# US 12,223,093 B2 · Systems and methods for processing electronic images across regions > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,223,093 B2 - Document ID: US12223093B2 - Status: Granted - Kind: B2 - Application number: 18/585,295 - Filed: 2024-02-23 - Published: 2024-07-11 - Granted: 2025-02-11 - Earliest claimed: 2016-06-28 - Assignees: HeartFlow, Inc. - Applicants: HeartFlow, Inc. - Inventors: Razik Yousfi; Leo Grady; Nathalie D'Amours - Web page: https://patentgrep.com/patent/US12223093B2 ## CPC - G06F 21/6254: {by anonymising data, e.g. decorrelating personal data from the owner's identification} - G16H 10/60: for patient-specific data, e.g. for electronic patient records - G16H 50/50: for simulation or modelling of medical disorders - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G16H: HEALTHCARE INFORMATICS, i.e. INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR THE HANDLING OR PROCESSING OF MEDICAL OR HEALTHCARE DATA ## Abstract Systems and methods are disclosed for preserving patient privacy while transmitting health data from one geographic region to another geographic region for data analysis. One method includes receiving patient-specific health data including patient privacy information at a first region; removing the patient privacy information from the patient-specific health data to generate anonymous health data; storing the patient privacy information at the first region; and transmitting the anonymous health data to a second region for analysis. ## Claims ### Claim 1 A computer-implemented method of processing electronic images while transferring data across regions, the method comprising: removing, using a processor physically located in a first region, first patient-identifiable information from patient-specific data to generate a first set of de-identified data, based on a first geographic region specific privacy standard; storing, using the processor physically located in the first region, the first patient-identifiable information within the first region; transmitting, using the processor physically located in the first region, the first set of de-identified data to a remote data analysis server physically located in a second region for a patient-specific computation based on the first set of de-identified data; generating, using the remote data analysis server physically located within the second region, a model of a patient based on the first set of de-identified data and conducting the patient-specific computation through the generated model; determining, using the remote data analysis server physically located within the second region, a patient-specific blood flow computation in the patient based on the generated model and a mass or a volume of a myocardial tissue of the patient; receiving, by the processor physically located in the first region, analyzed de-identified data from the remote data analysis server physically located in the second region; and identifying a patient associated with the generated model by determining, using the processor physically located in the first region, first patient-identifiable information associated with the analyzed de-identified data based on the first patient-identifiable information stored within the first region and the patient-specific blood flow computation stored in a permanent storage at the second geographic region, wherein the first patient privacy information is inaccessible within the second geographic region. ### Claim 2 (depends on 1) The computer-implemented method of claim 1, wherein the second region is distinct from and outside the first region, and wherein the first region and the second region are governed by different data anonymization regulations. ### Claim 3 (depends on 1) The computer-implemented method of claim 1, further comprising: generating, using the processor physically located in the first region, an identifier associated with the first set of de-identified data, wherein the first patient-identifiable information is absent from the identifier. ### Claim 4 (depends on 1) The computer-implemented method of claim 1, wherein the analyzed de-identified data includes results of a patient-specific blood flow computation calculated at an earlier date and stored in the permanent storage. ### Claim 5 (depends on 1) The computer-implemented method of claim 1, further comprising: generating, using the processor physically located in the first region, an irreversible hash of the first patient-identifiable information. ### Claim 6 (depends on 1) The computer-implemented method of claim 1, further comprising: prompting refining of modeling techniques available at the second region, based on the analyzed de-identified data. ### Claim 7 (depends on 1) The computer-implemented method of claim 1, further comprising: determining, using the processor physically located in the first region, an identifier associated with the analyzed de-identified data from the second region; determining, using the processor physically located in the first region, an association between the identifier and the first patient-identifiable information stored within the first region; and determining, using the processor physically located in the first region, the first patient-identifiable information corresponding to the analyzed de-identified data based on the association between the identifier and the first patient-identifiable information stored within the first region. ### Claim 8 (depends on 1) The computer-implemented method of claim 1, further comprising: determining, using the processor physically located in the first region, a hash associated with the analyzed de-identified data or the first set of de-identified data; and determining, using the processor physically located in the second region, previously analyzed data associated with either the analyzed de-identified data or the first set of de-identified data, based on a comparison of the hash to one or more stored hashes. ### Claim 9 A system for processing electronic images while transferring data across regions, the system comprising: at least one data storage device physically located within a first region and storing instructions for providing cross-border data transfer while preserving first data anonymization; and at least one processor physically located within the first region and configured to execute the instructions to perform operations comprising: removing, using a processor physically located in a first region, first patient-identifiable information from patient-specific data to generate a first set of de-identified data, based on a first geographic region specific privacy standard; storing, using the processor physically located in the first region, the first patient-identifiable information within the first region; transmitting, using the processor physically located in the first region, the first set of de-identified data to a remote data analysis server physically located in a second region for a patient-specific computation based on the first set of de-identified data; generating, using the remote data analysis server physically located within the second region, a model of a patient based on the first set of de-identified data and conducting the patient-specific computation through the generated model; determining, using the remote data analysis server physically located within the second region, a patient-specific blood flow computation in the patient based on the generated model and a mass or a volume of a myocardial tissue of the patient; receiving, by the processor physically located in the first region, analyzed de-identified data from the remote data analysis server physically located in the second region; and identifying a patient associated with the generated model by determining, using the processor physically located in the first region, first patient-identifiable information associated with the analyzed de-identified data based on the first patient-identifiable information stored within the first region and the patient-specific blood flow computation stored in a permanent storage at the second geographic region, wherein the first patient privacy information is inaccessible within the second geographic region. ### Claim 10 (depends on 9) The system of claim 9, wherein the second region is distinct from and outside the first region, and wherein the first region and the second region are governed by different data anonymization regulations. ### Claim 11 (depends on 9) The system of claim 9, wherein the operations at the remote data analysis server physically located within the first region further comprise: generating an identifier associated with the first set of de-identified data, wherein the first patient-identifiable information is absent from the identifier. ### Claim 12 (depends on 9) The system of claim 9, further comprising: transmitting the first set of de-identified data to the second region with the generated identifier. ### Claim 13 (depends on 9) The system of claim 9, wherein the operations at the remote data analysis server physically located within the first region further comprise: generating an irreversible hash of the first patient-identifiable information. ### Claim 14 (depends on 9) The system of claim 9, the operations further comprising: prompting refining of blood flow modeling techniques available at the second region, based on the analyzed de-identified data. ### Claim 15 (depends on 14) The system of claim 14, wherein the operations at the remote data analysis server physically located within the first region further comprise: determining an identifier associated with the de-identified analyzed data from the second region; determining an association between the identifier and the first patient-identifiable information stored within the first region; and determining the first patient-identifiable information corresponding to the de-identified analyzed data based on the association between the identifier and the first patient-identifiable information stored within the first region. ### Claim 16 (depends on 14) The system of claim 14, the operations further comprising: determining, at the remote data analysis server physically located within the first region, a hash associated with the de-identified analyzed data or the de-identified data; and determining, at the remote data analysis server physically located within the second region, previously analyzed data associated with either the de-identified analyzed data or the de-identified data, based on a comparison of the hash to one or more stored hashes. ### Claim 17 A non-transitory computer readable medium for use on a computer system containing computer-executable programming instructions that execute operations for processing electronic images while transferring data across regions, the operations comprising: removing, using a processor physically located in a first region, first patient-identifiable information from patient-specific data to generate a first set of de-identified data, based on a first geographic region specific privacy standard; storing, using the processor physically located in the first region, the first patient-identifiable information within the first region; transmitting, using the processor physically located in the first region, the first set of de-identified data to a remote data analysis server physically located in a second region for a patient-specific computation based on the first set of de-identified data; generating, using the remote data analysis server physically located within the second region, a model of a patient based on the first set of de-identified data and conducting the patient-specific computation through the generated model; determining, using the remote data analysis server physically located within the second region, a patient-specific blood flow computation in the patient based on the generated model and a mass or a volume of a myocardial tissue of the patient; receiving, by the processor physically located in the first region, analyzed de-identified data from the remote data analysis server physically located in the second region; and identifying a patient associated with the generated model by determining, using the processor physically located in the first region, first patient-identifiable information associated with the analyzed de-identified data based on the first patient-identifiable information stored within the first region and the patient-specific blood flow computation stored in a permanent storage at the second geographic region, wherein the first patient privacy information is inaccessible within the second geographic region. ### Claim 18 (depends on 17) The non-transitory computer readable medium of claim 17, wherein the second region is distinct from and outside the first region, and wherein the first region and the second region are governed by different data anonymization regulations. ### Claim 19 (depends on 17) The non-transitory computer readable medium of claim 17, the operations further comprising: generating, using a processor physically located in the first region, an identifier associated with the first set of de-identified data, wherein the first patient-identifiable information is absent from the identifier. ### Claim 20 (depends on 17) The non-transitory computer readable medium of claim 17, the operations further comprising: generating, using a processor physically located in the first region, an irreversible hash of the first patient-identifiable information.