JP2009169700A - Disease onset identification system secure at cohort tracking - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a disease onset identification system that can acquire only information necessary for a cohort program while ensuring anonymity of participants in the cohort program. <P>SOLUTION: The disease onset identification system 1 comprises a research institute computer 2 having a cohort tracking database 2e for storing information about participants, a municipality computer 3 having a participant information database 3e for storing information about the participants, and a hospital computer 4 having a bill information database 4e for storing information about patients. The municipality computer 3 converts the participants' name 32 and other data into a hash value 36. The hospital computer 4 specifies participants from the patients according to a cohort disease name notified from the research institute computer 2 and the hash values 36. The disease onset identification system 1 can store the cohort disease name in the cohort tracking database 2e while ensuring anonymity of the participants. <P>COPYRIGHT: (C)2009,JPO&INPIT

Description

  The present invention is a cohort business that acquires medical information such as the health status, disease name, or genetic information of a specific individual over time, without browsing the medical information of those who have not consented to participate in the cohort business. The present invention relates to a disease onset grasping system capable of acquiring only medical information of participants who have agreed to participate in a cohort project.

  In recent years, a cohort business has been actively conducted to clarify the cause of diseases and methods for preventing diseases by accumulating and analyzing medical information such as the health status, disease names, and genetic information of specific individuals over time. . In the cohort business, in order to clarify the cause of disease and how to prevent the disease, it is necessary to accumulate medical information about a large number of individuals and to collect medical information about specific individuals over several years to decades. Need to get. Since medical information used in the cohort business includes disease names and genetic information, it needs to be stored in a state where personal anonymity is ensured. In addition, the medical information is desirably data based on highly reliable diagnosis contents and health check results held in a medical institution. In addition, medical information used in the cohort business must be obtained without browsing medical information other than those who have not agreed to participate in the cohort business from the viewpoint of personal information protection.

  Then, the technique which estimates the onset of a disease by calculating onset probability based on a test subject's constitution type is known (for example, refer patent document 1). In addition, a technique for calculating a health index value by indexing an individual's health state and predicting the individual's health state based on the health index value is known (for example, see Patent Document 2).

However, in the technique disclosed in Patent Document 1, it is possible to predict the onset of a disease based on the diagnosis content, height, weight, or the like of a subject held in a medical information processing apparatus installed in a medical institution. However, there is a risk that the operator of the medical information processing apparatus may view the name, address, diagnosis content, height, weight, etc. other than the subject. Moreover, in the technique shown by patent document 2, an individual's health state is estimated based on the information regarding an individual's health state, and anonymity of an individual could not be ensured.
JP 2006-163489 A JP 2002-63278 A

  The present invention has been made to solve the above-mentioned problems, and refers to the name, address, or diagnosis content of a person who has not agreed to participate in the cohort business from the diagnosis content held in the medical institution. The purpose is to provide a disease onset monitoring system that can acquire the names of diseases used in the cohort business without having to do so, and keeping the personal information such as names and addresses of participants in the cohort business confidential And

  In order to achieve the above object, the invention according to claim 1 is a disease onset grasping system comprising at least three computers connected to each other via a telecommunication line, and is installed at a local government office and participates in a cohort project. Participant information database that stores the name, date of birth, and address of the participant who agrees with the personal identification number uniquely assigned to the participant, and matches the predetermined conditions from the participant information database A local government computer equipped with a local government control means for extracting information and a local government connection means that can communicate with a computer only when data is transmitted to and received from a predetermined computer, and personal identification installed in a research institution Cohort tracking that associates and stores numbers, participant health checkup information, and tracking information that stores participant disease names A research facility comprising a database, research institution control means for storing a predetermined disease name in tracking information, and research institution connection means that can communicate with a computer only when data is transmitted to or received from a predetermined computer. From an institution computer, a receipt information database, which is installed in a hospital and stores the receipt ID and the patient's name, date of birth, address, diagnosis date, and disease name in association with each other using the receipt ID as a key, and the receipt information database A hospital computer comprising: a hospital control unit that extracts information that matches a predetermined condition; and a hospital connection unit that can communicate with the computer only when data is transmitted to and received from a predetermined computer. The local government control means uses a predetermined encryption function in the participant information database. The remembered name, date of birth, and address are converted into first encrypted data, the personal identification number and the first encrypted data are stored in the participant information database in association with each other, and the local government connection means stores the first encrypted data. The encryption data is transmitted to the hospital computer, the research institution control means causes the research institution connection means to transmit the predetermined disease name to the hospital computer as a cohort disease name, and the hospital control means receives the reception using the encryption function. The name, date of birth, and address stored in the information database are converted into second encrypted data, and the personal identification number and the second encrypted data are stored in association with each other in the receipt information database. When the first encrypted data and the cohort disease name are received, the second encrypted data associated with the disease name that matches the cohort disease name from the receipt information database. The second encrypted data that matches the first encrypted data is extracted, and the second encrypted data extracted by the hospital connecting means is transmitted to the local government computer, and the local connecting means uses the second encrypted data. The local government control means extracts the personal identification number associated with the first data that matches the second encrypted data from the participant information database, and researches the personal identification number extracted by the local government connection means. When it is sent to the institutional computer and the connection means for the research institution receives the personal identification number, the control means for the research institution stores the name of the cohort disease in the tracking information associated with the personal identification number in the cohort tracking database. It is.

  Further, the invention of claim 2 is a disease onset monitoring system comprising at least three computers connected to each other via a telecommunication line, and is a participant who is installed at a local government office and agrees to participate in a cohort project. Participant information database that stores the name, date of birth, and address of a person in association with a personal identification number uniquely assigned to the participant, and a local government that extracts information that matches a predetermined condition from the participant information database A local government computer having a control means for use and a connection means for a local government that can communicate with a computer only when transmitting and receiving data to and from a predetermined computer, a personal identification number, and a participant A cohort that stores and associates health checkup information with tracking information to which death information indicating whether or not a participant has died is added. A research institution comprising a tracking database, a research institution control means for storing death information in the trace information, and a research institution connection means for communicating with a computer only when data is transmitted to and received from a predetermined computer Death information database, which is installed in a health care center and stores death information ID, death name, birth date, address, and death date in association with death information ID as a key, death information A health center computer comprising: health center control means for extracting information that matches a predetermined condition from the database; and health center connection means for enabling communication with the computer only when data is transmitted / received to / from a predetermined computer; The local government control means uses a predetermined encryption function and uses a participant information database. The stored name, date of birth, and address are converted into the first encrypted data, the personal identification number and the first encrypted data are stored in association with each other in the participant information database, and the first connecting means for the local government uses the first The encryption data is transmitted to the health center computer, the research institution control means causes the research institution connection means to request the provision of death information to the health center computer, and the health center control means transmits the encryption function. The name, date of birth, and address stored in the death information database are converted to the third encrypted data, and the personal identification number and the third encrypted data are stored in the death information database in association with each other. When the means receives the first encrypted data, the third encrypted data that matches the first encrypted data is extracted from the death information database and extracted to the health center connecting means. When the third cipher data is transmitted to the local government computer and the local government connection means receives the third cipher data, the local government control means sends the first data that matches the third cipher data from the participant information database. When the personal identification number associated with is extracted, the local government connection means transmits the extracted personal identification number to the research institution computer, and when the research institution connection means receives the personal identification number, the research institution control means The death information is stored in the tracking information associated with the personal identification number in the tracking database.

  According to a third aspect of the present invention, in the disease onset grasping system according to the first or second aspect, the encryption function is a hash function.

  According to the first aspect of the present invention, the disease onset grasping system transmits data obtained by encrypting a name, an address, etc. for identifying a participant from a local government computer to a hospital computer. Thereby, the disease onset grasping | stimulating system can memorize | store the disease name required for a cohort business in the cohort tracking database in the state where information, such as a name and address which identifies the participant to a cohort business, was kept secret. In addition, the disease onset grasping system extracts only the diagnostic content of the participant from the receipt information database. Thereby, the disease onset grasp system can prevent a doctor, a nurse, a medical information manager, or a researcher from browsing the diagnosis contents of a patient who does not participate in the cohort business. Further, the disease onset grasping system is stored in the participant information database, the cohort tracking database, and the receipt information database from the outside so that the data can be transmitted / received via the telecommunication line only when the data is transmitted / received. Information can be prevented from being falsified or stolen.

  According to the invention of claim 2, the disease onset grasping system transmits data obtained by encrypting a name, an address and the like for identifying the participant from the local government computer to the health center computer. Thereby, the disease onset grasping system can store death information indicating that the participant died in a state where the information such as the name and address specifying the participant to the cohort business is kept secret in the cohort tracking database. . Moreover, the disease onset grasping system extracts only death information indicating that the participant has died from the death information database. As a result, the disease onset monitoring system can prevent the death information of residents who have not participated in the cohort project from being viewed by public health staff or researchers. Further, the disease onset grasping system is stored in the participant information database, the cohort tracking database, and the death information database from the outside in order to make it possible to send and receive data via the telecommunication line only when sending and receiving data. Information can be prevented from being falsified or stolen.

  According to the invention of claim 3, the disease onset grasping system uses the hash function, and the participant name, date of birth, and address stored in the participant information database, the receipt information database, and the death information database. Is converted into a hash value that cannot be theoretically decrypted. As a result, researchers, doctors, nurses, medical information managers, health center staff, etc. will not be able to know the names and addresses that identify participants, thus ensuring the anonymity of participants. . Moreover, the disease onset grasping system can use a hash value with a low risk of being always decrypted by periodically changing the hash function.

  Hereinafter, a disease onset grasping system according to first and second embodiments of the present invention will be described with reference to the drawings. FIG. 1 shows a configuration of a disease onset grasping system according to the first embodiment. The disease onset grasping system 1 is installed in a research institution computer 2 installed in a research institution such as a university hospital or a research facility, a local government computer 3 installed in a city hall or town hall of a local government, a hospital or a clinic, etc. The hospital computer 4 is provided. The research institution computer 2, the local government computer 3, and the hospital computer 4 are installed in geographically distant locations, and are connected to the dedicated line 5 via the LANs 2a to 4a, respectively.

  The research institution computer 2 stores information on the participant who has agreed to participate in the cohort project and an input means 2b for inputting a disease name, information on the participant, a main body 2c for processing this information, and the participant And display means 2d for displaying information on the disease or disease name. The main body 2c has a cohort tracking database 2e for storing information about participants, a connection means 2f for transmitting / receiving data to / from the local government computer 3 or the hospital computer 4 via the dedicated line 5, and a control for controlling the entire research institution computer 2 Means 2g are provided. The cohort is to investigate a lifestyle or health condition of a predetermined human body in advance, and analyze, investigate, or predict a subsequent disease occurrence state or generation time. The research institution computer 2 stores information on the participants who have agreed to participate in the cohort project, and acquires information on the disease necessary for conducting the cohort project from the hospital computer 4. Here, the cohort business is a business that investigates and researches about the onset time and onset state of various diseases based on personal health diagnosis information, genetic information, information on diseases, and the like. Participants who have agreed to participate in the cohort business agree to provide research institutions with their own health checkup information, genetic information, and disease information anonymously after understanding the significance of the cohort business. The person who did.

  The local government computer 3 includes an input unit 3b for inputting information about the participant, a main body 3c for storing information about the participant, processing the information, and a display unit 3d for displaying the information about the participant. The main body 3c controls the participant information database 3e for storing information about participants, connection means 3f for transmitting / receiving data to / from the research institution computer 2 or the hospital computer 4 via the dedicated line 5, and the local government computer 3 as a whole. A control unit 3g and a storage unit 3h that stores a hash function used for encrypting information about the participant are provided.

  The storage unit 3h stores in advance hash functions that are unified throughout the disease onset grasping system 1, and the types of hash functions are, for example, SHA-1 (Secure Hash Algorithm-1) and MD5 (Message Digest Algorithm 5). Etc. Since the hash value cannot theoretically be decrypted, the disease onset grasping system 1 can prevent researchers, doctors, nurses, medical information managers, and the like from specifying the names and addresses of the participants. . Moreover, the disease onset grasping system 1 can use a hash value with a low risk of being always decrypted by periodically changing the hash function.

  The hospital computer 4 includes an input unit 4b for inputting information related to the diagnosis contents of the patient, a main body 4c for storing information related to the diagnosis contents, and processing the information, and a display means 4d for displaying the diagnosis contents. Here, the diagnostic content is, for example, information recorded in an electronic medical record stored in a hospital. The main body 4c has a receipt information database 4e for storing information relating to diagnostic contents, connection means 4f for transmitting / receiving data to / from the research institution computer 2 or the local government computer 3 via the dedicated line 5, and control for controlling the hospital computer 4 as a whole. Means 4g and a storage unit 4h for storing a hash function used for encrypting information about the participant. The hash function stored in the storage unit 4h is the same as the hash function stored in the storage unit 3h.

  Here, the input unit 2b to the input unit 4b are, for example, a keyboard and a mouse, and the display unit 2d to the display unit 4d are, for example, a liquid crystal display and a plasma display. The connection means 2f is physically connected to the dedicated line 5, but normally maintains a state in which data cannot be transmitted / received to / from the local government computer 3 and the hospital computer 4. The connection means 2f executes data transmission / reception via the dedicated line 5 only when receiving an instruction to transmit / receive data to / from the local government computer 3 or the hospital computer 4 from the control means 2g. A state where data cannot be transmitted / received to / from the local computer 3 and the hospital computer 4 is set. The connection means 3f and the connection means 4f have the same configuration as the connection means 2f. Thereby, the research institution computer 2, the local government computer 3, and the hospital computer 4 can prevent unauthorized access from other computers and the alteration or theft of information stored in each computer.

  FIG. 2 shows a configuration of a database stored in each computer according to the present embodiment. 2A shows the configuration of the cohort tracking database 2e, FIG. 2B shows the configuration of the participant information database 3e, and FIG. 2C shows the configuration of the receipt information database 4e. Referring to FIG. 2 (a), the cohort tracking database 2e includes a personal identification number 21 for storing a number uniquely assigned to the participant, and is implemented for the participant when the participant participates in the cohort business. In the health check to be performed, a health check number 22 for storing a number used to identify the participant, and the height, weight, chest circumference, visual acuity, hearing, blood pressure, heart rate, etc. of the participant acquired in the health check Physiological examination information 23 for storing information, biological sample information 24 for storing information such as blood and urine collected in the health check, and tracking for storing information such as the disease name of the participant and the time when the disease occurred The information 25 is stored in association with it.

  Participants who are anonymously participating in the cohort project receive a medical examination once a year, for example, in order to provide research institutions with information used in the cohort project. In the medical examination, the participant is assigned not the name and personal identification number 21 but the medical examination number 22 associated with the personal identification number 21 in advance. Participants are always identified by the health examination number 22 during the health examination, and the health examination result is recorded in association with the health examination number 22. The medical examination number 22 is not reused once it is used in the medical examination. As a result, the doctor or nurse who is conducting the health check cannot link the participant receiving the health check with the personal identification number 21 of the participant. The physiological examination information 23 and the biological sample information 24 can be stored in a state where anonymity is ensured.

  2B, the participant information database 3e includes a personal identification number 31, a participant's name 32, a participant's date of birth 33, a participant's gender 34, and the participant's address. 35 is stored in association with each other. Also, the participant information database 3e stores the hash value 36 converted by the control means 3g in association with the personal identification number 31. Here, the hash value 36 is a numerical value obtained by converting the name 32, the date of birth 33, the gender 34, and the address 35 using the hash function stored in the storage unit 3 h by the control unit 3 g.

  Referring to FIG. 2 (c), the receipt information database 4e uses the receipt ID 41 uniquely assigned to the patient as a key, the patient's name 42, the patient's date of birth 43, the patient's gender 44, and the patient. The patient's address 45, the diagnosis date 46 when the patient was diagnosed, the diagnosed disease name 47, and the patient biological information 48 storing the patient's body temperature, blood pressure, heart rate, etc. are stored in association with each other. The receipt information database 4e stores the hash value 49 converted by the control means 4g in association with the receipt ID 41. Here, the hash value 49 is a numerical value obtained by converting the name 42, the date of birth 43, the sex 44, and the address 45 using the hash function stored in the storage unit 4h by the control unit 4g.

  Next, a cohort process in which the disease onset grasping system 1 according to the present embodiment acquires a participant's disease name will be described. FIG. 3 shows a flow of cohort processing executed by the disease onset grasping system 1. The local government computer 3 transmits the hash function stored in the storage unit 3h to the hospital computer 4 (S101). After the connection unit 3f is communicable with the connection unit 4f via the dedicated line 5, the connection unit 3f transmits the hash function to the connection unit 4f. After the transmission is completed, the connection unit 3f is in a state where data cannot be transmitted / received to / from another computer via the dedicated line 5. The hospital computer 4 stores the received hash function in the storage unit 4h. Thereby, the local government computer 3 and the hospital computer 4 hold the same hash function.

  Next, in the local government computer 3, the control means 3 g converts the name 32, date of birth 33, gender 34, and address 35 for all participants stored in the participant information database 3 e into a hash value 36. (S102). The participant information database 3e stores the converted hash value 36 in association with the personal identification number 31. Next, the local government computer 3 transmits all the hash values 36 stored in the participant information database 3e to the hospital computer 4 (S103). After the connection means 3f is communicable with the connection means 4f via the dedicated line 5, it transmits all hash functions stored in the participant information database 3e to the connection means 4f. After the transmission is completed, the connection unit 3f is in a state where data cannot be transmitted / received to / from another computer via the dedicated line 5.

  The research institution computer 2 stores the contents of the health examination performed on the participants in the cohort tracking database 2e (S104). The control means 2g stores the personal identification number 21, health check number 22, physiological examination information 23, and biological sample information 24 input to the input means 2b in the cohort tracking database 2e as the contents of the health check. Here, the personal identification number 21 is associated with the health examination number 22 in advance, and the personal identification number 21 assigned to the same participant and the personal identification number 31 stored in the participant information database 3e are the same. is there. Next, the research institution computer 2 notifies the hospital computer 4 of a disease name required in the cohort business as a cohort disease name (S105). Here, the cohort disease name is, for example, “myocardial infarction”, and the cohort disease name “myocardial infarction” is input from the input unit 2b. The control unit 2g causes the connection unit 4f to transmit the cohort disease name “myocardial infarction” input to the connection unit 2f. After the connection unit 2f is communicable with the connection unit 4f via the dedicated line 5, the connection unit 2f transmits the cohort disease name “myocardial infarction” to the connection unit 4f. After the transmission is completed, the connection unit 2 f is in a state where data cannot be transmitted / received to / from another computer via the dedicated line 5.

  The hospital computer 4 extracts a disease name 47 that matches the received cohort disease name “myocardial infarction” from the receipt information database 4e (S106). The control means 4g searches for the disease name 47 stored in the receipt information database 4e, and extracts all the receipt IDs 41 associated with the disease name 47 that matches the cohort disease name “myocardial infarction”. Next, the control unit 4g uses the hash function stored in the storage unit 4h to hash the name 42, date of birth 43, gender 44, and address 45 associated with all the extracted receipt IDs 41 into a hash value. 49 (S107). The receipt information database 4e stores the converted hash value 49 in association with the receipt ID 41.

  The control means 4g searches the hash value 49 stored in the receipt information database 4e, and extracts all the receipt IDs 41 associated with the hash value 49 that matches the hash value 36 stored in the storage unit 4h ( S108). Thereby, the hospital computer 4 can extract only the data of the participants participating in the cohort business from the data stored in the receipt information database 4e. Next, the control means 4g causes the display means 4d to display the date of birth 43, sex 44, diagnosis date 46, disease name 47, and patient biological information 48 associated with the extracted receipt ID 41 (S109).

  The doctor confirms whether the displayed disease name 47 matches the cohort disease name “myocardial infarction” by checking the information displayed on the display unit 4d. When the disease name 47 displayed on the display means 4d and the cohort disease name “myocardial infarction” do not match, the doctor uses the control means 4g to obtain the receipt ID 41 associated with the displayed disease name 47. Delete from the extracted receipt ID 41. When the doctor determines that the disease name 47 needs to be changed based on the date of birth 43, gender 44, diagnosis date 46, disease name 47, and patient biological information 48 displayed on the display means 4d. The receipt ID 41 associated with the displayed disease name 47 is deleted from the receipt ID 41 extracted by the control means 4g. Further, the doctor needs to change the disease name 47 displayed on the display unit 4d by referring to the medical examination information and the contents of the medical chart described on the paper in addition to the information displayed on the display unit 4d. When it is determined that there is a receipt ID 41 associated with the displayed disease name 47, it is deleted from the receipt ID 41 extracted by the control means 4g. Thereby, the hospital computer 4 can extract only the receipt ID 41 associated with the disease name 47 that matches the cohort disease name “myocardial infarction”. Here, the control means 4g does not display the name 42 and the address 45 associated with the extracted receipt ID 41 on the display means 4d. Thereby, the disease onset grasping system 1 extracts only the receipt ID 41 associated with the disease name 47 matching the cohort disease name “myocardial infarction” in a state where the anonymity of the participant is ensured based on the judgment of the doctor. be able to.

  Next, the hospital computer 4 transmits the hash value 49 and the diagnosis date 46 associated with the extracted receipt ID 41 to the local computer 3 (S110). After the connection unit 4f is communicable with the connection unit 3f via the dedicated line 5, the connection unit 4f transmits the hash value 49 and the diagnosis date 46 associated with the extracted receipt ID 41 to the connection unit 3f. After the transmission is completed, the connection means 4f makes a state in which data cannot be transmitted / received to / from another computer via the dedicated line 5.

  The local government computer 3 extracts the personal identification number 31 from the participant information database 3e based on the received hash value 49 (S111). Here, the control means 3g searches the hash value 36 stored in the information database 3e, and extracts all the personal identification numbers 31 associated with the hash value 36 that matches the received hash value 49. Next, the local government computer 3 transmits the extracted personal identification number 31 to the research institution computer 2 (S112). After the connection means 3f is communicable with the connection means 2f via the dedicated line 5, the connection means 3f transmits the extracted personal identification number 31 to the connection means 2f. After the transmission is completed, the connection unit 3f is in a state where data cannot be transmitted / received to / from another computer via the dedicated line 5.

  The research institution computer 2 stores the cohort disease name “myocardial infarction” in the cohort tracking database 2e based on the received personal identification number 31 (S113). Here, the control unit 2g searches the personal identification number 21 stored in the cohort tracking database 2e, and the tracking information associated with the personal identification number 21 that matches the received personal identification number 31. 25 stores the cohort disease name “myocardial infarction” and the diagnosis date 46. Thereby, the research institution computer 2 can obtain information on the occurrence of “myocardial infarction” and the time when “myocardial infarction” has occurred in a specific participant. As described above, the hospital computer 4 does not display the data about the patient who does not participate in the cohort business stored in the receipt information database 4e, the name 42 and the address 45 of the participant on the display means 4d, and displays the name of the cohort disease. The receipt ID 41 associated with the disease name 47 matching “myocardial infarction” is extracted. In addition, the research institution computer 2 does not access the names and addresses of the participants that are not required in the cohort business. Thereby, the disease onset grasping system 1 is in a state in which the confidentiality of the data related to the patient stored in the receipt information database 4e is ensured, and in the state in which the anonymity of the participants in the cohort business is ensured. Data required for the cohort business can be stored in 2e.

  Next, the disease onset grasping system 1 according to the second embodiment of the present invention will be described. FIG. 4 shows a schematic configuration of the disease onset grasping system 1 according to the second embodiment of the present invention. Here, a difference in configuration between the disease onset grasping system 1 according to the present embodiment and the disease onset grasping system 1 according to the first embodiment will be described. The disease onset grasping system 1 includes a research institution computer 2, a local government computer 3, and a health center computer 6 installed in a local health center. The health center computer 6, the local government computer 3, and the hospital computer 4 are installed in geographically distant locations, and are connected to the dedicated line 5 through the LAN 2a, the LAN 3a, and the LAN 6a, respectively.

  The health center computer 6 is an inhabitant of the local government, and input means 6b for inputting the death information of the deceased residents, the body information 6c for storing the death information and processing the death information, and the display for displaying the death information Means 6d is provided. Here, the death information is, for example, the name of a dead inhabitant and the date of death. The main body 6c includes a death information database 6e for storing death information, a connection means 6f for transmitting / receiving data to / from the research institution computer 2 or the local government computer 3 via the dedicated line 5, and a control means 6g for controlling the health center computer 6 as a whole. And a storage unit 6h for storing a hash function used for encrypting the death information. The hash function stored in the storage unit 6h is the same as the hash function stored in the storage unit 3h.

  The connection means 6f is physically connected to the dedicated line 5, but normally maintains a state in which data cannot be transmitted to and received from the research institution computer 2 and the local government computer 3. The connection means 6f executes data transmission / reception only when it receives a command to send / receive data to / from the research institution computer 2 or the local government computer 3 from the control means 6g. A state in which data cannot be transmitted to or received from the local government computer 3 is set.

  FIG. 5 shows the structure of the death information database 6e. The death information database 6e uses the death information ID 61 uniquely assigned to the deceased residents as keys, and the name 62 of the deceased residents, the date of birth 63 of the deceased residents, and the sex 64 of the deceased residents. The address 65 of the resident and the date of death 66 when the resident died are stored in association with each other. The death information database 6e stores the hash value 67 converted by the control means 6g in association with the death information ID 61. Here, the hash value 67 is a numerical value obtained by converting the name 62, the date of birth 63, the sex 64, and the address 65 using the hash function stored in the storage unit 6h by the control unit 6g.

  Next, a cohort process in which the disease onset grasping system 1 according to the present embodiment acquires a participant's disease name will be described. FIG. 6 shows a flow of cohort processing executed by the disease onset grasping system 1. The local government computer 3 transmits the hash function stored in the storage unit 3h to the health center computer 6 (S201). After the connection unit 3f is communicable with the connection unit 6f via the dedicated line 5, the connection unit 3f transmits the hash function to the connection unit 6f. After the transmission is completed, the connection unit 3f is in a state where data cannot be transmitted / received to / from another computer via the dedicated line 5. The health center computer 6 stores the received hash function in the storage unit 6h. Thereby, the local government computer 3 and the health center computer 6 hold the same hash function.

  Next, the control means 3g in the local government computer 3 converts the name 32, date of birth 33, gender 34, and address 35 for all participants stored in the participant information database 3e into a hash value 36 ( S202). The participant information database 3e stores the converted hash value 36 in association with the personal identification number 31. Next, the local government computer 3 transmits all the hash values 36 stored in the participant information database 3e to the health center computer 6 (S203). After the connection unit 3f is communicable with the connection unit 6f via the dedicated line 5, the connection unit 3f transmits all the hash functions stored in the participant information database 3e to the connection unit 6f. After the transmission is completed, the connection unit 3f is in a state where data cannot be transmitted / received to / from another computer via the dedicated line 5. The health center computer 6 stores the received hash value 36 in the storage unit 6h.

  The research institution computer 2 stores the contents of the health check performed on the participants in the cohort tracking database 2e (S204). The control means 2g stores the personal identification number 21, health check number 22, physiological examination information 23, and biological sample information 24 input to the input means 2b in the cohort tracking database 2e. Next, the control unit 2g causes the connection unit 2f to transmit an information provision request notification requesting provision of the death information of the participant to the health center computer 6 (S205). After the connection unit 2f is communicable with the connection unit 6f via the dedicated line 5, the connection unit 2f transmits an information provision request notification to the connection unit 6f. After the transmission is completed, the connection unit 2 f is in a state where data cannot be transmitted / received to / from another computer via the dedicated line 5.

  Upon receiving the information provision request notification, the health center computer 6 converts the name 62, date of birth 63, gender 64, and address 65 stored in the death information database 6e into a hash value 67 (S206). The hash value 67 is converted by the control means 6g using a hash function stored in the storage unit 6h. Next, the control means 6g searches for the hash value 67 stored in the death information database 6e, and obtains the death information ID 61 associated with the hash value 67 that matches the hash value 36 stored in the storage unit 6h. All are extracted (S207). Thereby, the health center computer 6 can extract only the data of the participants participating in the cohort business from the data stored in the death information database 6e.

  Next, the health center computer 6 transmits the hash value 67 and the death date 66 associated with the extracted death information ID 61 to the local computer 3 (S208). After the connection unit 6f is communicable with the connection unit 3f via the dedicated line 5, the connection unit 6f transmits the hash value 67 and the death date 66 associated with the extracted death information ID 61 to the connection unit 3f. After the transmission is completed, the connection means 6f makes a state in which data cannot be transmitted / received to / from another computer via the dedicated line 5.

  The local government computer 3 extracts the personal identification number 31 from the participant information database 3e based on the received hash value 67 (S209). The control means 3g searches the hash value 36 stored in the participant information database 3e, and extracts all the personal identification numbers 31 associated with the hash value 36 that matches the received hash value 67. Next, the local government computer 3 transmits the extracted personal identification number 31 and date of death 66 to the research institution computer 2 (S210). After the connection means 3f is communicable with the connection means 2f via the dedicated line 5, the connection means 3f transmits the extracted personal identification number 31 and death date 66 to the connection means 2f. After the transmission is completed, the connection unit 3f is in a state where data cannot be transmitted / received to / from another computer via the dedicated line 5.

  The research institution computer 2 stores the death date 66 in the cohort tracking database 2e based on the received personal identification number 31 (S211). Here, the control unit 2g searches the personal identification number 21 stored in the cohort tracking database 2e, and the tracking information associated with the personal identification number 21 that matches the received personal identification number 31. 25 stores the date of death 66. As a result, the research institution computer 2 can obtain information on the fact that a specific participant has died and the time of death. In this way, the health center computer 6 extracts only information related to the participants stored in the death information database 6e. In addition, the research institution computer 2 does not access the names and addresses of the participants that are not required in the cohort business. Thereby, the disease onset grasping system 1 is in a state in which the confidentiality of the data regarding the inhabitants stored in the death information database 6e is secured, and the anonymity of the participants in the cohort business is secured in the cohort tracking database 2e. Can store data necessary for cohort business.

  Thus, in the first embodiment of the present invention, the local government computer 3 uses the hash value of the participant's name 32, date of birth 33, gender 34, and address 35 stored in the participant information database 3e. 36, the hospital computer 4 converts the name 42, date of birth 43, gender 44, and address 45 into a hash value 49. Thereby, the disease onset grasp system 1 can memorize | store the cohort disease name and the diagnosis date 46 in the cohort tracking database 2e in the state which ensured the anonymity of the participant. Further, since the connection means 2f, the connection means 3f, and the connection means 4f can be connected to the dedicated line 5 only when data is transmitted / received, the cohort tracking database 2e, the participant information database 3e, and the receipt information database are externally provided. The information stored in 4e can be prevented from being falsified or stolen. Furthermore, the disease onset grasping system 1 extracts only information about the participants from the receipt information database 4e. Thereby, the disease onset grasping system 1 is obtained by a doctor, a nurse, a medical information manager, or a researcher by the name 42, date of birth 43, sex 44, address 45, diagnosis date of a patient who does not participate in the cohort business. 46, disease name 47, and patient biological information 48 can be prevented from being browsed.

  Thus, in the second embodiment of the present invention, the municipal computer 3 uses the participant name 32, date of birth 33, sex 34, and address 35 stored in the participant information database 3e as a hash value. 36, the health center computer 6 converts the name 62, date of birth 63, gender 64, and address 65 into a hash value 67. Thereby, the disease onset grasp system 1 can memorize | store the death date 66 in the cohort tracking database 2e in the state which ensured the anonymity of the participant. Further, the connection means 2f, the connection means 3f, and the connection means 6f are connected to the dedicated line 5 only when data is transmitted / received, so that the cohort tracking database 2e, the participant information database 3e, and the death information database are externally provided. It is possible to prevent the information stored in 6e from being falsified or stolen. Furthermore, the disease onset grasping system 1 extracts only information about the participant from the death information database 6e. Thereby, in the disease onset grasping system 1, the name 62, the date of birth 63, the sex 64, the address 65, and the date of death 66 of the residents who have not participated in the cohort project are viewed by the health center staff or researchers. This can be prevented.

  In addition, this invention is not restricted to the structure of the said embodiment, A various deformation | transformation is possible, In 1st Embodiment, the local government computer 3 is the participant's name 32 memorize | stored in the participant information database 3e. Instead of converting the date of birth 33, gender 34, and address 35 to the hash value 36, only the name 32 and the date of birth 33 may be converted to the hash value 36. The hospital computer 4 is not configured to convert the name 42, date of birth 43, gender 44, and address 45 to the hash value 49 but to convert only the name 42 and date of birth 43 to the hash value 49. It doesn't matter. Furthermore, the receipt information database 4e may further be configured to store information such as the patient's height, weight, blood pressure, or body temperature, and information related to the prescribed medicine. In the second embodiment, the health center computer 6 is not configured to convert the name 62, the date of birth 63, the sex 64, and the address 65 into the hash value 67, but only the name 62 and the date of birth 63 are converted into the hash value 67. It may be configured to convert. In the first and second embodiments, the disease onset grasping system 1 may not be configured to transmit / receive data via the dedicated line 5 but may be configured to transmit / receive data via the Internet or a telephone line.

The lineblock diagram of the disease onset grasp system concerning a 1st embodiment of the present invention. The block diagram of the database which the computer concerning this embodiment memorize | stores. The flowchart of the cohort process which concerns on this embodiment. The block diagram of the disease onset grasp system which concerns on the 2nd Embodiment of this invention. The block diagram of the database which the health center computer which concerns on this embodiment memorize | stores. The flowchart of the cohort process which concerns on this embodiment.

Explanation of symbols

1 Disease onset grasp system 2 Research institution computer 2e Cohort tracking database 2f Connection means (research institution connection means)
2g Control means (control means for research institutions)
3 Local government computer 3e Participant database 3f Connection means (connection means for local government)
3g Control means (control means for local government)
4 Hospital computer 4e Receipt information database 4f Connection means (hospital connection means)
4g Control means (hospital control means)
5 Dedicated line (telecommunications line)
6 Health center computer 6e Death information database 6f Connection means (connection means for health centers)
6g Control means (control means for health centers)
21 personal identification number 25 tracking information 31 personal identification number 32 name 33 date of birth 35 address 36 hash value (first encrypted data)
41 Receipt ID
42 Name 43 Date of birth 45 Address 46 Date of diagnosis 47 Disease name 49 Hash value (second encrypted data)
61 Death Information ID
62 Name 63 Date of birth 65 Address 67 Hash value (third encryption data)

Claims (3)

In a disease onset grasping system comprising at least three computers connected to each other via a telecommunication line,
Participant information database that is installed at the local government office and stores the name, date of birth, and address of the participant who has agreed to participate in the cohort project, and the personal identification number uniquely assigned to the participant. And a local government control unit that extracts information that matches a predetermined condition from the participant information database, and a local government connection unit that can communicate with the computer only when data is transmitted to and received from the predetermined computer. A local government computer comprising:
A cohort tracking database that is installed in a research institution and stores the personal identification number, the health check information of the participant, and tracking information that stores the participant's disease name in association with each other, and a predetermined disease in the tracking information A research institution computer comprising: a research institution control means for storing a name; and a research institution connection means that can communicate with the computer only when transmitting and receiving data to and from the predetermined computer;
A receipt information database that is installed in a hospital and stores the receipt ID and the patient's name, date of birth, address, diagnosis date, and disease name in association with each other using the receipt ID as a key, and a predetermined information from the receipt information database. A hospital computer comprising: a hospital control means for extracting information that matches the conditions; and a hospital connection means that can communicate with the computer only when transmitting and receiving data to and from the predetermined computer. ,
The local government control means converts the name, the date of birth, and the address stored in the participant information database into first encrypted data using a predetermined encryption function, and the participant Storing the personal identification number and the first encrypted data in an information database in association with each other, causing the local government connection means to transmit the first encrypted data to the hospital computer,
The research institution control means causes the research institution connection means to transmit the predetermined disease name to the hospital computer as a cohort disease name,
The hospital control means converts the name, the date of birth, and the address stored in the receipt information database into second encrypted data using the encryption function, and stores the personal information in the receipt information database. When the hospital connection means receives the first encrypted data and the cohort disease name, the identification number and the second encrypted data are stored in association with each other, and the cohort disease name matches with the cohort disease name from the receipt information database. The second encrypted data that is associated with the disease name and that is extracted from the second encrypted data that matches the first encrypted data and is extracted to the hospital connection means To the local government computer,
When the local government connection means receives the second encrypted data, the local government control means sends the personal identification associated with the first data that matches the second encrypted data from the participant information database. Extract the number, and send the personal identification number extracted to the local government connection means to the research institution computer,
When the research institution connection means receives the personal identification number, the research institution control means stores the cohort disease name in the tracking information associated with the personal identification number in a cohort tracking database. Disease onset grasp system. In a disease onset grasping system comprising at least three computers connected to each other via a telecommunication line,
Participant information database that is installed at the local government office and stores the name, date of birth, and address of the participant who has agreed to participate in the cohort project, and the personal identification number uniquely assigned to the participant. And a local government control unit that extracts information that matches a predetermined condition from the participant information database, and a local government connection unit that can communicate with the computer only when data is transmitted to and received from the predetermined computer. A local government computer comprising:
A cohort tracking database which is installed in a research institution and stores the personal identification number, the health check information of the participant, and tracking information to which death information indicating whether the participant has died is added in association with each other. A research institution control means for storing the death information in the tracking information, and a research institution connection means for making communication with the computer only when data is transmitted / received to / from the predetermined computer. An institutional computer;
A death information database that is installed in a health center and stores the death information ID in association with the death information ID and the name, date of birth, address, and date of death of the death, and the death information database; A health center computer comprising: health center control means for extracting information that matches a predetermined condition; and health center connection means for enabling communication with the computer only when transmitting and receiving data to and from the predetermined computer; With
The local government control means converts the name, the date of birth, and the address stored in the participant information database into first encrypted data using a predetermined encryption function, and the participant Storing the personal identification number and the first encrypted data in an information database in association with each other, causing the local government connection means to transmit the first encrypted data to the health center computer,
The research institution control means causes the health center computer to send an information provision request notification requesting the research institution connection means to provide the death information,
The health center control means converts the name, date of birth, and address stored in the death information database into third encrypted data using the encryption function, and stores the personal information in the death information database. An identification number and the third encrypted data are stored in association with each other, and when the health center connection means receives the first encrypted data, the third encrypted data coincides with the first encrypted data from the death information database. Extracting the encrypted data and transmitting the extracted third encrypted data to the health center connecting means to the local government computer;
When the municipal connection means receives the third encrypted data, the municipal control means, from the participant information database, the personal identification associated with the first data that matches the third encrypted data. Extract the number, and send the personal identification number extracted to the local government connection means to the research institution computer,
When the research institution connection means receives the personal identification number, the research institution control means stores the death information in the tracking information associated with the personal identification number in a cohort tracking database. Disease onset grasp system.   The disease onset grasping system according to claim 1 or 2, wherein the encryption function is a hash function.

Images