JP7453707B2 - Personal information anonymization system - Google Patents

Description

The present invention relates to a personal information anonymization system for generating anonymized information by anonymizing personal information from processed information including personal information such as electronic medical record information, and particularly relates to a personal information anonymization system that includes an inspection process by human visual inspection. Regarding anonymization system.

In recent years, electronic medical record information created by various medical institutions has been accumulated as big data and used as a statistical information database for research and development in the medical field, and the contents of treatments and tests at other medical institutions can be used as reference information. Attempts are being made to However, information regarding an individual's physical and mental condition, such as an individual's medical history, family history, oral medication history, physical findings, laboratory data, image data, and treatment policy, included in electronic medical record information is highly confidential information. If the information is identified as belonging to a specific individual, that person's privacy will be violated. Privacy is protected by the Constitution and the Personal Information Protection Act, and the Act on Anonymously Processed Medical Information to Contribute to Research and Development in the Medical Field was enacted to prevent the use of such medical information. Creation of "anonymous processed medical information" in which medical information is processed so that a specific individual cannot be identified and cannot be restored by deleting part of the included descriptions or all personal identification codes. is required. Note that deleting information includes replacing it with other descriptions, etc. using a method that does not have a regularity that allows it to be restored.

Patent Document 1 discloses that an electronic medical record server receives information on symptoms, disease name, and corresponding treatment input as electronic medical record information created for each patient from a plurality of electronic medical record terminals located at a plurality of medical institutions. A statistical information database is constructed by accumulating or testing, and each electronic medical record terminal searches the statistical information database according to the symptoms entered in the electronic medical record, and searches for the names of diseases that are frequently associated with such symptoms, An electronic medical record system is disclosed that selectably displays treatments, tests, etc. on the screen of an electronic medical record terminal. Patent Document 1 states that personal information such as the patient's name, address, and telephone number in electronic medical record information is unnecessary for the statistical information database, and from the perspective of personal information protection, it is preferable not to register it in the statistical information database. There is.

Patent Document 2 describes a system in which a plurality of information processing devices installed in a plurality of departments within a medical institution, each equipped with a reference viewer for displaying data, and an electronic medical record system equipped with a data warehouse are connected to enable data transmission and reception. When a patient ID is registered by a user, the server computer automatically assigns an anonymized ID and stores the patient's personal information together with the patient ID. Other information is recorded in the server storage unit as extended patient information with an anonymized ID and accumulated in the structured medical data integrated management database, and used when diagnosing and treating a specific patient in each clinical department. discloses an anonymized medical information search support system that displays information stored in a database together with a patient ID, and performs processing using an anonymized ID when switching to a search screen for searching medical information.

Furthermore, big data is beginning to be used in various fields other than the medical field. Big data is data for deriving knowledge useful for various businesses, and is a group of data from diverse sources. Big data includes, for example, weather, temperature, and humidity data in each region, purchase history and entry history accumulated on online shopping sites and blog sites, and multimedia data such as music and videos provided on web distribution sites. , social media data such as profiles and comments written by participants on social media, sensor data such as location, ride history, temperature, etc. detected by GPS, IC card, and RFID, managed by CRM (Customer Relationship Management) system This includes customer data such as direct mail data and membership card data.

JP2018-81528A Japanese Patent Application Publication No. 2019-133540

Regarding the anonymization of personal information, in Patent Document 1, among basic patient information such as patient ID, name, gender, date of birth, height, weight, age, address, and telephone number stored in a patient information table, the name The information is anonymized by not including personally identifiable information such as addresses, telephone numbers, etc. Furthermore, in Patent Document 2, the patient's personal information is recorded as basic patient information together with the patient ID, and by not associating the patient's personal information with the anonymized ID, the extended patient information recorded together with the anonymized ID includes personal information. I try not to include.

However, in Patent Documents 1 and 2, specific data that is recognized as information that can identify an individual, such as name, address, and telephone number, is anonymized by excluding each item, but other data Anonymization is insufficient if information that can identify an individual is included. For medical information that requires the creation of "anonymously processed medical information," if you simply exclude specific data such as name, address, and telephone number, the remaining data may still contain information that can identify individuals. machine anonymization was insufficient. In particular, when personal information is mixed in unstructured, irregular text information that can be written freely, it is difficult to extract it.

In Patent Document 2, the structured medical data integrated management database accumulates structured medical data, not data in free text format. Structuring data refers to a data format expressed in rows and columns, where each column has its own meaning, and the column value is selected from specific options, or a numerical value with a specified precision is entered, and the data format is managed based on specific rules. For this reason, the input in Patent Document 2 is designed to eliminate fluctuations in notation by standardizing the way each medical department writes, and selecting and entering from a selection screen. However, in actual medical examinations, the patient's chief complaint and the doctor's findings are often not only information that can be selected from a selection screen, and there is still a need for items that allow the input of free text format data in order to record information more accurately.

Sentences entered in free text format may be expressed differently depending on the person who entered them, or the input content may not be fixed, making it unsuitable for automatic processing by machines, so human visual inspection will determine if personal information is included. However, this method not only requires a huge amount of work, time and money, but also has the potential to be overlooked due to human error. could have occurred. Reliability can be improved by multiple tests conducted by multiple people, but it takes more time and money, which hinders the effective use of information. For this reason, currently, sentences input in free text format are all deleted because they may contain personal information, and important information is not used. In addition, when actually providing anonymized information, automatic anonymization by a machine alone is not trusted, and human test results are sometimes required as guarantee, which also hinders the effective use of anonymized information. This was a contributing factor.

The present invention has been made in view of the above-mentioned problems, and it is an object of the present invention to provide a personal information anonymization system that can seamlessly perform an automatic anonymization process by a machine and an inspection process by human visual inspection. With the goal. Furthermore, the present invention provides a personal information anonymization system that can improve accuracy through relearning, and/or a personal information anonymization system that can prevent erroneous anonymization. This is also one of the objectives.

In order to solve the above-mentioned problems, the personal information anonymization system of the present invention is a personal information anonymization system for generating anonymized information in which personal information is anonymized from processed information including personal information. a storage means in which processed information is stored; an anonymization means including an anonymization model for extracting a description to be anonymized from the processed information; and an inspection device including a display means and an input means; The anonymization means applies the anonymization model to the processed information acquired from the storage means to extract candidates for descriptions to be anonymized, and the inspection device extracts the anonymization information extracted by the anonymization means. The processed information is displayed on the display means so that candidates for the description to be anonymized can be recognized, and the input means is capable of modifying the candidate description to be anonymized displayed on the display means, and the input means can modify the candidate description to be anonymized displayed on the display means. If there is a modification by the input means, the device provides the modified data to the anonymization means, and if there is no modification by the input means, the device determines the candidate for the description to be anonymized as the description to be anonymized. The anonymization means trains the anonymization model using the corrected data.

Furthermore, in the above-mentioned personal information anonymization system, the anonymization means assigns a label for identifying the description content to the candidate description to be anonymized, and the inspection device attaches the label attached to the candidate. The processed information may be displayed on the display means so that the information can be recognized, and the input means may be able to modify the label.

Furthermore, in the personal information anonymization system, the anonymization model includes a non-anonymization dictionary that accumulates entries that are not to be anonymized, and excludes entries that correspond to the non-anonymization dictionary from the candidates for the descriptions to be anonymized. It is preferable.

Furthermore, in the personal information anonymization system, the anonymization means adds a label indicating that the description corresponds to the non-anonymization dictionary to the description that corresponds to the non-anonymization dictionary among the processed information. You may.

Furthermore, in the personal information anonymization system, the anonymization means generates provisional anonymization information by anonymizing the extracted candidates, and the testing device is configured to recognize the candidate description to be anonymized. Furthermore, the temporary anonymization information may be displayed on the display means, and the input means may be able to modify the temporary anonymization information.

Furthermore, in the personal information anonymization system, the testing device may display the temporary anonymization information on the display means simultaneously or switchably with the processed information.

Furthermore, in the personal information anonymization system, the input means may be capable of changing the anonymous processing performed by the anonymization means.

Furthermore, in the personal information anonymization system, the anonymization means may include an anonymization table storing details of anonymization, and change the temporary anonymization information by changing the anonymization table.

Furthermore, in the above-mentioned personal information anonymization system, it is preferable that the anonymization means replaces the descriptions to be anonymized with the same character string when the descriptions to be anonymized are the same.

Furthermore, the personal information anonymization system includes a plurality of inspection devices, and the plurality of inspection devices perform an inspection process on the same processed information, and the same information outputted from the plurality of inspection devices is Differences between a plurality of pieces of correction data with respect to the processed information may be determined, and if a difference occurs, the difference may be displayed for confirmation and the inspection process may be performed again.

In the personal information anonymization system of the present invention, the anonymization means extracts candidates for descriptions to be anonymized by applying an anonymization model to the processed information acquired from the storage means, and performs an automatic anonymization process by a machine. The inspection device displays the information to be processed on the display means so that it can recognize candidates for descriptions to be anonymized extracted by the anonymization means, and the input means displays the anonymous information displayed on the display means. Since candidates for descriptions to be anonymized can be modified, the automatic anonymization process by a machine and the inspection process by human visual inspection can be performed continuously and without interruption. Then, if there is a correction made by the input means in the human inspection process, the testing device provides the corrected data to the anonymization means, and if there is no correction made by the input means, the testing device converts the temporary anonymized information into the anonymized information. The anonymization means can improve the accuracy of machine anonymization by learning the anonymization model using the corrected data.

In addition, a label that identifies the description content is given to the candidate description to be anonymized, and the information to be processed is displayed on a display means so that the label given to the candidate can be recognized, and the label can be modified using an input means. This is preferable because it makes it easier for humans to judge in the inspection process whether or not the anonymization candidate is used for the purpose of a label in the information to be processed, and it becomes easier to discover erroneous anonymization by a machine. In addition, by changing the label, it is possible to change whether or not to make the item an anonymization candidate and to change the details of the anonymization process, so it can be easily corrected.

In addition, when an anonymization model performs machine learning by including a non-anonymized dictionary that has accumulated entries that will not be anonymized, and excluding entries that correspond to the non-anonymization dictionary from candidates for entries to be anonymized, In addition, it is possible to prevent erroneous anonymization due to information recognized as personally identifying information (e.g., person's name, place name, telephone number, etc.) or similar information being used for a different meaning. , it is possible to prevent important information from being omitted from the processed information. Further, by attaching a label indicating that the description corresponds to the non-anonymized dictionary to the description that corresponds to the non-anonymized dictionary among the processed information, it is possible to make the judgment in the inspection process easier.

In addition, the anonymization means can generate temporary anonymization information by anonymizing the extracted candidates, and the temporary anonymization information can be displayed on the display means so that the inspection device can recognize the candidate description to be anonymized. By enabling the input means to modify the temporary anonymization information, it is possible to inspect and modify not only candidates for descriptions to be anonymized but also the content of anonymization processing. Other effects will be described in the detailed description.

A schematic diagram showing an example of the overall configuration of the personal information anonymization system of the present invention An example of the display screen of the inspection device, (A) is a state in which processed information is displayed, and (B) is a state in which anonymized processed information is displayed. An example of the display screen of the inspection device, in which (A) shows corrected processed information displayed, and (B) shows corrected anonymized processed information displayed. This is an example of a display screen displaying different processed information of the inspection device, where (A) shows the processed information before correction, and (B) shows the processed information after correction. Flowchart showing an example of anonymization processing Flowchart showing an example of anonymization processing using multiple testing devices Flowchart showing an example of anonymization candidate extraction process Diagram showing an example of an anonymization table An example of a display screen of a testing device displaying a non-anonymized label

[Overview of personal information anonymization system]
FIG. 1 is a schematic diagram showing an example of the overall configuration of a personal information anonymization system 1 according to the present invention. It generates information 14, and includes a storage means 2, an anonymization means 3 including an anonymization model 31, and an inspection device 4 including a display means 41 and an input means 42. Furthermore, the personal information anonymization system 1 may include structuring means 5. In the personal information anonymization system 1 of the present invention, candidates for descriptions to be anonymized (anonymization candidates) are extracted and/or temporary anonymization information 13 is generated by an automatic anonymization process by a machine in the anonymization means 3, In the inspection process in the inspection device 4, the anonymization candidate and/or temporary anonymization information 13 is visually inspected by a human, and if necessary, the anonymization information 14 is generated. Further, it is preferable that information including corrections in the inspection process (correction data 43) be fed back to the anonymization model 31 of the anonymization means 3 and reflected in the extraction of anonymization candidates and/or the generation of temporary anonymization information. In this way, by reflecting the modified data 43 in the generation of temporary anonymization information, the details of the human inspection process are also reflected in the extraction of anonymization candidates, improving accuracy.

The storage means 2 stores processed information 12 including personal information, and may be provided independently as a storage server, for example, or may be a storage connected to a computer or server that creates or stores the processed information 12. It may be a medium (for example, a hard disk device, a semiconductor memory, etc.), or a storage medium (for example, a hard disk device, a semiconductor memory, etc.) connected to the anonymization means 3, the inspection device 4, or the structuring means 5. Alternatively, it may be a portable storage medium (for example, a USB memory, a DVD, etc.) in which the information to be processed 12 is stored. Further, the number of storage means 2 does not need to be one, and various pieces of processing information 12 stored in a plurality of storage means 2 may be processed. The storage means 2 may or may not be connected to the anonymization means 3, the inspection device 4, and the structuring means 5 via a network (including the Internet, an internal bus, and an external bus). . If not connected, the information to be processed may be provided from the storage means 2 to the anonymization means 3, the testing device 4, and the structuring means 5 using a portable storage medium (USB memory, DVD, etc.).

The processed information 12 is information that includes personal information, and in particular, in the personal information anonymization system 1 of the present invention, even text information input in an unstructured free text format can be anonymized. can contain unstructured text information. Examples of the processed information 12 include electronic medical record information, purchase history and entry history accumulated on online shopping sites and blog sites, multimedia data such as music and videos provided on web distribution sites, and social media data. Social media data such as profiles and comments written by participants; sensor data such as location, riding history, and temperature detected by GPS, IC cards, and RFID; and direct mail data managed by the CRM (Customer Relationship Management) system. and customer data such as membership card data. In particular, the personal information anonymization system 1 of the present invention is preferably applied to processed information that includes sensitive personal information, and includes text information input in free text format in addition to sensitive personal information. It is preferable to apply this method to anonymization of information such as electronic medical record information. Personal information requiring special consideration is sensitive information that may cause unfair discrimination or prejudice, and specifically includes race, creed, social status, medical history, criminal record, criminal damage information, physical, intellectual, and mental information. This information includes information such as the presence of a disability and the results of a medical examination.

Descriptions to be anonymized include personal information that is information that can identify a specific individual and information that includes a personal identification code, and even if a single piece of information falls under personal information, a combination of multiple pieces of information may fall under personal information. It also includes information on For example, name, date of birth, face photo, skeletal information, fingerprint, ear print, iris, palm print (palm), foot print (sole of foot), lip print, address, telephone number, email address, SNS address, My Number. , including an identification number (ID) that identifies an individual. Furthermore, it is preferable to include information specific to a small number of candidates in the description to be anonymized. For example, some information may be applicable alone, such as the name of a special disease or prescription with a small number of patients, a history of visits to a special facility with a small number of users, a purchase history of a special product that is produced in small numbers, etc., or information that may apply to multiple facilities. There may be a small number of candidates based on a combination of multiple pieces of information, such as visit history to websites (hospitals, online stores, etc.), purchase history of multiple products, etc. For this reason, it is preferable to anonymize special disease names, prescriptions, facilities, or products, or to anonymize them so that they cannot be recognized as people with the same visit history or purchase history.

The anonymization means 3 includes an anonymization model 31, applies the anonymization model 31 to the processed information 12 acquired from the storage means 2, extracts candidates described to be anonymized (anonymization candidates), and extracts the extracted candidates. This is a means for generating temporary anonymized information 13 by anonymizing the information. The anonymization means 3 may further perform predetermined anonymization processing on descriptions that are always to be anonymized, rather than using them as candidates. Here, an anonymization candidate is a description that will be confirmed if there is no problem in the subsequent human inspection process, and will be changed if there is a problem, and a description that must be anonymized is a description that will be changed after the human inspection process. This is a description that confirms anonymization without going through the process. For example, in structured data, descriptions that must be anonymized include information that can identify an individual, such as data entered into a table in which information that identifies an individual such as "name" and "telephone number" is input. Although it is preferable to include specific data that is certain to be input and to reduce the amount of work in the inspection process by humans, it is not an essential configuration because it can also be processed as an anonymization candidate. The anonymization means 3 can be realized by having a computer or server run an anonymization program, and may be provided independently as an anonymization computer or an anonymization server that exclusively performs anonymization processing, for example. It may be realized by a computer or a server that creates or stores the processed information 12, or may be realized by the inspection device 4 and/or the structuring means 5.

Furthermore, the anonymization means 3 may include an anonymization target dictionary 32 that accumulates anonymization targets (anonymization candidates and descriptions that must be anonymized) and/or a non-anonymization dictionary 33 that accumulates descriptions that are not to be anonymized. Often, the anonymization target dictionary 32 and the non-anonymization dictionary 33 may be realized by the anonymization model 31. The anonymization means 3 anonymizes the anonymization target of the processed information 12, and does not anonymize other descriptions. Providing a dictionary 33 is not normally considered. In addition, even if a description other than a description that identifies an individual is mistakenly anonymized, there is some processed information for which it is sufficient that the description that identifies the individual to be anonymized is anonymized. However, since the information to be processed is anonymized and used for a certain purpose, if information that is necessary in relation to the purpose of use is mistakenly anonymized, correct information collection may not be possible. As a result, the utility value of the anonymized information decreases. For example, in the case of electronic medical record information, information such as disease name, drug name, test name, regimen, treatment result, etc. becomes a record of treatment results, treatment results, etc., and is extremely important information in research and development in the medical field. . In particular, text information entered in a free text format is written differently depending on the person inputting it. For example, a name can be written not only in kanji or hiragana, but also in katakana, alphabets, initials, abbreviations, etc. obtain. For this reason, some or all of the words such as disease names, drug names, test names, regimens, and treatment results may contain character strings that are the same as or similar to the spelling of the name, thus preventing accidental anonymization. I can't do it. In order to deal with such cases, we have created a non-anonymized dictionary 33 that contains a dictionary of words that are highly important in relation to the purpose of use, such as disease names, drug names, test names, regimens, treatment results, etc., and that contain words that should not be anonymized. By specifying the description, important information in the processed information 12 can be prevented from being omitted.

Anonymization processing by the anonymization means 3 may be performed by deleting the anonymization target (anonymization candidates and descriptions that must be anonymized), or by replacing the description with a predetermined character string (including one character). If the objects to be converted are the same, they may be replaced with the same character string. The predetermined character string may be a meaningless character string that is a combination of one or more of alphabets, symbols, hiragana, katakana, numbers, etc., such as "A", "XXXX", "○○", etc. Character strings with meanings that include the attributes of the information (gender, age, generation, region, occupation, annual income, etc.), such as "Male A", "Female B in her 20s", "Hospital C", "Kanto region" ” etc. The anonymization means 3 may include an anonymization table storing details of anonymization processing, and may anonymize the anonymization target according to the anonymization processing table. The anonymous processing table stores the contents of anonymous processing, and stores, for example, the correspondence between anonymization targets and their replacement character strings. The anonymization means 3 may have a plurality of anonymous processing tables, and may change the anonymous processing by changing the anonymous processing tables. Further, the content of anonymous processing may be changeable using the input means 42 of the inspection device 4, and for example, the anonymous processing table may be editable using the input means 42. The anonymization table may be included in the anonymization model 31, and the anonymization target of the anonymization processing table may be used as the anonymization target dictionary 32.

The anonymization model 31 is a model that can extract anonymization candidates when the processed information 12 is input. The anonymization model 31 can be constructed, for example, by machine learning using sample data labeled with personal information, and the anonymization model 31 constructed in this way also functions as the anonymization target dictionary 32. . Further, it is preferable that the anonymization model 31 is configured to incorporate a natural language processing algorithm to tag and structure words from text information, and as a result of structuring, words tagged as personal information can be structured. It may be extracted as an anonymization candidate. In this case, the anonymization model 31 also functions as the structuring means 5. The learning method algorithm and model used in the anonymization model 31 are not particularly limited, and models such as supervised learning, unsupervised learning, and deep learning can be used, for example. However, the anonymization model 31 may be configured to be connectable to a separately prepared anonymization target dictionary 32 and configured to refer to the anonymization target dictionary 32. In addition, the anonymization model 31 includes a non-anonymization dictionary 33 that stores descriptions that are not to be anonymized, including a dictionary of words with high importance in relation to the purpose of use, and refers to the non-anonymization dictionary 33. Words registered in may be excluded from the anonymization target. The non-anonymized dictionary 33 may be constructed by machine learning in addition to constructing a dictionary based on rules. For example, the de-anonymized dictionary 33 may be constructed by learning a dictionary of disease names, a dictionary of drug names, a dictionary of test names, etc. Machine learning may be performed using sample data that is labeled with a description that is not. The anonymization means 3 may generate temporary anonymization information 13 in which a label for identifying the written content is attached to the anonymization target, and the tag attached to the word at the time of anonymization or structuring is used as the anonymization target. It may be given as a label. Further, the anonymization means 3 may give a label indicating that the description corresponds to the non-anonymization dictionary 33 to the description that corresponds to the non-anonymization dictionary 33 among the processed information. In this specification, a "label" is used to identify the written content (meaning, attributes, metadata), and a "tag" is used to identify the written content (meaning, attributes, metadata). It refers to the one given by the anonymization model 3 or the structuring means 5 as an identification. Examples of the label include a facility name (hospital name), name, address, identification number, email address, and telephone number.

The temporary anonymization information 13 is information that includes an anonymized description of the anonymization candidates extracted by the anonymization model 31, and may be just a description of the anonymization candidates that have been anonymized, or the anonymization target of the processed information 12. It may also be information (anonymized processed information) in which (anonymization candidates and descriptions that must be anonymized) are replaced with anonymously processed descriptions. The anonymization means 3 provides anonymization candidates and/or temporary anonymization information 13 to the testing device 4. The temporary anonymization information 13 may include the original processed information 12 (original anonymization candidate) and provide it to the testing device 4 . Further, the anonymization candidate and/or temporary anonymization information 13 may include a label given to the anonymization target. The anonymization candidates and/or temporary anonymization information 13 are sent to the inspection device 4, displayed on the display means 41, and subjected to a human inspection process.

The inspection device 4 is a device for a human to carry out an inspection process of temporarily anonymized information, and includes at least a display means 41 and an input means 42, and may further include a storage means, a control means, and a network interface. As the testing device 4, a computer, a tablet terminal, a PDA (Personal Digital Assistant), a multifunctional mobile phone (smartphone, i-phone (registered trademark)), etc. can be adopted. The inspection device 4 may be provided separately from the anonymization means 3, or may also serve as the anonymization means 3 by causing the inspection device 4 to execute an anonymization program. A plurality of inspection devices 4 can be provided via a network, and a large amount of temporarily anonymized information can be processed, and one temporary anonymized information 13 can be inspected in parallel by a plurality of people. The inspection device 4 acquires anonymization candidates and/or temporary anonymization information 13 from the anonymization means 3, also acquires processed information 12 from the storage means 2 or the anonymization means 3, and uses the anonymization means 3 to The temporary anonymization information and/or the processed information are displayed on the display means 41 so that the extracted anonymization candidates can be recognized. The inspection device 4 provides the corrected data 43 to the anonymization means 3 when there is a correction made by the input means 42, and when there is no correction made by the input means 42, the anonymization candidate is determined and/or temporarily anonymized. Anonymization processing of the anonymized information is confirmed and output as anonymized information 14. The inspection device 4 has a UI (user interface ), it is preferable to build a system in which errors in judgment are less likely to occur. By displaying anonymization candidates on the display means 41 in an easy-to-recognize manner, it is possible to prevent anonymization candidates from being overlooked. In addition, by displaying the labels of anonymization candidates in an easy-to-recognize manner, it becomes easier to determine whether the anonymization candidates are used for the label purpose in the processed information, and it becomes easier to correct incorrect anonymization by machines. preferable.

The display means 41 is means for displaying various information, and includes, for example, a liquid crystal display (LCD), an organic EL display, a projector, and the like. If a touch panel display is used as the display means 41, it can also be used as the input means 42. The display means 41 displays the temporary anonymization information 13 acquired from the anonymization means 3 and/or the processed information 12 acquired from the storage means 2 or the anonymization means 3 so that anonymization candidates can be recognized. . For example, it is possible to display information (anonymized processed information) in which the anonymization target of the processed information 12 is replaced with an anonymized description, and display anonymization candidates by selecting the anonymized description ( (You may highlight anonymized entries). Alternatively, the processed information 12 with anonymization candidates highlighted may be displayed, and descriptions that have been anonymized by selecting the anonymization candidates may be displayed. Furthermore, one inspection device 4 may be provided with two display means 41, or the screen of the display means 41 may be divided into two, so that the anonymized processed information is displayed on one side and the processed information 12 is displayed on the other. Alternatively, a list of anonymization candidates and/or anonymized descriptions may be displayed on one side, and a list of processed information 12 and/or anonymization targets may be displayed on the other side. Processing information may also be displayed. By highlighting and displaying the anonymization target or highlighting and displaying the anonymized description, it becomes easier to understand the anonymization target (especially anonymization candidates), reducing the chance of overlooking the anonymization target. Can be done. Further, when the anonymization candidate is assigned a label, it is preferable that the display unit 41 displays the temporary anonymization information and/or the processed information so that the label assigned to the anonymization candidate can be recognized. For example, you can write labels together, display anonymization candidates in different colors for each label, change the display screen for each label to clearly display only the anonymization candidates for the corresponding label, or anonymize. A label may be displayed by selecting a candidate. By making it possible to recognize the label of an anonymization candidate in this way, it becomes easier to judge whether the purpose of the anonymization candidate, which can be understood from the context, matches the label, and if it does not match, the anonymization candidate is valid. Instead, it can be discovered that it is a mistake in machine anonymization.

The input means 42 is a means that can modify description candidates to be anonymized with respect to the temporary anonymized information 13 and/or the processed information 12 displayed on the display means 41, and includes, for example, a keyboard, a pointing device (mouse, touchpad, etc.), touch panels (including touch screens), microphones, etc. Modification of anonymization candidates by the input means 42 includes designating as anonymization candidates descriptions that were not subject to anonymization of the processed information, removing the anonymization candidates from the anonymization targets, and contents of anonymization processing of the anonymization candidates. This includes changing the label attached to the anonymization candidate. The modification contents inputted by the input means 42 are displayed on the display means 41, and the modified data 43 is provided to the anonymization means 3 and reflected in the extraction of anonymization candidates and/or the generation of temporary anonymization information. For example, the modified anonymization candidate and/or temporary anonymization information may be provided to another inspection device 4 and the inspection process may be performed again, or the anonymization model 31 may be retrained using the modified data 43. Alternatively, the anonymization target dictionary 32, non-anonymization dictionary 33, and/or anonymization processing table may be updated. If there is no modification, the anonymization candidate of the temporary anonymization information 13 and its anonymization processing are determined and output as anonymization information 14. When the temporary anonymized information 13 is modified, the modified content may be finalized and output as the anonymized information 14, or the inspection process may be performed again by another person or the same person.

The structuring means 5 is a means for applying a natural language processing algorithm to unstructured text information, extracting and tagging each word, and structuring it. It is preferable to provide this when text information that does not exist is included. The structuring means 5 can be constructed by machine learning using labeled sample data. The structuring means 5 can be realized by causing a computer or server to execute a structuring program, and may be provided independently as a structuring computer or a structuring server that exclusively performs structuring processing, for example, It may be realized by a computer or a server that creates or stores the processed information 12, or may be realized by an anonymization means 3, an inspection device 4, and/or a structuring means 5. The structuring means 5 can generate structured information 15 by structuring the unstructured text information in the information to be processed 12, and can provide the structured information 15 as the information to be processed 12 to the anonymizing means 3. .

FIGS. 2A and 2B are examples of display screens on the display means 41. A window 44 in which the processed information 12 and temporary anonymized information 13 are displayed is arranged on the screen, and FIG. 2(A) shows the processed information 12 displayed in the window 44, and FIG. 2(B) shows the This is a state in which anonymized processed information is displayed. In the label selection frame 45 arranged at the top of the window 44, from the left side, there are a square "display switching check field" 45a, "facility ₁ " 45b, "name ₂ " 45c, "address ₃ " 45d, and "ID". ₄ (identification number)" 45e, "Mail ₅ " 45f, and "Telephone ₆ " 45g label buttons are arranged. The anonymization candidate or its anonymized description displayed in the window 44 is displayed with a highlight and a label name. If the display switching check box 45a in the label selection frame 45 is not checked, the processed information 12 with anonymization candidates highlighted is displayed in the window 44, as shown in FIG. In this case, as shown in FIG. 2(B), the anonymized information obtained by anonymizing the anonymization candidate is displayed in the window 44. With the label buttons 45b to 45g, by selecting a character string in a sentence while selecting a button with an arbitrary label, the selected character string can be input as an anonymization candidate with the corresponding label. Note that in the label selection frame 45, the numbers attached to the labels are shortcuts, and the label button is configured to be selected by pressing the corresponding number. At the bottom of the window 44, a decision button 46a marked with "O" and a cancel button 46b marked with "x" are arranged. The OK button 46a is a button that is input when the inspection process of the displayed information to be processed is finished. When the OK button 46a is input, anonymization candidates are confirmed and anonymization processing is executed, and if there is a correction, the anonymization process is executed. provides the corrected data to the anonymization means 3. The cancel button 46b is a button for canceling the inspection process when it is difficult to handle the situation by just modifying the anonymization candidate. In FIG. 2A, the "Facility ₁ " button 45b is selected, and the window 44 displays "Sato" (name), "Yamada Hospital" (facility), "Nishikawa" as anonymization candidates and labels in the processed information. "Kai Hospital" (facility) and "03-1234-5678" (telephone) are highlighted and displayed. The window 44 in FIG. 2(B) displays anonymized processed information obtained by anonymizing the anonymization candidates, such as "Sato" being changed to "A", "Yamada Hospital" being changed to "B Hospital", "Nishikawakai Hospital" has been converted to "C Hospital" and "03-1234-5678" has been converted to "03-xxxx-xxxx".

Corrections in the inspection process include selecting a description that should be anonymized if it is not an anonymization candidate, and selecting it as an anonymization candidate if only a part of the description that should be anonymized is an anonymization candidate. Selecting all descriptions as anonymization candidates, removing descriptions that should not be anonymized from the anonymization candidates, and selecting appropriate labels when the anonymization candidate labels are inappropriate. It may be replaced with. For example, in Figure 2 (A), "Sato" is highlighted as an anonymization candidate, but if the patient name is "Hajime Sato", not only "Sato" but also "Hajime Sato" will be anonymized. It is necessary to make it a candidate for development. In this case, it is possible to correct the name by selecting up to "Hajime Sato" with the cursor while selecting the name label button. Furthermore, in FIG. 2A, the description "Dr. Suzuki" is also a personal name and needs to be selected as an anonymization candidate. Figure 3 (A) shows the screen after the correction, with the name label button selected and the cursor 47 selecting the ``Suzuki'' part of the entry ``Dr. Suzuki'' and selecting it as an anonymization candidate. It shows the condition. Note that in FIG. 3(A), up to "Hajime Sato" has already been modified so that it becomes an anonymization candidate. FIG. 3(B) is the anonymized processed information of FIG. 3(A), in which up to "Hajime Sato" is converted to "A" and "Dr. Suzuki" is converted to "Dr. D." In addition, a cancel button may be provided to remove the anonymization candidates.The cancel button is always displayed somewhere on the screen, and after selecting an anonymization candidate, selecting the cancel button removes it from the anonymization candidates. Alternatively, when an anonymization candidate is selected with a cursor or the like, a cancel button may be displayed near the anonymization candidate, and by selecting the cancel button, the anonymization candidate may be removed. Furthermore, if the label of the anonymization candidate is inappropriate, the label can be changed by selecting the anonymization candidate while selecting the correct label button.

FIG. 4 shows a screen displaying other processed information in the window 44. In FIG. 4(A), a name label is attached to the description "Amlo" and it is considered an anonymization candidate, but it is a drug name "Amlodipine" and is not an anonymization candidate. Additionally, the entry "Fentanyl" is also labeled with a name and is considered an anonymization candidate, but this is also a drug name and is not a candidate for anonymization. Information regarding these drugs is subject to collection in electronic medical records and is important information, so it must be excluded from anonymization candidates. In FIG. 4(A), when the cursor 47 selects "Amuro", a cancel button 48 with an x inside a circle is displayed at the upper left of the highlight. By selecting this release button, the person can be removed from the anonymization candidates. Similar work will be done for fentanyl. Note that by providing a non-anonymized dictionary, words included in the non-anonymized dictionary can be excluded from being anonymized, and such erroneous conversions can be reduced. Furthermore, in FIG. 4(A), the description "Chiyoda-ku, Tokyo" is an address, but since it is not considered an anonymization candidate, the description "Chiyoda-ku, Tokyo" is selected while the address label 45d is selected. By doing so, it can be used as an anonymization candidate. Further, although a telephone label is attached to the description "11223344," since the ID label is appropriate, the label can be changed by selecting a number while selecting the ID label 45e. FIG. 4(B) is a screen displaying the corrected processed information. Note that the correction operation using the input means is just one example, and other means may be used, for example, after first selecting the description to be anonymized, the label of the description may be selected.

FIG. 5 is a flowchart illustrating an example of anonymization processing. Upon acquiring the processed information (S51), the anonymization means 3 extracts anonymization candidates (S52). An anonymization target dictionary and a non-anonymization dictionary may be used when extracting anonymization candidates. Thereafter, the anonymization means 3 anonymizes the extracted anonymization candidates to generate temporary anonymization information (S53). An anonymization table may be used for anonymization processing. When the testing device 4 acquires the temporary anonymized information (S54), the user of the testing device 4 carries out an inspection process for the temporary anonymized information (S55). The user shall check the anonymization candidate and/or the content of the anonymization process, or its label, and if correct, confirm it as is, and if there is a problem, change the anonymization candidate, change the content of the anonymization process, or Correct label changes, etc. and generate corrected data. If there is corrected data (Yes in S56), the corrected data is provided to the anonymization means 3 and reflected in the extraction of anonymization candidates and/or the generation of temporary anonymization information. For example, by relearning the anonymization model or changing the anonymization processing table, provisional anonymization information generated again is provided to the inspection device 4, and the provided provisional anonymization information is A human may perform the inspection process again. If there is no correction data (No in S56), the determined temporary anonymization information is output as anonymization information (S57). Note that if there is corrected data (Yes in S56), the corrected data may be provided to the anonymization means 3, and the corrected temporary anonymized information may be output as the anonymized information.

Figure 6 shows an example of anonymization processing that uses multiple inspection devices 4A, 4B, and so on, and that increases reliability by inspecting one piece of processed information in parallel by multiple persons in charge A, B, and so on. FIG. The processing in the anonymization means 3 is the same as that shown in FIG. 5, and when the information to be processed is acquired (S61), anonymization candidates are extracted (S62), the extracted anonymization candidates are anonymized, and the temporary anonymization information is (S63). The plurality of inspection devices 4A, 4B... each acquire the same temporary anonymization information (S64A, S64B), and the respective persons in charge A, B... inspect the temporary anonymization information (S65A, S65B). Each person in charge A, B, etc. inspects the temporary anonymized information, and if there is a problem, generates corrected data (S66A, S66B). Then, in S67, the difference between the plurality of corrected data acquired from the plurality of inspection devices 4A, 4B, etc. or the difference between the plurality of corrected temporary anonymized information is determined, and if there is a difference (Yes in S67), the person in charge Since different corrections have been made in each of the inspection devices 4A, 4B, etc., the differences are displayed in a checkable manner and the inspection process is performed again (S65A, S65B). The revised data that has been reconfirmed is checked for differences again, and the confirmation process is repeated until there are no differences and a unified result is obtained. If there is no difference (No in S67), temporary anonymized information corrected by the unified correction data is output as anonymized information (S68). Further, the corrected data is provided to the anonymization means 3 and used for relearning the anonymization model. In FIG. 6, since the inspection is carried out by a plurality of persons in charge A, B, etc., more reliable anonymized information can be obtained. The means for detecting the difference may be realized by a dedicated server connected to the plurality of inspection devices 4A, 4B, etc., or may be realized by the anonymization means 3 and/or the inspection device 4. In addition, in FIGS. 5 and 6, temporary anonymization information is first generated and then the temporary anonymization information is inspected, but before generating the temporary anonymization information, the inspection device 4 checks the anonymization candidates. The anonymization means 3 may perform anonymization processing on the acquired and inspected anonymization candidates that have been determined.

FIG. 7 is a flowchart illustrating an example of anonymization candidate extraction processing when a non-anonymization dictionary is provided. When the anonymization means 3 acquires the information to be processed (S71), it selects a word from the information to be processed (S72), and uses the anonymization target dictionary to determine whether the word is to be anonymized ( S73). If it is determined that the word is to be anonymized (Yes in S73), it is determined whether or not the word is included in the non-anonymized dictionary by referring to the non-anonymized dictionary (S74). Here, not only when the word itself is included in the non-anonymized dictionary (for example, "fentanyl" in FIG. 4), but also when the word is part of the words included in the non-anonymized dictionary (for example, "fentanyl" in FIG. "Amlo" and "Amlodipine") are also determined to be included in the non-anonymized dictionary. If the word is included in the non-anonymized dictionary (Yes in S74), the word is excluded from the anonymization target, and a label is given to the word indicating that the word corresponds to the non-anonymized dictionary (S75). If the word is not included in the non-anonymization dictionary (No in S74), the word is extracted as an anonymization candidate, and a label as an anonymization target is given to the word. If it is determined that the word is not to be anonymized (No in S73), or after a label is attached to the word in S75 or S76, it is checked whether there is a next word (S77), and if there is no next word ( (Yes in S77) ends, and if there is a next word (No in S77), the next word is selected (S73) and the process of determining whether it is to be anonymized is continued. Note that the label indicating that the description corresponds to the non-anonymized dictionary may be, for example, information fields such as disease name, drug name, test name, regimen, and treatment result.

FIGS. 8A and 8B are examples of anonymization tables showing the details of anonymization processing. In the anonymization table in Figure 8(A), the facilities and name labels to be anonymized are replaced with alphabetical characters in the order of their appearance, but descriptions that mean facilities (e.g., hospital, clinic, clinic, etc.) are processed to remain. I do. Address labels to be anonymized will be processed by the city, and IDs and email labels to be anonymized will be deleted. For telephone labels to be anonymized, all information other than the area code is replaced with x. Figure 8 (B) is another anonymization table with a different processing method, where facility labels to be anonymized are replaced with a symbol consisting of the alphabet "O" and a number, and the same facility has the same symbol. Processed into Name labels to be anonymized are replaced with a symbol consisting of the alphabet "N" and a number, and identical names are processed to have the same symbol. Addresses, IDs, emails, and phone labels that are to be anonymized will be deleted. According to such an anonymization table, a processing method is determined and anonymized according to the label to be anonymized, so that an appropriate processing method can be selected by simply replacing the label in the inspection process. Further, by providing a plurality of anonymization tables, the processing method can be changed simply by switching the anonymization tables. The contents of the anonymization table may be changeable by input means of the testing device.

An anonymization model (anonymized dictionary, non-anonymized dictionary) was constructed using actual electronic medical record information. The electronic medical record information is created for each patient and includes text information input in free text format. The text information was structured by a structuring means using a natural language processing algorithm, and the anonymization target was inputted into the structured text information using an inspection device, and was used as teacher data for the anonymization target dictionary. In addition, entries that should not be anonymized were also input with a label for non-anonymization, and used as training data for the non-anonymization dictionary. By repeating this process, we were able to construct an anonymized model (anonymized dictionary, non-anonymized dictionary).

An example of processed information from which anonymization candidates have been extracted using such an anonymization model is shown in FIG. 2(A), and anonymized processed information obtained by anonymizing the anonymization candidates is shown in FIG. 2(B). . When inspected with the inspection device, "Sato" was highlighted as an anonymization candidate in Figure 2 (A), but since the patient name was "Sato Hajime", the cursor was moved up to "Sato Hajime" as an anonymization candidate. , and added a label button with their name. Furthermore, regarding the description "Dr. Suzuki" in FIG. 2(A), "Suzuki" was selected with the cursor as an anonymization candidate, and a name label button was added. FIG. 3(A) shows the screen after modification, and the descriptions of "Hajime Sato" and "Suzuki" have been modified to be anonymization candidates. The corrected data entered by the inspection device was fed back to the anonymization model as training data for the dictionary to be anonymized.

Another example of processed information from which anonymization candidates have been extracted using such an anonymization model is shown in FIG. 4(A). In Figure 4 (A), the entry "Amlo" is the drug name "Amlodipine" and is not an anonymization candidate, and the entry "Fentanyl" is also a name label and is considered an anonymization candidate. Since these are also drug names and are not candidates for anonymization, they were removed from the list of candidates for anonymization. Furthermore, in FIG. 4(A), the description "Chiyoda-ku, Tokyo" is an address, but since it is not considered an anonymization candidate, the description "Chiyoda-ku, Tokyo" is selected while the address label 45d is selected. This made it a candidate for anonymization. Also, a telephone label is attached to the description "11223344", but since an ID label is appropriate, the label was changed by selecting a number with ID label 45e selected. Figure 4 (B) is a screen displaying the corrected processed information, with "Amuro" and "Fentanyl" removed from the anonymization candidates, and "Chiyoda-ku, Tokyo" added to the address label anonymization candidates. "11223344" has been changed to an anonymization candidate for the ID label. These corrected data were also fed back to the anonymization model as training data for the dictionary to be anonymized.

Furthermore, in FIG. 9, a non-anonymized label frame 49 is displayed, and drug labels indicating that "amlodipine" and "fentanyl" are descriptions that should not be anonymized are attached. By feeding this corrected data back to the anonymization model, it can be made to learn that the words "amlodipine" and "fentanyl" are descriptions that should not be anonymized as training data for the non-anonymization dictionary.

1 Personal information anonymization system 2 Storage means 3 Anonymization means 4 Inspection device 5 Structuring means 12 Processed information 13 Temporary anonymization information 14 Anonymization information 15 Structured information 31 Anonymization model 32 Anonymization target dictionary 33 Non-anonymous conversion dictionary 41 display means 42 input means 43 correction data

Claims (10)

A personal information anonymization system for generating anonymized information by anonymizing personal information from processed information including personal information,
a storage means in which the processed information is stored;
anonymization means including an anonymization model that extracts descriptions to be anonymized from the processed information;
an inspection device including a display means and an input means;
The anonymization means applies the anonymization model to the processed information acquired from the storage means to extract candidates for descriptions to be anonymized,
The inspection device displays the processed information on the display means so that the candidate description to be anonymized extracted by the anonymization means can be recognized;
The input means is capable of modifying the candidate description to be anonymized displayed on the display means,
The inspection device provides the corrected data to the anonymization means when there is a correction made by the input means, and anonymizes the candidate description to be anonymized when there is no correction made by the input means. Confirmed as written,
The anonymization means is a personal information anonymization system that trains the anonymization model using the corrected data. The anonymization means gives the candidate description to be anonymized a label that identifies the description content,
The inspection device displays the processed information on the display means so that the label given to the candidate can be recognized,
The personal information anonymization system according to claim 1, wherein the input means is capable of modifying the label. The individual according to claim 1 or 2, wherein the anonymization model includes a non-anonymized dictionary that accumulates entries that are not to be anonymized, and excludes entries that correspond to the non-anonymized dictionary from the candidates for the entries to be anonymized. Information anonymization system. The personal information according to claim 3, wherein the anonymization means adds a label indicating that the description corresponds to the non-anonymized dictionary to the description that corresponds to the non-anonymized dictionary among the processed information. Anonymization system. The anonymization means generates temporary anonymization information by anonymizing the extracted candidates,
The testing device is capable of displaying the temporary anonymization information on the display means so that the candidates for the description to be anonymized can be recognized;
The personal information anonymization system according to claim 1 or 2, wherein the input means is capable of modifying the temporary anonymization information. 6. The personal information anonymization system according to claim 5, wherein the inspection device displays the temporary anonymization information on the display means simultaneously or switchably with the processed information. 6. The personal information anonymization system according to claim 5, wherein the input means is capable of changing the anonymization processing performed by the anonymization means. 6. The personal information anonymization system according to claim 5, wherein the anonymization means includes an anonymization processing table storing details of anonymization processing, and changes the temporary anonymization information by changing the anonymization processing table. 6. The personal information anonymization system according to claim 5, wherein the anonymization means replaces the descriptions to be anonymized with the same character string when the descriptions to be anonymized are the same. including multiple testing devices;
In the plurality of inspection devices, an inspection process is performed on the same processed information,
A claim that determines the difference between a plurality of pieces of corrected data for the same processed information output from the plurality of inspection devices, and if a difference occurs, displays the difference so that it can be confirmed and performs the inspection process again. Personal information anonymization system described in Section 1 or 2.