DETAILED ACTION
This office action is based on the amended claim(s) filed on 08/28/2026.
Claims 1-10, 13-16, and 19-21 has been amended.
Claim 11-12, 17-18 have been canceled.
Claims 1-10, 13-16 and 19-21 are currently pending and have been examined.
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Claim Rejections - 35 USC § 101
35 U.S.C. 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title.
Claim 1-10, 13-16 and 19-21 are rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea without significantly more. Claims 1-10, 13-16, 19, and 21 are drawn to a method, and Claim 20 is drawn to a system, which are within the four statutory categories (i.e., a machine and a process). Claims 1-10, 13-16 and 19-21 are further directed to an abstract idea on the grounds set out in detail below.
Under Step 2A, Prong 1, the steps of the claim for the invention represents an abstract idea of a series of steps that recite a process for identifying a high-profile patient(s) and risk level and determining data access. Collecting a patient(s) data from different sources, analyzing, and determine the profile of the patient and risk are steps that could have been performed by a human performing the steps arranging patient data citing an abstract idea directed to organizing and managing patient information but for the fact that the claims recite a general-purpose computer processor to implement the abstract idea for which both the instant claims and the abstract idea are defined as Methods of Organizing Human Activity.
Independent Claim 1 recites the steps of:
determining, by one or more processors, a patient entity;
obtaining, by the one or more processors, a first set of data associated with the patient entity from one or more database systems, the first set of data comprising first entity identification data;
obtaining, by the one or more processors and using the first set of data, a second set of data from one or more web pages, the second set of data comprising second entity identification data and risk level indication data;
comparing, by the one or more processors, the first entity identification data with the second entity identification data;
determining, by the one or more processors, that a threshold match exists between the first entity identification data and the second entity identification data based on the comparing the first entity identification data with the second entity identification data;
generating, by the one or more processors, a risk level associated with the patient entity and a confidence rate, using a trained machine learning model, the risk level indication data and risk criteria;
the trained machine learning model trained using first risk level indication training data obtained from a second one or more web pages and the risk criteria and/or second risk level indication training data provided via user input to determine an association between the one or more risk levels and one or more factors identified in the first risk level indication training data and/or the second risk level indication training data based on weights or biases assigned to the one or more factors;
determining, by the one or more processors, that a threshold risk exists with respect to the patient entity based on the generated risk level and the confidence rate;
associating, by the one or more processors, the patient entity with a high-profile indicator based upon determining that the threshold risk exists;
responsive to determining, by the one or more processors, that the threshold risk exists with respect to the patient entity, restricting, by the one or more processors, network access to at least one electronic record associated with the patient entity;
monitoring, by the one or more processors, access events to one or more records from the one or more database systems;
generating, by the one or more processors, suspicion scores associated with user access of the one or more records;
comparing, by the one or more processors, the suspicion scores associated with user access to records of entities associated with high-profile indicators to a first anomalous activity threshold;
comparing, by the one or more processors, the suspicion scores associated with user access to records of entities not associated with high-profile indicators to a second anomalous activity threshold different from the first anomalous activity threshold;
based on the comparing the suspicion scores to the first anomalous activity threshold and based on the comparing the suspicion scores to the second anomalous activity threshold, determining, by the one or more processors, one or more potential breaches associated with the access events; and
generating, by the one or more processors, alerts based on the one or more potential breaches”.
Independent Claim 16 recites the steps of:
“obtaining, by one or more processors, a first set of data associated with a patient entity from one or more database systems, the first set of data comprising first entity identification data;
obtaining, by the one or more processors, a second set of data from one or more web pages, the second set of data comprising second entity identification data and risk level indication data;
generating, by the one or more processors and using a machine learning model and the risk level indication data, one or more risk levels associated with a patient entity and a confidence rate, the machine learning model trained using first risk level indication training data obtained from a second one or more web pages and risk criteria and/or second risk level indication training data provided via user input to determine an association between one or more risk levels and one or more factors identified in the first risk level indication training data and/or the second risk level indication training data based on weights or biases assigned to the one or more factors,
wherein the one or more risk levels including at least one of i) a first risk level determined based on first risk level indication data or ii) a second risk level provided via user input, the user input further including second risk level indication data;
displaying, by the one or more processors and via a graphical user interface (GUI), the one or more risk levels and corresponding of the first and/or second risk level indication data for validation;
receiving, by the one or more processors and via the GUI, a feedback validating or invalidating each of the one or more risk levels;
updating, by the one or more processors and using the feedback and a set of features derived from the first and/or second risk level indication data corresponding to the one or more risk levels, the machine learning model configured to classify the patient entity into an appropriate risk level;
analyzing, by the one or more processors, the risk level indication data for the patient entity against the risk criteria;
determining, by the one or more processors, that a threshold risk exists with respect to the patient entity based on the analyzing the risk level indication data and the confidence rate;
associating, by the one or more processors, the patient entity with an elevated risk level based upon determining that the threshold risk exists;
responsive to determining, by the one or more processors, that the threshold risk exists, restricting, by the one or more processors, network access to at least one electronic record associated with the patient entity;
monitoring, by the one or more processors, access events to one or more records from the one or more database systems;
generating, by the one or more processors, suspicion scores associated with user access of the one or more records;
comparing, by the one or more processors, the suspicion scores associated with user access to records of entities associated with the elevated risk level to a first anomalous activity threshold;
comparing, by the one or more processors, the suspicion scores associated with user access to records of entities not associated with the elevated risk level to a second anomalous activity threshold different from the first anomalous activity threshold;
based on the comparing the suspicion scores to the first anomalous activity threshold and based on the comparing the suspicion scores to the second anomalous activity threshold, determining, by the one or more processors, one or more potential breaches associated with the access events; and
generating, by the one or more processors, alerts based on the one or more potential breaches”.
Independent Claim 20 recites the following steps:
“a memory storing instructions and a trained machine learning model configured to classify patient entities into appropriate risk levels; and at least one processor operatively connected to the memory and configured to execute the instructions to perform operations including:
determining a patient entity from a database system;
obtaining at least one of first risk level indication data associated with the patient entity from one or more web pages and second risk level indication data associated with the patient entity from user input, the second risk level indication data including a risk level;
deriving a set of features from the first risk level indication data and the second risk level indication data;
providing the set of features to the trained machine learning model;
generating, using the trained machine learning model, an updated risk level associated with the patient entity and a confidence rate,
the trained machine learning model trained by using first risk level indication training data obtained from a second one or more web pages and risk criteria and/or second risk level indication training data provided via user input to determine an association between one or more of risk levels and one or more factors identified in the first risk level indication training data and/or the second risk level indication training data based on weights or biases assigned to the one or more factors;
associating the patient entity with a risk level indicator corresponding to the updated risk level and the confidence rate
responsive to determining that the updated risk level exceeds a threshold risk level; associating the patient entity with a high-profile status restricting network access to at least one electronic record associated with the patient entity;
monitoring access events to one or more records from the database system;
generating suspicion scores associated with user access of the one or more records;
comparing the suspicion scores associated with user access to records of entities associated with high-profile statuses to a first anomalous activity threshold;
comparing the suspicion scores associated with user access to records of entities not associated with a high-profile statuses to a second anomalous activity threshold different from the first anomalous activity threshold;
based on the comparing the suspicion scores to the first anomalous activity threshold and based on the comparing the suspicion scores to the second anomalous activity threshold, determining one or more potential breaches associated with the access events; and
generating alerts based on the one or more potential breaches”.
The limitations, as drafted, given the broadest reasonable interpretation, cover performance of the limitations by a human user/actor interacting with a computing system that constitute certain methods of organizing human activity along with mental process, thus, an abstract idea, but for the recitation of generic computer components. The claimed concept encompasses a user to performance of the limitations for obtaining a patient identity pr profile from a medical record, compare the information, determine a risk level for the patient profile, and associate the risk level to level of the patient profile and monitor access to the patient information, which are steps that could be performed by a human actor interacting with other user(s) and/or a machine as such identifying an abstract idea. This abstract idea could have been performed by a human actor but for the fact that the claims recite a general-purpose computer processor to implement the abstract idea for configuring and obtaining, comparing, associating, monitoring, information of a patient following instruction. If a claim limitation(s), under its broadest reasonable interpretation, covers performance of the limitation(s) by a human actor but for the recitation of generic computer components, then it falls within the “Certain Methods of Organizing Human Activity” grouping of abstract ideas. Accordingly, the claim limitations (in BOLD) recite an abstract idea. Any limitations not identified above as part of methods of organizing human activity are deemed "additional elements," and will be discussed in further detail below.
Under Step 2A, Prong 2, this judicial exception is not integrated into a practical application because the remaining elements amount to no more than general purpose computer components programmed to perform the abstract ideas, linking the abstract idea to a particular technological environment. In particular, the claims recite the additional elements such as “processor, memory, web pages, machine learning model, database, graphical user interface, network” that is/are recited at a high - level of generality (i.e., as generic processors, machine learning model) to perform the steps, “updating...”, “store[ing]…”, “display[ing]…”, “provide[ing]… that iteratively takes input data and analyzes said data to determine an output to performing generic computer functions for determining risk level(s) such that it amounts no more than adding the words "apply it" (or an equivalent) with the judicial exception, or mere instructions to implement an abstract idea on a computer, or merely uses a computer as a tool to perform an abstract idea, see MPEP 2106.05(f) (e.g. “automatically generating a first database entry that includes computer-readable links to the one or more web pages used to determine the threshold and one or more computer-readable pointers connecting the high-profile indicator to a patient entity database entry in the one or more database systems associated with the patient entity...”), generally linking the use of the judicial exception to a particular technological environment or field of use, see MPEP 2106.05(h), and a mere data gathering process that does not add a meaningful limitation to the above abstract idea, see MPEP 2106.05(g). As set forth in the 2019 Eligibility Guidance, 84 Fed. Reg. at 55 "merely include[ing] instructions to implement an abstract idea on a computer" is an example of when an abstract idea has not been integrated into a practical application. Accordingly, looking at the claim as a whole, individually and in combination, these additional elements do not integrate the abstract idea into a practical application because they do not impose any meaningful limits on practicing the abstract idea. The claim is directed to an abstract idea.
Under step 2B, the claims do not include additional elements that are sufficient to amount to significantly more than the judicial exception because they do not present improvements to another technology or technical field and the additional elements amount to no more than a generic computer components, recited at a high level of generality, that amounts to no more than adding the words "apply it" (or an equivalent) to apply the exception using generic computer component, see MPEP 2106.05(f), and a mere data gathering process that does not add a meaningful limitation to the above abstract idea, see MPEP 2106.05(g). There is no indication that the combination of elements improves the functioning of a computer or improves any other technology. Their collective functions merely provide conventional computer implementation and mere instructions to apply an exception using a generic computer component to the abstract idea, for example, applying a machine-learning model to the abstract idea cannot provide an inventive concept, see Alice, 573 U.S. at 223 ("mere recitation of a generic computer cannot transform a patent-ineligible abstract idea into a patent-eligible invention"). Therefore, whether considered alone or in combination, the additional elements do not amount to significantly more than the abstract idea.
Dependent Claims 2-10, 13-15, 19, and 21 include all of the limitations of claim(s) 1, 16, and 20, and therefore likewise incorporate the above-described abstract idea. While the depending claims add additional limitations, such as
As for claims 2-4, 13-15, 19, and 21 recite limitations that are under the broadest reasonable interpretation, further define the abstract idea noted in the independent claim(s) that covers a performing the steps by a human actor associating/comparing/organizing/monitoring patient data, which is a certain methods of organizing human activity, but for, the recitation of the generic computer components which are similarly rejected because, neither of the claims, further, defined the abstract idea and do not further limit the claim to a practical application or provide an inventive concept such that the claims are subject matter eligible. Mere instructions to apply an exception using a generic computer component cannot provide an inventive concept ("significantly more").
As for claims 5-10, the claim(s) recite limitations that are under the broadest reasonable interpretation, further define the abstract idea noted in the independent claim(s) that covers a performing the steps by a human actor associating/comparing/organizing/monitoring patient data, which is a certain methods of organizing human activity, but for, the recitation of the generic computer components which are similarly rejected because, neither of the claims, further, defined the abstract idea and do not further limit the claim to a practical application or provide an inventive concept such that the claims are subject matter eligible. The claims recite additional elements “graphical user interface, machine learning model, processors, database, web pages”. This recitation of additional elements in the claim(s), is merely implemented as a tool such that it amounts no more than adding the words "apply it" (or an equivalent) with the judicial exception, or mere instructions to implement an abstract idea on a computer, or merely uses a computer as a tool to perform the steps (e.g. “train[ing]…”, “display[ing]…”), of an abstract idea, see MPEP 2106.05(f), and a mere data gathering process that does not add a meaningful limitation to the above abstract idea, see MPEP 2106.05(d). Accordingly, these additional elements do not integrate the abstract idea into a practical application because it does not impose any meaningful limits on practicing the abstract idea. The claims do not include additional elements that are sufficient to amount to significantly more than the judicial exception. Mere instructions to apply an exception using a generic computer component cannot provide an inventive concept ("significantly more").
Response to Amendment
Applicant's arguments filed 08/28/2026 have been fully considered by the Examiner and addressed as the following:
In the remarks, Applicant argues in substance that:
Applicant's arguments with respect to the 35 U.S.C. § 112(a) rejection on page 11.
In response to the Applicant amendment, Examiner withdraws the 112(a) rejection.
Applicant's arguments with respect to the 35 U.S.C. § 101 rejection on page 11-15.
On page 12 of the remarks, Applicant argues that the claims are not directed to a judicial exception arguing “Applicant respectfully disagrees with this characterization of the claims. However, Applicant has amended the claims to advance prosecution and respectfully submits that the amended Claims do not recite and are not directed to an abstract idea and are instead directed to patent-eligible subject matter... Amended claim 1 is directed to a computer-implemented method for identifying breaches of patient data. The claimed method is "necessarily rooted in computer technology" in order to overcome a problem specifically arising in network access of electronic records. See DDR Holdings, LLC v. Hotels.com, L.P., 773 F.3d 1245, 1256 (Fed. Cir. 2014)”, Examiner respectfully disagree. The claim limitations, given their broadest reasonable interpretation, recite steps, i.e., analyzing risk level to patient information based on the received information of the patient and monitoring access to the patient information and grant or restrict access, which have been analyzed under Step 2A, Prong One reciting a process for obtaining/collecting patient data/information from different sources, comparing and analyzing risk level of the data, monitoring access events to the patient information and generating a suspicious score for access and provide an alert, which are steps of associating, comparing, organizing, monitoring patient data, grant or restrict access, along with observing, evaluating, judgment, and opinion that are citing a process for which can be performed by a human following instructions, but for the fact that the claims recite a general-purpose computer processor to implement the abstract idea for which both the instant claims and the abstract idea are defined as Certain Methods of Organizing Human Activity and Mental Process.
In addition, as described in the final OA mailed 09/03/2025 and non-final mailed 3/30/2026, response to remarks, that DDR Holdings did not disclose any non-conventional technology but were 101 patent eligible because they used known information in combination of conventional technology to present the information in a new form by combining contacts on a website which provides a solution rooted in computer technology in order to overcome a problem specifically arising in the realm of computer networks. In contrast, the instant claims do not recite any solution to a technical or provide a technological improvement similar to in DDR Holdings.
On page 13 of the remarks, Applicant argues that the claims are not directed to a judicial exception arguing “Applicant respectfully submits that the claims are directed to improvements in computer technology under the same principles emphasized in Ex parte Desjardins ... Rather, amended claim 1 recites meaningful limitations to the claimed method, directly applicable to the problem and advantages presented”, Examiner respectfully disagree. As described in the prior OA mailed 3/30/206, response to remarks, The PTAB had found the Desjardins invention ineligible under Section 101 as being directed to an abstract idea however the Appeals Review Panel (ARP) found the claims to be directed to methods for training artificial intelligence/machine learning (AI) models and the claims improved the functioning of the computer itself by reducing storage requirements and preserving task performance across sequential training as such improves the operation of a machine learning system by enhancing its training efficiency or preserving prior learning, as such it is not “directed to” an abstract idea under Alice Step 1. In addition, the improvement in Enfish, for example, provided an improvement to a computer function and/or technical field (self-pointing database) reciting a self-referential table for a computer database providing a particular improvement in the computer’s functionality that improves the way a computer stores and retrieves data in memory.
In contrast and as mentioned above, the machine learning (ML) model, is/are recited in the claims in a high level of generality and is in described in the specification, (see PGPub 0018, 0021, 0049), in an arbitrary form without disclosing a specific algorithm and implementing the claimed invention for allowing the model to learn patterns and relationships within the data and implement these additional elements to perform the claimed function rather the trained ML model is recited at a high level of generality and describing a general concept of using a ML model to perform task(s) which is a mere in instruction(s) that may be performed by human that it amounts no more than adding the words "apply it" (or an equivalent). Moreover, restricting access as recited in the claim, under BRI, has been identified as step of concept of controlling or restricting who can view or access data that is identified as part of the abstract idea while linking to a technological environment—like a processor, memory, web pages, machine learning model, database, graphical user interface, network —does not make the core idea non-abstract, see (Applicant [0062], [0067], [0098]).
On page 13 of the remarks, Applicant argues that the claims are not directed to a judicial exception arguing “Because the claims are not directed to an abstract idea, they do not need to be analyzed under Step 2B of the eligibility analysis. See Enfish LLC v. Microsoft Corp ... However, even if the claims were found to involve an abstract idea, which they should not be, the claims are directed to "significantly more" than an abstract idea and thus comply with Section 101... Additionally, the claims include specific limitations other than what is well-understood,
routine, conventional activity in the field. MPEP 2106.05(I)(A)(v).”, Examiner respectfully disagree. As described in the prior OA mailed 3/30/206, response to remarks and described above that the instant claims are not analogous to Ex parte Desjardins and/or Enfish, and do not describe any improvement to a computing system or components or technological field. In light of the Alice decision and the guidance provided in the 2019 PEG, the features listed in the claims are not considered an improvement to another technology or technical field, or an improvement to the functioning of the computer itself. At best, these features may be considered to be an organizational issue solving managing personal information, using computers. The alleged benefits that Applicants tout such as are due to administrative decisions, using computers, rather than any improvement to another technology or technical field, or an improvement to the functioning of the computer itself. Relying on computing devices to perform routine tasks more quickly or more accurately is insufficient to render a claim patent eligible (See Alice, 134 S. Ct. at 2359 "use of a computer to create electronic records, track multiple transactions, and issue simultaneous instructions" is not an inventive concept).
There is a fundamental difference between computer functionality improvements, on the one hand, and uses of existing computers as tools to perform a particular task, on the other. There is nothing, for example, in the pending claims to suggest that the claimed "processor", "machine-learning model" applied by said processors and "computing device" are somehow made more efficient or that the manner in which these elements carry out their basic functions is otherwise improved in any way. The alleged advantages that Applicants tout do not concern an improvement in computer capabilities but instead relate to an alleged improvement in determining high-profile patient information risk, for which a computer is used as a tool in its ordinary capacity.
On page 15 of the remarks, Applicant argues that the claims are not directed to a judicial exception arguing “These limitations are not "incidental to the primary process" of amended claim 1, reciting more than extra-solution activity. MPEP 2106.05(g). Rather, they are significant to the claimed method "for identifying breaches of patient data."... Consequently, even if the present claims recited a judicial exception (which applicant disputes), the claims would not be "directed to" an abstract idea and, in any case, would represent significantly more than an abstract idea.”, Examiner respectfully disagree. The claims, under BRI, recite steps such as monitoring, determining, generating warning that encompass a judicial exception to define the identified abstract idea, the claims recite additional elements that it amounts no more than adding the words "apply it" (or an equivalent) with the judicial exception, e.g., generating an entry, and storing in a database. The claim(s), as a whole, recites an abstract idea for identifying a high-profile patient and associating risk and nowhere the claims nor the specification recite a technical solution improving the functioning of a computer or improves another technology or technical field rather the claimed invention is describing a solution addressing an administrative activity for identifying high-profile patient entities faster than a manual classification process. In addition, the cited specification [0025] in the Applicant remarks do not indicate an improvement to a computer system nor a addressing a technical issue rather describing a standard behavior of any computing system according to data processing and will not cause the claim to be "directed to" something other than an abstract idea. As mentioned above, the Applicant's invention is to improve the abstract idea of process to identify and monitor patient entities with high risk levels, through leveraging computing technology, e.g., processor, machine learning model, in a well understood manner. However, improving upon an abstract idea does not make the abstract idea any less abstract.
Therefore, the Applicant argument is found to be unpersuasive, and Examiner remains the 101 rejections of claims which have been updated to address Applicant's argument.
Conclusion
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a). A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any extension fee pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to ALAAELDIN ELSHAER whose telephone number is (571)272-8284. The examiner can normally be reached M-Th 8:30-5:30.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, MAMON OBEID can be reached at Mamon.Obeid@USPTO.GOV. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/ALAAELDIN M. ELSHAER/Primary Examiner, Art Unit 3687
Prosecution Insights