Method and system for maintaining HIPAA patient privacy requirements during auditing of electronic patient medical records

A computerized method for permitting an institution running clinical trials on new drugs, which trials must be audited periodically by an outside Audit Agency, to prepare a Compliance Report independent of the outside Audit Agency, and to maintain Patient Privacy requirements mandated by HIPAA, relative to the Compliance Report to be provided to the outside Audit Agency, the method comprising:

• outside Audit Agency steps including:
• using an outside Audit Agency computer programmed to transform a self-indexing Search Engine for independent use by said institution in preparing a Compliance Report for use by said outside Audit Agency to audit a clinical trial run by said Institution, the transformation steps including:
• constructing application programs containing Protocol requirements for a clinical trial to be audited, and necessary steps for permitting
• said Institution to run the transformed Search Engine on an Institution computer to prepare said Compliance Report;
• adding to the Search Engine said application programs;
• and
• storing the transformed Search Engine in an outside Audit Agency computer memory;
• using said outside Audit Agency computer to read said transformed Search Engine from said computer memory, and send the transformed Search Engine to said Institution;
• said Institution steps including:
• programming an Institution computer to assemble individual electronic patient records from the clinical trial into a discrete database;
• programming said Institution computer to remove all personal information from each patient record;
• programming said Institution computer to assign a unique number or code to each patient record that permits only the Institution access to the patients' private information;
• programming said Institution computer to mark the patient records via a markup language to permit data in the patient records to be accessed by said transformed Search Engine;
• operating said Institution computer to receive and store in a memory the transformed Search Engine from said outside Audit Agency;
• using said Institution computer to read said transformed Search Engine from said memory, and run the transformed Search Engine independent of said outside Audit Agency to produce a Compliance Report detailing discrepancies relative to the Protocol dictated course of treatment for each said patient;
• storing the Compliance Report in said memory;
• using said Institution computer to retrieve said Compliance Report from said memory, and send sending the Compliance Report produced by said transformed Search Engine to said outside Audit Agency;
• outside Audit Agency steps further including:
• receiving on said outside Audit Agency Computer the Compliance Report from said Institution;
• processing the Compliance Report on said outside Audit Agency computer to produce an Audit Report requesting comments, and if necessary, a corrective action plan, from the Institution;
• storing the Compliance Report, and the Audit Report in said outside Audit Agency memory;
• and
• using said outside Audit Agency computer to retrieve said Audit Report from memory, and send the Audit Report to the Institution.