DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
This initial written action is responding to the communication dated on 04/03/2025.
Claims 1-21 are submitted for examination.
Claims 1-21 are pending.
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
Priority
This application filed on April 03, 2025 claims priority of Provisional application 63/635,385 filed on April 17, 2024.
Information Disclosure Statement
The following Information Disclosure Statements in the instant application submitted in compliance with the provisions of 37 CFR 1.97, and thus, have been fully considered:
IDS filed on 07 April 2025.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1-2, 4-5, 7-9, 12-13, 15-16, 18-19 and 21 are rejected under 35 U.S.C. 103 as being unpatentable over Boston et al. (US PGPUB. # US 2016/0019346, hereinafter “Boston”), and further in view of Bhatt et al. (US PAT. # US 11,582,240, hereinafter “Bhatt”).
Referring to Claims 1, 12 and 21:
Regarding Claim 1, Boston teaches,
A computer system for advanced provisioning of secure information, the system comprising at least one processor in communication with at least one memory device, the at least one processor programmed to: (¶189)
store a plurality of sets of personal information for a plurality of individuals, wherein each set of personal information of the plurality of personal information is stored with a plurality of privacy settings for accessing the corresponding set of personal information; (Fig. 2, ¶65, “the demographic data module 80, according to one or more embodiments, houses and manages one or more patients' demographic information, such as age, weight, sex, et”, ¶77, “segments of data are sharable to and viewable by this requester (e.g., the requester at step 102) based on laws, patient privacy settings”, ¶92, i.e. personal set of information for individuals along with their privacy preference are stored in a database)
receive, from a requestor device, a request for access to a first set of personal information for a first individual, (Fig. 3(102), ¶70-¶75, i.e. a request to access personal information for an individual is received) [wherein the request for access includes one or more attributes];
determine one or more items of information from the first set of personal information approved to be provided in response to the request for access; (Fig. 3, ¶76, “the system identifies permissible segments”, ¶77, “one or more segments of data are sharable to and viewable by this requester (e.g., the requester at step 102) based on laws, patient privacy settings”, ¶78, “identifies two permissible segments viewable by the requester”, ¶92, “the retrieved patient segment is restricted by the patient (e.g., the patient can submit to the UMIS with whom they wish any or all of his or her data to be shared)”, i.e. it is determined which information is approved to provide the requester for the request)
generate a response to the request for access to the first set of personal information including the one or more items of information; (Fig. 3, ¶79, “the system normalizes the data in the permissible set (e.g., the permissible set of identified segments above)”, ¶80-¶81, ¶83, i.e. a personal report including personal item is generated) and
transmit, to the requestor device, the response to the request for access to the first set of personal information. (Fig. 3, ¶84, “ the system is configured to present the permissible set by transmitting the data to one or more displays”, “In a particular embodiment, the system is configured to transmit the data to one or more displays associated with a computer system of the party that requested the data (e.g., the requester at step 102)”, i.e. generated report (first set of personal information) is transmitted to the requester device).
Boston does not teach explicitly,
[receive, from a requestor device, a request for access to a first set of personal information for a first individual], wherein the request for access includes one or more attributes;
compare the one or more attributes of the request for access to the plurality of privacy settings for the first set of personal information;
However, Bhatt teaches,
[receive, from a requestor device, a request for access to a first set of personal information for a first individual], wherein the request for access includes one or more attributes; (Fig. 12, CL(13), LN(62-67), CL(14), LN(1-5), “user attributes and context data can be received, for example in response to a request for access to data including sensitive or confidential data”, i.e. request access includes attributes)
compare the one or more attributes of the request for access to the plurality of privacy settings for the first set of personal information; (CL(2), LN(48-55), Fig. 12, CL(14), LN(5-17), “User attribute and context data can be utilized to determine a predetermined persona that most closely matches the user, i.e. comparison is made for user attributes to a user’s policy (privacy) settings).
As per KSR vs Teleflex, combining prior art elements according to known methods (device, product) to yield predictable results may be used to create a prima facie case of obviousness.
It would have been obvious to one of ordinary skill in the art before the effective filing date to have combined the teachings of Bhatt with the invention of Boston.
Boston teaches, storing plurality of personal information along with privacy settings of users and receiving a request to access the personal information and providing the requested information based on privacy settings. Bhatt teaches, receiving a request to access user’s personal information along with user’s attribute and comparing the attributes with the stored attributes to retrieve the information. Therefore, it would have been obvious to have receiving a request to access user’s personal information along with user’s attribute and comparing attributes with the stored attributes to retrieve the information of Bhatt with storing plurality of personal information along with privacy settings of users and receiving a request to access the personal information and providing the requested information based on privacy settings of Boston to protect data according to level of sensitivity of the data as well as one or more policies or regulations.
KSR Int’l v. Teleflex Inc., 127 S. Ct. 1727, 1740-41, 82 USPQ2d 1385, 1396 (2007).
Regarding Claim 12 it is a method claim of above system claim 1 and therefore Claim 12 is rejected with the same rationale as applied against Claim 1 above.
Regarding Claim 21 it is a non-transitory computer-readable storage media claim of above system claim 1 and therefore Claim 21 is rejected with the same rationale as applied against Claim 1 above.
Referring to Claims 2 and 13:
Regarding Claim 2 rejection of Claim 1 is included and for the same motivation Boston teaches,
The computer system of claim 1, wherein the at least one processor is further programmed to execute a privacy model to determine the one or more items of information from the first set of personal information to approve providing in response to the request for access. (Fig. 3(200), “the system identifies permissible segment”, “one or more requesters may not be permitted to view one or more portions of patient data (e.g., because of privacy laws, patient preferences, etc.)”, Fig. 4(204), “the system determines whether the retrieved patient segment is sharable to the requester (e.g., the data included may be restricted as to with whom the data can be shared). In various embodiments, the retrieved patient segment is restricted by the Health Insurance Portability and Accountability Act (“HIPAA”) and/or other privacy regulations”, i.e. privacy policies (privacy model) is executed to determine whether a request can be approved or not based on the policies).
Regarding Claim 13 rejection of Claim 12 is included and Claim 12 is rejected with the same rationale as applied against Claim 2 above.
Referring to Claims 4 and 15:
Regarding Claim 4 rejection of Claim 2 is included and for the same motivation Boston teaches,
The computer system of claim 2, wherein the at least one processor is further programmed to determine one or more of the plurality of privacy settings based upon execution of the privacy model. (Fig. 4, ¶92, ¶95).
Regarding Claim 15 rejection of Claim 13 is included and Claim 15 is rejected with the same rationale as applied against Claim 4 above.
Referring to Claims 5 and 16:
Regarding Claim 5 rejection of Claim 1 is included and for the same motivation Boston teaches,
The computer system of claim 1, wherein the plurality of personal information includes personal healthcare information (PHI). (¶65-¶66, “the demographic data module 80 and the clinical data module 90 are maintained separately for enhanced security of the one or more patients' personal health information”, ¶73).
Regarding Claim 16 rejection of Claim 12 is included and Claim 16 is rejected with the same rationale as applied against Claim 5 above.
Regarding Claim 7 rejection of Claim 1 is included and for the same motivation Boston does not teach explicitly,
The computer system of claim 1, wherein the requestor device executes an application programming interface (API) to transmit the request for access.
However, Bhatt teaches,
The computer system of claim 1, wherein the requestor device executes an application programming interface (API) to transmit the request for access. (CL(5), LN(17-20)).
Referring to Claims 8 and 18:
Regarding Claim 8 rejection of Claim 1 is included and for the same motivation Boston teaches,
The computer system of claim 1, wherein [the one or more attributes] includes a category for a requestor associated with the requestor device, and wherein the at least one processor is further programmed to determine one or more items of information from the first set of personal information to be provided in response to the request for access based upon the category for the requestor. (¶91, ¶83-¶84)).
Boston does not teach explicitly,
The computer system of claim 1, wherein the one or more attributes [includes a category for a requestor associated with the requestor device, and wherein the at least one processor is further programmed to determine one or more items of information from the first set of personal information to be provided in response to the request for access based upon the category for the requestor].
However, Bhatt teaches,
The computer system of claim 1, wherein the one or more attributes (Fig. 12, CL(13), LN(62-67), CL(14), LN(1-5)) [includes a category for a requestor associated with the requestor device, and wherein the at least one processor is further programmed to determine one or more items of information from the first set of personal information to be provided in response to the request for access based upon the category for the requestor].
Regarding Claim 18 rejection of Claim 12 is included and Claim 18 is rejected with the same rationale as applied against Claim 8 above.
Referring to Claims 9 and 19:
Regarding Claim 9 rejection of Claim 1 is included and for the same motivation Boston teaches,
The computer system of claim 1, wherein [the one or more attributes] includes a category for a requestor associated with the requestor device, and wherein the at least one processor is further programmed to determine one or more items of information from the first set of personal information to prevent access to based upon the category for the requestor. (Fig. 4(204, 206), ¶92-¶93, ¶94, “determining that the retrieved patient segment is not sharable to this requester, the system discards the retrieved patient segment”, Fig. 4, (208, 210), ¶95-¶96),
Boston does not teach explicitly,
The computer system of claim 1, wherein the one or more attributes [includes a category for a requestor associated with the requestor device, and wherein the at least one processor is further programmed to determine one or more items of information from the first set of personal information to prevent access to based upon the category for the requestor].
However, Bhatt teaches,
The computer system of claim 1, wherein the one or more attributes (Fig. 12, CL(13), LN(62-67), CL(14), LN(1-5)) [includes a category for a requestor associated with the requestor device, and wherein the at least one processor is further programmed to determine one or more items of information from the first set of personal information to prevent access to based upon the category for the requestor].
Regarding Claim 19 rejection of Claim 12 is included and Claim 19 is rejected with the same rationale as applied against Claim 9 above.
Claims 3 and 14 are rejected under 35 U.S.C. 103 as being unpatentable over Boston et al. (US PGPUB. # US 2016/0019346, hereinafter “Boston”), and further in view of Bhatt et al. (US PAT. # US 11,582,240, hereinafter “Bhatt”), and further in view of Bell et al. (US PGPUB. # US 2025/0094611, hereinafter “Bell”, provided by the applicant in an IDS).
Referring to Claims 3 and 14:
Regarding Claim 3 rejection of Claim 2 is included and combination of Boston and Bhatt does not teach explicitly,
The computer system of claim 2, wherein the at least one processor is further programmed to train the privacy model to determine an amount of access to provide to requestors based upon a plurality of historical requests and responses.
However, Bell teaches,
The computer system of claim 2, wherein the at least one processor is further programmed to train the privacy model to determine an amount of access to provide to requestors based upon a plurality of historical requests and responses. (¶42, Fig. 2, ¶44, “ personal data of the user can be used in training protection ML model 212. Accordingly, protection ML model 212 can be retrained based on the user's answer to the request (e.g. train based on the user's personal information if accepted”, ¶62, Claim 9).
As per KSR vs Teleflex, combining prior art elements according to known methods (device, product) to yield predictable results may be used to create a prima facie case of obviousness.
It would have been obvious to one of ordinary skill in the art before the effective filing date to have combined the teachings of Bell with the invention of Boston in view of Bhatt.
Boston in view of Bhatt teaches, storing plurality of personal information along with privacy settings of users and receiving a request to access the personal information and providing the requested information based on privacy settings and receiving a request to access user’s personal information along with user’s attribute and comparing the attributes with the stored attributes to retrieve the information. Bell teaches, utilizing machine learning model and training the machine learning model to determine sensitive data access. Therefore, it would have been obvious to utilize machine learning model and training the machine learning model to determine sensitive data access of Bell into the teachings of Boston in view of Bell for improved handling of data in large language model processing.
KSR Int’l v. Teleflex Inc., 127 S. Ct. 1727, 1740-41, 82 USPQ2d 1385, 1396 (2007).
Regarding Claim 14 rejection of Claim 13 is included and Claim 14 is rejected with the same rationale as applied against Claim 3 above.
Claims 6 and 17 are rejected under 35 U.S.C. 103 as being unpatentable over Boston et al. (US PGPUB. # US 2016/0019346, hereinafter “Boston”), and further in view of Bhatt et al. (US PAT. # US 11,582,240, hereinafter “Bhatt”), and further in view of Randhava et al. (US PGPUB. # US 2022/0391534, hereinafter “Randhava”).
Referring to Claims 6 and 17:
Regarding Claim 6 rejection of Claim 5 is included and combination of Boston and Bhatt does not teach explicitly,
The computer system of claim 5, wherein the at least one processor is further programmed to:
analyze a set of personal information to determine a healthcare recommendation for the corresponding individual; and
provide the healthcare recommendation to the corresponding individual.
However, Randhava teaches,
The computer system of claim 5, wherein the at least one processor is further programmed to:
analyze a set of personal information to determine a healthcare recommendation for the corresponding individual; (¶241, ¶242) and
provide the healthcare recommendation to the corresponding individual. (¶242).
As per KSR vs Teleflex, combining prior art elements according to known methods (device, product) to yield predictable results may be used to create a prima facie case of obviousness.
It would have been obvious to one of ordinary skill in the art before the effective filing date to have combined the teachings of Randhava with the invention of Boston in view of Bhatt.
Boston in view of Bhatt teaches, storing plurality of personal information along with privacy settings of users and receiving a request to access the personal information and providing the requested information based on privacy settings and receiving a request to access user’s personal information along with user’s attribute and comparing the attributes with the stored attributes to retrieve the information. Randhava teaches, analyzing a person’s private health information and providing wellness recommendation. Therefore, it would have been obvious to analyze a person’s private health information and providing wellness recommendation of Randhava into the teachings of Boston in view of Bell to protect a person’s health record and suggest healthy recommendation to the person for their wellbeing.
KSR Int’l v. Teleflex Inc., 127 S. Ct. 1727, 1740-41, 82 USPQ2d 1385, 1396 (2007).
Regarding Claim 17 rejection of Claim 16 is included and Claim 17 is rejected with the same rationale as applied against Claim 6 above.
Claim 10 is rejected under 35 U.S.C. 103 as being unpatentable over Boston et al. (US PGPUB. # US 2016/0019346, hereinafter “Boston”), and further in view of Bhatt et al. (US PAT. # US 11,582,240, hereinafter “Bhatt”), and further in view of Prakash et al. (US PGPUB. # US 2014/0090091, hereinafter “Prakash”).
Regarding Claim 10 rejection of Claim 1 is included and combination of Boston and Bhatt does not teach explicitly,
The computer system of claim 1, wherein the at least one processor is further programmed to receive the plurality of privacy settings for a set of personal information from the corresponding individual.
However, Prakash teaches,
The computer system of claim 1, wherein the at least one processor is further programmed to receive the plurality of privacy settings for a set of personal information from the corresponding individual. (¶14, ¶23, “a user may organize user information into one or more information profiles, with each datum of information having an associated privacy setting”, Fig. 4, ¶42, Fig. 5, ¶45-¶46).
As per KSR vs Teleflex, combining prior art elements according to known methods (device, product) to yield predictable results may be used to create a prima facie case of obviousness.
It would have been obvious to one of ordinary skill in the art before the effective filing date to have combined the teachings of Prakash with the invention of Boston in view of Bhatt.
Boston in view of Bhatt teaches, storing plurality of personal information along with privacy settings of users and receiving a request to access the personal information and providing the requested information based on privacy settings and receiving a request to access user’s personal information along with user’s attribute and comparing the attributes with the stored attributes to retrieve the information. Prakash teaches, a user assigning privacy setting for each personal data. Therefore, it would have been obvious to have a user assigning privacy setting for each personal data of Prakash into the teachings of Boston in view of Bell so a user can controlled each confidential data for sharing with others.
KSR Int’l v. Teleflex Inc., 127 S. Ct. 1727, 1740-41, 82 USPQ2d 1385, 1396 (2007).
Claims 11 and 20 are rejected under 35 U.S.C. 103 as being unpatentable over Boston et al. (US PGPUB. # US 2016/0019346, hereinafter “Boston”), and further in view of Bhatt et al. (US PAT. # US 11,582,240, hereinafter “Bhatt”), and further in view of Casey et al. (US PGPUB. # US 2023/0277246, hereinafter “Casey”).
Referring to Claims 11 and 20:
Regarding Claim 11 rejection of Claim 1 is included and combination of Boston and Bhatt does not teach explicitly,
The computer system of claim 1, wherein the at least one processor is further programmed to analyze a set of personal information to determine a service to provide to the corresponding individual.
However, Casey teaches,
The computer system of claim 1, wherein the at least one processor is further programmed to analyze a set of personal information to determine a service to provide to the corresponding individual. (Fig. 7, ¶153-¶156).
As per KSR vs Teleflex, combining prior art elements according to known methods (device, product) to yield predictable results may be used to create a prima facie case of obviousness.
It would have been obvious to one of ordinary skill in the art before the effective filing date to have combined the teachings of Casey with the invention of Boston in view of Bhatt.
Boston in view of Bhatt teaches, storing plurality of personal information along with privacy settings of users and receiving a request to access the personal information and providing the requested information based on privacy settings and receiving a request to access user’s personal information along with user’s attribute and comparing the attributes with the stored attributes to retrieve the information. Casey teaches, collecting and analyzing patient information to provide suggestion/guidance related to patient’s health. Therefore, it would have been obvious to collect and analyze patient information to provide suggestion/guidance related to patient’s health of Casey into the teachings of Boston in view of Bell so an accurate assessment of a patient's health is made and appropriate suggestion/guidance is provided to a patient.
KSR Int’l v. Teleflex Inc., 127 S. Ct. 1727, 1740-41, 82 USPQ2d 1385, 1396 (2007).
Regarding Claim 20 rejection of Claim 12 is included and Claim 20 is rejected with the same rationale as applied against Claim 11 above.
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure. Refer to PTO-892, Notice of References Cited for a listing of analogous art.
Mitra et al. (US PGPUB. # US 2023/0153448) discloses, facilitating generation of representative datasets. In embodiments, an original dataset for which a data representation is to be generated is obtained. A data generation model is trained to generate a representative dataset that represents the original dataset. The data generation model is trained based on the original dataset, a set of privacy settings indicating privacy of data associated with the original dataset, and a set of value settings indicating value of data associated with the original dataset. A representative dataset that represents the original dataset is generated via the trained data generation model. The generated representative dataset maintains a set of desired statistical properties of the original dataset, maintains an extent of data privacy of the set of original data, and maintains an extent of data value of the set of original data.
Walker et al. (US PGPUB. # US 2021/0390190) discloses, managing and rewarding sharing of user data via a computing device with a requesting device. A privacy risk score is received for the requesting device characterizing a degree of cyber risk for sharing data. Initial privacy settings are received for the user via a GUI in response to the privacy risk score characterizing the user data allowable for sharing. A reward incentive is then automatically determined based on the privacy risk and the initial privacy settings for sharing additional user data with the requesting device beyond that identified by the initial privacy settings. Then, in response to an override from the GUI overriding the initial privacy settings to accept the reward incentive and thereby allow sharing of the additional user data beyond the initial range: updated privacy settings are determined and the sharing of the user data is limited to the updated privacy settings.
Bulut et al. (US PGPUB. # US 2020/0394334) discloses, a method that receives at an apparatus a request from a first computing device for access to information related to a first user data set; determines, or receives an indication of a determination, whether the first computing device can access the information based on criteria for sharing information, the criteria based on one or more characteristics of the first user data set and a second user data set accessible by the first computing device; and provide a response based on the determination, the response preserving privacy of a user corresponding to the first user data set.
Rai (US PGPUB. # US 2018/0041475) discloses, a method for centralized management and enforcement of online privacy policies of a private network are provided. According to one embodiment, existence of private information contained in a data packet originated by a client device of a private network and destined for a server device external to the private network is identified by a network security device protecting the private network by scanning the data packet for information matching a signature contained within a private information signature database. An online privacy policy of the private network is determined by the network security device that is applicable to the private information with reference to a privacy policy set defined by an administrator of the private network. The online privacy policy is enforced by the network security device on the data packet by performing one or more actions specified by the online privacy policy to the data packet.
Biswas et al. (US PGPUB. # US 2015/0154357) discloses, a method for determining consent to access medical data based on an aggregate response. The group consent platform processes a response from each user of a subset of one or more users, one or more user privacy settings, one or more group privacy settings, or a combination thereof to determine a privacy policy for the subset. The subset is from a group of one or more users sharing a common genealogical relationship in response to a notification from a user from the group requesting consent to access medical data related to at least one test genetic test characteristic. The group consent platform then determines an aggregate response for the subset from the response from each user of the subset based on the privacy policy. The group consent platform also processes the aggregate response to determine whether the subset consented to access the medical data.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to DARSHAN I DHRUV whose telephone number is (571)272-4316. The examiner can normally be reached M-F 9:00 AM-5:00 PM.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Yin-Chen Shaw can be reached at 571-272-8878. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/DARSHAN I DHRUV/Primary Examiner, Art Unit 2498
Prosecution Insights