# US 10,372,941 B2 · Data selection > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,372,941 B2 - Document ID: US10372941B2 - Status: Granted - Kind: B2 - Application number: 15/275,330 - Filed: 2016-09-23 - Published: 2017-02-02 - Granted: 2019-08-06 - Earliest claimed: 2009-06-23 - Assignees: The University of Manchester; Salford Royal NHS Foundation Trust - Applicants: The University of Manchester; Salford Royal NHS Foundation Trust - Inventors: John Philip New; John Martin Gibson; Iain Edward Buchan; John David Ainsworth - Web page: https://patentgrep.com/patent/US10372941B2 ## CPC - G06F 21/6254: {by anonymising data, e.g. decorrelating personal data from the owner's identification} - G06F 16/2455: Query execution - G06F 16/2457: with adaptation to user needs - G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database} - G16H 10/20: for electronic clinical trials or questionnaires - G16H 10/60: for patient-specific data, e.g. for electronic patient records - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G16H: HEALTHCARE INFORMATICS, i.e. INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR THE HANDLING OR PROCESSING OF MEDICAL OR HEALTHCARE DATA ## Abstract A method of selecting data, the method comprising, receiving data indicating a first requirement and identifying first records stored in a first database. The first records relate to first data subjects and the identification is based upon the first requirement. The first data subjects cannot be identified from the records of the first database. Second records are identified, the second records being stored in a second database and relating to the first data subjects. The first data subjects can be identified from the identified records of the second database. Each of the second records corresponds to a respective one of the first records, and the identification of the second records is based upon the first requirement. ## Claims ### Claim 1 A method for allowing an at least one unauthorized user to access select data contained in an at least one secure database while maintaining the privacy of an at least one subject to which the data relates, the method comprising the steps of: hosting the at least one secure database on an at least one server, the at least one secure database containing a plurality of secure records within which the data is stored, each of said secure records containing data associated with at least one subject; hosting an at least one abstracted database on the at least one server, the at least one abstracted database containing a plurality of abstracted records, each of the abstracted records containing an at least one abstracted version of select data associated with a corresponding one of the secure records in the at least one secure database such that the associated at least one subject cannot be identified; and upon a one of the at least one unauthorized user selectively accessing the at least one abstracted database: performing a search of the abstracted database to determine whether any of the abstracted records contain data meeting an at least one specified criterion from said unauthorized user; and upon identifying at least one of the abstracted records that contains data meeting the at least one specified criterion: performing a search of the secure database, based on the at least one specified criterion, to access each of the at least one respective secure record corresponding to the at least one identified abstracted record; determining an at least one authorized user for each of the at least one identified abstracted records, each said authorized user being authorized to access the secure record corresponding to the at least one identified abstracted record; transmitting a notification to each of the at least one authorized user regarding the at least one subject associated with said identified abstracted records; receiving confirmation from the at least one authorized user regarding whether said at least one subject meets the at least one specified criterion; and for each of the at least one identified abstracted record for which confirmation has been received from the at least one authorized user: transmitting a notification to the at least one subject associated with said identified abstracted record; and upon receiving approval from the at least one subject associated with said identified abstracted record, providing said unauthorized user with necessary data contained in the associated secure record. ### Claim 2 (depends on 1) The method of claim 1, further comprising the step of hosting each of the at least one secure database and abstracted database on separate servers, the at least one secure database being stored on an at least one server to which the at least one unauthorized user does not have access. ### Claim 3 (depends on 1) The method of claim 1, wherein the step of transmitting a notification to each of the at least one authorized user regarding the at least one subject associated with said identified abstracted records further comprises the step of providing the at least one authorized user with the at least one specified criterion. ### Claim 4 (depends on 1) The method of claim 1, further comprising the step of, upon identifying at least one of the abstracted records that contains data meeting the at least one specified criterion, providing said unauthorized user with an initial count of a number of subjects based upon said identified abstracted records. ### Claim 5 (depends on 4) The method of claim 4, further comprising the steps of, upon said unauthorized user indicating that the initial count is unacceptable: receiving an at least one revised specified criterion from said unauthorized user; performing a search of the abstracted database to determine whether any of the abstracted records contain data meeting the at least one revised specified criterion; and upon identifying at least one of the abstracted records that contains data meeting the at least one revised specified criterion, providing said unauthorized user with a revised initial count of a number of subjects based upon said identified abstracted records. ### Claim 6 (depends on 4) The method of claim 4, further comprising the step of, upon identifying at least one of the abstracted records that contains data meeting the at least one specified criterion, providing said unauthorized user with a confirmed count of a number of subjects based on the confirmation received from the at least one authorized user. ### Claim 7 (depends on 6) The method of claim 6, further comprising the steps of, upon said unauthorized user indicating that the confirmed count is unacceptable: receiving an at least one revised specified criterion from said unauthorized user; performing a search of the abstracted database to determine whether any of the abstracted records contain data meeting the at least one revised specified criterion; and upon identifying at least one of the abstracted records that contains data meeting the at least one revised specified criterion, providing said unauthorized user with a revised confirmed count of a number of subjects based on the confirmation received from the at least one authorized user. ### Claim 8 (depends on 1) The method of claim 1, further comprising the step of populating the at least one abstracted database. ### Claim 9 (depends on 8) The method of claim 8, wherein the step of populating the at least one abstracted database further comprises the steps of: obtaining select data from at least one of the secure records in the at least one secure database; abstracting said select data; and inserting the abstracted data into corresponding abstracted records associated with the at least one secure record from which the select data was obtained. ### Claim 10 (depends on 9) The method of claim 9, wherein the step of abstracting select data from at least one of the secure records further comprises the steps of, for each of the at least one associated secure record: generating a unique randomly generated abstracted identifier; and mapping the abstracted identifier to a unique record identifier associated with said secure record. ### Claim 11 (depends on 10) The method of claim 10, further comprising the steps of, for each of the at least one associated secure record: upon determining that a given data value associated with said secure record indicates a geographic location associated with the at least one subject, converting said geographic location to a relatively less precise abstracted geographic area; and upon determining that a given data value associated with said secure record indicates a date containing at least a month, converting said month to a relatively less precise quartile. ### Claim 12 (depends on 1) The method of claim 1, wherein the step of performing a search of the abstracted database to determine whether any of the abstracted records contain data meeting the at least one specified criterion further comprises the step of searching the abstracted database using a first database query containing the at least one specified criterion. ### Claim 13 (depends on 12) The method of claim 12, wherein the step of accessing each of the at least one respective secure record corresponding to the at least one identified abstracted record further comprises the steps of: processing the first database query to generate a second database query; and searching the secure database using the second database query. ### Claim 14 (depends on 1) The method of claim 1, wherein the step of transmitting a notification to each of the at least one authorized user regarding the at least one subject associated with said identified abstracted records further comprises the step of providing the at least one authorized user with only the secure records with which said authorized user is associated. ### Claim 15 A method for allowing an at least one unauthorized user to access select data contained in an at least one secure database while maintaining the privacy of an at least one subject to which the data relates, the method comprising the steps of: hosting the at least one secure database on an at least one server to which the at least one unauthorized user does not have access, the at least one secure database containing a plurality of secure records within which the data is stored, each of said secure records containing data associated with at least one subject; hosting an at least one abstracted database on an at least one further server, the at least one abstracted database containing a plurality of abstracted records, each of the abstracted records containing an at least one abstracted version of select data associated with a corresponding one of the secure records in the at least one secure database such that the associated at least one subject cannot be identified; and upon a one of the at least one unauthorized user selectively accessing the at least one abstracted database: receiving an at least one specified criterion from said unauthorized user; performing a search of the abstracted database to determine whether any of the abstracted records contain data meeting the at least one specified criterion; and upon identifying at least one of the abstracted records that contains data meeting the at least one specified criterion: performing a search of the secure database, based on the at least one specified criterion, to access each of the at least one respective secure record corresponding to the at least one identified abstracted record; determining an at least one authorized user for each of the at least one identified abstracted records, each said authorized user being authorized to access the secure record corresponding to the at least one identified abstracted record; transmitting a notification to each of the at least one authorized user regarding the at least one subject associated with said identified abstracted records; receiving confirmation from the at least one authorized user regarding whether said at least one subject meets the at least one specified criterion; and for each of the at least one identified abstracted record for which confirmation has been received from the at least one authorized user: transmitting a notification to the at least one subject associated with said identified abstracted record; and upon receiving approval from the at least one subject associated with said identified abstracted record, providing said unauthorized user with necessary data contained in the associated secure record. ### Claim 16 A system configured for allowing an at least one unauthorized user to access select data contained in an at least one secure database while maintaining the privacy of an at least one subject to which the data relates, the system comprising: at least one processor coupled to a memory; an at least one secure database residing on an at least one server, the at least one secure database containing a plurality of secure records within which the data is stored, each of said secure records containing data associated with at least one subject; an at least one abstracted database residing on the at least one server, the at least one abstracted database containing a plurality of abstracted records, each of the abstracted records containing an at least one abstracted version of select data associated with a corresponding one of the secure records in the at least one secure database such that the associated at least one subject cannot be identified; and wherein, upon a one of the at least one unauthorized user selectively accessing the at least one abstracted database, the at least one processor executes the steps of: receiving an at least one specified criterion from said unauthorized user; performing a search of the abstracted database to determine whether any of the abstracted records contain data meeting the at least one specified criterion; and upon identifying at least one of the abstracted records that contains data meeting the at least one specified criterion: performing a search of the secure database, based on the at least one specified criterion, to access each of the at least one respective secure record corresponding to the at least one identified abstracted record; determining an at least one authorized user for each of the at least one identified abstracted records, each said authorized user being authorized to access the secure record corresponding to the at least one identified abstracted record; transmitting a notification to each of the at least one authorized user regarding the at least one subject associated with said identified abstracted records; receiving confirmation from the at least one authorized user regarding whether said at least one subject meets the at least one specified criterion; and for each of the at least one identified abstracted record for which confirmation has been received from the at least one authorized user: transmitting a notification to the at least one subject associated with said identified abstracted record; and upon receiving approval from the at least one subject associated with said identified abstracted record, providing said unauthorized user with necessary data contained in the associated secure record. ### Claim 17 (depends on 16) The system of claim 16, wherein the at least one unauthorized user is a researcher. ### Claim 18 (depends on 17) The system of claim 17, wherein the at least one authorized user is a clinician. ### Claim 19 (depends on 18) The system of claim 18, wherein the at least one subject is a patient of the associated clinician.