JP2020144800A - Information sharing system - Google Patents

Abstract

To hold down a leak of individual information from medical information via a network a number of unspecified persons use.SOLUTION: An information acquisition unit (S110) is configured to acquire device information attached with a plurality of tags from an internal network. An anonymization unit (S120) is configured to process disclosure device information so that the individual information being information in which a patient individual included in the disclosure device information is identified for each disclosure device information is anonymized. An image generation unit (S130) is configured to generate integration image data, using anonymization device information being the disclosure device information processed by the anonymization unit. A check unit (S140) is configured to extract an anonymization necessary portion from an integration image to be displayed by the integration image data. An information providing unit (S150 to S170) is configured to, when the anonymization necessary portion is not extracted in the check unit, permit a distribution of the anonymization device information via an external network.SELECTED DRAWING: Figure 8

Description

The present disclosure relates to techniques for sharing medical information obtained from medical devices used in surgery and treatment.

Patent Document 1 below describes a technique for anonymizing and transmitting information that should not be known to a third party when a hospital outsources analysis and statistical processing of medical information of patients to an external research institution. Are listed.

Specifically, specify what information is to be anonymized and how, and anonymize the acquired medical image by removing the metadata related to the medical image using the anonymization template, and via the network. And upload the anonymized medical image to the cloud server.

JP-A-2017-91185

However, as a result of detailed examination by the inventor and the like, it has been found that the prior art described in Patent Document 1 has the following problems. That is, in the prior art, although the information specified in the metadata can be dealt with, for example, the information written on the documents or name tags that are accidentally reflected in the image cannot be dealt with, and such information is leaked. There was a risk of letting them.

One aspect of the present disclosure is to provide a technique for suppressing leakage of personal information from medical information shared via a network used by an unspecified number of people.

One aspect of the present disclosure is an information sharing system, which includes an information acquisition unit (63: S110), an anonymization unit (63: S120), an image generation unit (63: S130), and a confirmation unit (63: S140). ) And an information providing unit (63: S150, S170).

The information acquisition unit acquires a plurality of tagged device information from an internal network used by a specific user who is a limited user. The tagged device information is the time and device information obtained from each of the device information obtained from the plurality of medical devices used for at least one of the patient's examination, examination, and treatment. It is information associated with tag information including information indicating a type.

The anonymization unit processes the public device information for each public device information so that the personal information included in the public device information that identifies the individual patient is anonymized. Public device information is required to be shared with users other than specific users via an external network that is also used by users other than specific users among the tagged device information acquired by the information acquisition department. Tagged device information.

The image generation unit uses the public device information processed by the anonymization unit as the anonymization device information, and generates integrated image data which is image data for displaying a plurality of anonymization device information associated with the same time on one screen. Generate. The confirmation unit extracts the anonymized part where the personal information is shown from the integrated image displayed by the integrated image data. The information providing unit permits the distribution of the anonymized device information via the external network when the anonymization-required part is not extracted by the confirmation unit.

According to such a configuration, not only the plurality of device information is individually anonymized for each device information, but also it is confirmed whether the device information is actually anonymized in the state of the integrated image, and then other than the specific user. Since it is shared with the users of, it is possible to further suppress the leakage of personal information from the shared device information.

It is a block diagram which shows the structure of an information sharing system. It is a functional block diagram which shows the function of each part of an information providing system. It is explanatory drawing which shows the structure of the tagged device information. It is explanatory drawing which shows the structure of the tagged comment information. It is explanatory drawing which shows the information which is read in the display AP. It is explanatory drawing which shows an example of the integrated image. It is explanatory drawing which shows an example of the integrated image including the comment display. It is a flowchart which shows the upload process. It is a flowchart which shows anonymization processing.

Hereinafter, embodiments of the present disclosure will be described with reference to the drawings.
[1. overall structure]
The information sharing system 1 shown in FIG. 1 includes a plurality of information providing systems 2, a server 7, and a plurality of external terminal devices 8, and these are connected to each other via a communication network 9.

The information providing system 2 is installed in each hospital, for example, and acquires device information from various medical devices used for any of examination, examination, and treatment of a patient. Further, the information providing system 2 generates integrated information for displaying the plurality of device information in synchronization with the time axis, and uploads the integrated information to the server 7 on the communication network 9. In addition, the information providing system 2 uploads the personal information included in the integrated information after anonymizing the information that identifies the individual patient as personal information. In addition, the information providing system 2 forms an internal network used by a limited number of persons (hereinafter, specific users) belonging to the hospital.

The external terminal device 8 is installed in a place where doctors, medical researchers, students, etc. can use it, such as a hospital or a medical university. Further, the internal terminal device 6 which belongs to the information providing system 2 and will be described later functions as an external terminal device 8 with respect to the other information providing system 2. The external terminal device 8 acquires at least an application for acquiring integrated information uploaded to the server 7 via the communication network 9 and supporting information sharing and communication between users who browse integrated images based on the integrated information. Execute. The users also include providers who provide integrated information. That is, the communication network 9 corresponds to an external network that is also used by users other than the specific user.

Such an information sharing system 1 is used, for example, for surgical analysis and educational purposes after surgery, as well as for real-time examination and support during surgery.
[2. Information provision system]
As shown in FIG. 1, the information providing system 2 includes a device group 3, a providing processing unit 4, a database 5, and an internal terminal device 6.

[2-1. Devices]
As shown in FIG. 2, the device group 3 includes a plurality of devices 31A to 31H. Each of the devices 31A to 31H generates data and supplies the data to the providing processing unit 4. In the following, when a plurality of devices 31A to 31H are referred to without distinguishing between them, they will be referred to as device 31.

The device 31 is a medical device, medical equipment, or the like used during surgery or treatment. Specific examples of the medical device include a biological information monitor, a respiratory function monitor, a hemodynamic monitor, a sedation monitor, an anesthesia machine, an infusion pump, a syringe, a blood purification device, an artificial heart-lung machine, and an auxiliary circulation device. Examples of medical equipment include surgical navigation systems (hereinafter referred to as surgical navigation), IP cameras, medical gas systems, endoscopes, microscopes, electric scalpels, drills, supersonic irradiation devices, and the like. In addition, the device may include an air conditioning system, an isolation system, and the like.

The data supplied from the device 31 (hereinafter, device information) includes the measured value by the device 31, the moving image or still image output from the device 31, the information about the measurement target and the observation target of the device 31, and the like. May be good. Further, the device information may include the usage status of the device 31, the state of the device including an error, the setting value of the device 31 itself, the setting value related to the parameter handled by the device 31, and the like.

The surgical navigation is a device for acquiring a three-dimensional position and posture of a surgical instrument during surgery. Examples of surgical instruments include electric scalpels and forceps, as well as microscopes and the like. Further, the focal point of the microscope may be specified as a three-dimensional position. At this time, the three-dimensional position is specified by associating the affected part of the patient with a three-dimensional image taken in advance by CT, MRI, or the like. CT is an abbreviation for Computed Tomography and MRI is an abbreviation for Magnetic Resonance Imaging.

[2-2. Database]
The database 5 is realized by a large-capacity memory such as an HDD. HDD is an abbreviation for Hard Disk Drive. As shown in FIG. 2, the database 5 includes a device information area 51, a comment information area 52, and an anonymized information area 53. The tagged device information T_Idv is stored in the device information area 51. The tagged comment information T_Icm is stored in the comment information area 52. In the anonymized information area 53, the anonymized device information T_Idv, which is the tagged device information T_Idv, which is anonymized by the anonymization process by the internal terminal device 6, and the anonymized comment, which is the tagged comment information T_Icm which is also anonymized. Information is temporarily stored. Further, the tagged device information T_Idv and the tagged comment information T_Icm are collectively referred to as integrated information, and the anonymized device information and anonymized comment information are collectively referred to as anonymized information.

As shown in FIG. 3, the tagged device information T_Idv has the first tag information T1 and the device information Idv.
The device information Idb is information acquired from any device 31 belonging to the device group 3 during surgery, treatment, or examination (hereinafter, treatment, etc.), and specifically represents a measured value, a set value, or the like. Character data, image data showing the state of treatment, etc. are included. Character data includes characters, numerical values, symbols, and the like, and image data includes both moving images and still images.

The first tag information T1 is information related to the device information IDv, and includes at least a case identification tag T11, a case information tag T12, a time tag T13, and a data type tag T14.

The case identification tag T11 is identification information for uniquely identifying a series of device information IDvs that are continuously acquired for a certain period of time when a certain patient is treated or the like. The case identification tag T11 may be set so as to be able to identify the information providing system 2 that has provided a series of device information IDvs.

The case information tag T12 indicates information regarding the treatment or the like identified by the case identification tag T11. Specifically, it includes personal information such as the therapist (for example, a surgeon in the case of surgery), the name of the disease, the name of the surgery, and the age and sex of the person to be treated. Not limited to this, information that can be a search item when used for educational purposes at a later date may be included.

The time tag T13 is information representing the time when the device information IDv is acquired (hereinafter, the acquisition time).
The data type tag T14 includes identification information for identifying the device 31 that is the source of the device information Idv. When a plurality of device information IDvs are acquired from one device 31, the identification information for identifying which device information IDv is also included.

As shown in FIG. 4, the tagged comment information T_Icm has a second tag information T2 and a comment information Icm.
The comment information Icm is information input via the internal terminal device 6, and specifically, includes at least one of text data, voice data, and image data. The image data may include handwritten characters, bitmap data representing a figure, and the like.

The second tag information T2 is information related to the comment information Icm, and includes a case identification tag T21, a comment identification tag T22, an inputter information tag T23, a comment target tag T24, a time tag T25, and a time tag T26. At least the comment type tag T27 is included.

The case identification tag T21 is the same as the case identification tag T11 in the first tag information T1, and the case identification tag T11 associated with the device information Idb that is the target of the comment information Icm is used.

The comment identification tag T22 is information for individually identifying the comment information Icm. This information is information that enables comments on comments.
The input person information tag T23 is information for identifying the input person who input the comment.

The comment target tag T24 is information for specifying the target of the comment. The comment target may include all or a part of the device information IDv identified by the data type tag T14. The part of the device information Idv may be, for example, a number or a graph actually displayed when the device information Idv is a measured value by the device 31. Further, the comment target may include the entire information that does not specify the device information Idv (that is, the entire screen on which the device information Idv is displayed), and the comment specified by the comment identification tag T22.

The time tag T25 is information representing the acquisition time of the comment target, that is, the time on the same time axis as the time tag T13 described above.
The time tag T26 is information representing a time when the comment target is designated when the comment information Icm is input. The time tag T26 represents the current time (hereinafter, reproduction time) at which the integrated information is being reproduced. However, when the integrated information is reproduced in real time, that is, when the integrated information is generated and reproduced at the same time, the time tag T26 may have the same value as the time tag T25.

The comment type tag T27 is information representing the format of the comment information Icm, and may include text data, voice data, image data, voice recognition data, motion analysis data, and the like.
[2-3. Provision processing department]
Returning to FIG. 1, the providing processing unit 4 includes a microcomputer having a CPU 4A and, for example, a semiconductor memory such as a RAM or a ROM (hereinafter, a memory 4B).

Functionally, the provision processing unit 4 includes a plurality of providers 41A to 41H and middleware 43, as shown in FIG. In the following, when a plurality of providers 41A to 41H are referred to without distinction, they are referred to as providers 41.

Any one of the devices 31 is connected to each provider 41. The provider 41 mediates the exchange of information with the connected device 31.
The middleware 43 is a communication interface that provides a unified access means together with the provider 41 for various devices 31 connected to the provider 41 regardless of the difference in programming language or communication protocol. Here, ORiN is used as the middleware 43. ORiN is an abbreviation for Open Resource interface for the Network.

When the instruction to start information generation is input from the internal terminal device 6, the middleware 43 acquires the device information Idv from the device 31 via the provider 41. The device information Idb acquired from one device 31 may be one type or a plurality of types. Further, the middleware 43 generates the first tag information T1 every time the device information Idv is acquired. Further, the middleware 43 generates the tagged device information T_Idv by adding the generated first tag information T1 to the device information Idv, and stores it in the device information area 51 of the database 5.

The contents of the tags T11 to T14 belonging to the first tag information T1 are set as follows, for example.
The case identification tag T11 and the case information tag T12 use the information input via the internal terminal device 6 when the middleware 43 starts information generation.

The time tag T13 is generated by acquiring the current time. The current time may be acquired from the clock function of the microcomputer, or time information representing the acquisition time of the device information Idv provided by the device 31 together with the device information Idv may be used.

The data type tag T14 is information representing the type of acquired device information IDv, and information prepared in advance is used according to the device 31 connected to the provider 41.
[2-4. Internal terminal device]
As shown in FIG. 1, the internal terminal device 6 includes an input unit 61, a display unit 62, and a terminal processing unit 63. Although one internal terminal device 6 is shown in the information providing system 2 in FIG. 1, the information providing system 2 may include a plurality of internal terminal devices 6.

The display unit 62 is, for example, a touch panel type liquid crystal display, and displays three-dimensional images such as MPR images, waveform data and numerical values representing measurement results such as biological information, various operation buttons, setting values of each device, and layout values. It can be displayed. MPR is an abbreviation for Multi Planar Reconstruction.

The input unit 61 is, for example, an input device such as a touch panel, a keyboard, a mouse, a microphone, a camera, and a motion sensor provided in the above-mentioned liquid crystal display. The input unit 61 outputs text data, position data, voice data, image data, and the like corresponding to the input operation via these input devices to the terminal processing unit 63.

The terminal processing unit 63 includes a microcomputer having a CPU 63A and, for example, a semiconductor memory such as a RAM or a ROM (hereinafter, a memory 63B). The terminal processing unit 63 executes one or more applications (hereinafter, AP) related to the integrated information stored in the database 5. Here, as shown in FIG. 2, the terminal processing unit 63 at least executes the display AP631, the comment addition AP632, and the upload AP633.

[2-4-1. Display AP]
The display AP631 is an application that displays a series of device information Idb and comment information Icm related to the same case specified by the case identification tags T11 and T21 on the display screen of the display unit 62 in synchronization with time.

Specifically, the device information Idv and the comment information Icm corresponding to the time S designated via the input unit 61 are displayed on the display screen of the display unit 62. However, in the operation mode for displaying a still image, the time S is changed according to the input from the input unit 61, and in the operation mode for displaying a moving image, the time S is set after the initial value is input from the input unit 61. , It is automatically updated according to the display cycle.

When the terminal processing unit 63 acquires the time S, the terminal processing unit 63 obtains the device information Idv and the comment information Icm to which the time tags T13 and T25 representing the latest time before the time S are added to the case to be displayed from the database 5. get. In the search for the latest time, an upper limit time that can be traced back may be determined.

For example, as shown in FIG. 5, the device information area 51 of the database 5 stores four types of device information identified by A to D, and the comment information area 52 stores 2 types identified by a and c2. Suppose that the type of comment information is stored. In FIG. 5, when the time S is 9:00: X milliseconds, the hours and minutes are omitted, and "X" is displayed in milliseconds. That is, the column of numerical values shown in the column of "A" in FIG. 5 indicates the content of the time tag T13 assigned to the device information Idv of the device type A.

When the time S is "100", the device information having the latest time tag T13 before the time S is as shown by a circle in FIG. That is, in the type A, the time tag T13 is the device information of "97". In the type B, the time tag T13 is the device information of "100". In the type C, the time tag T13 is the device information of "99". In the type D, the time tag T13 is the device information of "98".

Further, the comment information having the latest time tag T25 before the time S is the comment information in which the time tag T25 is "93" in the type a. In type c, it means that the corresponding comment information does not exist within the upper limit time range.

The terminal processing unit 63 generates integrated image data which is image data for displaying the read device information Idv according to the layout set at that time. Hereinafter, the image displayed by the integrated image data is referred to as an integrated image.

As an example of the layout of the integrated image, for example, as shown in FIG. 6, it may have a monitor area A1, a video area A2, a navigation image area A3, a time domain A4, and the like. The monitor area A1 is an area in which a graph or the like for monitoring biological information is displayed. In the monitor area A1, biological information is displayed in numerical and graph formats. The image area A2 is an area in which a moving image of the treatment target captured by a camera or the like is displayed. The navigation image area A3 is an area in which the three-dimensional position detected by the surgical navigation is displayed together with the three-dimensional image of the affected area prepared in advance. In the navigation image area A3, three cross-sectional images including the detection position and showing different cross-sections are displayed in a three-view format. The time domain A4 is an area for expressing the time range in which the time series of integrated information exists on the time axis and displaying the time S on the time axis. In the time domain A4, a balloon-shaped display indicating the time when the event occurs may be displayed together with the time axis. There may be a dedicated application for changing the layout of the integrated image.

The terminal processing unit 63 generates comment display data, which is display data for displaying the comment information Icm together with the integrated image. In the following, the display displayed by the comment display data is referred to as comment display. The display position and display format of the comment display on the integrated image are set in advance according to the comment type of the comment information Icm or the data type of the device information Idb to be commented. In addition, there may be a dedicated application for changing the display position and display format of the comment display.

The terminal processing unit 63 outputs the integrated image data and the comment display data to the display unit 62 as display data, so that the integrated image and the comment display are displayed on the display screen of the display unit 62. FIG. 6 is a display example when the comment information does not exist or the comment information is set to be hidden, and FIG. 7 is a display example when the comment information is set to be displayed.

Reference numeral C1 in FIG. 7 is a comment input in association with the parameter to be commented. Reference numeral C2 is a comment including a line diagram or characters handwritten on the image to be commented by using the touch panel. Reference numeral C3 is a comment for commenting on the three-dimensional position specified by the MPR image displayed in the navigation image area A3. Reference numeral C4 is a comment for commenting on a point designated on the MPR image. Reference numeral C5 is a display area in which a comment for which the entire screen is a comment target is displayed. Comments are displayed in this display area in association with the timeline TL. When the comment target is a comment, the comments are displayed in an overlapping manner as shown by reference numerals C51 and C52.

[2-4-2. Commenting AP]
The comment addition AP632 is an application for inputting a comment regarding the integrated screen when the integrated screen is displayed on the display unit 62 by the display AP631.

The terminal processing unit 63 activates the comment addition AP632 according to the instruction from the input unit 61. In the comment giving AP632, when the input unit 61 performs an operation of designating a part or all of the integrated screen, the information input from the input unit 61 is subsequently acquired as the comment information Icm. In the comment giving AP632, the second tag information T2 is generated every time the comment information Icm is acquired. Further, in the comment addition AP632, the tagged comment information Icm is generated by adding the generated second tag information T2 to the comment information Icm, and is stored in the comment information area 52 of the database 5. Note that the tagged comment information T_Icm stored in the database 5 is immediately reflected in the display on the display unit 62 by the display AP631 when the comment information is set to be displayed.

The contents of the tags T21 to T27 belonging to the second tag information T2 are generated as follows, for example.
As the case identification tag T21, the case identification tag T11 that specifies the integrated information being reproduced by the display AP631 is used when the comment addition AP632 is activated.

The comment identification tag T22 is identification information for uniquely identifying the comment information Icm, and is generated every time the comment information Icm is input.
The input person information tag T23 is information for identifying a comment input person, and may be input via the input unit 61, or a user ID or the like to be input by the user when the internal terminal device 6 is started. ..

The comment target tag T24 generates information that identifies the comment target specified by the input unit 61. When the comment target is the device information IDv, the information specifying the device 31 included in the data type tag T14 may be used. When the comment target is a comment, the value of the comment identification tag T22 may be used.

The time tag T25 is set by acquiring the acquisition time corresponding to the timing at which the comment designation input, which is the input for designating the comment target, is performed. The time tag T26 acquires and sets the playback time corresponding to the timing. The acquisition time is the time S acquired by the display AP631 before the timing when the comment designation input is performed, or the time indicated by the time tag T13 associated with the device information IDv displayed at that timing. is there. The playback time is the current time acquired from the clock function of the microcomputer at the timing when the comment target is specified.

The comment type tag T27 is information for specifying the type of the input comment, and is set according to the input device used for inputting the comment. Types of comments include, for example, character input via a keyboard, handwriting input via a touch panel, voice input via a microphone, image input via a camera, and the like.

[2-4-3. Upload AP]
When the upload AP633 uploads the integrated information to the server 7 in order to share the integrated information generated inside the information providing system 2 with the user of the external communication network 9 to which the information providing system 2 is connected. The application to run.

The processing content of the upload AP633 will be described with reference to the flowchart of FIG.
The upload AP633 is activated when an instruction specifying case identification data that specifies the integrated data to be uploaded is input via the input unit 61.

When the processing is started, in S110, the terminal processing unit 63 acquires a series of tagged device information T_Idv and tagged comment information T_Icm, that is, integrated information, specified by the designated case identification data from the database 5. .. The device information Idv included in the tagged device information T_Idv acquired here corresponds to the public device information.

In the following S120, anonymization processing is executed for the individual device information Idv and comment information Icm included in the acquired integrated information.
In this anonymization process, as shown in FIG. 9, first, in S210, the terminal processing unit 63 selects either the device information Idv or the comment information Icm acquired in S110 as the target information.

In the following S220, the terminal processing unit 63 anonymizes the personal information included in the tag information (that is, metadata) associated with the target information. Specifically, for example, the text data representing the personal information included in the case information tag T12 is processed, and the text data is deleted or replaced with hidden characters. That is, even if the integrated image includes the display using the tag information, the personal information is not displayed.

In the following S230, the terminal processing unit 63 refers to the data type tag T14 or the comment type tag T27 to determine whether or not the target information is image data. If a positive determination is made in S230, the process is transferred to S240, and if a negative determination is made, the process is transferred to S250.

In S240, the terminal processing unit 63 executes face recognition by image processing on the image displayed by the target information, and processes the target information so that the area determined to be a face is masked. , Anonymize the target information and proceed to S280.

In S250, the terminal processing unit 63 determines whether or not the target information is text data. If an affirmative determination is made in S250, the process is transferred to S260, and if a negative determination is made, the process is transferred to S270.

In S260, the terminal processing unit 63 searches for whether or not the target information includes the personal information of the patient, and if the target information includes the personal information, deletes the text data representing the personal information or replaces it with a hidden character. Then, the target information is anonymized and the process proceeds to S280. For example, when the target information is comment information Icm, personal information may be included in the comment, so this is anonymized.

In S270, the target information in a data format other than the image data and the text data is processed according to the target information, and the processing proceeds to S280. For example, in the case of voice data, the part where personal information is emitted is deleted or masked by using voice recognition or the like.

In S280, the terminal processing unit 63 stores the target information anonymized by the processing of S210 to S270 in the anonymized information area 53 of the database 5.
In the subsequent S290, the terminal processing unit 63 determines whether or not the above-mentioned processes S210 to S280 have been executed for all the device information Idb and the comment information Icm acquired in S120. If a negative determination is made in S280, the process is returned to S210, and if an affirmative determination is made, the process ends.

That is, in the anonymization process, anonymization is performed in units of individual device information Idb and comment information Icm. The device information IDv anonymized by the anonymization process corresponds to the anonymized device information.

Returning to FIG. 8, in S130 following the anonymization process of S120, the terminal processing unit 63 generates integrated image data that displays all types of device information Idv acquired in S110 on one screen.

In the subsequent S140, the terminal processing unit 63 executes a confirmation process of extracting an anonymization-required portion from all the integrated images, which are images displayed by the integrated image data generated in S130. In this confirmation process, anonymization-required parts are extracted by performing image recognition for all integrated images, specifically, at least one of face recognition and character recognition. For example, it detects documents that happen to be reflected in all integrated images, personal information written on name tags, and the like. In addition to image recognition, an image based on integrated image data may be displayed on the display screen of the display unit 62, and the operator of the internal terminal device 6 may be made to input the anonymization required portion via the input unit 61.

In the following S150, the terminal processing unit 63 determines whether or not the personal information has been extracted by the confirmation process of S140. If an affirmative determination is made in S150, the process is transferred to S160, and if a negative determination is made, the process is transferred to S170.

In S160, the terminal processing unit 63 processes the device information Idv corresponding to the anonymization-requiring part stored in the anonymization information area 53 so that the anonymization-requiring part extracted in S140 is anonymized. Anonymization processing is executed and the processing proceeds to S170. In the re-anonymization process, the same process as the anonymization process may be automatically performed, or the operator of the internal terminal device 6 may process the device information IDv.

In S170, the terminal processing unit 63 sends the anonymized information stored in the anonymized information area of the database 5, that is, the anonymized tagged device information T_Idv and the anonymized tagged comment information T_Icm to the server. It is transmitted to 7 and the process is completed. As a result, a series of integrated information regarding the specified case is anonymized and uploaded to the server 7.

When the anonymization-required part is extracted by the confirmation process of S140, the upload may be stopped instead of executing the re-anonymization process in S160. Further, in the re-anonymization process, S140 to S160 may be repeated using the re-anonymized device information IDv. Further, here, the confirmation process is executed only for the all integrated images based on the device information Idb, but the comment display based on the comment information Icm may be executed in the same manner.

In the present embodiment, S110 corresponds to the information acquisition unit, S120 corresponds to the anonymization unit, S130 corresponds to the image generation unit, S140 corresponds to the confirmation unit, and S150 and S170 correspond to the information providing unit. , S150 and S160 correspond to the re-anonymization unit.

[6. effect]
According to the information sharing system 1 described in detail above, the following effects are obtained.
(1) In the information sharing system 1, when uploading integrated information from the information providing system 2 to the server 7, anonymization processing is executed in units of individual device information Idb and comment information Icm, which are elements constituting the integrated image. .. Furthermore, by performing image recognition on all integrated images that display all types of device information included in the case to be uploaded on one screen, whether or not the part requiring anonymization in the integrated image is extracted. Check and if the part requiring anonymization is not extracted, allow uploading.

That is, before the integrated image is released to an unspecified number of users, anonymization-required parts are extracted and anonymized again using an image that can actually be released. Therefore, even if personal information is reflected in the integrated image by an unexpected method, it can be corrected before publication, so that leakage of personal information can be suppressed.

(2) In the information sharing system 1, since the comment information Icm is also anonymized, it is possible to prevent the leakage of personal information due to comments including personal information. In other words, even if there is a comment containing personal information, it is anonymized before it is published, so that an unlimited free comment can be left by the comment-giving AP.

[7. Other embodiments]
Although the embodiments of the present disclosure have been described above, the present disclosure is not limited to the above-described embodiments, and can be implemented in various modifications.

(A) In the above embodiment, the confirmation process is performed by the information providing system 2, but before the information providing system 2 executes the anonymization process for each information, uploads it to the server 7, and actually distributes it. May cause the server 7 to perform the confirmation process.

(B) The terminal processing unit 63 and methods thereof described in the present disclosure are provided by configuring a processor and memory programmed to perform one or more functions embodied by a computer program. It may be realized by a dedicated computer. Alternatively, the terminal processing unit 63 and the methods thereof described in the present disclosure may be realized by a dedicated computer provided by configuring the processor with one or more dedicated hardware logic circuits. Alternatively, the terminal processing unit 63 and their methods described in the present disclosure include a processor and memory programmed to perform one or more functions and a processor composed of one or more hardware logic circuits. It may be realized by one or more dedicated computers configured by the combination of. The computer program may also be stored on a computer-readable non-transitional tangible recording medium as an instruction executed by the computer. The method of realizing the functions of the terminal processing unit 63 and each part included in the terminal processing unit 63 does not necessarily include software, and all the functions are realized by using one or more hardware. May be done.

(C) A plurality of functions possessed by one component in the above embodiment may be realized by a plurality of components, or one function possessed by one component may be realized by a plurality of components. .. Further, a plurality of functions possessed by the plurality of components may be realized by one component, or one function realized by the plurality of components may be realized by one component. Further, a part of the configuration of the above embodiment may be omitted. In addition, at least a part of the configuration of the above embodiment may be added or replaced with the configuration of the other above embodiment.

(D) In addition to the above-mentioned information sharing system 1, a program for operating a computer as an internal terminal device 6 constituting the information sharing system 1, a non-transitional actual recording medium such as a semiconductor memory in which this program is recorded, etc. , The present disclosure can also be realized in various forms.

1 ... Information sharing system, 2 ... Information providing system, 3 ... Device group, 4 ... Providing processing unit, 5 ... Database, 6 ... Internal terminal device, 7 ... Server, 8 ... External terminal device, 9 ... Communication network, 31A ~ 31H ... device, 41A to 41H ... provider, 43 ... middleware, 51 ... device information area, 52 ... comment information area, 53 ... anonymized information area, 61 ... input unit, 62 ... display unit, 63 ... terminal processing unit, display AP ... 631, commenting AP ... 632, uploading AP ... 633.

Claims (4)

Information representing the time when the device information was acquired and the type of the device information for each of the device information acquired from a plurality of medical devices used for at least one of a patient's examination, examination, and treatment. With an information acquisition unit (63: S110) configured to acquire a plurality of tagged device information associated with tag information including the above from an internal network used by a specific user who is a limited user. ,
Of the tagged device information acquired by the information acquisition unit, it is required to be shared with users other than the specific user via an external network that is also used by users other than the specific user. Using the tagged device information as public device information, the public device information is processed so that the personal information included in the public device information that identifies the individual patient is anonymized for each public device information. Anonymization unit (63: S120) configured to do
Using the public device information processed by the anonymization unit as anonymization device information, integrated image data which is image data for displaying a plurality of the anonymization device information associated with the same time on one screen is generated. An image generator (63: S130) configured as described above,
A confirmation unit (63: S140) configured to extract the anonymization-required site in which the personal information is shown from the integrated image displayed by the integrated image data, and
With the information providing unit (63: S150, S170) configured to allow the distribution of the anonymized device information via the external network when the anonymized part is not extracted by the confirmation unit. ,
Information sharing system equipped with. The information sharing system according to claim 1.
The confirmation unit performs at least one of character recognition and face recognition on the integrated image.
Information sharing system. The information sharing system according to claim 1 or 2.
The confirmation part
A display unit (62) configured to display the integrated image, and
An input unit (61) configured to accept an operation for inputting a part requiring anonymization in the integrated image, and an input unit (61).
An information sharing system that determines that the personal information has been extracted when the input unit receives the operation. The information sharing system according to any one of claims 1 to 3.
When the personal information is extracted from the integrated image by the confirmation unit, the re-anonymization unit is configured to reprocess the anonymized device information so that the extracted personal information is anonymized. (63: S150, S160)
Information sharing system further equipped with.

Images