 1 , wherein the protected data comprises one or more of protected health information or protected customer information.

9. An apparatus for exception handling, the apparatus comprising at least one processor, wherein the at least one processor is configured to cause the apparatus to at least:

detect attempted performance of a prohibited action involving protected data by at least detecting an attempt to send an email including protected data to an external recipient of the email;

determine based at least in part on a role associated with a user associated with the prohibited action whether the user has rights permitting performance of the prohibited action;

permit an exception allowing performance of the prohibited action only in an instance in which it is determined that the user does have rights permitting performance of the prohibited action;

prohibit performance of the prohibited action in an instance in which it is determined that the user does not have rights permitting performance of the prohibited action;

determine whether the external recipient is authorized to receive the protected data based at least in part on a role associated with the external recipient, wherein the role associated with the external recipient indicates whether the external recipient is authorized to receive the protected data via the email; and

permit an exception allowing sending of the email including protected data to the external recipient only in an instance in which the role associated with the external recipient indicates that the external recipient is authorized to receive the protected data via the email.

10. The apparatus of claim 9 , wherein the at least one processor is configured to further cause the apparatus to determine whether the user has rights permitting performance of the prohibited action at least in part by determining whether the role associated with the user is mapped to an exception allowing performance of the prohibited action.

11. The apparatus of claim 9 , wherein the at least one processor is configured to further cause the apparatus to permit an exception allowing performance of the prohibited action in an instance in which it is determined that the user does have rights permitting performance of the prohibited action by automatically permitting an exception allowing performance of the prohibited action without requiring approval by an administrator.

12. The apparatus of claim 9 , wherein the at least one processor is configured to further cause the apparatus to:

determine whether an identity of the user has been validated; and

permit an exception allowing performance of the prohibited action only in an instance in which the identity of the user has been validated.

13. The apparatus of claim 9 , wherein the at least one processor is configured to further cause the apparatus to:

determine whether a condition associated with a result of performance of the prohibited action is satisfied; and

permit an exception allowing performance of the prohibited action only in an instance in which it is determined that the condition associated with a result of performance of the prohibited action is satisfied.

14. The apparatus of claim 9 , wherein the at least one processor is configured to further cause the apparatus to detect attempted performance of a prohibited action involving protected data cat least in part by detecting an attempt to send an email including protected data to an external recipient.

15. The apparatus of claim 14 , wherein the at least one processor is configured to further cause the apparatus to:

determine based at least in part on a role associated with the external recipient whether the external recipient is permitted to receive the email including protected data; and

permit am exception allowing sending of the email including protected data to the external recipient only in an instance in which it is determined that the external recipient is permitted to receive the email including protected data.

16. The apparatus of claim 9 , wherein the at least one processor is configured to further cause the apparatus to:

determine whether the particular memory is encrypted; and

permit an exception allowing saving of the protected data to the particular memory only in an instance in which it is determined that the particular memory is encrypted.

17. The apparatus of claim 9 , further comprising at least one memory storing instructions that when executed by the at least one processor cause the apparatus to:

detect attempted performance of a prohibited action involving protected data;

determine based at least in part on a role associated with a user associated with the prohibited action whether the user has rights permitting performance of the prohibited action;

permit an exception allowing performance of the prohibited action only in an instance in which it is determined that the user does have rights permitting performance of the prohibited action; and

prohibit performance of the prohibited action in an instance in which it is determined that the user does not have rights permitting performance of the prohibited action.

18. A computer program product for exception handling, the computer program product comprising at least one non-transitory computer-readable storage medium having computer-readable program instructions stored therein, the computer-readable program instructions comprising:

program instructions configured to detect attempted performance of a prohibited action involving protected data, by at least detecting an attempt to send an email including protected data to an external recipient of the email;

program instructions configured to determine based at least in part on a role associated with a user associated with the prohibited action whether the user has rights permitting performance of the prohibited action;

program instructions configured to permit an exception allowing performance of the prohibited action only in an instance in which it is determined that the user does have rights permitting performance of the prohibited action;

program instructions configured to prohibit performance of the prohibited action in an instance in which it is determined that the user does not have rights permitting performance of the prohibited action;

program instructions configured to determine whether the external recipient is authorized to receive the protected data based at least in part on a role associated with the external recipient, wherein the role associated with the external recipient indicates whether the external recipient is authorized to receive the protected data via the email; and

program instructions configured to permit an exception allowing sending of the email including protected data to the external recipient only in an instance in which the role associated with the external recipient indicates that the external recipient is authorized to receive the protected data via the email.

Assignments (11)