JP2011133958A - Information processing system for calculating index value of degree of anonymity and method for calculating index value of degree of anonymity - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an information processing system can digitize and present the degree of anonymity of personal information, in other words, probability in which an individual is predetermined. <P>SOLUTION: The information processing system calculates the index value of the degree of anonymity, and includes: an information quantity database 14 in which, about each of items included in personal information, the quantity of information of an event expressed by data, which can be input to the items, is stored; an input screen display part 12 for displaying an input screen including item names, designated as the items included in the personal information, and the edit boxes of the data of the items; a data input part 13 for making an operator input data to the edit boxes on the input screen; and an index value calculation part 15 which, about all of the items in which data have been input to the edit boxes on the input screen, extracts the quantity of information of the event expressed by the input data from the information quantity database 14 and adds the extracted quantity of information, and presents the addition result as the index value of the degree of anonymity of the personal information. <P>COPYRIGHT: (C)2011,JPO&INPIT

Description

  The present invention provides information processing capable of presenting the degree of anonymization of data to be used in numerical form when part or all of electronic data including personal information can be used for statistical purposes, for example. The present invention relates to a system and a method for calculating anonymity.

  In recent years, in the medical field, information systems such as so-called electronic medical record systems have been introduced, and information related to patient privacy, such as patient illness and medical treatment contents, is generally managed by a computer. Yes. In addition, some or all of the actual patient information may be extracted from the electronic medical record system and used for secondary purposes for the purpose of providing case reports, academic research, or statistical use. In such a case, from the viewpoint of protecting the privacy of the patient, it is extremely important to make it impossible to identify an individual patient from information provided for secondary use.

  In view of this situation, for example, the Japanese Association for Surgical Association has created guidelines for protecting patient privacy in medical papers including case reports and academic presentations at academic societies. In this guideline, an item (for example, name, hospitalization number, initials or name) that can identify an individual patient is not described in the case report. In addition, the patient's address is not stated in principle, and even if the place where the disease occurs is related to the pathology, etc., it is said that it should be limited to the area (for example, prefecture name or city name) .

  In addition to formulating the above guidelines, it has also been proposed to take measures to protect patient privacy on a computer system. For example, in Japanese Patent Application Laid-Open No. 2005-115917 (Patent Document 1), when using medical information of a patient for medical research, non-personal identification information separated from the patient's personal identification information is provided together with a medical code. Thus, a computer system that attempts to prevent the leakage of personal information of patients has been proposed.

Japanese Patent Laid-Open No. 2005-115917

  However, even if items such as the patient's name are concealed, it may still be possible to identify an individual. For example, even if it is difficult to identify individual patients with only one item of data, it should be noted that depending on the combination with the data of other items, it may be possible to narrow down the individual patient to a level that can be almost identified. For example, it is assumed that patient data including items such as age, sex, disease name, prescription drug, residential area (for example, prefecture name) is provided from a hospital to a third party for the purpose of academic research. That is, the patient data does not include the patient's name. However, in this case, for example, when the “disease name” data represents a disease with a very low morbidity rate, the probability that an individual patient will be specified becomes extremely high by combining with data of other items. For example, if “disease name” is a disease with a very low morbidity rate throughout Japan, it is possible to identify individual patients with a relatively high accuracy by combining with the “residential area” data. . In addition, for example, when an item “drug prescription date” is added to the above item, the data of this item and the data of the item of “prescription drug” are combined, and further, a customer list of pharmacies in that district on that day is obtained. By contrasting with this, the probability that an individual patient will be specified becomes much higher.

  Therefore, when providing a part or all of electronic data including patient's personal information for secondary use such as case reports and statistics, the data provided is sufficiently high that the individual cannot be easily identified. It is desirable to have a mechanism that can check whether anonymization has been performed.

  In view of such problems, an object of the present invention is to provide an information processing system capable of quantifying and presenting the degree of anonymization of personal information, in other words, the probability that an individual will be specified.

  In order to achieve the above object, one aspect of the present invention is an information processing system for calculating an index value of anonymity, and each item that can be included in personal information can be input to the item An information storage means for storing the information amount of the event represented by the data, an input screen display means for displaying an input screen including an item name specified as an item to be included in personal information and an input field for data of the item, and an operation Data input means for allowing a user to input data into the input field on the input screen, and the information amount of the event represented by the input data for all items for which data has been input into the input field on the input screen. It is characterized by comprising index value calculation means for extracting and adding from the quantity storage means and presenting the addition result as an index value of anonymity of the personal information.

  The anonymity index value only needs to represent the probability that an individual will be identified as at least a relative numerical value. That is, the anonymity index value may be expressed with a scale that takes a larger value as the anonymity level is higher, and vice versa.

  In the above personal information processing system, when the occurrence probability of the event represented by the data is P (E) and the information amount of the event represented by the data is I (E),

I (E) =-logP (E)
Is preferably satisfied. Furthermore, it is preferable to use at least one of a disease prevalence, a regional population distribution, and an age distribution as the occurrence probability of the event represented by the data.

  Further, another embodiment of the present invention is a method for calculating an anonymity index value using a computer, and for each item that can be included in personal information, event information represented by data that can be input to the item An input screen including an information amount storing step for storing the amount in a storage means accessible from a computer, an item name designated as an item to be included in personal information, and an input field for data of the item is displayed on a computer display. An input screen display step, a data input step for accepting data input to the input field on the input screen, and an event represented by the input data for all items for which data has been input to the input field on the input screen The amount of information is extracted from the storage means and added, and the addition result is added to the personal information on the computer display. Characterized in that it comprises a index value calculation step of presenting as an index value in the name of.

  ADVANTAGE OF THE INVENTION According to this invention, the information processing system which can quantify and show the degree of anonymization of personal information (probability that an individual is specified) about data including personal information can be provided.

FIG. 1 is a diagram showing an example of a screen display of an information processing system according to an embodiment of the present invention. FIG. 2 is a diagram showing an example of a screen display of the information processing system according to the embodiment of the present invention. FIG. 3 is a diagram showing an example of a screen display of the information processing system according to the embodiment of the present invention. FIG. 4 is a diagram showing an example of a screen display of the information processing system according to the embodiment of the present invention. FIG. 5 is a block diagram showing a functional configuration of the information processing system according to the present embodiment. FIG. 6 is a diagram showing an example of a screen display of the information processing system according to the embodiment of the present invention. FIG. 7 is a diagram showing an example of a screen display of the information processing system according to the embodiment of the present invention.

  Hereinafter, a specific example of an information processing system according to an embodiment of the present invention will be described with reference to the drawings.

  The information processing system according to the present embodiment can be constructed as a stand-alone system such as a personal computer, but is not limited thereto, and can be configured as a server / client system. The information processing system according to the present embodiment, for example, provides patient information that can be acquired from an electronic medical record system or the like for the purpose of secondary use such as case reports, academic research, or statistics, and then uses the patient information. It has a function to display the probability that the user will be specified in numerical form. Here, a numerical value of the probability that an individual is specified is referred to as an “anonymity index value”.

  The information processing system according to the present embodiment can be realized as a part (one function) of the electronic medical record system, or as an external system connected to the electronic medical record system or a system completely independent of the electronic medical record system. It can also be realized. When realized as part of an electronic medical record system, it can be incorporated as a plug-in into an existing electronic medical record system.

  Here, FIGS. 1 to 4 show screen display examples of the information processing system according to the present embodiment. In the example shown in FIGS. 1 to 4, in order to input data on the screen 100, an age input field 101, a gender input field 102, a disease name input field 103, a prescription date input field 104, a prescription drug name input field 105, A residential area input field 106 is displayed. Note that the data input to each of the input fields may be direct input using a keyboard or a numeric keypad, or may be a method of selecting and inputting from preset data candidates using a drop-down list or the like. In addition, data candidates displayed in the drop-down list may be taken from a database of an electronic medical record system or the like. Alternatively, it is also possible to directly input the input data for each of the input fields from a database of an electronic medical record system or the like.

  When data is input to these input fields, the information amount of the data input for each item is displayed in bit units in the bit display fields 107 to 111 provided on the right side of each input field. A method of calculating this information amount for each item will be described later. Furthermore, in the index value display column 112, a value obtained by adding the information amounts displayed in the bit display columns 107 to 111 is displayed as an index value of anonymity. In the evaluation result display column 113, whether or not the anonymity index value displayed in the index value display column 112 satisfies a predetermined criterion is displayed using, for example, a symbol “◯” or “×”. . Thereby, the user of the information processing system according to the present embodiment can objectively grasp the probability that the individual patient will be specified from the patient information. Further, it can be easily understood whether or not the anonymity index value satisfies a predetermined standard.

  Here, with reference to FIGS. 1 to 4, how the anonymity index value changes due to the change of the input data in the input fields 101 to 106 will be described. As described above, when data is input to the input fields 101 to 106, the information amount for each input data is input to the bit display fields 107 to 110. A value obtained by adding the information amounts displayed in the bit display columns 107 to 111 is displayed in the index value display column 112 as an anonymity index value. In the example shown here, the amount of information displayed in the bit display fields 107 to 111 is simply added up assuming that the input data to each of the input fields 101 to 106 is related to an independent event. Thus, the anonymity index value is obtained. However, when two or more events represented by the input data in the input field have a correlation with each other, as will be described later, it is also preferable to reflect the influence of the correlation by using a correlation function.

  In the data example shown in FIG. 1, the total amount of information displayed in the bit display columns 107 to 111 is 21.4, and it is assumed that this anonymity index value satisfies the standard. The “O” symbol is displayed. Here, it is assumed that the anonymity index value threshold is set to 24.0. The amount of information “24.0” is approximately 8 million when the power of 2 is about 8 million, and is still about 10 people based on this amount of information when the population is 100 million. However, it is a numerical value that is set because the applicable person cannot be narrowed down. Then, if the anonymity index value obtained by adding the amount of information displayed in the bit display fields 107 to 111 is smaller than this threshold value, the criterion is satisfied, and if it exceeds, it is determined that the criterion is not satisfied. The

  Here, as shown in FIG. 2, it is assumed that the disease name in the disease name input field 103 is changed to “Marfan syndrome”. The Marfan syndrome is a disease having a much lower morbidity than the “diabetes” shown in FIG. By changing the disease name in the disease name input field 103 in this way, the information amount of the disease name item increases from 4.5 to 11.5. As a result, the total amount of information displayed in the bit display columns 107 to 111 is 28.4. Since this numerical value exceeds the threshold value of 24.0, an “x” symbol is displayed in the evaluation result display column 113 as not satisfying the standard.

  Here, it is assumed that the operator changes the data in the age input field 101 from “45” to “40-49” having a width as shown in FIG. By this operation, the information amount of the data in the age input field 101 is reduced from “6.0” shown in FIG. 2 to “2.5” as shown in FIG. Therefore, in the data example illustrated in FIG. 3, the anonymity index value obtained by adding the information amounts of all input data is as low as 24.9. However, since this numerical value still exceeds the threshold value of 24.0, an “x” symbol is displayed in the evaluation result display column 113 as not satisfying the standard.

  Therefore, it is assumed that the operator further deletes the data in the residential area input field 106 as shown in FIG. Thereby, the information amount of this item becomes zero. As a result, the anonymity index value obtained by adding the information amounts of all the input data decreases to 20.2, which is lower than the threshold value of 24.0. As a result, in the example of FIG. 4, a “◯” symbol is displayed in the evaluation result display field 113.

  As described above, according to the information processing system according to the present embodiment, it is possible to comprehensively determine whether the data input to each item on the input screen satisfies the criterion regarding the anonymity index value. Therefore, for example, as shown in FIG. 2, when the determination result that the criterion regarding the anonymity index value is not satisfied is shown, as shown in FIGS. 3 and 4, the data of the input item is changed or While deleting, it is possible to confirm whether or not the criterion of anonymity is satisfied. 1 to 4, the input screen display is automatically refreshed every time the input item data is changed or deleted, and the numerical values in the index value display column 112 and the evaluation result display column 113 are changed. Updated. However, a button such as “Update” may be provided on the input screen, and the numerical values in the index value display column 112 and the evaluation result display column 113 may be updated when this button is clicked.

  Hereinafter, a schematic configuration of an information processing system for realizing the above-described anonymity index value calculation function will be described with reference to the drawings. FIG. 5 is a block diagram showing a functional configuration of the information processing system according to the present embodiment. As shown in FIG. 5, the information processing system 1 according to the present embodiment includes an item database 11, an input screen display unit (input screen display unit) 12, a data input unit (data input unit) 13, and an information amount database. (Information amount storage means) 14 and an index value calculation unit (index value calculation means) 15 are provided.

  In the item database 11, names of items used as input items in the information processing system 1 are registered in advance. Examples of input items registered in the item database 11 include arbitrary items in addition to age, sex, disease name, prescription date, prescription drug name, residential area, etc., as shown in FIGS. included. It is possible to add a new input item to the item database 11, delete an existing input item, or change an item name. The items registered in the item database 11 may be the same as the items used in the electronic medical record system, or may be a part of the items used in the electronic medical record system. That is, as the item database 11, the item database of the electronic medical record system may be used as it is, or some items may be extracted from the item database of the electronic medical record system and copied to the item database 11.

  The input screen display unit 12 configures an input screen in which input fields for input items selected by the operator from the item database 11 are appropriately arranged, and displays the input screen on the display. The display examples of the input screen are as shown in FIGS. 1 to 4, but are not limited to this example. Note that the operator arbitrarily selects and adds input items to be arranged on the input screen from the item database 11, deletes the input items from the input screen, and positions of the input items arranged on the input screen. It is also possible to change.

  The data input unit 13 accepts data input to an input field on the input screen from an arbitrary input device such as a keyboard.

  The information amount database 14 stores, for each item registered in the item database 11, an information amount of an event represented by data that can be input to the item. In this embodiment, it is assumed that the information amount database 14 stores the bit-converted information amount, but the original data is stored in the information amount database 14 and the number of bits from the original data is stored. You may make it convert into. As the information amount, a selected information amount (self-entropy) can be used. That is, assuming that the probability of occurrence of an event E represented by data that can be input to each item is P (E), the selection information amount I (E) can be expressed by the following equation.

            I (E) =-logP (E)

  The index value calculation unit 15 searches the information amount database 14 in accordance with the data input to each of the input fields, acquires the information amount of the data, and displays it in the bit display fields 107 to 111.

  Taking the input item of “age” as an example, the information amount database 14 stores the information amount of each age obtained from the age distribution of the population (for example, Japanese). For example, when the age is 45 years old, the information amount “6.0” obtained by converting the ratio of the 45-year-old person in the population into the number of bits is stored in the information amount database 14. Therefore, as shown in FIGS. 1 and 2, when the age “45” is input in the age input field 101, the bit information amount “6.0” is extracted from the information amount database 14 and is displayed in the bit display field 107. Is displayed.

  Similarly, the information amount database 14 stores “1.0” as the information amount when the gender is “male” or “female”. Therefore, as shown in FIGS. 1 and 2, when “male” is input in the gender input field 102, the index value calculation unit 15 extracts this value from the information amount database 14, so that it is displayed in the bit display field 108. “1.0” is displayed. Here, the amount of information when the gender is “male” or “female” is set to “1.0”, respectively, but the gender is “male” according to the population ratio of men and women in the population. And the information amount when the gender is “female” may be defined as different values.

  As for the input item of “disease name”, the information amount database 14 stores the bit rates of the prevalence of various diseases. As this morbidity, for example, public data published by the Ministry of Health, Labor and Welfare or various research groups can be used.

  The information amount relating to the prescription of the drug, that is, the information amount for the input data in the prescription date input column 104 and the prescription drug name input column 105 is also stored in the information amount database 14. The amount of information regarding drug prescription can be generated, for example, by extracting sample data from a hospital information system of a large hospital. The information amount related to the prescription of the medicine generated in this way is stored in advance in the information amount database 14. This amount of information can be obtained, for example, by searching the hospital information system, the number of patients prescribed for a specific drug, the percentage of the total number of patients, or the specific drug on a specific day. It can be obtained by extracting data such as the number of patients prescribed.

  The bit information amount of “residential area” is obtained according to the population of the area input to the residential area input field 106. That is, the information amount database 14 stores values obtained by converting populations of prefectures and municipalities with respect to the population of the population (for example, the entire Japan) into information amounts. For example, in the example shown in FIG. 1 and FIG. 2, data “Shizuoka Prefecture” is input to the residential area input field 106, which is a value obtained by bit conversion of the ratio of Shizuoka Prefecture to the total population of Japan. 7 ”is stored in the information amount database 14. The index value calculation unit 15 extracts this information amount from the information amount database 14 and displays it in the bit display column 111.

  The index value calculation unit 15 further adds the amount of information displayed in the bit display fields 107 to 111 to obtain the anonymity index value as the entire data displayed on the input screen.

  Further, the index value calculation unit 15 compares the anonymity index value obtained by adding the information amount of each item with a predetermined threshold value, thereby determining whether or not the anonymity index value satisfies a predetermined standard. Judging. Then, the determination result is displayed by a symbol in the evaluation result display column 113. In addition, the said threshold value can be arbitrarily set according to the number of bits showing the magnitude | size of a population, a required anonymity level, etc.

  Here, FIGS. 6 and 7 show other examples of the data input screen. In the examples shown in FIGS. 6 and 7, data provided for the purpose of secondary use such as a case report includes items related to examination. That is, in the data input screen shown in FIG. 6, in order to input data related to two inspections, the inspection performed on October 1, 2008 and the inspection performed on November 26, 2008, Search date input fields 114 and 117, inspection item input fields 115 and 118, and inspection result input fields 116 and 119 are provided. In the example of FIG. 6, the date of inspection is entered in the inspection date input fields 114 and 117. In the inspection item input fields 115 and 118, items of the inspection that has been performed are input. In the inspection input fields 116 and 119, numerical values of inspection results are input.

  As shown in FIG. 6, when the date of inspection is input in the inspection date input fields 114 and 117, “12.0” is displayed in the bit display field 120 indicating the information amount of data related to the first inspection. "Is displayed. In addition, a value “8.0” is shown in the bit display column 121 that represents the amount of information of data related to the second inspection.

  The amount of information of 12.0 in the bit display column 120 can be generated, for example, by extracting sample data from a hospital information system of a large hospital. The generated information amount is stored in advance in the information amount database 14. This amount of information is obtained, for example, as follows. First, the hospital information system is searched, and an examination called HbA1c is performed on October 1, 2008, and the number of patients whose result is 8.5 is obtained. Next, the ratio of the number of persons to the total number of patients registered in the hospital information system is obtained. When this ratio is P (E), the information amount I (E) can be obtained by the following equation.

            I (E) =-logP (E)

  Note that the amount of information of 8.0 in the bit display column 121 can also be generated by extracting sample data from a hospital information system of a large hospital in the same manner as described above.

  Here, when all the information amounts in the bit display columns 107 to 109, 120, and 121 are added, the anonymity index value obtained thereby becomes 28.0. Since this is higher than the threshold value of 24.0, an “x” symbol is displayed in the evaluation result display field 113 in the example of FIG.

  Therefore, as shown in FIG. 7, the number of days elapsed from the first examination date to the second examination date is input in the examination date input fields 114 and 117, and the anonymity index value displayed in the index value display field 112. Try to see how much is. In the example of FIG. 7, the examination date input field 114 for entering the first examination date is left blank, and the examination date entry field 117 for entering the second examination date is entered from the first examination date. Data “+ 8W” indicating that the number of elapsed days is 8 weeks is input. This input format is merely an example, and an appropriate input format can be used. In this case, as shown in FIG. 7, the numerical value in the bit display column 120 indicating the information amount of the data related to the first inspection is lowered to “7.0”. As a result, the anonymity index value displayed in the index value display field 112 drops to 23.0 and is lower than the threshold value of 24.0, so that the “◯” symbol is displayed in the evaluation result display field 113. In this way, the threshold condition of the anonymity index value can be satisfied by expressing the date of the examination date by the number of days elapsed from the previous examination date instead of the date.

  While the embodiments of the present invention have been described above, the above-described embodiments are merely examples for carrying out the present invention. Therefore, the present invention is not limited to the above-described embodiment, and can be implemented by appropriately modifying the above-described embodiment without departing from the spirit thereof.

  For example, in the above-described specific example, the amount of information displayed in the bit display columns 107 to 111 is simply added up assuming that the input data to each of the input columns 101 to 106 is related to an independent event. Thus, the anonymity index value is obtained. However, if at least part of the input data is related to events that are correlated with each other, the amount of information displayed in the bit display column is not simply added up, but by using a correlation function, etc. It is preferable to reflect the influence.

  For example, age and gender are independent events, but there may be a correlation between age and disease. In such a case, when adding the information amount displayed in the bit display column of two or more events having a correlation with each other, an upper limit value may be set for the total value using a correlation function.

Claims (4)

For each item that can be included in the personal information, an information amount storage means that stores an information amount of an event represented by data that can be input to the item;
An input screen display means for displaying an input screen including an item name designated as an item to be included in personal information and an input field for data of the item;
Data input means for allowing an operator to input data into the input field on the input screen;
The information amount of the event represented by the input data is extracted from the information amount storage means for all the items for which data has been input in the input field on the input screen, and the addition result is added to the personal information. An information processing system comprising index value calculation means for presenting as an index value of anonymity. When the occurrence probability of the event represented by the data is P (E) and the information amount of the event represented by the data is I (E),
I (E) =-logP (E)
The information processing system according to claim 1, wherein:   The information processing system according to claim 2, wherein at least one of a disease incidence, a regional population distribution, and an age distribution is used as an occurrence probability of an event represented by the data. A method of calculating an anonymity index value using a computer,
For each item that can be included in the personal information, an information amount storage step of storing an information amount of an event represented by data that can be input to the item in a storage means accessible from a computer;
An input screen display step for displaying an input screen including an item name designated as an item to be included in personal information and an input field for data of the item on a computer display;
A data input step for receiving data input to the input field on the input screen;
For all items for which data has been input in the input field on the input screen, the information amount of the event represented by the input data is extracted from the storage means and added, and the addition result is displayed on the computer display. And an index value calculating step of presenting as an index value of anonymity of the personal information.

Images