# US 11,907,399 B2 · Highly secure networked system and methods for storage, processing, and transmission of sensitive personal information

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 11,907,399 B2
- Document ID: US11907399B2
- Status: Granted
- Kind: B2
- Application number: 18/134,101
- Filed: 2023-04-13
- Published: 2023-08-10
- Granted: 2024-02-20
- Earliest claimed: 2014-10-07
- Assignees: Optum, Inc.
- Applicants: Optum, Inc.
- Inventors: Robin Edison
- Web page: https://patentgrep.com/patent/US11907399B2

## CPC

- G06F 21/6245: {Protecting personal data, e.g. for financial or medical purposes}
- G06F 21/6263: {during internet communication, e.g. revealing personal data from cookies}
- H04L 9/0643: {Hash functions, e.g. MD5, SHA, HMAC or f9 MAC}
- H04L 9/3239: {involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD}
- H04L 9/50: {using hash chains, e.g. blockchains or hash trees}
- H04L 63/0272: {Virtual private networks}
- H04L 63/083: {using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226)}
- G16H 10/60: for patient-specific data, e.g. for electronic patient records
- H04L 2209/88: Medical equipments
- H04L 2463/082: applying multi-factor authentication
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G16H: HEALTHCARE INFORMATICS, i.e. INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR THE HANDLING OR PROCESSING OF MEDICAL OR HEALTHCARE DATA

## Abstract

A highly secure networked system and methods for storage, processing, and transmission of sensitive information are described. Sensitive, e.g. personal/private, information is cleansed, salted, and hashed by data contributor computing environments. Cleansing, salting, and hashing by multiple data contributor computing environments occurs using the same processes to ensure output hashed values are consistent across multiple sources. The hashed sensitive information is hashed a second time by a secure facility computing environment. The second hashing of the data involves a private salt inaccessible to third parties. The second hashed data is linked to previously hashed data (when possible) and assigned a unique ID. Data dictionaries are created for particular individuals provided access to the highly secure information, e.g. researchers. Prior to a data dictionary being accessible by a researcher computing device, the data dictionary undergoes compliance and statistical analyses regarding potential re-identification of the source unhashed data. The data dictionaries are viewable by researchers as certified views via a secure VPN.

## Claims

### Claim 1

A highly secure system for transforming and securing data, comprising:
one or more hardware processors configured to:
receive first hashed values from a data contributor computing environment, the first hashed values formed from sanitized clear text data and a hashing algorithm;
transform, using a private salt and the hashing algorithm, the first hashed values into second hashed values;
store the second hashed values within an identity vault, the identity vault including previously stored hashed values associated with unique IDs;
link the second hashed values to previously stored hashed values;
determine if the second hashed values include an additional data compared to the previously stored hashed values;
rekey a previously generated unique ID and associate in a first storage each of the second hashed values with a rekeyed unique ID to include the additional data not present in the previously stored hashed values;
associate in a second storage each stored clear text data with the rekeyed unique ID;
analyze a data dictionary for compliance with an admin schema storage of a data storage zone;
communicate, when the data dictionary is compliant with the admin schema storage of the data storage zone, the data dictionary to a data access zone with a certified view storage;
generate one or more independent certified views approved for viewing by a researcher, and store in the certified view storage; and
securely control access to the one or more independent certified views by a researcher computer with one or more corresponding virtual desktop interfaces in a single session.

### Claim 2 (depends on 1)

The system of claim 1, wherein the clear text data includes one of personal information, healthcare claims data, and clinical data.

### Claim 3 (depends on 2)

The system of claim 2, wherein the clear text data includes personal information, healthcare claims data, and clinical data, and the healthcare claims data is separate from the clinical data.

### Claim 4 (depends on 1)

The system of claim 1, wherein the second hashed values are processed to change encounter identifiers, provider identifiers, and facility identifiers into sequential alternate IDs.

### Claim 5 (depends on 1)

The system of claim 1, wherein:
the hashing algorithm comprises a first hashing algorithm and a second hashing algorithm and the first hashing algorithm and the second hashing algorithm are different hashing algorithms.

### Claim 6

A method for transforming, securing, and transmitting data in a computer network that includes contributor computing devices, the method comprising the steps of:
receiving sanitized, first hashed data values and corresponding clear text data from the contributor computing devices;
transforming the sanitized, first hashed data values into second hashed data values;
linking the second hashed data values to data values previously stored in an identity vault using unique IDs;
determining if the second hashed values include an additional data compared to the data values previously stored in the identity vault;
rekeying a previously generated unique ID and associating in a first storage each of the second hashed values with a rekeyed unique ID to include the additional data not present in the data values previously stored in the identity vault;
generating a data dictionary, the data dictionary including clear text data from multiple data storages, at least some of the clear text data being associated by the rekeyed unique ID;
analyzing the data dictionary for compliance with an admin schema storage of a data storage zone;
communicating, when the data dictionary is determined compliant with compliance rules, the data dictionary to a data access zone with a certified view storage;
storing the data dictionary as one or more independent certified views approved for viewing by a researcher when the data dictionary is determined compliant with the compliance rules; and
providing restricted access to the one or more independent certified views, data dictionary, clear text data, and associated rekeyed unique ID to at least one researcher computing device via a separate and secure virtual desktop interface and preventing data communication from one virtual desktop interface to another virtual desktop interface.

### Claim 7 (depends on 6)

The method of claim 6, wherein the admin schema storage identifies fields of data that present re-identification risk.

### Claim 8 (depends on 6)

The method of claim 6, wherein data storage applies a threshold risk value of re-identification to the data dictionary.

### Claim 9 (depends on 6)

The method of claim 6, further comprising augmenting a previous certified view with additional data.

### Claim 10 (depends on 9)

The method of claim 9, further comprising the step of:
identifying additional data within multiple data storages and compiling the additional data into original data.

### Claim 11 (depends on 6)

The method of claim 6, wherein:
the sanitized, first hashed data values are generated using a common salt;
the second hashed data values are generated using a private salt; and
the second hashed data values are matched and linked to previously stored second hashed values using unique IDs and compared to determine if the second hashed data values include an additional data compared to the previously stored second hashed values in the identity vault.

### Claim 12

A processor, comprising:
a memory device including instructions operable to be executed by the processor to receive sanitized, first hashed data values and corresponding clear text data;
transform the sanitized, first hashed data values into second hashed data values;
link, using unique IDs, the second hashed data values to previously stored hashed data values;
determine if the second hashed values include an additional data compared to the previously stored hashed data values;
rekey a previously generated unique ID and associate in a first storage each of the second hashed values with a rekeyed unique ID to include the additional data not present in the previously stored hashed data values;
generate a data dictionary including clear text data from multiple data storages, at least some of the clear text data being associated by the rekeyed unique ID;
analyze the data dictionary for compliance with an admin schema storage of a data storage zone;
communicating a compliant data dictionary to a data access zone with a certified view storage;
store the compliant data dictionary as one or more independent certified views approved for viewing by a researcher, each of the one or more independent certified views based on the analysis of the data dictionary and stored in the certified view storage; and
provide restricted access to the one or more independent certified views, compliant data dictionary, and clear text data via separate and secure virtual desktop interfaces using a virtual private network.

### Claim 13 (depends on 12)

The processor of claim 12, further including instructions operable to be executed by the processor to configure the processor to determine an exact match between a recently stored hashed data value and a previously stored data value.

### Claim 14 (depends on 13)

The processor of claim 13, wherein if an exact match between the recently stored hashed data value and previously stored data is found, then comparing demographic values of the recently stored data to analogous values of matching previously stored data.

### Claim 15 (depends on 14)

The processor of claim 14, wherein the recently stored data includes both hashed and clear text values.

### Claim 16 (depends on 14)

The processor of claim 14, wherein the processor compares all data fields of the second hashed values and the previously stored hashed data values to determine if the previously generated unique ID needs to be rekeyed to include the additional data.

### Claim 17 (depends on 12)

The processor of claim 12, wherein the first hashed data values are hashed using a first hashing algorithm and the second hashed data values are hashed using a second hashing algorithm.

### Claim 18 (depends on 12)

The processor of claim 12, further comprising determining whether an exact match exists between the second hashed values and the previously stored hashed data values.

### Claim 19 (depends on 18)

The processor of claim 18, further comprising rekeying the previously generated unique ID to apply to both the second hashed values and the previously stored hashed data values.

### Claim 20 (depends on 12)

The processor of claim 12, further comprising an identity vault configured to store unique IDs.