CA2400160A1

CA2400160A1 - Method and system for distributing health information

Info

Publication number: CA2400160A1
Application number: CA002400160A
Authority: CA
Inventors: Roy Schoenberg
Original assignee: Individual
Current assignee: Trizetto Corp
Priority date: 2000-02-22
Filing date: 2001-02-22
Publication date: 2001-08-30
Anticipated expiration: 2021-02-22
Also published as: EP1269378A1; AU4723101A; EP1269378A4; WO2001063538A1; HK1049896A1; US6463417B1; CA2400160C; AU2001247231B2; JP2003524269A

Abstract

A method of and system for distributing medical information for an individua l over a communications network is disclosed. The method includes the steps of generating a plurality of security access codes (202), generating a pluralit y of hierarchical categories ranging from a low security category to a high security category (204), categorizing the individual's medical information into privacy levels ranging from a least private level to a most private lev el (206), inputting the individual's categorized medical information into the plurality of hierarchical categories (208), the least private level being input into the low security category and the most private level being input into the high security category and assigning, to each of the categories, on e or more of the access security codes, such that the medical information in each category will be released only if the assigned access security codes ar e received (214).

Description

APPLICATION

UNITED STATES LETTERS PATENT

TO ALL WHOM IT MAY CONCERN:
Be it known that Roy Sehoenberg has invented METHOD AND SYSTEM
FOR DISTRIBUTING HEALTH INFORMATION of which the following description in connection with the accompanying drawings is a specification.

SUBSTITUTE SHEET (RULE 26) RELATED APPLICATIONS
This application claims the benefit of United States Provisional Patent Application No. 60/183,857, f led February 22, 2000.
FIELD OF THE INVENTION
This invention generally relates to a method of and system for distributing medical information over a communications network, and more specifically to a method of and system for assigning increasing levels of security to portions of an individual's medical records and linlcing each of the security levels to access security codes that must be supplied by the requestor of the medical information in order to access the medical records.
BACKGROUND OF THE INVENTION
When a patient is brought into a hospital for emergency care, it is very unlikely that the patient's medical record will be present in the hospital. A
patient's medical record is very important, particularly in an emergency situation, as it typically contains information regarding the patient's blood type, allergies, medical history, etc. Typically, such records are at the location where the patient receives the majority of lus or her medical care. In most cases, this is the location of the patient's primary care physician, thus making quick access to the record by the emergency care provider virtually impossible. Furthermore, even if the patient's medical record is accessible, it is likely that much of the information in the record is scattered between several archives in various locations; is obsolete, redundant or indecipherable to the extent that it does not benefit the patient at the point of care.
Presently, the transfer of patients' medical xecords between care providers is done in a number of different ways. Records can be trmsferred by phone, facsimile and overnight mail, however, these options are relatively slow, expensive and can be unreliable. The use of email for transferring medical records can be relatively simple and quick. However, email is typically too insecure fox transferring the sensitive information contained in a patient's medical xecord, and information can only be exchanged between parties that are aware of each other's email addresses.
SUBSTITUTE SHEET (RULE 26) Smart cards, which contain memory devices in which a patient's medical data is stored, allow the patient to carry his or her medical records, thereby potentially enabling immediate access to the patient's record. However, the cards axe easily lost or misplaced, thus endangering the securing of the record, and smart cards must be compatible with the smart card reader at a particular medical location, which may not always be the case. Furthermore, since the smart card must be physically present at the time the information is needed, remote consultation is impossible. For example, if an ambulance is bringing a patient to the hospital, the information contained in the smart card cannot be accessed by care providers at the hospital until f the patient atTives. A further disadvantage of the above methods is that they generally do not permit only selective access to the patient's information, depending on the situation that has precipitated the need for the patient's medical data. For example, if the patient suffers a broken bone, while information regarding the patient's blood type and allergies might be necessary for the proper treatment of the injury, the patient's cardiological or serological data is not. None of the above methods can prevent unnecessary medical data from being divulged to the medical care provider, thus potentially risking the patient's privacy.
While the intemet could be used to distribute medical records, there is presently no online system that is capable of securely distributing only the information from a patient's medical record that is necessary for the situation that has required access to the record.
Accordingly, it is an object of this invention to provide a method of and system for distributing medical information in which the medical care provider has quiclc access to a patient's medical record, but only to the information within the medical record that is necessary for the proper treatment of the patient at that time.
SUMMARY OF THE INVENTION
The present invention is directed to a method of and system for distributing medical information over a communications network. A patient's medical record is divided into a hierarchy of categories, each category having a level of privacy associated therewith which is greater than the previous Ievel. The lowest Ievel category could include information such as blood type and allergies, while a high-SUBSTITUTE SHEET (RULE 26) level category could include the patient's HIV status. The patient constructs a list of access codes, wherein, the higher the level of the category, the more access codes are required to gain access to the category of the medical record. This enables the patient to control how much access to his or her medical records a particular medical care provider has, by selecting the access codes that are provided to the care provider.
According to the invention, a method for distributing health information includes the steps of generating health data representative of at least one set of health information for an individual, generating access priority data representative of an access priority associated with each of the at least one set of health information, the access priority being based on criteria for release authorization established by the individual, storing at a datastore the health data and associated access priority data and receiving from a requestor, by way of a communications network, a request for at least one of the sets of health information, the request including access data correlated to an access priority. The method fiuther includes the steps of processing the access data to determine whether the access data corresponds to the access priority criteria for the requested health information. When the access data corresponds to the access criteria for the requested health information, the requested health information is transmitted to the requestor by way of the communications network, and, when the access data fails to corxespond to the access criteria, access to the requestor to the health information is denied. The communications network may be the Internet and the transmitted health information rnay be encrypted.
According to another embodiment of the invention, a method of distributing medical information for an individual over a communications network includes the steps of generating a plurality of security access codes, generating a plurality of hierarchical categories, ranging from a low security category to a high security category, categorizing the individual's medical information into privacy levels ranging from a least private level to a most private level, inputting the individual's categorized medical information into the plurality of hierarchical categories, the least private level being input info the low security category and the most private level being input into the high security category and assigning, to each of the categories, one or more of the access security codes, such that the medical SUBSTITUTE SHEET (RULE 26) information in each category will be released only if the assigned access security codes are received. The method further includes the steps of receiving, from a requestor, one or more of the access security codes over the communications network, determining whether the received access security codes match one or more of the assigned access security codes and transmitting, to the requestor over the communications network, the medical information in the categories in which the received security access codes match the assigned security access codes.
A system for distributing medical information for an individual over a communications network according to the present invention includes a server system including a computer processor and associated memory, the server system having database of a plurality or hierarchical categories for the individual, the categories ranging from a low security category to a high security category, each of the categories having medical information of the information contained therein.
The medical information ranges from least private information to most private information, the least private medical information being contained in the low security category and the most private medical information being contained in the high security category. Each of the categories have one or more security access codes assigned thereto. The system further includes a request system including a computer processor and associated memory, the requestor system inputting one or more of the security access codes to the server system over the communications networlc and an access determining device for transmitting, to the requestor system, the medical information in each of the categories in which the input security access codes match the assigned security access codes. The system may further include a setup system, having a computer processor and associated memory, for inputting the medical information to the database. The security access codes may be defined by a user and assigned to the categories by the user through the setup system. More of the security access codes may be required to access the high security categories than the low security categories. The setup system and the requestor system may be the same system. The setup system may be coupleable to said network by a wired or a wireless connection, and may be a personal computer, an interactive television system, a personal digital assistant or a cellular telephone.
SUBSTITUTE SHEET (RULE 26) BRIEF DESCRIPTION OF THE DRAWINGS
The foregoing and other objects of this invention, the various features thereof, as well as the invention itself may be more fully understood from the following description when read together with the accompanying drawings in which:
FIG. 1 is a diagrammatic view of a system for distributing medical information in accordance with the present invention;
FIG. 2 is a flow diagram of a method of distributing medical information in accordance with the present invention;
FIG. 3 is a schematic diagram of an example medical record in accordance with the system of FIG. l;
FIG. 4 is a diagrammatic view of another embodiment of the system of FIG.
1; and FIG. 5 is a diagrammatic view of yet another embodiment of the system of FIG. 1.
DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS
The present invention enables a medical care provider to have remote access to a patient's medical record, while also enabling the patient to dictate exactly how much information the medical care provider can access. FIG. 1 shows a diagram of a system 100 for distributing medical information in accordance with a preferred embodiment of the present invention. The system 100 includes setup system 110, server system 120 and request system 130 all connected to a common communications networlc 160. Preferably, the setup system 110, server system and request system 130 can each be a personal computer such as an IBM PC or IBM
PC compatible system or an APPLE~ MacINTOSH~ system or a more advanced computer system such as an Alpha-based computer system available from Compaq Computer Corporation or SPARC~ Station computer system available from SLTN
Microsystems Corporation, although a main frame computer system can also be used. Preferably, the communications channel 160 is a TCP/IP-based network such as the Internet or an intranet, although almost any well known LAN, WAN or VPN
technology can be used.
SUBSTITUTE SHEET (RULE 26) In one preferred embodiment of the invention, the setup system 110 and request system 130 are IBM PC compatible systems operating a Microsoft Windows~ operating system and server system 120 is configured as a web server providing access to information such as web pages in HTML format via the HyperText Transport Protocol (http). The setup system 110 and request system include software to allow viewing of web pages, commonly referred to as a web browser, thus being capable of accessing web pages located on server system 120.
Furthermore, setup system 110, server system 120 and request system 130 include software for encrypting and decrypting data that is transmitted over the communications network 160. Alternatively, setup system 110 and request system 130 can be any wired or wireless device that can be connected to a communications network, such as an interactive television system, such as WEBTV, a personal digital assistant (PDA) or a cellular telephone. In this preferred embodiment, setup system 110 is located at the patient's primary care physician's office and request system 130 is located wherever access to a patient's medical record is required, such as in an emergency room, ambulance or another doctor's office.
FIG. 2 shows a flow diagram of the method of distributing medical information according to the present invention. First, the user of the setup system 110, FIG. 1, who can be the patient or the patient's physician, generates security access codes, step 202, which will provide varying access to the patient's medical records. Such security access codes can include demographic data such as the patient's name, birth date, social security number, address and phone number;
non-demographic data such as a passport number and the patient's native language;
physical attributes such as eye and hair color and scars or other identifying marks;
and user-definable fields such as passwords. The user then generates hierarchical categories into which the patient's medical information will be stored, step 204.
These categories range from a low security category, for information that the patient is less concerned about becoming known by a third party, to a high security category, for information that the patient is more concerned about becoming known by a third party. The patient and/or the patient's physician then determine the level of privacy that is desired for each piece of medical information in the patient's medical record, step 206. The least private level could include information such as SUBSTITUTE SHEET (RULE 26) the patient's blood type and allergies. The most private level could include HIV
data. Intermediate levels of privacy may include serology data, psychiatric data, cardiology data and genetic data. After the levels of privacy for each piece of the patient's medical information is determined, the information is transmitted from the setup system 110, FIG. 1, to the server system 120 over the communications network 160, and is stored in a database 122 of the server system 120, step 208. The patient then assigns one or more of the security access codes to each of the categories in the database 122, step 210. Preferably, security access codes that are easier to ascertain axe assigned to low security categories, while security access codes that are more difficult to ascertain are assigned to high security categories.
This allows the patient to more precisely control who has access to the categories, by enabling the patient to provide the security access codes for each of the categories only to medical personnel who have a "need-to-know" the particular information in each category.
As a further security measure, the patient can define which of the security access codes are necessary to be input by the requestor to identify the requestor as being authorized to access the patient's medical record, step 212. The security access code that will identify an authorized requestor is preferably a code that will not be easily guessed by an unauthorized requestor.
When a patient's medical record is needed, the requestor inputs to the server system 120, FIG. 1, through request system 130 and over network 160, any information that is lcnown about the patient in order to identify the patient:
While prior art systems require specific predetermined data to identify a patient, the present invention is capable of searching its database to identify the patient based on whatever information the requester can pxovide. Such information can include, but is not limited to, actual medical record numbers for a particular hospital, demographic data such as the patient's name, age and sex, information from a smart card that identifies the patient, retinal or iris scans and fingerprints. This flexible identification system enables the present invention to be used in conjunction with existing legacy systems. Since the database 122 may include medical records for a great number of patients, the server system 120 determines whether, based on the identification information input by the requestor, a unique patient match has been SUBSTITUTE SHEET (RULE 26) achieved, step 216. In this embodiment, the identification information input by the requestor could also be the security access codes set up by the patient. If the identification information input by the requestor does not define a unique patient in the database, the server system notifies the requestor that more identification information is needed to establish a unique patient match, step 218. If the identification information provided by the requestor provides a unique patient match, step 216, the server system prompts the requestor to enter security access codes for the patient. The server system then receives one or more of the security access codes input to the server system by the requestor, step 219. The server system 120 determines whether the received security access codes satisfy the requestor identification constraints, step 220. If they do not, the system notifies the requestor that the identification constraints have not been satisfied, step 222. If the identification constraints have been satisfied, the server system determines which of the assigned access codes match the received access codes input by the requestor, step 224, and transmits, to the request system 130 over the network 160, the information from the categories in which the received security access codes match the assigned security access codes, step 226. If more of the security access codes are received from the requestor, step 228, the system returns to step 224 to determine which of the assigned codes match the received codes. If no more codes are received in step 228, the process is terminated.
An example of the above method will now be described with reference to FIG. 3, which is a schematic diagram of a patient's medical record in accordance to the present invention. Shown at 302 are the security access codes generated by the patient in step 202, FIG. 2. In this example, the security access codes are the patient's first and last name, zip code, eye color, street number, birth year and two passwords. Shown at 304 are the medical information categories generated by the patient in step 204. These categories include EI~G data, allergies, blood type, serology, HIV and CD4. Shown at 306 are the security access codes that are assigned to the categories in step 210. As described above, security access codes that are easily ascertained are assigned to low security categories and security access codes that are more difficult to ascertain axe assigned to high security categories. In this example, the patient's birth year is assigned to the blood type and allergies, SUBSTITUTE SHEET (RULE 26) while the patient-defined passwords are assigned to the HIV and CD4 categories. In step 212, the patient's first name and zip code, block 308, are chosen by the patient as the identification constraints that must be input by the requestor to establish that he or she is authorized to access the patient's record. The following table shows the response of the system of the present invention to various combinations of security access codes received from the requestor:
If Reauestor supplies this data System will resuond with A. First Name "More than one patient found, No unique match"
B. First Name, Birth Year, Key 1 "Unique Match, ID constraints not satisfied"
C. First Name, Zip Code, Birth Year EKG data, Allergies, Blood Type D. First Name, Zip Code, Birth Year, Password 1 EKG data, Allergies, Blood Type, Serology, E. First Name, Zip Code, Birth Year, EKG data, Allergies, Blood Type, Password 1, Password 2 Serology, HIV
F. First Name, Zip Code, Birth Year, EKG data, Allergies, Blood Type, Password 1, Password 2, Eye Color Serology, HIV, CD4 In case A, because only the first name of the patient has been received, the system determines that a unique patient match has not been found, step 216, and notifies the requestor that more identification information is needed, step 218. In case B, the first name, birth yeax and password 1 are received, step 214.
Although these codes allow the system to identify the patient, step 2I6, the identification constraints (the first name and zip code) have not been satisfied, step 220.
The system then notifies the requestor that more security access codes are needed to satisfy the identification constraints, step 222. In case C, the first name, zip code and birth year are received, step 214. A unique patient match is found, step 216 and the identification constraints are satisfied, step 220. The system then determines which of the assigned security access codes match the received security access to SUBSTITUTE SHEET (RULE 26) codes, step 224, and transmits the information in the matched categories to the requestor over the communications network, step 226. In case C, because the zip code and birth year are received, referring to block 306, FIG. 3, the EKG
data, allergy information and blood type are transmitted from the database to the requestor. In case D, in addition to the first name zip code and birth year, password 1 is received, step 228. Accordingly, in addition to the information transmitted in case C, the patient's serology information is transmitted to the requestor. In case E, with the receipt of password 2, the patient's HIV data is transmitted and, in case F, the receipt of password 2 and the patient's eye color prompts the transmission of the patient's CD4 data, in addition to all of the information transmitted in the previous cases.
While the invention has been described as including one setup system that accesses the server system, a plurality of setup systems may be coupled to the server system in order to allow patients at different locations to access the server system.
Such a configuration is illustrated in Fig. 4. In this system 300, in addition to the setup system 110, a second server system 140 is coupleable to the server system 120 over communications network 160 for the purpose distributing medical information in the manner described above. It will be understood that the server system can be accessed through any number of setup systems, and that any number of request systems may access the server system in the manner described above.
In another embodiment, shown at 400 in FIG. 5, system 115 can be used both as the setup system, for setting up the patient's medical record on the database 122 of server system 120, as described above, and as the request system for inputting security access codes and receiving medical information from the database 122 of the server system 120, as described above.
Accordingly, the present invention provides a method of and system for distributing medical information over a network in a granular manner, in which the patient determines the level of security associated with each category of his or her medical record. A requestor of the patient's medical information must input the proper security access codes to the system in order to obtain the information contained within the record. The system enables the patient to distribute the security access codes for the hierarchy of security categories to medical personnel on a SUBSTITUTE SHEET (RULE 26) "need-to-know" basis, thus reducing the risk that highly private medical iZZformation be exposed to unauthorized personnel.
Attached as Appendix A is the Javascript and VBscript code used to implement the present invention and a sample database on which the invention can be used.
The invention may be embodied in other specific forms without departing from the spirit or essential characteristics thereof. The present embodiments are therefore to be considered in respects as illustrative and not restrictive, the scope of the invention being indicated by the appended claims rather than by the foregoing description, and all changes which come within the meaning and range of the equivalency of the claims are therefore intended to be embraced therein.

SUBSTITUTE SHEET (RULE 26) 
<%
dim a ( ) dim patient id .******************************************************************************
*
****************
' this sub loads the request data table with the entries in the form snb update database with new,_patient() dim time stamp dim num -of items dim counter time stamp = cstr(now()) ' time stamp counter = 0 length = cint(Request.Form("count")) ' number of fields to extract from request form ' create an entry in the patients table and get the new id set cnnl = server.Create0bject("adodb.connection") crml~:Open "filedsn=cardionet.dsn"
set rstl = server.CreateObject("adodb.recordset") rstl.ActiveConnection = cnnl ' rstl.CursorType = adOpenKeyset rstl.LockType = adLockOptimistic rstl.Source = "patients"
rstl.open rstl.AddNew rstl("ref data 1")=Request.Form("1") rstl("ref data 2")=Request.Form("2") rstl("ref data 3")=Request.5erverVariables("remote addr") rstl.Dpdate patient id= rstl.Fields("patient id") ,rstl.Close - ' set rstl = nothing ' add the pid_data for the new patient to the pid data table set rst2 =-server.CreateObject("adodb.recordset") rst2.ActiveConnection = cnnl rst2.CursorType = adOpenKeyset rst2.IockType = adLockOpt3imistic rst2.Source = "pid data"
rst2.Open _ for s = 1 to length ' loop through items if len(cstr(Request.Form(cstr(x))))>0 then ' append only items that have a value enetered counter = counter + 1 redim preserve a(3,counter) redim works only on last dimension, note it is turned around 2,30 a(O,counter) = cstr(x) ' item id a(l,counter) a lease(trim(Request.Form(cstr(x)))) ' item value a(2,counter) ~ (Request.Form("c" ~ cstr(x))="on") ' item is a required for identification rst2.AddNew ' add a record for each entered item rst2("patient id") = cint(patient id) SUBSTITUTE SHEET (RULE 26) rst2("item id") = cint(a(O,counter)) rst2("value") = cstr(a(l,counter)) rst2.update if a(2,counter) then 'add a record in id_pass id this is a required item for identification set rst3 a server.CreateObject("adodb.recordset") rst3.ActiveConnection = cnal rst3.CursorType = adOpenReyset rst3.LockType = adhockOptimistic ~rst3.Source = "id,_pass"
rst3.Open rst3.AddNew rst3("patient id")~int(patient id) rst3("item id")acint(a(O,counter)) rst3.~pdate rst3.Close end if end if next rst2.Close cnnl.Close set rst2anothing set cnnhnothing a(0,0) = cstr(counter) end sub %>
<HTML>
<HEAD>
Q4ETA NAME="GENERATOR" Content="Mi.crosoft Visual Studio 6.0">
<TITLE></TITLE>
</READ>
<body background=backgrnd.gif>
<%
call update_database with_new_patient Response.Write("Patient Added to Database") ' %>
<P> </P>
</BODY>
</HTML>

SUBSTITUTE SHEET (RULE 26) <t--#include file="adovbs.inc" -->
<~
dim a ( ) din gatient id t******************************************************************************
*
****************
this sub loads the request data table with the entries in the form sub update database_with new~atient() .
dim time stamp dim n~ of items dim counter _ time stamp = cstr(now()) ' time stamp counter = 0 length = cint(Request.Form("count")) ' number of fields to extract fraa4 request form create an entry in the patients table and get the new id set cnnl = seswer.CreateObject("adodb.connection") cnnl.Open "filedsn=cardionet.dsn"
set rsti = server.CreateObject("adodb.recordset") rstl.ActiveConnection = cnnl rstl.CursorType = adOpenKeyset rstl.LockType = adLockOptimistic rstl.Source = "patients"
rstl.open rstl.AddNew rstl("ref data 1")=Request.Form("1") rstl("ref data 2")=Request.Form("2") rstl("ref data 3")=Request.ServerVariables("remote addr") rstl.Update patient id= rstl.Fields("patient id") rstl.Close set rstl = nothing add the pid data for the new patient to the pfd data table set rst2 = server.CreateObject("adodb.recordset") rst2.ActiveConnection = cnnl rst2.CursorType = adOpen~Ceyset rst2.hockType = adLockOptimistic rst2.Source = "pid data"
rst2.Open for x = 1 to length ' loop through items if len(cstr(Request.Form(cstr(x))))>0 then ' append only items that have a value endtered counter = counter + 1 redim preserve a(3,counter) redim works only on last dimension, note it is turned around 2,30 a(O,counter) = cstr(u) ' item id a(l,counter) = lease(trim(Request.Form(cstr(x)))) ' item value a(2,counter) _ (Request.Form("c" ~ cstr(x))="on") ' item is a required for identification rst2.AddNew ~ add a record for each entered item rst2("patient id") = cint(patient id) SUBSTITUTE SHEET (RULE 26) rst2("itea id") = cint(a(O,counter)) rst2("valve") = cstr(a(l,counter)) rst2.update if a(2,counter) then 'add a record in id~ass id this is a required item for identification set rst3 = server.CreateObject("adodb.recordset") rst3.ActiveConnection = cnnl rst3.CursorType = adOpenReyset rst3.LockType = adLoexOptimistic rst3.Source = "id_pass"
rst3.Open rst3.AddNeW
rst3("patient id")~int(patient id) rst3("item id")~int(a(O,counterr)) rst3.Update rst3.Close end if end if neat rst2.Close cnnl.Close set rst2anothing set cnni~nothing a(0,0) = cstr(counter) end sub %>
<HTML>
<HEAD>
<META NAME=~GENERATOR" Content=~Microsoft Visual Studio 6.0">
<TITLE>G/TITLE>
</HEAD>
<body background backgrnd.gif>
~<%
call update database with_new~atient Response.Write("Patient'~dded to Database") %>
<P»nbsp; </P>
</BODY>
</ATML>

SUBSTITUTE SHEET (RULE 26) 
<$
function item locked(fld name,fld value,pid) set rst chl~server.CreateObject("adodb.recordset") rst chk.ActiveConnection = cnnl rst chk.CursorType = adOpenReyset rst chk.LockType = adLockOptimistic sql=wselect distinct item id from locks where (patient id=w t cint(pid) w and w ~ fld name ~ w=w ~ cint(fld value) sqhsql ~ w) and item id not in ( select distinct item id frcaa request data where user ip='w i near ip i w')w -rst chk.Source ~ sql rst chk.Open .if rst chk.EOF then item_locked = false else item_locked = true end if 'while not(rst chk.EOF) ' Response.Write("<br>w ~ rst chk.Fields(witem id") ~ "<br>") ' rst_chk.MoveNext 'wend rst_chk.Close set rst chk=nothing end function %>
<htmlxheadx/headxbody background=backgrnd.gif>
<strong> Observations : </strong>
<hr>
<table align=center bordera3 bordercoloi=#OOOOcd cellpadding=3 width=100%>
<tr><th>Category</thxth>Parameter</th><th>Observation</thx/tr>
<% .
user ip=Request.ServerVariables("remote addr") ' open the database connection set cnnl = server.CreateObject("adodb.connection") cnnl.Opeif "filedsn=cardionet.dsn"
' extract the patient on which this ip is allowed to work on, from the online table set rst_pid=server.Create0bject("adodb.recordsetw) rst~id.ActiveConnection = cnnl rst_pid.CursorType = adOpenKeyset rst_pid.LockType = adLockOptimistic rst_pid.Source = "select patient id from online where user ip= "' i nser ip ~
w'w rst~id.Open if not rst~id.EOF then pid=cint(rst_pid.Fields("patient id")) SUBSTITUTE SHEET (RULE 26) end if ~ loop through the categories set rst cat = server.Create0bject("adodb.recordset") rst cat.ActiveConnection = cnnl rst cat.CnrsorType = adOpenKeyset rst cat.hocxType = adLockOptimistic rst cat. Source = "categories"
rst_cat.Open while not rst cat.EOF
cat id = cint(rst cat.Fields("category id")) cat name= rst cat.Fields("category name") .
'Response.ilrite(cat id ~ ".") 'Response.Write(cat name ~ ":") if item locked("category id",cat id,pid) then ' IF CATEGORY IS 1.OCP~:D
Response.Write("<tr><td colspan=3 align=left>Category " .cat name ~
" is Loc7ced</td></tr>") else ' loop through the parameters set rst~sar = server.CreateObject("adodb.recordset") rst~ar.ActiveConnection = cnnl rst~ar.CursorType = adOpenKeyset rst~par.hockType a adbockOptimistic - rst~ar.Source = "select * from [parameters] where category ids"
cat_id rst~ar.0pen while not rst~ar.EOF
par id=rst-par.Fields("parameter id") par name=rst~ar.Fields("parameter name") 'Response.Write(par id ~ "-") 'Response.Write(par_name ~ ":") if item_locked("parameter id",par id,pid) then ' IF PARAMETER
IS LOCKED
Response.Write("<tr>ttd colspan=3 align=left>" &
cat name ~ " : " & par name & " Parameter is Locked</td></tr>") else ' loop through the observations set rst obs = server.CreateObject("adodb.recordset") rst_obs.ActiveConnection = cnnl rst obs.CursorType = adOpenKeyset rst obs.LockType = adLockOptimistic rst obs.Source = "select * from observations where parameter id=" 6 par id ~ ° and patient_id=" & pid rst obs.Open while not rst obs.EOF
obs id=rst obs.Fields("observation id").
obs value=rst obs.Fields("value"j if item locked("observation id",obs id,pid) then ' IF OBSERVATION IS LOCKED
Response. Write("<tr><td colspan=3 align=left >" & cat name & " : " ~ par name & " Observation is Locked</td></tr>") else Response. write("<tr><td>" & cat_name ~ "</tdxtd>"
~ par name & "</td><td>" ~ obs value ~ "</tdx/tr>") SUBSTITUTE SHEET (RULE 26) end if CLOSE OBSERVA?ION IF
rst obs.MoveNext wend ' close observation loop rst obs.Close set rst obs~nothing end if ' CLOSE PARAMETER IF
rst_par.MoveNext wend ' close parameter loop rst_par.Close set rst,_par~nothing end if CLOSE CATEGORY IF
rst cat.MoveNeat wend ' close category loop rst cat. Close set rst cat~othing Response.Rrite("</table>t/body></html>") cnal.Close %> ~ .

SUBSTITUTE SHEET (RULE 26) 

<%
' get the category iii and the observation id from the reqnest-cat id=Request.QueryString("catid") obx id=Req~est.QueryString("obxid") if cat_id~ull or obx_id~rull or cat_id="" or obx_id="" then Response.Redirect "id input-page.asp", =top" _ end if ' extract the patient on which this 3p is allowed to work on, frog the online table user ip=Request.ServerVariables("remote addr") set rst-pid=server.Createobject("adodb.recordset") sql = "select patient id fr~n online where user ip like '" ~ nser ip s "'"
rst."pid.Open sql,connobj,adOpenKeyset,adLockOptimistic if not rst~pid.EOF then pid=cint(rst~id.Fields("patient id")) rst~id.Close ' else rst-pid.Close~ ' set rst~Oid= nothing Response.Redirect("id input-page.asp") end if ' get the observation text set rst_obxsserver.CreateObject("adodb.recordset") sql~"select obx text from observations where obx id=" & obx_id & " and patient id=" & pid & " and category id=" & cat id rst obx.Open sql,connobj,adOpenKeyset,adLockOptimistic if not rst_obx.EOF then obx_textarst_obx.Fields(0) end if rst_obx.Close set rst obxsnothing Response. Write(" Coding for observation: " & obx text) get the observation codes set rst_obc=server.CreateObject("adodb.recordset") sql="select observation coding.code system id, observation coding. code id, coding systems. coding system id, coding systems.
coding system name from observation coding inner join coding systems on observatibn coding. code system id~coding system id where observation coding.observation id=" ~ obxx id 'Response.Write("<br>" ~ sql ~ "<br>"j ' rst obc.Open sql,connobj,adOpenKeyset,adtockOptimistic while not rst obc.EOF
obc text="<br> code system name : " ~ rst obc.Fields("coding system name") & " ... code :" & rst obc.Fields("code id") & "~<br>"
Response.Write(obc text) , rst_obc.MoveNext wend rst obc.Close set rst obc~nothing SUBSTITUTE SHEET (RULE 26) Response.Ead E>
cATML>
cHEAD>
c~ETA ~GENERATOR~ Contenta~Mf.crosoft V3sua1 Studio 6.0~>
CTITLE></TIT1.E>
C/HEAD>
GBODY>
cP»nbsp; </P>
c/BODY>
c/ATi~L>

SUBSTITUTE SHEET (RULE 26) <HEAD>
Q~IETA http-eqniv=~Expires" content="Tue, 20 Ang 1996 14:25:27 C,MT">
<TITLB></TITLE>
</HEAD>
<frameset roxs="Z00,*">
<frame name="top frame" src~"logo~age.asp" border=0>
<frameset cols=~35%,65%~>
<frame~na~~left frame~ src=~skeleton.asp~ border=1>
<frame -names"right frame" srct"viex_patient.asp~ border=1>
</frameseta </frameset>
</HTML>

SUBSTITUTE SHEET (RULE 26) <t--#include file=*adovbs.inc" -->

<~
' get the category id from the left frame ( skeleton.asp ) cat id=Request.QueryString("id") .cat name=Request.QueryString("cat name") if cat_id=nnll or cat id=*" then -Response.Redirect("id input~age.asp") end if extract the patient on which this ip is alloxed to work on, from the online table user ip=Request.ServerVariables("remote addr") set rst~id=server.Create0bject("adodb.recordset") sql = "select gatient id from online where user ip like '" ~ user ip & "'"
rst,~id.Open sql,connobj,adOpenKeyset,adl'.ockOptimistic if not rst_pid.EOF then pid=cant(rst_pid.Fields("patierit_iii")) rst_pid.Close else rst,_pid.Close set rst~id= nothing Response.Redirect("id_input~age.asp") end if %>
<tiTML>
<HEAD>
<t~TA NAMEa"GENERATOR" Contenta"Microsoft Visual Studio 6.0">
<TIThE></TITLE>
</ttEAD>
<BODY backgroundabackgrnd.gif >
<%
rst~id.Open "select va7~ue from pid data where patient id=" ~ pid ~ " and item id<3",connobj,adOpenDynamic,adbockOptimistic if not rst-pid.EOF then rst-pid.Movelast Response. Write "<center>Patient: <strong>" ~ rst_pid.Fields(0) rst~id.Movefirst ReSponse.Write( " " ~ rst-pid.Fields(0) i "</strong>snbsp snbsp 6nbsp~nbsp ~nbsp &nbsp snbsp Category: <strong>" ~ cat name) end if rst-pid.Close set rst_pid~othing Response.Write("<hr width=90% noshade>") %>

SUBSTITUTE SHEET (RULE 26) <form action=process new observation. asp method=post name=new_obx>
<input type=hidden name~id values%apid%»
<input type=hidden nameacat_id valueat%=oat_id%»
<input type=hidden name=cat_name valuex%=cat name%»
<table cellspacing=2 cellpadding=4>
<tr><th width=10% >&nbsp</th><th width=20%
align=left>Observation:~nbsp&nbsp</th><td Width=60%><textarea namesobx val width=80 rows=3 cols=40></textarea>G/td><th width=10% >snbsp</th></tr>
<tr><th>&nbsp</th><th align=left>Time:~nbsp~nbsp</th><tdxinput nam~obx time width=80 value="<%=FoxmatDateTime(now(),0)%>"></td></tr>


<~ dim arr() ' (0,0) holds the number of items in the array ' (0,x) holds the item id (l, x) holds the item name (2,x) holds the previous value provided by the ip in previous sessions .******************************************************************************
*
**************
' this function loads the items and their names a blank array named arr() Function get_pid items() dim cnn dit~t rst dim counter set rst = server.CreateObject("adodb.recordset") 'rst.Open sql,"FIbEDSN=cardionet.dsn",adOpenDynamic sql="select * from pid items"
rst.Open sql,connobj,adOpenDynamic rst.MoveEirst counter = 0 while not rst.EOF
counter = counter + 1 redim preserve arr(3,counter+1) arr(O,counter) = trim(cstr(rst.Fields("item id").value)) arr(l,counter) = trim(cstr(rst.Fields("item name").value)) rst.MoveNext wend rst.Movefirst if counter > 0 then ~
ReDim arr(2,counter+1) for x = 1 to counter arr(O,x) a Trim(CStr(rst.Fields("item id").Value)) arr(l,x) = Trim(CStr(rst.Fields("item name").Value)) rst.MoveNext next arr(0, 0) = CStr(counter) get_pid items = true else get,_pid items = false end if rst.close Set rst= Nothing session.Abandon () End Function SUBSTITUTE SHEET (RULE 26) ~******************************************************************************
*
**************
' this sub loads the array with the previous values entered by the same ip user to the arr() array sub load existing values() user ip = trim(cstr(Request.ServerVariables("remote addr"))) set rst 1= server.CreateObject("adodb.recordset") counteracint(arr(0,0)) ' for x = 1 to counter sqla"select itemvalue fros request data where ((user ip like '" ~ user ip "') and (item id=" -& cint(arr(O,x)) ~ "j)"
'Response.Write("<br>" ~ sql) rst l.Open sql,connobj,adOpenKeyset,adLockOptimistic 'Response.Write(rst I.RecordCount ) if not (rst 1.EOF) then arr(2,x)=rst l.fields("item value") 'Response. Write("hello " & arr(2,x)) else arr (2, x) gull end if rst_l.Close next set rst 1=nothing end sub .******************************************************************************
*
***********
' this sub generates the actual HTML. grid with the values if they exist in the arr() array Sub export html() Dim x x=0 items~per_id = arr length = cint(items~er id(0, 0)) Response. Write( "<center><strong><font size=4 color=#OOOOff>CareKey Patient Identification Page</font></strong><hr>") Response.Write("<form action=""process id input.asp"" method~ost>") Response. Write("<input type=hidden name="~"count"" value=""" ~ CStr(length) """></input>") Respo~nse.Write("<table cellpadding=I cellspacing=0 borderal>") Response. Write("<tr bgcolor=#00008b><th>&nbsp ID 6nbsp </th><th><font color=#ffff00>Item Name</th><th>Gfont color=#ffff00>Input</th><th>&nbsp</th><th>6nbsp ID ~nbsp</th><th><font color=#ffff00>Item Name</th><th><font color=#ffff00>Input</th></tr>") For x = I To Int(length / 2) Response.Write("<tr><th>" ~'items~er id(O,x) ~ "</th><td>" &
items_per id(l,x) ~ "</td>") Response.Write("<td><input name=""" i items~er id(O,x) ~ www size=20 value=""" & items~er id(2,x) ~ """></input>t/td ><td bgcolor=#00008b»nbsp</td>") Response.Write("<th>" ~ items per id(O,x + Int(length / 2)) &
"</th><td>" ~ items,_per id(l,x + Int(Iength / 2)) ~ "</td>") SUBSTITUTE SHEET (RULE 26) Response.izrite("<td>tinput name=""" b items-pe~c id(O,x + Int(length /

2)) & """ size=20></input>c/td><tr>") Next _ If (x - 1) * 2 < length Then Response.iirite("<tr><th></th><td></td><td></td><td bgcolor=MediumPrquamarine></td><th>" ~ items~er id(O,length) ~ "</thXtd>"
items~er id(I,lenqth) ~ "</td>") Reesponse.i~lrite("<td>tinput name=""" ~ items-per 3d(O,length) i """
size=20></input></td>c/ti>") End If Response.idrite("</table><br><input type=""subaait"" values""Attempt Unique Identification""></form>") End Sub r******************************************************************************
*
*********
' HTHL CODE STARTS HERE
%>
<html xhead>tfont size=3 face=sans-serif>
<META http-equip="Expires" content="Tue, 20 Aug 1996 14:25:2? t~IT">
<TITLE~Carekey Patient Identification Page</TITL~
</HEAD>
<body backgrounc~backgrnd.gif>
<%
if get~id_items () then call load existing values call export html end if connobj.close set connobj=nothing %>
<AR NOSHADE>
</BODY>
</HTML>

SUBSTITUTE SHEET (RULE 26) <lDOCTyPE POBbIC "-//W3C//DTD aTHL 3.2 FINAL//EN">
<HTML>
<HEAD>
<script language="javascript" for="window" event="onload">
</script>
<font size=2 face=serif>
<script language="javascript">
var html text=" ;
var toggle=false;
var depth=1000=
var next sib;
var epos=0;
var vmax=1;
var temp node;
var xmldoc=new ActiveXObject("Microsoft.xHILDOM"j;
xmldoc.load("make dtd.asp");
loaddoc();
function Ioaddoc () t if (xmldoc.readyState~"4")( start ( ) s window. section.inuerHTML=html text;
) -else window.setTimeout("loaddoc()" , 200 );
) function start() ( var root=xmldoc.documentElement;
stratify(vpos,root);
) function stratify(vpos,node) ;
if (vpos<depth)( node name=node.nodeName;
if (node name !_ '#text') node attanode.attributes(0).text else node att=node.nodeName;
node text~node.text:
if (node text !_ " p toggle )( tabera" ;
for (x=O;x<vpos;x++) taberataber+'&nbsp&nbsp~nbsp&nbsp6nbsp6nbsp&nbsp';
if (node name~'obx')( local htmlataber+'~nbspsnbsp6nbsp&nbsp<font ' color="OOOOff">'+node text+'</font>4~r>'+String.fromCharCode(10) html text=html text+local html;

else ( . if (node.hasChildNodes())( local htmlstaber+'<label onclick=document.all("'+node name+'").style:display="none">ac&nbsp</label>';

SUBSTITUTE SHEET (RULE 26) local html=local html+'<label onclick~ocumeat.all(*'+node name+'w).style.display="block">xt/label>';
. ~ .
else local html=tuber+'~nbsp&nbsp~nbsp~nbsps~nbsp';
if (node text !_") local html=local html+'<strongxfont colota"ff0000">'+node att+'</font></strongxbr>>' else local html=local html+'<strongxfont color="808080~>'+node att+'</fontx/strongxbr>>';
local html=local html+'<div id="'+node name+'">'+String.fromCharCode(10);
html text=html text+local html;
if (node.hasChildNodes())[
if (vmax<vpos) vmax=vpos;
stratify(epos+l, node.childNodes(0));
tuber=" ;
for (x=O:x<vpos;x++) taber=taber+' ';
html text=html text+'</div>'+String.fromCharCode(10);
W
) temp node=node.nextSibling:
if (temp node != null b& temp node.nodeName !_ '#comment' ) stratify(vpos,temp -node);
function toggle empty() toggle=-toggle;
html_text=" ;
stratify ( 0, x<nldoc: ~IocumentElement ) window. section.innerHTMI,ahtml text;
function display(flag)( vai" root=xmldoc.documentElement;
.if (flag~l) show(root);
) if (flag~2) ( hide(root):
function hide(node),~
node name~node.nodeName;
if (node name!='obx' && node name!='#text')( SUBSTITUTE SHEET (RULE 26) if (document.all(node name)l~nll) document.all(node name).style.display="none";
) if (node.hasChildNodes())( hide(node.childNodes(0));
temp nodeanode.nextSibling;
if (temp node != null ~~ temp node.nodeName !s '#comment' )( hide(temp -node);
function show(node) ( node_nameanode.nodeName:
if (node name!='obx' ~~ node namel='#text')( if (document.all(node name)!'null)( document.all(node name).style.display="block";
) if (node.hasChildNodes())( show(node.childNodes(0));
) temp node=node.nestSibling;
if (temp node != null &~ temp node.nodeName !_ '#comment' )( show(temp -node):
</script>
</HEAD>
<body background=backgrnd.gif>

<center>
<input name="showit" value="Show All" type="button°
onclick="display(1)">snbsp <input name="hideit" vale="Hide All" type="button" onclick="display(2)"»nbsp <input names"toggle" value="Toggle Empty" type="button"
onclick="toggle empty()">&nbsp <input name="Id Page" value="Back to ID page" type="button"
onclick="window.open('id input_page.asp',' top')">
<input name="frames" value="Data Entry" type="button"
onclick="t~rindow.open('frame set l.asp',' top')">
</center>
tbr><hr noshade width=80%><br>
<div id="section"></div>
</BODY>
</HTNIL>

SUBSTITUTE SHEET (RULE 26) <i--#include file="adovbs.inc" °>
<i--#include file="setodbc.inc" -->
dim a ( ) dim user id *******************************************************************************
*
*************
' this function creates the SQi~ that finds the unique match using the data in the array ' returns negative number is no matches, 0 if many matches, gatient id if unique hatch -Function get_pid id() dim rst dim counter set rst = server.CreateObject("adodb.recordset") part0 = "select distinct patient id from pid data where ((1=1) "
partl = " and ( part2 = " patient id in (select patient id from pid data where item id="
part3 = " and va1ue like part4 = "'))"
parts = ")"
sql a part0 for x = 1 to cint(a(0,0)) sql = sql + partl + part2 + a(O,x) + part3 + a(l,x) + part4 next sqla sql + parts 'Response.Write(sql) rst.Open sql,connobj 'Response.Write(sql) ' if not rst.EOF then rst.MoveFirst counter = 0 while not rst.EOF
counter s counter + 1 ' 'Response.F7ryite( "<br>patient found:" +
cstr(rst.Fields("patient id").value)+ "cbr>") rst.MoveNext wend 'Response.Write("<brxounter:" ~ counter ) if counter =1 then ' patient matched - rst.MoveFirst get~id_id = rst.Fields("patient id").value end if if counter < 1 then ' no patients match getJpid id = -1 end if if counter >1 then ' too many patients match get_pid id = 0 end if set rsta Nothing session.Abandon () End Function SUBSTITUTE SHEET (RULE 26) .******************************************************************************
*
****************
' this sub loads the request data table with the entries in the form sub update database with user request() dim time stamp - - -dfm nva -of_items ditn rstl dim counter user id = trim(cstr(Request.ServerVariables("remote addr"))) ~ ip address time stamp = cstr(now().j ' time stamp counter = 0 length = cint(Request.Form("count")) ' number of fields to extract from request form ' remove old entries for this ip set rstl = server.CreateObject("adodb.recordset") rstl.CursorType= adOpenDynamic sql = "delete from request data where user ip like '~ & usei id & ~'" ' clear database from previous attempts rstl.open sql,connobj set rstl a nothing 'set cnnl = server.CreateObject("adodb.connection") 'cnnl.Open "filedsn~cardionet.dsn"
set rst2 a server.Create0bject("adodb.recordset") rst2.ActiveConnection = connobj rst2.CursorType = adGpenKeyset rst2.LockType = adLockOptimistic rst2.Source = "request data"
rst2.Open for x = 1 to length ' loop through items if len(cstr(Request.Form(cstr(x))))>0 then ' append only items that have a value enetered counter = counter + 1 redim preserve a(2,counter) redim works only on last dimension, note it is turned around 2,30 a(O,counter) = cstr(x) ' item id a(l,counter) = lease(trim(Request.Form(cstr(x)))) ' item value rst2.AddNew ' add a record for each entered item rst2("user ip") = user id rst2("item id") a a(O,counter) rst2("item value") = a(I,counter) .
rst2("time stamp") = time stamp rst2("session id") = cstr(sessfon.SessionID) rst2.update .
end if next rst2.Close 'cnnl.Close set rst2anothing 'set cnnl=nothing a(0,0) = cstr(counter) end sub SUBSTITUTE SHEET (RULE 26) *******************************************************************************

**************
' this funciton checks to see if the items specified by the patient as required to his ' identification are indeed provided. the list of those items are in table id_pass and ' the items provided are 3.n table request data function check id_pass(pid) 'set cnn4 = server.CreateObject("adodb.connection") 'enn4.Open "filedsn=cardionet.dsn".
user ip= trim(cstr(Request.ServerVariables("remote addr"))) set .recset= server.CreateObject("adodb.recordset") recset.ActiveConnection = connobj recset.CursorType = adOpenKeyset recset.hockType = adLockOptimistic ' the following sql returns the item id that were not provided and are necessary for authorization sql0="select item name from pid items where item id in "
sqh=" (select iteia id from id_pass where (patient ids" ~ pid 6 ") "
sql2="and item id not in "
sql3=" (select item id from request data where user ip like '" ~ user ip i w.}}w _ _ _ ' recset.source=sql0 & sqll & sql2 ~ sql3 recset.Open if recset.RecordCount>0 then ' patient security specs are not met check id~ass=0 Response.Write("<hr><br><li><font size=2 color=~OOOOcd><strong> For this patient, access will be authorized upon furnishing the following information: </font>"}
'Response.Write(recset.RecordCount ) while not recset.eof Respoi~se.Write("<br><li>" ~ recset.Fields ("item name")}
recset.movenext wend Response.Write("<br></font>") else check id~ass=1 ' patient security is OK
end if recset.close cnn4.Close set recsetsnothing ' set cnn9=nothing end function .******************************************************************************
*
*******
this sub updates the online table with the access granted for this ip user for this patient SUBSTITUTE SHEET (RULE 26) sub update online (user, patient) set rst5 = server.CreateObject("adodb.recordset") 'set cans = server.CreateObject("adodb.connection") 'cnnS.Open "filedsn=cardionet.dsn"
sql "delete froa online where user ip like '" ~ nser ~ "'"
rstS.Open sql,connobj set rst6 = server.CreateObject("adodb.recordset") rst6.ActiveConnection = connobj rst6.CursorType = adOpenReyset rst6.LockType = adLockOptimistic rst6.Source = "online"
rst6.Open rst6.AddNew rst6("user ip")=user rst6("patient id")patient 'rst6("tine stamp")=now() rst6.Qpdate rst6.Close cnnS.Close set rst6~othing set rst5=nothing set cnn5~nothing end sub *******************************************************************************
*
*******
********************* P R O G R A M S T A R T
***********************************
*******************************************************************************
*
******* .
call update database_with user request p = get~id id ' calling the patient matching function 'Response.Write ("<hr>" 6 cstr(a(0,0)) ~ "&nbsp items provided by ip user "
user id ~ "<brxhr>") p intecint(p) if p int>0 then sec'tire--check id_pass(cstr(p)) if secure=1 then update Online user id,p int ' update the online table with the new access provision 'Response. Write("patient identified:" & p int) 'response.redirect("data root.asp") 'Response.Write("You nort have access to patient " ~ p int ) Response.Redirect("view~atient.asp") else '%>
<html>
<head>
</head>
SUBSTITUTE SHEET (RULE 26) body background=backgrnd.gif>
4~r><center><hr noshade Hidth=80%></center>
dar clear=all> -<%
Response. Write("<br>Access requirements not met for the identified patient: " ~ p) end if end if if p int<0 then Response. Write ("<li>snbsp No Matching patients found.
Attempt identification again using validated data only.") if p int=0 then Response.iirite ("<li»nbsp More than one patient found. Try adding or changing patient infozmation.") 'if p int>0 then check id_pass(cstr(p)) %>
tcenter><br>d~r>
<a href="id_input_page.asp">Back to Tdentification Page</a>
<P>inbspi<lP>
</BODY>
</aTML>

SUBSTITUTE SHEET (RULE 26) <!-#include files"adovbs.inc" -->

<%
pid=Request.Form("pid") obx valueaRequest.Form("obs vaI") obx time=Request.Form("obx time") code system=Request.Form("code system") code value=Request.Form("code value") cat id=Request.Form("cat id") cat name=Request.Form("cat name") if obx_value="" then Response. Redirect("get data. asp?id=" & cat id & "scat names" & cat name) end if i:f not(isdate(obx time) ) then obx time~ow ( ) end if 'Response.Write("<br>" & pfd ~ "<br>" ~ obs value & "Q>r>" i obx time ~ "tbr>"
~
code system & "4~r>" & code value & "<br>" -~ cat id 'Response. End set rst=server.GreateObject("adodb.recordset") rst.open "observations",connobj,adOpenKeyset,adLockOptimistic rst.Add~lew rst("patient id")did rst("obx text")~bx value rst("obx time")=obx time rst("category id")=cat id rst.Update obx id= rst.Fields("obx id") rst.Close ' this is part of the old interface where coding was entered as part of the observation 'rst.open "observation coding",connobj,adQpenKeyset,adLockOptimistic 'rst.AddNew rst("observation id")=obx id ' rst("code system id")=code system rst("code id")=code_value 'rst.Update 'rst.Close set rst~nbthing Response. Redirect("get data. asp?id=" & cat id ~ "scat name=" & cat name) %>

SUBSTITUTE SHEET (RULE 26) <!~#include files"adovbs.inc" ~> ' <!~#include file="setodbc.inc" -->
' extract the patient on which this ip is allowed to work on, from the online table user ip=Request.ServerVariables("remote addr") set rst~id=server.CreateObject("adodb.recordset") sql = "select patient id from online where user ip like '" ~ user i~ ~ "'"
rst_pid.Open sql,connobj,adOpenKeyset,adLockOptimistic if not rst-pid.EOF then pidacint(rst_pid.Fields("patient id")) rst~id. Close set rst-pid= nothing ' else rst-pid.Close set rst~id= nothing Response.Redirect("id input~age.asp") end if . ' .******************************************************************************
*
****
check if either a category or an observation is locked for this patient function item locked(fld name,fld value) ' fld name should be either "observation id" or "category id"
' fld value should contain the id of the item required weather an observation or a category set rst chk=server.Create0bject("adodb.recordset") .
sql="select distinct item id from locks where (patient id=" & cint(pid) &
" and " & fld name & "_" & cint(fld value]
sqla sql ~ ") and item id not in ( select distinct item id from request data where user ip 1ike '" &fuser ip & "')" -rst chk.Open sql,connobj,adOpenKeyset,adLockOptimistic if rst chk.EOF then item_locked = false else item_locked = true end if ' rst_chk.Close set rst chk=nothing end function 'if item locked("category id",19)then ' Response.Write("locked") ' else ' Response,Write("not locked") 'end if .******************************************************************************
*
****

SUBSTITUTE SHEET (RULE 26) snb stratify dtd(item id, name, level) ' generate the DTD from the table categories set rst=server.CreateObject("adodb.recordset") sqI="select * from categories where category,~arent id=" ~ item id rst.Open sql,connobj,adOpenDynamic,adLockOptimistic tabber=""
for x =1 to level tabber3tabber & " "
next if rst.EOF then Response.Write(chr(10) &~tabber s "<lELEMENT id" ~ item id ~ "
(obx*)>") -Response.Write(chr(10) ~ tabber ~~"<!ATTbIST id" & item id ~ " name CDATA """ ii name i~ www>w) - .
else Response.Write(chr(10) i tabber t "<lELEMENT id" & item_id & "
(Obx*,") while not rst.EOF
local id=rst.Fields("category id") Response.Write( "id" i local id ~ "*") rst.MoveNext if not rst.EOF then Response.Write(", ") end if wend Response.Write(" )>") Response.Write(chr(10) & tabber & "<!ATTLIST id" ~ item_id & " name CDATA """ ~ name & """>") rst.MoveFirst level=level+1 while not rst.eof Response.Write(" ,stratify level " & level & ":" ~
rst.Fields("category id*)) cat id=rst.Fields("category id") cat name=rst.Fields("category name") call stratify dtd(cat id,cat_name,level) ~ recursion origin rst.MoveNext wend levelalevel-1 end if rst.Close set rst~othing end sub .*******ir*********************************************************************
**
***********
sub stratify xml(item id, name, level) ' produce the actual XML data tabbera""
for x =1 to level tabber=tabber ~ " "
next check if this category is locked, in which case write.the category name as empty and exit this branch if item locked("category id",item id) then SUBSTITUTE SHEET (RULE 26) Response.Write(chr(10) ~ tabber & "<id" ~ item id ~ " names""w name E =?.oCked" & www/]w) exit sub end if set rst=server.CreateObject("adodb.recordset") set data=server.CreateObject("adodb.recordset") sql="select * from categories where category~parent id " ~ item id rst.Open -sql,connobj,adOpenDynamic,adLockOptimistic ~ check for data of this node sql="select * from observations where category ids" & item id ~ " and patient id=" & pid ~ " order by obx time" -data.Opea sql,connobj,adOpenDynamic,adLockOptimistic if rst.EOF then ' if the parent node has no children...'check for data....
if data.EOF then ' if no data, close the node Response.Write(chr(10) & tabber ~ "<id" & item id & w n~~www ~ n~ ~ www/>w) -elSe Response.Write(chr(10) & tabber ~ "<id" & item id ~ " name="""
& name & www>w) .-while not data.EOF ' if it has data, but no children, load it and then close the node ' obs id=cint(data.Fields("obx id")) obs txtadata.Fields("obx text") if item locked("observation id",obs id) then obs_txt="Observation Locked"
end if Response.Write(chr(10) & tabber ~ " " ~ "<obx obx id=""" s data.Fields("obg id") & """>") Response.Write(obs txt ~ "</obx>") data.MoveNext wend Response.Write(chr(10) & tabber & "</id" ~ item id 6 ">") end if else ' if the parent node has children... check for data....
Response.Write(Chr(10) & tabber ~ "<id" & item id & " name="""
name & ""w>w) 'print out all the obis of the root element if they exist while not data.EOF ' if it has data, print it.
obs id cint(data.Fields("obx id")) obs txtadata.Fields("oba_text") if item locked("observation id",obs id) then obs_txt=" Observation Locked end if Response.Write(chr(10) i tabber G " " & "<obx Obx id=""" & data.Fields("Ob7L id") ~ www>w) Response.Write(obs txt ~ "</obx>") data.MoveNext wend data. close level=level+1 SUBSTITUTE SHEET (RULE 26) ' and then drill down to the child nodes while not rst.eof cat id=rst.Fields("category id") cat name=rst.Fields("category name") call stratify xml(cat id, cat name, level) 'recursion origin rst.MoveNeat - -- - - -wend Response.Write(chr(10) & tabber ~ "</id" ~ item id ~ ">") level=level-Z ' end if rst.Close set rst=nothing set data~othing end sub ---_----- INIT XML PAGE WITH INTERNAL DTD --- --------__-----------Response.Write("<?xml version=""1.0""?>" ~ chr(10)) -Response. Write("<lDOCTYPE idI [" E chr(10)) Response. write("<ISLEt~NT obx (#PCD~ATA)>" ie chr(10)) Response. Write("<lATTbIST obx" i chr(10)) Response. Write(" obx id CDATA #REQDIRED" 6 chr(10)) Response.Write(» code sys id CDATA ""ICD9""" & chr(10)) -Response. Write(" -code id CDATA.""134.18""" ~ chr(10)) Response.Write(">") Response.Write(chr(10) & chr(10)) BALL THE PROCEDORE THAT CREATES THE DTD ACCORDING TO THE DATABASE -call stratify dtd (1,"xmlnet",0) Response.Write(chr(10) & ")>" ~ chr(10)) CALL THE PROCEDDRE THAT GENERATES THE ACTOAb XtiL DATA DOCDMENT ---Response.Write(chr(10) & chr(10)) call stratify xml(l,"riolnet",0) %>

SUBSTITUTE SHEET (RULE 26) 
<3 pid=Request.Form("pid") obz value=Request.Form("obx val") obx time=Request.Form("obx time") code system Request.Foxm("code system") code valueaRequest.Form("code value") cat i~Request.Form("cat id") cat name=Request.Form("cat name") if obx value="" then Response. Redirect("get data. asp?id=" i cat id ~ "&cat name=" ~ cat name) end if tf not(isdate(obx time) ) then obx_time=now() end if 'Response.Write("<br>" ~ pid & "fir>" ~ obx value ~ "<br>" & obx time i "<br>"
~
code system & "<br>" ~ code value ~ "<br>' ~ cat id 'Response. End set rst=server.CreateObject("adodb.recordset") rst.open "observations",connobj,adOpenKeyset,adF.ockOptimistic rst.AddNew rst("patient id")did rst("obs text")aobx value rst("obx time")~obx time rst("category id")xat id rst.Update obx_id= rst.Fields("obx id") rst.Close ' this is part of the old interface where coding was entered as part of the observation .
'rst.ogen "observation coding",connobj,adOpenKeyset,adLockOptimistic 'rst.AddNew ' rst("observation id")~bx id ' rst("code system_id")=code system rst("code id")~ode_value 'rst.Opdate 'rst.Close set rst=nothing Response. Redirect("get data. asp?id " ~ cat id & "scat name=" & cat name) %>

SUBSTITUTE SHEET (RULE 26) ~T~
<HEAD>
<META "CareKey System Demo" Content="Center for Clinical Coa~uting, Harvard Ntedical School">
<TITLE>CareKey Democ/TITLE>
</HEAD>
<BODY background backgrnd.gif>
<font size=5 color=#00008b><strong><Center>
<a href="id input_page.asp" >
<ing name="imgl" src="bidmc-banner.gif" border=0 Width=903 >
</a>
</BODY>
</HTMW

SUBSTITUTE SHEET (RULE 26) 


<%
dim arr ( ) counter~0 -pid--Request.Form("pid") cat id Reqnest.Form("cat id") cat name=Request.Form("cat name") set rstl=server.CreateObject("adodb.recordset") sql="select obx id from observations where patient ic~* i pid ~ " and category id=' ~ cat id rstl.Open sql,connobj,adOpenDynamic,adLockOptimistic while not rstl.EOF
obxid~stl.Fields("obx id") cname="c" & obxid checkid=Request.Form(cname) if checkid<>"" then counter=counter+1 redim preserve arr(connter+1) arr(counter)=obxid 'Response.Write(obxid & "<br>") rstl.Delete adAffectCurrent rstl.MovePrevious end if rstl.MoveNext wend 'Response.Write("tbr>" & pid ~ "<br>" & cat id ) rstl.Close sqla""
sql="delete from observation coding where observation id in ("
for x 3 1 to counter sql=sql ~ arr(x) 6 ","
next sql=sql & "0)"
'Response.Write(sqI) rstl.open sql,connobj,adOpenDynamic,adLockOptimistic ' recordset closes automatically after deletion set rstl=nothing Response. Redirect("get data. asp?id=" ~ cat id & "scat name=" ~ cat name) %>

SUBSTITUTE SHEET (RULE 26) <!DOCTYPE HTML PDBLIC "-//W3C//DTD HTML 3.2 FINAh//EN">
<ATlffJ
<font size=2 face=serif>
<script languages"javascript">
var html text=~': ' var toggl~false;
var depth=1000;
var next sib;
var epos=Ot var vmax=1;
var tear node; _ var cat idt var ~anldoc~eyt ActiveXObject("Microsoft.7~DOM");
xmldoc.load("prepare skeleton.asp");
loaddoc():
function loaddoc () if (xmldoc.readyState~"4")( start ( ) ;
Window. section.innerHTMI~html text;
) , _ else window.setTimeout("loaddoc()" , 1000 );
) function start() ( var root~ldoc.documentElement;
stratify(vpos,root);
) function stratify(vpos,node) if (epos<depth)( node_name=node.nodeName;
if (node name !_ '#text') node att~ode.attributes(0).text else node attanode.nodeName;
node text=node. text;
tabex~" ;
for (~0; x<vpos; x++) tuber=taber+'~nbsp&nbsp~nbsp&nbsp~nbsp&nbspsnbsp';
if (node.hasGhildNodes())( local html=tuber+'<label onclickadocmnent.all("'+node name+'").style.display="none">x&nbsp</label>~;
local htmlalocal html+'<label onclickadocument.all("'+node name+~").style.display="block"»snbsp</label>';
W
else local html=tuber+'~nbsp6nbsp&nbsp&nbsp&nbsp';
cat id=node.attributes(1). text;

SUBSTITUTE SHEET (RULE 26) local html=local html+'<strong><font color="#OOOOff">'+node att+'~nbsp~nbsp<a target="right frame"
href="get data.asp?id='+cat id+'~cat name='+node att+'">~</a></font>c/strong><br >.
local html=local html+'<div id="'+node_name+'~>'+String.fromChaxCode(10);
html text=html text+local html;
if (node.hasChildNodes())~
if (vmax<vpos) vmax=vpos;
stratify(epos+l, node.childNodes(0));
tuber=" _ for (x=O;x<vpos;x++) taber=taber+' ';
) html test=html text+'</div>'+String.fromCharCode(10);
temp node=node.nextSibling;
if (temp node != null && temp node.nodeName !_ '#comment' stratify(vpos,temp node):
function display(flag)i var root=xmldoc.documentElement;
if (flag~l) show(root);
) if (flag=2) ( hide(root);
function hide(node) ;
node name=node.nodeName;
document.all(node name).style.display="none~:
if (node.hasChildNodes())( hide(node.childNodes(0));
) ~
temp node~ode.nextSibling;
if (temp node != null &~ temp node.nodeName !_ '#comment' ) hide(temp -node);
function ~how(node) node namesnode.nodeName;
- document.all(node name).style.display=~block~;
if (node.hasChildNodes())( show(node.childNodes(0));
) temp node=node.nextSibling;
if (temp node != null ~~ temp node.nodeName !_ '#comment' ) show(temp node);
</script>
</HEAD>

SUBSTITUTE SHEET (RULE 26) body backgronac~backgrnd.gif>
<center>
<input name="shoxit" values"Show All" types"button" onclick="display(1)"»nbsp <input name="hideit" values"Hide AlI" type="button" oncliclca"display(2)"»nbsp <input name="view" value="View" type="button" language~avascript onclicl~"window.open('view patient.asp','right frame')">
</center>

4~r><hr noshade width=80~><br>
<div idi"section"></div>
</BODY>
</HTZSL>
SUBSTITUTE SHEET (RULE 26) <%
r--_---..-----_~_-------.---- ~~- ---' MiCrOSOft ADO
~ (c) 1996-1998 Microsoft Corporation. All Rights Reserved.
' ADO constants include file for VBScript r '---- CursorTypeEnum Values ----Coast adOpenForwardOnly = 0 Coast adOpenKeyset = 1 Coast adOpenDynamic = 2 Coast adOpenStatic = 3 '---- CursorOptionEnum Values - -Const adHoldRecords = &HOOOOOI00 Coast adMovePrevious = sH00000200 Coast adAddNeW = &H01000400 Coast adDelete = ~H01000800 Coast adUpdate = &H01008000 Coast adBooka~ark = ~H00002000 Coast adApproxPosition = &H00004000 Coast adUpdateBatch = &H00010000 Const~adResync = ~H00020000 Coast adNotify = &H00040000 Coast adFfnd = &H00080000 '---- LockTypeEnum Values ----Coast adLockReadOnly = 1 Coast adLockPessimistic = 2 Const~adLockOptimistic = 3 Coast adLockBatchOptimistic = 4 '---- ExecuteOptionEnum Values ----Coast adRunAsync = &H000 0010 Coast adAsyncExecute = ~~00000010 Coast adAsyncFetch = &H00000020 Coast adAsyncFetchNonBlocking = ~H00000090 Coast adExecuteNoRecords = &H00000080 '---- CormectOptionEnum Values ----Coast adAsyncConnect = sH00000010 '---- ObjectStateEnum Values ----Coast adStateClosed = &H00000000 Coast adStateOpen = &H00000001 Coast adStateConnecting ; &H00000002 Coast adStateExecuting = &H00000004 Coast adStateFetching = ~H00000008 '---- CursorLocationEnum Values ----Coast adUseServer = 2 Coast adUseClient = 3 SUBSTITUTE SHEET (RULE 26) '---- DataTypeEnum Values ---Coast adEmpty a 0 Coast adTinyInt = 16 Coast adSmallInt = 2 Coast adInteger = 3 Coast adBigInt = 20 Coast adUnsignedTinyInt = 17 Coast adUnsignedSmallInt = 18 Coast adOnsignedInt = 19 Coast adUnsignedBigInt = 21 Coast adSingle = 4 Coast adDouble = 5 Coast adCurrency = 6 Coast adDecimal = 14 Coast adNumeric = 131 Coast adBoolean = 11 Coast adError = 10 Coast adOserDefined = 132 Coast adVariant = 12 Coast adIDispatch = 9 Coast adIOn)mown = 13 Coast ad6UID = 72 Coast adDate = 7.
Coast adDBDate = 133 Coast adDBT3me = 134 Coast adDBTimeStamp = 135 Coast adBSTR a 8 Coast adChar = 129 Coast adVarChar = 200 Coast adLongVarChar = 201 Coast adWChar = 130 Coast adVarWChar = 202 Coast adhongVarWChar a 203 Coast adBinary = 1,28 Coast adVarBinary = 204 Coast adLongVarBinary ~ 205 Coast adChapter = 136 Coast adFileTime = 64 '~~
Coast adDBFileTime = 137 Coast adPropVariant = 138 Coast adVarfiumeric = 139 '---- FieldAttributeEnum Values ----Coast adFldMayDefer = ~N00000002 Coast adFldOpdatable = &H00000004 Coast adFldUnknownOpdatable a iH00000008 Coast adFldFixed = ~H00000010 Coast adFldIsNullable = &H00000020 Coast adFldMayBeNul1 = ~H00000040 Coast adFldLong = &H00000080 Coast adFldRowID = ~H00000100 Coast adFldRowVersion = &H00000200 Coast adFldCacheDeferred = ~H00001000 Coast adFldKeyColumn = bA00008000 '---- EditModeEnum Values ----SUBSTITUTE SHEET (RULE 26) Coast adEditNone = ~H0000 Coast adEditInProgress = &H0001 Coast adEditAdd = ~H0002 Coast adEditDelete = &H0004 '---- RecordStatusEnum Valves ----Coast adRecOK = &H0000000 Coast adRecNew = &H0000001 Coast adRecModified a ~H0000002 Coast adRecDeleted = sH0000004 Coast adRecUnmodified = ~A0000008 Coast adRecInvalid ' &H0000010 Coast adRecMultipleChanges = ~H0000040 Coast adRecPendingChanges = &H0000080 Coast adRecCanceled a 8H0000100 Coast adRecCantRelease = &H0000400 ~onst adRecConcurrencyViolation = ~H0000800 Coast adRecIntegrityViolatioa = &H0001000 Coast adRecMaxChangesExceeded = ~8Q002000 Coast adRecObjectOpen = &H0004000 Coast adRecOutOfMemory = ~H0008000 Coast adRecPermissionDenied = bH0010000 Coast adRecSchemaViolation = &H0020000 Coast adRecDBDeleted = &H0040000 '---- GetRoWSOptionEnum Values ----Coast adGetRowsRest = -1 '---- PositionEnum Values ~ --Coast adPosUnknown = -1 Coast adPosBOF a -2 Coast adPosEOF = -3 '---- enum Values ----Coast adBoolanarkCurrent = 0 Coast adBoolonarkFirst = 1 Coast adBookmarkLast a 2 '---- MarshalOptionsErnuh~Values ----Coast adMarshalAll = 0 Coast adMarshalModifiedOnly = 1 '---- AffectEnum Values ----Coast adAffectCurrent = 1 Coast adAffect6roup = 2 Coast adAffectAll a 3 Coast adAffectAllChapters = 4 '---- ResyncEnum Values ----Coast adResyncUnderlyingValues = 1 Coast adResyncAllValues = 2 '---- CompareEnum Values ----Coast adCompareLessThan = 0 Coast adCompareEqual = 1 Coast adCompareGreaterThan = 2 Coast adCompareNotEqual = 3 SUBSTITUTE SHEET (RULE 26) Coast adCompareNotComparable = ~1 '---- FilterGroupEnum Values ----Coast adFilterNone = 0 Coast adFilterPendingRecords = 1 Coast adFilterAffectedRecords = 2 Coast adFilterFetchedRecords = 3 Coast adFilterPredicate = 4 Coast adFilterConflictingRecords = 5 '---- SearchDirectionEnum Values ----Coast adSearchForward = 1 Coast adSearchBackward = -1 '---- PersistFormatEnnm Values ----Coast adPersistADT6 = 0 Coast adPersistXNIh = 1 Coast adPersistHTML = 2 '---- StringFormatEnum Values ----Coast adString~ = 0 Coast adStringHTML = 1 Coast adClipString = 2 '---- ADCPROP DPDATECRITERIA_~ENOM Values ----Coast adCriteriaKey = 0 Coast adCriteiiaAllCols = I
Coast adCriteriaUpdCols = 2 Coast adCriteriaTimeStamp a 3 '---- ADCPROP ASYNCTHREADPRIORITY_ENUM Values ----Coast adPriorityhowest = 1 Coast adPriorityBelowNormal.= 2 Coast adPriorityNormal = 3 Coast adPriorityAboveNormal = 4 Coast adPriorityHighest ~ 5 '-'-- ConnectPromptEnum Values -----Coast adPromptAlways = 1~
Coast adPromptComplete = 2 Coast adPromptCompleteRequired = 3 Coast adPromptNever = 4 '---- ConnectModeEnum Values ----Coast adMCdeOnknown = 0 Coast adModeRead = 1 Coast adModeWrite = 2 Coast adModeReadWrite = 3 Coast adModeShareDenyRead a 4 Coast adModeShareDenyWrite = 8 Coast adModeShareExclusive = &Hc Coast adModeShareDenyNone = &H10 '---- IsolationLevelEnum Values ----Coast adXactUnspecified a &Hffffffff Coast adXactChaos = ~H00000010 Coast adXactReadDncommitted = bA00000100 SUBSTITUTE SHEET (RULE 26) Coast adXactBrowse = 6H00000100 Coast adXactCursorStability ~ bH00001000 Coast adXactReadCommitted = ~H00001000 Coast adXactRepeatableRead = 6H00010000 Coast adXactSerializable = ~H00100000 Coast adXactlsolated = &H00100000 '---- XactAttributeEnum Values ----Coast adXactCommitRetaining = ~H00020000 Coast adXactAbortRetainfng = &H00040000 '---- PropertyAttributesEnu~a Values ----Coast adPropNotSupported = ~H0000 Coast adPropRequired = &H0001 Coast adPropOptional~= &H0002 Coast adPropRead = ~H0200 Coast adPropWrite = ~H0400 '---- ErrorValueEnum Values ----Coast adErrInvalidArgument = 6Hbb9 Coast adErrNoCurrentRecord = 6Hbcd Coast adErrIilegalOperation = &8c93 Coast adErrIaTransaction = ~Hcae Coast adFsrFeatureNotAvailable = ~Hcb3 Coast adErrItemNotFound = &Hccl Coast adErrObjectInCollectioa = ~Hd2?
Coast adErrObjectNotSet = ~RdSc Coast adErrDataConversion = sHdSd Coast adErrObjectClosed = &He78 Coast adErrObjectOpen = &He79 Coast adErrProviderNotFound = &He7a Coast adErrBoundToCommand = ~He7b Coast adErrInvalidParamlnfo = ~He7c Coast adErrInvalidConnection = &He7d Coast adErrNotReentrant = bHe7e Coast adErrStillExecuting = ~He7f Coast adErrOperationCancelled = &He80 Coast adErrStillConnecting = ~He81 Coast adErrNotExecuting' &He83 Coast adErrUnsafeOperatioa = ~He89 '---- ParameterAttributesEnum Values ---Coast adParamSigned = &H0010 Coast adParamNullable = ~H0040 Coast adParamLong = &H0080 '---- ParameterDirectionEnum Values ----Coast adParamDnknown = ~H0000 Coast adParamInput = &H0001 Coast adParamOutput = &H0002 Coast adParau~InputOutput = &A0003 Coast adParamReturnValue = &H0004 '---- CommandTypeEnum Values ----Coast adQndUnImorm = ~H0008 Coast adCmdText = &H0001 Coast adCmdTable = ~H0002 SUBSTITUTE SHEET (RULE 26) Coast adCmdStoredProc = 6H0004 Coast adCmdFile = &H0100 Coast adCmdTableDirect = ~H0200 '---- EventStatusEnuai Values ----Coast adStatusOK = ~H0000001 Coast adStatusErrorsOccurred = ~H0000002 Coast adStatusCantDeny = ~H0000003 Coast adStatusCancel = ~H0000004 Coast adStatust)nwantedEvent = bH0000005 '---- EventReasonFnum Values ----Coast adRsnAddNew = 1 Coast adRsnDelete = 2 Coast adRsnOpdate = 3 Coast adRsnUndoUpdate = 4 Coast adRsnUndoAddNew = 5 Coast adRsnOndoDelete = 6 Coast adRsnRequery = 7 Coast adRsnResynch = 8 Coast adRsnClose = 9 Coast adRsnMove = 10 Coast adRsnFirstChange = 11 Coast adRsnMoveFirst = 12 Coast adRsnMoveNext = 13 Coast adRsnMovePrevious = 14 Coast adRsnMovehast = 15 '---- SchemaEnum Values ----Coast adSchemaProviderSpecific ~ -1 Coast adSchemaAsserts = 0 Coast adSchemaCatalogs a 1 Coast adSchemaCharacterSets = 2 Coast adSchemaCollations = 3 Coast adSchemaGolumns = 4 Coast adSchemaCheckConstraints = 5 Coast adSchemaConstraintColumnUsage = 6 Coast adSchemaConstraintTableUsage = 7 Coast adSchemaKeyColumnU age = 8 Coast adSchemaReferentia~Contraints = 9 Coast adSchemaTableConstraints = 10 Coast adSchemaColumnsDomainDsage = 11 Coast adSchemaIndexes = 12 Coast adSchemaColumnPrivileges = 13 Coast adSChemaTablePrivileges = 14 Coast adSchemaUsageprivileges = 15 Coast adSchemaProcedures = 16 Coast adSchemaSchemata = 1? .
Coast adSchemaSQLLanguages = 18 Coast adSchemaStatistics = 19 Coast adSchemaTables = 20 Coast adSchemaTranslations = 2I~
Coast adSchemaProviderTypes a 22 Coast adSchemaViews = 23 Coast adSchemaViewColumnUsage = 24 Coast adSchemaViewTableOsage = 25 Coast adSchemaprocedureParameters = 26 SUBSTITUTE SHEET (RULE 26) Coast adSchemaForeignKeys = 27 Coast adSchemaPrimaryKeys = 28 Coast adScheaeaProcedureCol~ns = 29 Coast adSchemaDBInfoReywords = 30 Coast adSchemaDBInfobiterals = 31 Const'adSchemaCobes = 32 Coast adSchemaDimensions = 33 Coast adSchemaHierarchfes = 3~
Coast adSchewaLevels = 35 Coast adSchemaMeasures = 36 Coast adSchemaProperties = 37 Coast adSch~naMembers = 38 '---- SeehEnwn Values --»
Coast adSeekFirstEQ = X81 Coast adSeektastEQ = iH2 Gonst adSeekGS = iH!
Coast adSeekGT = iH8 Coast adSeekLE = ~H10 Coast adSeelrLT = ~H20 8>

SUBSTITUTE SHEET (RULE 26)

Claims

1. A method of distributing health information, comprising the steps of:
A. generating health data representative of at least one set of health information for an individual;
B. generating access priority data representative of an access priority associated with each of said at least one set of health information, said access priority being based on criteria for release authorization established by said individual;
C. storing at a datastore said health data and associated access priority data;
D. receiving from a requestor, by way of a communications network, a request for at least one of said sets of health information, said request including access data correlated to an access priority;
E. processing said access data to determine whether said access data corresponds to said access priority criteria for said requested health information; and i. when said access data corresponds to said access criteria for said requested health information, transmitting said requested health information to said requestor by way of said communications network, and ii. when said access data fails to correspond to said access criteria, denying access to said requestor to said health information.

2. The method according to claim 1, wherein said communications network is the Internet.

3. The method according to claim 1, wherein said transmitted health information is encrypted.

4. The method of distributing medical according to claim 2 further comprising the step of designating certain of said access priority data as identification constraints which must be received in step D before access to said medical information is granted.

5. A method of distributing medical information for an individual over a communications network comprising the steps of:
A. generating a plurality of security access codes;
B. generating a plurality of hierarchical categories, ranging from a low security category to a high security category;
C. categorizing the individual's medical information into privacy levels ranging from a least private level to a most private level;
D. inputting the individual's categorized medical information into said plurality of hierarchical categories, said least private level being input into said low security category and said most private level being input into said high security category;
E. assigning, to each of said categories, one or more of said access security codes, such that said medical information in each category will be released only if the assigned access security codes are received;
F. receiving, from a requestor, one or more of said access security codes over said communications network;
G. determining whether said received access security codes match one or more of said assigned access security codes; and H. transmitting, to said requestor over said communications network, said medical information in said categories in which said received security access codes match said assigned security access codes.

6. The method of distributing medical information for an individual over a network according to claim 5, wherein said communications network is the internet,

7. The method of distributing medical information for an individual over a network according to claim 6, wherein said released medical information is encrypted.

8. The method of distributing medical information for an individual over a network according to claim 6 further comprising the step of designating certain of said security access codes as identification constraints which must be received in step F before access to said medical information is granted.

9. The method of distributing medical information for an individual over a network according to claim 6 wherein, prior to step F, identification information is received from the requestor, said identification information being for identifying the individual.

10. The method of distributing medical information for an individual over a network according to claim 9 wherein said identification information is selected from the group consisting of the individual's medical record numbers, demographic data, information from a smart card that identifies the patient, retinal scans, iris scans and fingerprints.

11. The method of distributing medical information for an individual over a network according to claim 9 wherein said identification information is any information about the individual which is available to said requester.

12. A system for distributing medical information for an individual over a communications network comprising:

a server system including a computer processor and associated memory, said server system having database of a plurality of hierarchical categories for the individual, said categories ranging from a low security category to a high security category, each of said categories having medical information of said individual contained therein, said medical information ranging from least private information to most private information, said least private medical information being contained in said low security category and said most private medical information being contained in said high security category, each of said categories having one or more security access codes assigned thereto;
a request system including a computer processor and associated memory, said requestor system inputting one or more of said security access codes to said server system over said communications network; and an access determining device for transmitting, to said requestor system, the medical information in each of said categories in which said input security access codes match said assigned security access codes.

13. The system according to claim 12 wherein said communications network is the internet.

14. The system according to claim 13, further including a setup system, including a computer processor and associated memory, for inputting said medical information to said database.

15. The system according to claim 14 wherein said security access codes are defined by a user and are assigned to said categories by said user through said setup system.

16. The system according to claim 13 wherein more of said security access codes are required to access said high security categories than said low security categories.

17. The system according to claim 13 wherein said setup system and said requestor system are the same system.

18. The system of claim 13 wherein said request system is coupleable to said network by a wired connection.

19. The system of claim 18 wherein said request system is selected from the group consisting of a personal computer, an interactive television system, a personal digital assistant and a cellular telephone.

20. The system of claim 13 wherein said request system is coupleable to said network by a wireless connection.

21. The system of claim 20 wherein said request system is selected from the group consisting of a personal computer, an interactive television system, a personal digital assistant and a cellular telephone.

22. The system of claim 14 wherein said setup system is coupleable to said network by a wired connection.

23. The system of claim 22 wherein said setup system is selected from the group consisting of a personal computer, an interactive television system, a personal digital assistant and a cellular telephone.

24. The system of claim 14 wherein said setup system is coupleable to said network by a wireless connection.

25. The system of claim 24 wherein said setup system is selected from the group consisting of a personal computer, an interactive television system, a personal digital assistant and a cellular telephone.