Methods and systems for automated assignment of protection to physical documents that are digitized
View Patent ↗Content analysis is performed on documents that have been scanned or converted into a digital format. Based on the content analysis of a document, a security policy is selected and assigned or attached to the document. The security policy prevents the document from being improperly accessed. In a specific implementation, the documents include patient medical records.
1. A method comprising:
storing at a central server a plurality of scanned documents, and a plurality of security policies, each security policy having a corresponding policy definition;
analyzing a scanned document to identify a visual feature in the scanned document, wherein the analyzing comprises parsing optical character recognition (OCR) data extracted from the scanned document to identify a form field and an handwritten entry of a name of a person for the form field in the scanned document, wherein the visual feature comprises the form field and the handwritten entry for the form field;
selecting, based on the identified visual feature, a security policy of the plurality of security policies;
assigning the selected security policy to the scanned document;
detecting an attempt to access the scanned document having the assigned security policy;
determining whether a user attempting to access the scanned document has a name that matches the name of the person;
evaluating at the central server the policy definition corresponding to the assigned security policy to determine whether the access is granted or denied; and
determining that access should be granted when the user has a name that matches the name of the person and that access should be denied when the user has a name that does not match the name of the person.
2. The method of claim 1 wherein the scanned document comprises a medical image and the visual feature comprises an abnormality.
3. The method of claim 1 wherein the method comprises:
parsing the OCR data to identify an address field and an entry for the address field in the scanned document, wherein the entry for the address field is used to identify a person listed in a directory;
determining whether the user attempting to access the scanned document has an address that matches the entry for the address field; and
determining that access should be granted when the user has an address that matches the entry for the address field and that access should be denied when the user has an address that does not match the entry for the address field.
4. The method of claim 1 wherein the handwritten entry for the form field comprises a name of a person and the method comprises:
determining whether the person belongs to a first group or a second group; and
assigning a first security policy to the scanned document when the person belongs to the first group, the first security policy being the assigned security policy, or a second security policy to the scanned document when the person belongs to the second group, the second security policy being the assigned security policy, wherein one of the first or second security policies is more restrictive than another of the first or second security policies.
5. The method of claim 1 wherein the plurality of scanned documents are medical records, the scanned document thereby being a medical record of a patient, and the method comprises:
determining whether an entry in the medical record comprises information indicating the patient suffers at least one of a sexually transmitted disease (STD), human immunodeficiency virus (HIV), mental illness, alcohol abuse, or drug abuse;
if the medical record comprises the information, assigning a first security policy to the medical record, the first security policy being the assigned security policy; and
if the medical record does not comprise the information, assigning a second security policy to the medical record, the second security policy being the assigned security policy,
wherein the first security policy blocks the medical record from being distributed through electronic mail, and the second security policy permits the medical record to be distributed through electronic mail.
6. The method of claim 1 comprising:
encrypting the scanned document; and
copying the encrypted scanned document to a client, wherein the client is remote from the central server, and the detecting an attempt to access the scanned document comprises receiving a request from the client to open the encrypted document at the client.
7. A computer program product, comprising a non-transitory computer-readable medium having a computer-readable program code embodied therein, the computer-readable program code including instructions to be executed by one or more processors to:
store at a central server a plurality of scanned documents, and a plurality of security policies, each security policy having a corresponding policy definition;
analyze a scanned document to identify a visual feature in the scanned document, wherein the analyzing comprises parsing optical character recognition (OCR) data extracted from the scanned document to identify a form field and an handwritten entry of a name of a person for the form field in the scanned document, wherein the visual feature comprises the form field and the handwritten entry for the form field;
select, based on the identified visual feature, a security policy of the plurality of security policies;
assign the selected security policy to the scanned document;
detect an attempt to access the scanned document having the assigned security policy;
determine whether a user attempting to access the scanned document has a name that matches the name of the person;
evaluate at the central server the policy definition corresponding to the assigned security policy to determine whether the access is granted or denied; and
determine that access should be granted when the user has a name that matches the name of the person and that access should be denied when the user has a name that does not match the name of the person.
8. The computer program product of claim 7 wherein the scanned document comprises a medical image and the visual feature comprises a foreign object.
9. The computer program product of claim 7 wherein further comprising instructions to:
parse the OCR data to identify an address field and an entry for the address field in the scanned document, wherein the name of the person and the entry for the address field are used to identify a person listed in a directory;
determine whether the user attempting to access the scanned document has an address that matches the entry for the address field; and
determine that access should be granted when the user has an address that matches the entry for the address field and that access should be denied when the user has an address that does not match the entry for the address field.
10. The computer program product of claim 7 wherein the handwritten entry for the form field comprises a name of a person, further comprising instructions to:
determine whether the person belongs to a first group or a second group; and
assign a first security policy to the scanned document when the person belongs to the first group, the first security policy being the assigned security policy, or a second security policy to the scanned document when the person belongs to the second group, the second security policy being the assigned security policy, wherein one of the first or second security policies is more restrictive than another of the first or second security policies.
11. The computer program product of claim 7 wherein the plurality of scanned documents are medical records, the scanned document thereby being a medical record of a patient, further comprising:
determining whether an entry in the medical record comprises information indicating the patient suffers at least one of a sexually transmitted disease (STD), human immunodeficiency virus (HIV), mental illness, alcohol abuse, or drug abuse;
if the medical record comprises the information, assigning a first security policy to the medical record, the first security policy being the assigned security policy; and
if the medical record does not comprise the information, assigning a second security policy to the medical record, the second security policy being the assigned security policy,
wherein the first security policy blocks the medical record from being distributed through electronic mail, and the second security policy permits the medical record to be distributed through electronic mail.
12. The computer program product of claim 7 , further comprising:
encrypting the scanned document; and
copying the encrypted scanned document to a client, wherein the client is remote from the central server, and the detecting an attempt to access the scanned document comprises receiving a request from the client to open the encrypted scanned document at the client.
13. A system for automatically assigning a security policy to a document, the system comprising:
a processor-based database management system, which when executed on a computer system, will cause the processor to:
store at a central server a plurality of scanned documents, and a plurality of security policies, each security policy having a corresponding policy definition;
analyze a scanned document to identify a visual feature in the scanned document, wherein the analyzing comprises parsing optical character recognition (OCR) data extracted from the scanned document to identify a form field and an handwritten entry of a name of a person for the form field in the scanned document, wherein the visual feature comprises the form field and the handwritten entry for the form field;
select, based on the identified visual feature, a security policy of the plurality of security policies;
assign the selected security policy to the scanned document;
detect an attempt to access the scanned document having the assigned security policy;
determine whether a user attempting to access the scanned document has a name that matches the name of the person;
evaluate at the central server the policy definition corresponding to the assigned security policy to determine whether the access is granted or denied; and
determine that access should be granted when the user has a name that matches the name of the person and that access should be denied when the user has a name that does not match the name of the person.
14. The system of claim 13 wherein the scanned document comprises a medical image and the visual feature comprises an abnormality.
15. The system of claim 13 wherein the handwritten entry for the form field comprises a name of a person and the processor-based database management system when executed on a computer system, will further cause the processor to:
determine whether the person belongs to a first group or a second group; and
assign a first security policy to the scanned document when the person belongs to the first group, the first security policy being the assigned security policy, or a second security policy to the scanned document when the person belongs to the second group, the second security policy being the assigned security policy, wherein one of the first or second security policies is more restrictive than another of the first or second security policies.