Privacy preserving logging
A server system implemented by a service provider may store health data of a user according to a multi-node data structure. The server system may generate transaction records based on requests to access the health data. Responsive to requests for the transaction records, the server system may query a database that includes the health data and generate a data package based on the querying. The data package may be sent to a requesting system. The data package may be usable by the requesting system to identify which patient profiles were accessed by which physicians.
1 . A computer-implemented method, comprising:
receiving, by a server system and from a plurality of electronic health record systems, health data associated with a plurality of health records of a plurality of users, wherein each electronic health record system is associated with a health institution that maintains health records of the plurality of health records on behalf of the plurality of users;
storing, by the server system, the health data for the plurality of users in accordance with a multi-node data structure, each node of the multi-node data structure being encrypted with a unique encryption key and being identified by a unique data identifier;
providing to a clinician dashboard associated with a particular health institution, a particular unique data identifier and a root key that is configured to decrypt a root node of the multi-node data structure identified by the particular unique data identifier;
receiving, by the server system and from the clinician dashboard, a first request to access a portion of the health data, the first request comprising (i) the particular unique data identifier associated with the root node of the multi-node data structure, (ii) a user identifier associated with a health care professional of the particular health institution, and (iii) the root key;
generating, by the server system, a transaction record based at least in part on logged information associated with the first request, the transaction record identifying (i) the particular unique data identifier, (ii) the user identifier associated with the health care professional of the particular health institution, and (iii) metadata associated with the first request;
responsive to receiving a second request to access transaction data corresponding to the first request to access the portion of the health data, querying, by the server system, a database accessible by the server system in accordance with a search parameter included in the second request;
generating, by the server system, a data package based at least in part on search results generated by querying the database, the data package comprising the transaction record; and
sending, by the server system, the data package to an external system associated with the second request, the transaction record being configured to enable the external system to identify a patient profile associated with the particular unique data identifier and the user identifier associated with the health care professional, wherein the root node is assigned to a unique health institution responsible for maintaining health records for a patient to which the patient profile belongs.
2 . The computer-implemented method of claim 1 , further comprising storing, by the server system, the transaction record in the database accessible by the server system, the database comprising other transaction records associated with other requests to access the health data, the transaction record comprising an encrypted version of the particular unique data identifier and an encrypted version of the user identifier that prevents the server system from identifying the patient profile associated with the particular unique data identifier or a health care professional profile associated with the health care professional.
3 . The computer-implemented method of claim 2 , wherein the transaction record being configured to enable the external system to identify the patient profile and the user identifier comprises the transaction record being configured for comparison with a different dataset that includes a mapping of patient profiles and unique data identifiers.
4 . The computer-implemented method of claim 1 , wherein the external system comprises a computer system of a particular electronic health record system associated with the particular health institution.
5 . The computer-implemented method of claim 1 , wherein the root node is associated with the patient profile and is linked to other nodes that store other health data for the patient to which the patient profile belongs.
6 . One or more non-transitory computer-readable media comprising computer-executable instructions that, when executed by one or more processors of a server system, cause the server system to perform operations comprising:
receiving, by the system and from a plurality of electronic health record systems, health data associated with a plurality of health records of a plurality of users, wherein each electronic health record system is associated with a health institution that maintains health records of the plurality of health records on behalf of the plurality of users;
storing, by the server system, the health data for the plurality of users in accordance with a multi-node data structure, each node of the multi-node data structure being encrypted with a unique encryption key and being identified by a unique data identifier;
providing to a clinician dashboard associated with a particular health institution, a particular unique data identifier and a root key that is configured to decrypt a root node of the multi-node data structure identified by the particular unique data identifier;
receiving, by the server system and from the clinician dashboard, a first request to access a portion of the health data, the first request comprising (i) the particular unique data identifier associated with the root node of the multi-node data structure, (ii) a user identifier associated with a health care professional of the particular health institution, and (iii) the root key;
generating, by the server system, a transaction record based at least in part on logged information associated with the first request, the transaction record identifying (i) the particular unique data identifier, (ii) the user identifier associated with the health care professional of the particular health institution, and (iii) metadata associated with the first request;
responsive to receiving a second request to access transaction data corresponding to the first request to access the portion of the health data, querying, by the server system, a database accessible by the server system in accordance with a search parameter included in the second request;
generating, by the server system, a data package based at least in part on search results generated by querying the database, the data package comprising the transaction record; and
sending, by the server system, the data package to an external system associated with the second request, the transaction record being configured to enable the external system to identify a patient profile associated with the particular unique data identifier and the user identifier associated with the health care professional, wherein the root node is assigned to a unique health institution responsible for maintaining health records for a patient to which the patient profile belongs.
7 . The one or more non-transitory computer-readable media of claim 6 , wherein the transaction record is stored in plain text.
8 . The one or more non-transitory computer-readable media of claim 6 , wherein the transaction record is encrypted.
9 . The one or more non-transitory computer-readable media of claim 6 , wherein each unique data identifier comprises a hash of data stored at the respective node of the multi-node data structure.
10 . The one or more non-transitory computer-readable media of claim 6 , wherein the transaction record further comprises a health institution identifier, a timestamp, and an IP address.
11 . The one or more non-transitory computer-readable media of claim 6 , wherein receiving the first request comprises receiving token information, and wherein generating the transaction record based at least in part on the logged information associated with the first request comprises extracting at least the user identifier from the token information.
12 . The one or more non-transitory computer-readable media of claim 11 , wherein the token information is generated by a particular electronic health record system.
13 . The one or more non-transitory computer-readable media of claim 12 , wherein the search parameter identifies a health institution identifier.
14 . A computerized system, comprising:
a memory configured to computer-executable instructions; and
a processor configured to access the memory and execute the computer-executable instructions to at least:
receive, from a plurality of electronic health record systems, health data associated with a plurality of health records of a plurality of users, wherein each electronic health record system is associated with a health institution that maintains health records of the plurality of health records on behalf of the plurality of users;
store the health data for the plurality of users in accordance with a multi-node data structure, each node of the multi-node data structure being encrypted with a unique encryption key and being identified by a unique data identifier;
provide to a clinician dashboard associated with a particular health institution, a particular unique data identifier and a root key that is configured to decrypt a root node of the multi-node data structure identified by the particular unique data identifier;
receive, from the clinician dashboard, a first request to access a portion of the health data, the first request comprising (i) the particular unique data identifier associated with the root node of the multi-node data structure, (ii) a user identifier associated with a health care professional of the particular health institution, and (iii) the root key;
generate a transaction record based at least in part on logged information associated with the first request, the transaction record identifying (i) the particular unique data identifier, (ii) the user identifier associated with the health care professional of the particular health institution, and (iii) metadata associated with the first request;
responsive to receiving a second request to access transaction data corresponding to the first request to access the portion of the health data, query a database accessible by the computerized system in accordance with a search parameter included in the second request;
generate a data package based at least in part on search results generated by querying the database, the data package comprising the transaction record; and
send the data package to an external system associated with the second request, the transaction record being configured to enable the external system to identify a patient profile associated the particular unique data identifier and the user identifier associated with the health care professional, wherein the root node is assigned to a unique health institution responsible for maintaining health records for a patient to which the patient profile belongs.
15 . The system of claim 14 , wherein the transaction record being configured to enable the external system to identify the patient profile and the user identifier comprises the transaction record being configured for comparison with a different dataset that includes a mapping of patient profiles and unique data identifiers.
16 . The system of claim 14 , wherein the external system comprises a computer system of a particular electronic health record system associated with the particular health institution.
17 . The system of claim 14 , wherein the root node is associated the patient profile and is linked to other nodes that store other health data for the patient to which the patient profile belongs.
18 . The computer-implemented method of claim 1 , wherein the first request further comprises authentication information useable by the server system to authenticate the first request.
19 . The computer-implemented method of claim 1 , wherein storing the health data for the plurality of users in accordance with the multi-node data structure comprises receiving, from individual user devices associated with individual users of the plurality of users, individual multi-node data structures specific to the individual users and that have been generated by the individual user devices.