JP2005346248A - Information mediation method and device - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a method by which providers of a variety of services can use personal information by anonymizing the personal information. <P>SOLUTION: An information mediation device is provided with; a first data storage part which stores individual-identification information for identifying an individual and diagnosis result information on the individual; an anonymizing means which excludes prescribed information including a name from the individual-identification information, and stores at least part of either the name-excluded individual-identification information or the diagnosis result information, as the anonymized individual information, in a second data storage part; a means which identifies an individual belonging to each of a plurality of categories stipulated based on information kind in the anonymized individual information stored in the second data storage part by using the information stored in the first data storage part, and stores the identification information of the individual belonging to each of the plurality of categories in a third data storage part; and a method which receives an advertisement mail from a registered providers for each of the plurality of categories included in the third data storage part, and transfers the advertisement mail by using the individual-identification information of an individual belonging to a categories. <P>COPYRIGHT: (C)2006,JPO&NCIPI

Description

  The present invention relates to an information mediation technique, and more particularly to a technique for managing the use of personal information.

Health care institutions need to collect sensitive personal information from individuals because of the nature of their work. Here, “sensitive personal information” refers to information that is not desired to be known to other people than personal information such as name, gender, and address regarding personal information protection. According to JIS Q 15001, it is defined as follows.
a. Matters concerning thoughts, beliefs and religions b. Human rights, ethnicity, gates, permanent address (excluding information on the prefecture where they are located), physical / mental disabilities, criminal records, and other matters that cause social discrimination c. Matters concerning workers' right to organize, collective bargaining and other acts of collective action d. Matters concerning participation in collective action, exercising petition rights, and exercising other political rights e. Health care and sex life

  In addition, according to the Personal Information Protection Law (established in May 2003 and scheduled to be enforced in April 2005), it is generally prohibited (in this case, service providers) to collect personal information without the permission of the person. When this Personal Information Protection Law is enacted, a business model in which service providers such as restaurants and greengrocers recruit members for their own stores and repeatedly visit them as before will take risks. Will accompany. For sensitive personal information such as health care information, the risk is even greater. On the other hand, with the aging of the population, the number of potential victims and reserves such as hypertension and diabetes has expanded, and many products have been developed with the key to health care information to meet these needs. Information marketing needs are expanding.

  In the past, information in the health care field has achieved its purpose by identifying individuals. However, in the case of research purposes such as clinical trials related to pharmaceuticals, we obtain consent from the person, collect sensitive personal information, and a specific researcher hides information that identifies individuals (referred to as “anonymization”). Based on sensitive personal information, statistical processing is performed for research.

  Also, health information is not the information that service providers need by simply collecting raw numbers, image data, and interview results. In general, doctors make a diagnosis based on this information, and as a result, examination instructions to confirm the disease name, confirmed disease name, treatment content such as medication and surgery, guidance content for patients and examinees (midnight Prohibit work, give instructions on exercise, etc.) and other information to the examinee / patient (referred to as “diagnosis information result information”).

  The diagnosis may be performed automatically by a computer without being a doctor. For example, Japanese Patent Laid-Open No. 7-95961 discloses the following technique in the medical examination field. In other words, the medical diagnostic system includes (a) means for inputting medical inquiry or diagnosis and examination data in medical examination, and (b) means for determining whether each input data falls within the determination range; (c) Condition group determination means for determining whether or not the condition group of the determination range relating to one or more test items related to each disease is satisfied; (d) Creating a determination result list and the same When different determination results are obtained for the disease, determination engine means for entering the determination result of the more severe symptom, and (e) output means. In the medical field, there are cases like the critical path being studied at the Medical Information System Development Center.

  Also, under the Personal Information Protection Law, in order to avoid complications in processing at companies, medical institutions, medical examination institutions, etc., even though the self-control rights of the person are permitted under the Personal Information Protection Law. Has been processed. For example, in Japanese Patent Laid-Open No. 2002-169898, the handling of personal information is uniform, and it is not considered to control for each individual. In other words, the control of personal information can be set for (1) each item, (2) each destination to be presented, (3) the timing of disclosure by a timer, etc., and by personal authentication such as PKI (Public Key Infrastructure), There were no devices that could not be modified by anyone other than the person.

Furthermore, a device that sends only information that has completely anonymized sensitive personal information related to information registrants to information accessors on the Internet, that is, the “personal identification information” tag is not allowed to pass through to be anonymized. There is no firewall. In the health care field, protocols for exchanging health information such as HL7 / DICOM have been standardized, but these are “personal identification information”, “inquiry information”, “value of measured value information”, “diagnosis” “Result information” is grouped by tag information.
Japanese Patent Application Laid-Open No. 7-95961 JP 2002-169898 A http://epath.medis.jp/index2.html

  As described above, there is no system in the prior art that can be used by various service providers after anonymizing sensitive personal information such as health care information.

  Accordingly, an object of the present invention is to provide a novel technique for making various service providers usable after anonymizing personal information.

  The information intermediary device of the present invention refers to a first data storage unit that stores personal identification information for identifying an individual including an email address and diagnostic result information of the individual, and the first data storage unit, Anonymization means for excluding predetermined information including name from personal identification information and storing at least a part of the remaining personal identification information and diagnosis result information as anonymization personal information in the second data storage unit; A plurality of means defined based on the means for enabling access from the terminal of the registered operator to the anonymized personal information stored in the data storage unit and the information type in the anonymized personal information stored in the second data storage unit For each of the classifications, the information stored in the first data storage unit is used to identify the individual to which the classification belongs, and the identification information of the individual belonging to each of the plurality of classifications is stored in the third data storage unit. For each of a plurality of classifications included in the third data storage unit, an advertisement mail from a registered operator is accepted, and the first data is stored using the identification information of the belonging person stored in the third data storage unit Means for forwarding the advertisement mail to the mail address stored in the section.

  In this way, registered operators can use anonymized personal information without directly handling personally identifiable information, and can also send advertising emails to individuals belonging to a class of interest. Become.

  Further, when transmitting information to a registered business operator's terminal, it may be determined whether the information includes the predetermined information, and if it is determined that the information is included, means for blocking the transmission may be further included. This is to prevent leakage of personal information.

  Furthermore, the first data storage unit further stores at least one of the measurement value information and the inquiry information, and generates the diagnosis result information using at least one of the measurement value information and the inquiry information, A means for storing in the first data storage unit may be further included.

  A fourth data storage unit that stores data defining access authority to information stored in the first data storage unit; and a unit that determines whether or not the first data storage unit is accessible according to the fourth data storage unit. You may make it have further. This is to prevent leakage of personal information.

  The diagnosis result information may include intervention recommendation information, and at least a part of the diagnosis result information may include intervention recommendation information. This is because the recommended intervention information is useful for the service provider, for example, on the registration business side.

  The information mediating apparatus of the present invention may be realized by a combination of a program for realizing the functions described above and a computer, in which case the program is, for example, a flexible disk, a CD-ROM, a magneto-optical disk, It is stored in a storage medium or storage device such as a semiconductor memory or a hard disk. Moreover, it may be distributed as a digital signal via a network or the like. The intermediate processing result is temporarily stored in a storage device such as a main memory.

  According to the present invention, personal information can be made anonymous and made available to various service providers.

  FIG. 1 shows a schematic diagram of a system according to an embodiment of the present invention. As shown in FIG. 1, there are “information registered member”, “anonymized ASP (Application Service Provider) provider”, and “information accessor (service provider)” on the Internet. “Service Providers” such as restaurants and fitness clubs, when promoting information on dietary and exercise menus for diabetes and hypertension to “information registered members” registered with ASP, are sensitive to health care I would like to issue a direct mail to an appropriate individual according to my personal information. However, there is a risk of leakage if personal information is held, and there is a risk of punishment after the enforcement of the Personal Information Protection Act in April 2005. According to the present embodiment, the service provider can issue a direct mail to an appropriate target person without violating the risk of holding personal information.

1. Policy box device Information registration members are general members, and register their privacy policies in the policy box device. According to the policy, a person such as a medical examination institution or medical institution registers personal information (particularly sensitive personal information) in a database (DB) in the personal information mediating apparatus. The policy box device is set for each individual (FIG. 1: policy box (1) (2)), and can be set for a plurality of people such as children and elderly people (FIG. 1). 1: Policy box (3)).

  In the policy box device, the individual sets information to be disclosed or not to be disclosed among the personal information according to the personal policy. Items to be set can be set individually such as “last name”, “first name”, “age”, etc., but may be set in groups from the viewpoint of operability and efficiency.

  For example, in the field of health care, information handled in the field of health care is classified in the “major classification of data item set” established by the Medical Information System Development Center, and each item set is disclosed / undisclosed. A method can be considered in which an individual selects and sets it on the policy box device. However, it is also possible to set for each lower classification (for example, information on names of wounds and the like). FIG. 2 shows a table of major classifications of data item sets, and FIG. 3 shows a table of major classification name and fine classification level items. The data is based on the 1999 report on creation of data item sets for exchanging electronically stored medical record information by the Medical Information System Development Center.

  In the example of FIG. 2, basic patient information, medical record management information, life background information, medical background information, and medical record information with a policy flag “Y” are set to be publicly available. However, name information is always private in this system. In the table, “-” indicates “not applicable”.

  The functions of this policy box device are: (1) identifying and authenticating individuals, making it impossible for other people to modify them without permission, and (2) modifying the policy from the viewpoint of preservation of evidence. It is even more desirable to be able to make a device that keeps the history.

  Regarding the method / medium for realizing the policy box device, in the present embodiment, it is assumed that the policy box device is stored in a personal computer (PC) at home. , A method of writing in what the user owns such as a USB memory, a method of storing in a specific area in the ASP server, and the like.

2. Registration of anonymized personal policy with ASP center (Figure 4: Registration of personal policy with ASP center)
After setting the policy box device at home, the policy box device is transmitted to the personal information mediation device, and the personal information mediation device sets the area for each individual. Similar to the policy box, the personal information intermediary device has a mechanism that does not allow modification by anyone other than the user. As a method of realizing processing that does not permit modification by anyone other than the principal, in addition to using an IC card, the person who operates by bio-authentication such as fingerprint is specified, and after confirming that the person actually exists / registered by PKI Measures such as modification processing can be adopted.

3. Registration of sensitive personal information according to individual policy (Figure 5: Registration of sensitive personal information)
The following three types of personal information are registered in the personal information mediating apparatus via the Internet line.
(1) Intervention information such as medication information, and information registrants themselves set on the input screen, such as interviews (Note that intervention is a means of maintaining or improving an individual's health. (For example, taking medicine, performing surgery, exercising lightly, resting, etc., including instructions given by the attending physician or industrial physician, or conscious implementation by yourself)
(2) When data is measured by equipment, such as blood pressure measurement data, it is automatically registered from a server at home via a wired / wireless line
(3) Information that is registered on the input screen on behalf of the medical institution / fitness club, such as test results at a medical institution, doctor's diagnostic information, fitness information at a fitness club, etc.

  When registering such information, as in the previous section, it is necessary to implement a security mechanism that does not permit registration or reference by the person or an institution other than that specified by the person. In particular, (3) is generally referred to as an electronic medical record in a broad sense. In this case, it is added / referenced only for a certain period of time before and after medical treatment at that institution, or during a membership period of a fitness club or the like. Is possible. In that case, since medical care may be performed in cooperation, it is possible to refer to information registered by other organizations with respect to the person's information as necessary.

4). Accumulation of personal information (FIGS. 6 to 8: Accumulation and provision of sensitive personal information, and FIG. 3: items of major classification name and minor classification level)
Personal information is stored in a database in the personal information mediating apparatus in accordance with a convention such as “data item set”. The accumulated information is the following information.
(1) “Patient basic information” and “Health insurance / welfare information” in FIG.
(2) Text data, image data, waveform information, etc. The objective “measured value information value” necessary for health care is “medical examination record information” in FIG.
(3) What is classified as “interview information” is “life background information” and “medical background information”.
These are classified by a header such as HL7 and are automatically stored in a prescribed area in the database.

  6 to 9 show an example of a critical path in the case of diabetes hospitalization.

5). Conversion of accumulated information registrant information to “diagnosis result information” (FIG. 9: Flow of derivation of diagnosis result information)
“Diagnosis result information” is derived automatically or by a doctor's diagnosis based on the values of the personal identification information, inquiry information / measurement value information in the previous section. For this, the existing technique (for example, a critical path or a conventional doctor's diagnosis) described in the section of the prior art is used. The critical path is created according to the critical path creation flow of FIG.

  As a result, in the “Step 2: Execution” step, based on the values of the personal identification information, inquiry information, and measurement value information, diagnostic findings and recommended intervention information are automatically input by a critical path or the like. Enter diagnosis / intervention recommendation information from the screen via the Internet.

  In the “data item set” in FIG. 9, information classified as “diagnosis result information” includes “medical management information” such as medical history, “medical summary information” such as current diseases, and “hospitalization” summarized at discharge. In addition, there is "instruction execution record information" as intervention information derived from the diagnosis results, such as exercise guidance, nutritional guidance, and medication guidance (Fig. 3: Major classification name / subclassification level) See item).

  With this mechanism also shown in FIG. 10, it is possible to establish a system in which the medical team can care for each patient (or the general public) in the personal information mediating apparatus according to the workflow by the critical path.

In general, intervention information by the critical path is
(1) It is usually different depending on the ability of the doctor possessed by the medical institution and the performance of the medical device.
(2) The derived results may differ depending on the service provider's supply capabilities (and thus for each selected region).
(3) In the case of insufficient inquiry information and measured value information that cannot make a definitive diagnosis, for “diagnosis result information” such as “instruction execution record information”, a probabilistic diagnosis (for example, Information such as “probability of diabetes is 60%”) is also automatically set as “diagnosis result information”. It is unnecessary for the information registrant himself, but it is necessary or desirable for the service provider to grasp the overall numerical value / trend.
(4) In addition, the critical path is originally a technique for establishing a countermeasure as a result of educational hospitalization of a plurality of patients, but by using it more generally, for example, intervention recommendation information is made. In spite of this, the government did not take measures to prevent the illness from being cured as a result of not taking sufficient intervention (for example, “Don't go to the doctor despite being told to see a doctor”) Reflecting this in the policies of local governments can be handled by repeatedly using this critical path method for groups.

6). Anonymization of information registrant information (Figure 11: Accumulation and provision of sensitive personal information)
An anonymized ASP provider obtains compensation from a service provider by providing information accessor (service provider) with information of an information registrant.

  Therefore, the personal information mediating apparatus can automatically and anonymously inform the service provider who does not want to have personal information of the affected persons and their reserves at an appropriate level. Then, the service provider can search for information such as people living in a certain area at a certain level.

7). Creation of anonymized intervention information table (Figure 12: Anonymized intervention information table)
To create an anonymized intervention information table in personal information mediation device, delete name / identification information (name, resident registration number, etc.) from personal identification information, along with information necessary for service provider such as address / age The “instruction execution record information” is moved to the anonymization intervention information table made up of a relational database (RDB) (FIG. 12: information for identifying an individual).

  As a result, intervention information such as exercise guidance, nutritional guidance, and medication guidance is set for each district, age, etc., enabling service providers to access for marketing.

  However, even in the case of “information to be transferred to the anonymized intervention information table”, for example, the person himself / herself may be identified from the sensitive information because he / she lives in a certain area. In order to avoid such a situation, if the number of people does not reach the specified number, there is a risk of being identified (for example, “5 or more people in the smallest area per sensitive information”). Performs a process of automatically expanding the area to a level where there is no possibility of identifying an individual.

8). Access of anonymized intervention information table (FIG. 13: Anonymized intervention information table)
In the anonymized intervention information table in the personal information mediating apparatus, for example, in FIG. 13, information of “diabetic diet first level, exercise necessary, living in Higashi-ku, Fukuoka, 55 years old, male” is set. For example, a man who has a need for a “diabetic diet” from a restaurant lives in Higashi-ku, Fukuoka can be accessed from the service provider via the Internet. The fitness club can also access the presence of women in Sawara-ku, Fukuoka, who need exercise.

9. Personal information firewall (Figure 11: Accumulation and provision of sensitive personal information)
The anonymization intervention information table in the personal information mediating device is accessible to a standard protocol such as HTTP (Hyper Text Transfer Protocol) or HL7 (communication protocol that can use medical information in common). Is released to the service provider. In order to prevent leakage of personally identifiable information such as name, basic resident code, and health insurance insured symbol number, a personal identification information firewall will be installed. This firewall monitors all the “information to be deleted for anonymization” in FIG. 12 so as not to leak outside.

10. Receiving e-mail for direct mail (Figure 14: Receiving e-mail for direct mail)
The linked anonymized intervention information table in the personal information intermediary device is a post office box for organizations that has a code for linking with the diagnostic result information storage device and a mail box in the smallest unit group of the anonymized intervention information storage device. It is. The service provider can only add information, and the information registrant can refer only to the identity information.

  In the case of FIG. 12, the service provider, via the Internet, the address where A: “Higashi-ku, Fukuoka City” and (1) “Men: Diabetes” intersect in the anonymized intervention information table in the personal information mediation device. , (Ie, “A (1)”), a direct mail is transmitted. The received personal information mediating apparatus temporarily stores the mail at the corresponding address, and then automatically transfers it to the personal address of the information registered member. The number in the cell is the management ID of the corresponding information registrant. In the personal information mediating device, the management ID is automatically converted into a personal mail address for use.

  In addition to sending direct e-mail to the group, the service provider shall entrust distribution of paper advertisement leaflets classified for specific prospective customers to an anonymized ASP provider. You can also.

  As a result, the information registered member can receive the advertising mail only for the necessary information, and the service provider can deliver the direct mail to the appropriate prospective customer with a small amount of mail (small advertising cost).

  The effects according to the present embodiment are summarized as shown in FIG.

  The main components in the present embodiment are summarized as follows.

  Although one embodiment of the present invention has been described, the present invention is not limited to this. For example, about 100 essential medical examination items determined by the Health and Safety Act are obliged to be managed by the company and reported to the Labor Standards Inspection Office as necessary. The medical checkup items do not need to be known by the company, or knowing them is obliged to prevent leakage, which is an additional risk for the company. Control the items that employees should report to the company they work for according to the information content.

  In addition, for the purpose of a will, etc., it becomes possible to disclose sensitive personal information with a setting such as “100 years from now”.

  The personal information mediating apparatus described above includes a memory 2501, a CPU 2503, a hard disk drive (HDD) 2505, a display control unit 2507 connected to the display device 2509, and a removable disk 2511 as shown in FIG. A drive device 2513, an input device 2515, and a communication control unit 2517 for connecting to a network are connected by a bus 2519. An operating system (OS) and an application program for performing the processing in the above embodiment are stored in the HDD 2505, and are read from the HDD 2505 to the memory 2501 when executed by the CPU 2503. If necessary, the CPU 2503 controls the display control unit 2507, the communication control unit 2517, and the drive device 2513 to perform necessary operations. Further, data in the middle of processing is stored in the memory 2501 and stored in the HDD 2505 if necessary. In the embodiment of the present invention, an application program for realizing the above functions is stored in the removable disk 2511 and distributed, and installed in the HDD 2505 from the drive device 2513. In some cases, the HDD 2505 may be installed via a network such as the Internet and the communication control unit 2517. Such a computer realizes various functions as described above by organically cooperating hardware such as the CPU 2503 and the memory 2501 described above with the OS and necessary application programs.

It is a system outline figure in an embodiment of the invention. It is a table of a large classification of a data item set. This is a table of items of the major classification name and fine classification level. It is a figure which shows the registration flow to the ASP center of a personal policy. It is a figure which shows the registration flow of sensitive personal information. It is a figure which shows the example (the 1) of a critical path. It is a figure which shows the example (the 2) of a critical path. It is a figure which shows the example (the 3) of a critical path. It is a figure which shows the creation flow of a critical path. It is a schematic diagram which shows accumulation | storage and application of sensitive personal information. It is a figure which shows the anonymization intervention information table. It is a figure for demonstrating deletion (anonymization) of the information which pinpoints an individual. It is a schematic diagram which shows the access to the anonymization intervention information table. It is a schematic diagram which shows reception of e-mail for direct mails. It is a figure showing the effect in this Embodiment. It is a functional block diagram of a computer.

Claims (6)

A first data storage unit for storing personal identification information for identifying an individual including an email address and diagnostic result information of the individual;
Referring to the first data storage unit, predetermined information including a name is excluded from the personal identification information, and the remaining personal identification information and at least a part of the diagnosis result information are set as second anonymized personal information. Anonymization means for storing in the data storage unit;
Means for enabling access from a terminal of a registered operator to the anonymized personal information stored in the second data storage unit;
For each of a plurality of classifications defined based on the information type in the anonymized personal information stored in the second data storage unit, the individual to which the user belongs is identified using the information stored in the first data storage unit And means for storing identification information of an individual belonging to each of the plurality of classifications in a third data storage unit;
For each of the plurality of classifications included in the third data storage unit, an advertisement mail from the registered business operator is accepted, and the identification information of the individual to which the user belongs is stored in the third data storage unit. Means for forwarding the advertisement mail to the mail address stored in one data storage unit;
An information mediating apparatus. The method according to claim 1, further comprising means for determining whether or not the predetermined information is included in the information when transmitting the information to the terminal of the registered business operator, and preventing the transmission when the information is determined to be included. Information mediation device. The first data storage unit further stores at least one of measurement value information and inquiry information;
The information mediating apparatus according to claim 1 or 2, further comprising: means for generating the diagnosis result information using at least one of the measurement value information and the inquiry information and storing the information in the first data storage unit. A fourth data storage unit for storing data defining an access authority to information stored in the first data storage unit;
Means for determining whether to access the first data storage unit according to the fourth data storage unit;
The information mediating apparatus according to any one of claims 1 to 3, further comprising: The diagnosis result information includes intervention recommendation information,
The information mediating apparatus according to any one of claims 1 to 4, wherein the intervention recommendation information is included in at least a part of the diagnosis result information. With reference to the first data storage unit that contains the email address and personal identification information for identifying the individual and diagnostic result information of the individual, excluding predetermined information including the name from the personal identification information, Storing the remaining personal identification information and at least a part of the diagnosis result information in the second data storage unit as anonymized personal information;
When a search request for the anonymized personal information stored in the second data storage unit is received from a terminal of a registered business operator, the second data storage unit is searched and a search result is obtained from the registered business operator's terminal. A search step to reply to the device,
Using the information stored in the first data storage unit, the individual to which the individual belongs is identified for each of a plurality of classifications defined based on the information type in the anonymized personal information stored in the second data storage unit Storing the identification information of the individual belonging to each of the plurality of classifications in a third data storage unit;
For each of the plurality of classifications included in the third data storage unit, an advertisement mail from the registered operator is received, and the identification information of the individual to which the user belongs is stored in the third data storage unit. Transferring the advertisement mail to the mail address stored in one data storage unit;
An information mediating method executed on a computer.

Images