Controlling access to protected information

Abstract

Controlling access to protected information stored in a database. Certain records in the database can be designated as master records. Master records are stored in a data table. Any database record of the database may include one or more ownership data fields comprising owner identification information for identifying a master record associated with the database record. Owner identification information of the ownership data fields of a retrieved database record are analyzed to identify the master record associated with the retrieved database record. Access to the retrieved database record is controlled using the same authorization rules used to govern access to the master record associated with the retrieved database record. The system provides a mechanism to ensure that the owner identification information of any new or updated database record is linked to the correct master records. New and updated database records inherit access control from their associated master records.

What is claimed is: 
     
         1 . A computer-implemented method for controlling access to protected information stored in a database, the method comprising:
 identifying a set of database records in various data tables as master records, with each master record having an associated set of authorization rule(s);   storing, in each database record of the database, one or more ownership data fields comprising owner identification information for identifying a master record associated with the database record;   retrieving the database record of the database;   analyzing the owner identification information of the one or more ownership data fields of the retrieved database record to identify the master record associated with the retrieved database record;   controlling access to the retrieved database record using the set of authorization rule(s) of the master record associated with the retrieved database record;   associating a newly created or updated database record in the data with the master record;   wherein:
 the step of associating comprises processing the newly created or updated database record by analyzing an ownership meta-data table to determine which master record the database record should be associated with; 
 the step of identifying the master records in the data table further comprises:
 extending the Data Definition Language (DDL) to allow a database designer to define data ownership rules; 
 extending the DDL language processor to allow the set of authorization rule(s) to be stored in the ownership meta-data table for the database; and 
 extending the Data Base Management System to process the ownership meta-data table so as to identify the master records in the database; 
 
 the one or more ownership data fields includes: metadata, a flag field comprising information for indicating whether the database record has an associated master record, an owner identification field comprising information identifying the master record associated with the database record, a key of the master record associated with the database record, with the key being an integer, a table identification field comprising information identifying the data table comprising the master record associated with the database record, and/or a record identification field which identifies the master record associated with the database record; 
 the Database Management System further includes:
 extensions to the Data Definition Language that allow the database designer to declare information indicative of ownership relationships between tables containing master data and other tables containing data related to that master data, with the ownership relationships information being stored in an ownership meta-data table; and 
 extensions in the Database Management System that are adapted to be triggered when a new database record is created or an existing record is updated so as to process the one or more ownership data fields to determine which master records, if any, that database record should be associated with; 
 
 the database comprises the set of database records in various data tables as master records; 
 the database is a relational database; and 
 the protected information comprises protected health information.