Granted Patent B2

US 12,731,679 · App. 18/278,198 · Granted Sep 8, 2026

Inventors: Scott Gray (Fort Lauderdale, FL); William Wing (San Francisco, CA); Trevor Smith (Salt Lake City, UT); Brent Snyder (Souderton, PA); Donna Brumback (Raleigh, NC)

G16H40/20G06F21/6245G06Q10/02G06Q10/1093G16H10/20

Abstract

Claims (139)

1 . A privacy enabled system for managing clinical study participant travel comprising:

a private cloud comprising:

a database configured to organize, store, and retrieve encrypted data about a clinical study;

a server in secure data communication with the database solely within the private cloud; and,

a network security system securing access to the private cloud;

a remote workstation external to the private cloud; and,

a GUI configured to receive the encrypted data from the server for visualization on the remote workstation;

wherein the private cloud is configured to provide a secure computing environment for managing the encrypted data;

wherein the network security system is configured to authenticate users and permit only the authenticated users to access the private cloud using a secure encrypted protocol, wherein the secure encrypted protocol utilizes end-to-end encryption, and, wherein the authenticated users comprise a coordinator;

wherein the server and the remote workstation are configured to communicate through the network security system over a public internet using the secure protocol for all data transmissions, ensuring secure delivery of a traveler profile and de-identified patient personal data to the coordinator;

wherein the remote workstation is configured to:

utilize the GUI to visualize the data received from the server over the secure encrypted protocol and transmit input data from an input device to the server over the secure encrypted protocol;

prevent caching of the traveler profile and the de-identified patient personal data to non-volatile storage; and,

use only volatile computer memory to display the traveler profile and the de-identified patient personal data;

wherein the encrypted data comprise:

a plurality of participant datasets comprising the de-identified patient personal data about clinical study participants assigned to a coordinator, wherein the plurality of participant datasets comprises a traveler dataset, and, wherein the traveler dataset comprises de-identified traveler personal data about a traveler who is a study participant assigned to the coordinator;

the traveler profile comprising one or more of a traveler origin location, a traveler full name, traveler documentation, and traveler preferences;

a participant ID, wherein the participant ID is an anonymous identifier associated with the traveler and the clinical study, wherein the participant ID is utilized as a traveler ID;

a unique identifier, wherein the unique identifier is a randomly generated anonymous code associated with the traveler ID to enable de-identification of the traveler personal data utilizing one or more pseudonyms selected from the unique identifier, a second unique identifier, and the traveler ID;

a clinical site dataset associated with a current visit for the traveler, wherein the clinical site dataset comprises a site appointment location for the current visit and a site contact;

a visit schedule comprising the current visit, wherein the current visit comprises a current visit number, an appointment procedure, and an appointment schedule;

a study travel policy comprising travel policy rules;

a trip dataset; and,

a coordinator id associated with the coordinator and the plurality of participant datasets;

wherein the database is further configured to:

enable anonymous storage and retrieval of personal data through the network security system that restricts access based on user roles, wherein the personal data comprises patient personal data and the traveler personal data;

employ an encryption key management service (KMS) to secure encryption keys separately from the encrypted data to prevent exposure of the personal data;

protect the traveler personal data by associating data records with the unique identifier;

utilize a lookup table to associate the unique identifier with the data records of the traveler personal data;

generate the unique identifier and associate it with the traveler ID;

store the unique identifier in a lookup table associated with the traveler ID to facilitate de-identified access to the traveler personal data;

restrict access to the traveler ID so that it can be retrieved only by utilizing the unique identifier;

use the unique identifier and the traveler ID for retrieval of the traveler personal data from the traveler profile in the encrypted data to avoid referencing actual record values of the traveler personal data and maintain privacy through de-identification;

restrict access to the traveler profile such that it can only be retrieved by utilizing the traveler ID accessed using the unique identifier, with access permissions restricted to the coordinator authenticated by the network security system;

associate the traveler dataset with the unique identifier, with encryption applied and by the coordinator authenticated by the network security system; and,

associate the current visit with the traveler ID, wherein the current visit is retrievable using the traveler ID accessed using the unique identifier, with access permissions restricted to the coordinator authenticated by the network security system;

wherein the network security system is further configured to:

receive login credentials from a user using the input device at the remote workstation;

authenticate the user as the coordinator by validating the login credentials against user data in the encrypted data; and,

restrict the coordinator to only access the participant datasets associated with the coordinator;

wherein the Encryption Key Management Service (KMS) is configured to:

implement encryption keys; and,

store the encryption keys on separately from the encrypted data they are used to encrypt;

wherein the database is configured to decrypt the traveler personal data using the encryption keys only when the traveler personal data is accessed utilizing the unique identifier;

wherein the server is configured to:

securely process the encrypted data by accessing the personal data from the database solely within the private cloud using encryption and with access permissions restricted to the coordinator;

perform a compliance check to validate trip segments data against study travel policies using a computing algorithm with the travel policy rules; and,

transmit the encrypted data among the database, the GUI on the remote workstation, and a travel booking module to facilitate secure management of clinical study participant travel and generation of the trip dataset and booking request data;

wherein responsive to the network security system authenticating the user as the coordinator, the server is configured to:

retrieve from the database the coordinator ID using the login credentials validated through network security system;

transmit to the GUI at the remote workstation only the plurality of participant datasets assigned to the coordinator;

restrict the GUI at the remote workstation to only access the plurality of participant datasets assigned to the coordinator based on the coordinator id; and,

receive trip segment data from the GUI for storage in the database;

wherein the GUI comprises a travel planning interface configured to enable the coordinator to plan and coordinate a trip for the traveler according to the traveler profile, the visit schedule, the clinical site dataset, and the study travel policy, displaying de-identified traveler personal data accessible through the unique identifier to prevent exposure of the travel personal data;

wherein the GUI is configured to enable the coordinator to utilize the input device a to request to view the plurality of participant datasets assigned to the coordinator, restricting access to de-identified patient personal data to prevent exposure of the patient personal data;

wherein responsive to the coordinator requesting to view the plurality of participant datasets, the GUI is configured to:

transmit, to the database, a coordinator request comprising the coordinator ID over the secure protocol with end-to-end encryption;

receive from the database the plurality of participant datasets the traveler dataset, and the unique identifier, ensuring all data remains de-identified; and,

display the plurality of participant datasets in association with a participant selection control linked to the unique identifier enabling the coordinator to select the traveler by utilizing the participant selection controls;

wherein responsive to the coordinator utilizing the participant selection control to select the traveler, the GUI is configured to:

transmit to the database over the secure internet protocol a traveler selection request comprising the unique identifier;

receive from the database and display on the remote workstation the current visit number from the database maintaining de-identification of all displayed information; and,

enable the coordinator to confirm the current visit; by utilizing a confirmation control visually associated with the current visit number received from the database;

wherein responsive to the coordinator confirming the current visit, the GUI is configured to:

transition to the travel planning interface, wherein the travel planning interface is configured to display information from the trip dataset filtered based on the traveler profile, visit schedule, clinical site dataset, and study travel policy;

transmit to the database the unique identifier and the current visit number over the secure internet protocol; and,

receive from the database the traveler profile, the appointment schedule, and the site appointment location, displaying de-identified traveler personal data to maintain privacy;

wherein responsive to receiving the coordinator request, the database is configured to:

retrieve the plurality of participant datasets associated with the coordinator ID after verifying the coordinator access level through the network security system;

retrieve the unique identifier associated with the traveler dataset in the participant datasets; and,

transmit to the GUI the plurality of participant datasets and the unique identifier maintaining encryption during transmission;

wherein responsive to receiving from the GUI the traveler selection request and unique identifier, the database is configured to:

retrieve the current visit number from the current visit using the traveler ID accessed through the unique identifier: with decryption enabled by the encryption keys managed by the KMS; and,

transmit the current visit number to the GUI, maintaining encryption during transmission;

wherein responsive to receiving the unique identifier and the current visit number, the database is configured to:

retrieve the traveler profile using the traveler ID accessed via the unique identifier, with decryption enabled by the encryption keys managed by the KMS;

retrieve the site contact and the site appointment location associated with the current visit by accessing the clinical site dataset using the current visit, with the site contact and the site appointment location de-identified; and,

retrieve the appointment schedule from the current visit, ensuring it remains encrypted until decrypted by an authorized key;

wherein responsive to receiving a booking request and the unique identifier, the database is configured to:

retrieve the trip dataset and the traveler profile using the traveler ID accessed using the unique identifier, with decryption enabled by the encryption keys managed by the KMS; and,

transmit the trip dataset and the traveler profile to the travel planning interface, maintaining encryption and accessible only to the authenticated coordinator;

wherein responsive to receiving from the database the traveler profile, the appointment schedule and the site appointment location, the travel planning interface is configured to:

set a trip origin as the traveler origin location and a trip destination as the site appointment location, displaying only de-identified data linked to the unique identifier to prevent exposure of traveler personal data;

cause the database to generate the trip dataset, wherein the trip dataset comprises the traveler ID, the trip origin, the trip destination and the trip segments data, wherein the trip segments data comprise one or more trip segments, one or more segment start locations, one or more segment end locations, and one or more segment schedules, wherein the trip segments data is automatically checked for compliance with the study travel policy through the compliance check;

cause the database to store the trip dataset after the compliance check confirms compliance with study travel policy in association with the current visit, wherein the trip dataset is encrypted and accessible by the coordinator only through the unique identifier by its association with the traveler ID;

display the one or more trip segments in a segment sequence visualizing a trip for the traveler, wherein the segment sequence comprises visual representations of the one or more trip segments ordered according to the one or more segment schedules;

display segment user controls visually associated with a first trip segment from the one or more trip segments enabling the coordinator to:

utilize the segment user controls to delete the first trip segment that is visually associated with the segment user controls;

utilize the segment user controls to modify the first trip segment that is visually associated with the segment user controls by using the input device to input modified trip segments data; and,

utilize the segment user controls to add a new trip segment before or after the first trip segment that is visually associated with the segment user controls by using the input device to input new trip segment data;

wherein the travel planning interface is further configured to:

prevent the coordinator from utilizing the segment user controls to delete or modify a second trip segment that is not associated with the segment user controls;

cause the server to perform the compliance check of one or more of the modified trip segment data and the new trip segment data to reject non-compliant modified trip segment data and non-compliant new trip segment data and return the coordinator to utilizing the segment user controls to correct the non-compliant modified trip segment data or the non-compliant new trip segment data and prevent the coordinator from submitting inputting non-compliant modified trip segment data and non-compliant new trip segment data; and,

enable the coordinator to request booking of the trip for the traveler;

wherein the one or more trip segments are selected from the group consisting of an appointment segment, a flight segment, an ambulance segment, a bus segment, a car rental segment, a car service segment, a train segment, a ferry segment, a lodging segment, and combinations thereof;

wherein responsive to the coordinator requesting booking of the trip, the travel planning interface is configured to:

transmit to the database a booking request comprising the unique identifier;

receive from the database the traveler profile and the trip dataset;

generate booking request data comprising the traveler full name and de-identified data from the trip dataset received from the database; and,

transmit the booking request data to a travel booking module over the secure protocol with end-to-end encryption;

wherein the travel planning interface is configured to automatically receive booked travel data from the travel booking module, wherein the booked travel data comprise the traveler ID; and,

wherein responsive to receiving the booked travel data, the travel planning interface is configured to:

cause the database to store the booked travel data in association with the current visit;

generate an itinerary based on information from the booked travel data, the trip dataset, the traveler profile, the current visit, the site data, and combinations thereof; and,

electronically transmit the itinerary to one or more of a traveler contact and the site contact.

2 . The system of claim 1 further comprising:

encryption tools comprising the KMS, wherein the encryption tools are configured to encrypt the data in the database, and decrypt the encrypted data when the coordinator requests the encrypted data from the database; and,

monitoring tools configured to monitor and log access to the database by one or more of the GUI, the travel planning interface, the coordinator, and the travel booking module;

wherein the server and the monitoring tools are configured to comply with the privacy regulations by generating automated audit trails for all data access events, wherein the privacy regulations comprise one or both of HIPAA and GDPR;

wherein the network security system is further configured to use an identity and access management system (IAM) to authenticate the user as the coordinator and to restrict access to the encrypted data based on the access permissions of the coordinator;

wherein the remote workstation, the network security system, and the database are configured to prevent caching of the personal data and purge personal data that is cached when it is not needed;

wherein the server is configured to receive patient enrollment information about the clinical study participants, wherein the patient enrollment information comprises the patient personal data;

wherein responsive to receiving the patient enrollment information the server is configured to:

cause the encryption tools to encrypt the patient enrollment information; and,

cause the database to store the patient enrollment information; and,

wherein the database is further configured to:

generate the de-identified patient data from the patient enrollment information;

generate the plurality of patient datasets from the de-identified patient data;

associate the plurality of patient datasets with a plurality of patient IDs, wherein the plurality of patient IDs are anonymous codes associated with the clinical study;

generate a plurality of patient unique identifiers associating them with the plurality of patient IDs;

store the plurality of patient unique identifiers separately from the plurality of patient IDs to protect the patient personal data;

store the patient personal data separately from the plurality of patient datasets; and,

restrict access to the patient personal data such that it can only be retrieved by utilizing the plurality of patient IDs accessed using the plurality of patient unique identifiers, with access permissions restricted to authorized users authenticated by the network security system.

3 . The system of claim 2 wherein the participant data set further comprises a participant consent record associated with the unique identifier;

wherein the participant consent record is selected from the group consisting of a consent provided indication and a consent not provided indication; and,

wherein responsive to receiving from the GUI the traveler selection request and unique identifier the database is further configured to:

use the unique identifier to access the participant consent record;

use the unique identifier to access traveler dataset, the traveler profile, the traveler personal information, and the current visit; and,

transmit the current visit to the GUI if the participant consent record is the consent provided indication.

4 . The system of claim 3 wherein the study travel policy comprises a main travel policy and a specialized travel policy;

wherein the specialized travel policy is selected from the group consisting of a country travel policy, a clinical site travel policy, a visit travel policy, a custom traveler policy, and combinations thereof; and,

wherein responsive to the coordinator adding one or more trip segments, the travel planning interface is configured to generate the trip segments data for the one or more trip segments based on information from the main travel policy, the specialized travel policy, the trip origin, the trip destination, a preceding trip segment trip segments data, a subsequent trip segment trip segments data, the traveler profile, and combinations thereof.

5 . The system of claim 2 , wherein the encrypted data further comprise a study id associated with a participant study id;

wherein the unique identifier is associated with the study id and with the participant study id;

wherein the traveler dataset and the traveler are associated with the participant study id; and,

wherein the unique identifier is associated with the traveler and with the traveler dataset through the participant study id.

6 . The system of claim 1 , wherein the encryption keys are hardware encryption keys;

wherein the Encryption Key Management Service (KMS) is configured to store the hardware encryption keys on a device separate from the encrypted data they are used to encrypt; and,

wherein the database is configured to decrypt the traveler personal data using the hardware encryption keys only when the traveler personal data is accessed utilizing the unique identifier.

Assignments (2)

Continuity (3)

References Cited (50)