Dynamic access control to electronic patient records

A non-transitory computer readable medium embodying programmed instructions which, when executed by a processor, are operable for performing a method for securing data in a plurality of electronic patient records, the method comprising:

• receiving a request from an entity for access to one or more of the plurality of electronic patient records, the plurality of electronic patient records having been machine learned to identify patient information in the electronic patient records including personally identifiable information (PII) and protected health information (PHI);
• determining a level of access of the entity;
• retrieving, from a database, the one or more electronic patient records requested by the entity;
• applying a rule to the retrieved one or more electronic patient records based on the determined level of access of the entity to at least one of mask, encrypt, or show one or more elements in the one or more electronic patient records;
• and
• in response to applying the rule to the retrieved one or more electronic patient records, transferring the one or more electronic patient records to the entity.

A system, comprising:

• a database operable to store a plurality of electronic patient records that have been machine learned to identify patient information in the electronic patient records including personally identifiable information (PII) and protected health information (PHI), and to store rules to at least one of mask, encrypt, or show one or more elements in the plurality of electronic patient records based on a determined level of access;
• and
• an interface operable to receive a request from an entity for access to one or more of the plurality of electronic patient records,
• wherein the database is further operable to determine a level of access of the entity, to retrieve the one or more electronic patient records requested by the entity, to apply at least one of the rules to the retrieved one or more electronic patient records based on the determined level of access of the entity, and
• wherein, in response to applying the at least one rule to the retrieved one or more electronic patient records, the interface is further operable to transfer the one or more electronic patient records to the entity.