JP4896054B2 - Personal information management device, personal information management program, and personal information management system - Google Patents

Description

  The present invention relates to a personal information management device used for managing personal information in a facility of a business operator handling personal information, a personal information management program that causes a computer to function as the personal information management device, and a personal information management device. The present invention relates to a personal information management system composed of server devices.

  Personal information is collected and used by various business operators, but since it is important information related to the privacy rights guaranteed by Article 13 of the Constitution, its handling requires strict attention. Personal information should not be leaked outside. Therefore, in recent years, Japan has enacted a law concerning the protection of personal information, and notifies personal information usage purposes (Article 2, Paragraph 3 of the Act) of the purpose of using personal information (Article 18 of the Act). , Imposes obligations such as prohibition of provision of personal data to third parties without consent (Article 23).

Accordingly, a business operator handling personal information must take measures to prevent the leakage of personal information so that the personal information it manages is not disclosed or leaked without the consent of the individual (Article 20 of the Act). .
JP 2004-30143 A

  However, if all employees who access personal information at the facility understand the contents of the law and are willing to comply with the provisions of the law, the personal information leakage prevention measures are simple. However, in reality, it is impossible to expect that from all staff. However, the personal information leakage prevention measure is strengthened, for example, the encryption unit encrypts the personal information using the key every time it is updated, and decrypts it only during browsing and displays it on the display. (1) If the encrypted personal information is damaged due to a system down of the personal information management device, the personal information can still be recovered compared to storing the personal information in plain text. Difficult problems, and (2) Personal information files containing encrypted personal information and keys may be leaked together as a result of inappropriate management by personnel who are not necessarily information processing specialists Therefore, there is a problem that personal information is decrypted outside as a result.

  Accordingly, an object of the present invention is to encrypt each time the personal information to be stored in the personal information file is updated in a personal information management apparatus (a computer for personal information management) installed in a facility that handles personal information. By protecting personal information and saving the personal information file storing the encrypted personal information outside the personal information management device (computer for personal information management) in a manner that cannot be decrypted, The risk of data loss due to system down of the information management apparatus (personal information management computer) is avoided.

A computer that executes a personal information management apparatus and a personal information management program according to the present invention for solving the above-described problems is stored in a personal information file in accordance with key issuing means for issuing a key and information input through the input apparatus. Personal information updating means for updating the personal information, and encryption means for encrypting the personal information using the key issued by the key issuing means after updating the personal information by the personal information updating means, The personal information file storing the personal information encrypted by the encryption means is uploaded to the server device using the communication device, and the personal information file is downloaded from the server device according to the information input through the input device. Download means to download and a predetermined master key from the server device Star key download means, key encryption means for encrypting the key issued by the key issuing means using the master key, key storage means for storing the key encrypted by the key encryption means in the storage device, The key stored in the storage device is taken out and decrypted using the master key, and the key decrypted by the key decrypting unit is used to download the personal information file downloaded by the downloading unit. Decryption means for decrypting the encrypted personal information, and an output device for outputting the contents of the personal information decrypted by the decryption means .

By functioning as described above, the personal information file is downloaded from the server device and stored in the personal information file only when the personal information is updated (added, changed, etc.) in the personal information management device (computer). but be decoded have use the key of the personal information managing apparatus for encryption issued in (computer) as the key for decrypt, updated in, is encrypted using a key for re the encrypted And stored in the personal information file and uploaded to the server device. Accordingly, since the plaintext personal information does not always exist in the personal information management device (computer), even in the facility where the personal information management device (computer) is installed, Even if there are access restrictions, those who do not follow proper procedures cannot steal the contents of personal information. The personal information is uploaded and stored in the server device in a state where it is encrypted and stored in the personal information file, and each time the personal information management device (computer) needs to access the personal information, the server device Downloaded to a personal information management device (computer) and used. Therefore, even if a failure such as a system failure occurs in the personal information management apparatus (computer), it is possible to prevent the personal information from being lost. The key for decrypting the personal information in the personal information file uploaded to the server device exists only in the uploading personal information management device (computer), and does not exist in the server device. Therefore, even if it is attempted to access the personal information in the personal information file in the server measure, it cannot be decrypted. As described above, since the contents of the personal information can be viewed only by using the decryption key in the personal information management apparatus (computer), the protection of the personal information can be enhanced.

Further , according to the present invention , it is possible to prevent the personal information from being decrypted illegally by using the key illegally in the personal information management apparatus (computer).

Furthermore, if access to the server operator has a formal access rights by operating the personal information management apparatus (a computer), it is not possible to download the master key further to strengthen the protection of personal information Can do.

According to the present invention configured as described above, it is possible to protect personal information by encrypting it every time the personal information to be stored in the personal information file is updated, and to store the encrypted personal information. The personal information file is saved outside the personal information management device (personal information management computer) in a manner that cannot be decrypted, so that the system of the personal information management device (personal information management computer) is down. Therefore, the risk of data loss can be avoided.

1. Hereinafter, an embodiment of a computer network which is an embodiment of a personal information management system according to the present invention will be described with reference to the drawings. In the following embodiments, the personal information management apparatus and the personal information management system are clinically obtained by clinical trials in which a large number of medical institutions participate in accordance with requests from clinical trial clients such as pharmaceutical companies. This is an example used together with an EDC (Electronic Data Capture) system in order to aggregate data in a data center.

  In other words, in a medical institution participating in a clinical trial (hereinafter referred to as “study participation facility”), subjects are selected and specified according to the clinical trial plan delivered from the sponsor, and designated for the specified subject. In addition, the treatment (medicine administration, treatment, etc.) of the subject of the trial is performed, and the state of the subject is recorded by performing examinations and interviews before and after the treatment. Therefore, a terminal on which a personal information management system operates is installed in the study participating facility, and the execution records of such treatments for each subject and the records of examinations and interviews (hereinafter referred to as “clinical data”) are the personal information of those subjects. (Name, initial, etc.) are stored and managed in a database (subject personal information database).

  In addition, in the study participating facility, clinical data of each subject is identified by an identification number (subject identification ID) uniquely assigned to each subject, but in addition to this, the name as personal information of each subject Is also associated with clinical data because communication with the subject must be performed based on the name of the subject. Moreover, as long as it is used in the test participating facility, it can be reasonably determined that the subject's personal information is within the normal intended purpose range.

  The clinical data accumulated in the subject personal information database in this way is collected in the data center using the EDC system, and is aggregated and analyzed from various viewpoints in the data center. In this tabulation / analysis, the gender and physical characteristics of each subject are used as parameters, but since the data tabulation / analysis is performed objectively, personal information for linking with a specific individual is not necessary in the first place. Accordingly, it can be said that notifying the data center of personal information is outside the normal purpose of use. Therefore, the clinical data transmitted from each medical institution to the data center through the EDC system does not include personal information of each subject.

  The personal information management system can be operated in conjunction with a server apparatus installed in the data center, or can be operated locally. In the former case, it becomes possible to link the personal information management system and the EDC system, automatically extract necessary data from the clinical trial data managed by the personal information management system, and transmit it to the data center. .

2. System Configuration FIG. 1 is a block diagram showing a schematic configuration of a computer network according to an embodiment of the present invention. As shown in FIG. 1, this computer network is composed of a system 1 on the clinical trial data center side constructed so as to be connected to each other through a wide area network N such as the Internet, a dedicated line, etc. The system 2 is configured.

As shown in FIG. 2, the system 1 on the clinical trial data center side includes a plurality of server devices (web server device 11, database server 12, etc.) on a LAN (local network) connected to a wide area network N through a router 3. Is made up of. Each test participation facility side system 2 is also connected to the wide area network N through the router 3 and from a plurality of computers (file server device 21, terminal 22) on the LAN constructed in each test participation facility. It is configured.

  Each of these server devices 11, 12, and 21 reads and executes hardware normally provided as a server device (a hard disk 24 that is a disk device that stores programs and various data, and a program stored in the hard disk 24). A CPU 23 that performs processing according to a program for data read or input from the outside, a RAM 17 that is a main storage device in which a work area when the CPU 23 executes the processing described above, and a LAN are used as communication protocols. And a communication adapter 25 for performing data conversion in accordance with the data. Each terminal 22 is also equipped with hardware normally provided as a terminal device (hard disk 29 [corresponding to storage device] similar to that described for the server device, CPU 26, RAM 27, communication adapter 18 [corresponding to communication device], etc.) , An input device 19 such as a keyboard or a pointing device for inputting a command or data to the CPU 26 when operated by an operator, and a display 28 [corresponding to an output device] for outputting a processing result by the CPU 26 to the screen.

  In each trial participating facility 2, a plurality of terminals 22 are installed, and each terminal 22 is operated by a doctor who conducts a clinical trial or a clinical trial coordinator (CRC).

  FIG. 1 shows the software configuration (logical configuration) of various programs and various data stored in the hard disks 24 and 29 for each of the computers 11, 12, 21, and 22 constituting the systems 1 and 2. It is shown. Therefore, next, functions and data realized by various programs on each computer will be described.

  First, the database server 12 builds various databases in the hard disk 24 by the CPU 23 reading and executing the database management software stored in the hard disk 24, and stores the data in each database in response to an external request. In addition, the computer extracts data by searching each database in response to a request from the outside. Here, in the hard disk 24 of the database server 12, three databases (EDC user database 121, clinical trial database 122, trial participation facility master key database 123) are constructed.

  The EDC user database 121 includes an ID, a password, and a trial participation to which the ID belongs, for each doctor who has authority to access the EDC system (hereinafter referred to as “study doctor”) and each clinical coordinator. It is a database storing a set of facility IDs (ie, accounts) for identifying facilities.

  The clinical trial database 122 is a database that stores clinical data (but not including personal information) for each subject related to the treatment specified in the clinical trial plan.

  Further, the test participation facility master key database 123 is associated with the facility ID of each test participation facility and is uniquely issued to the test participation facility “facility master key (details will be described later. This is a database for storing a key [facility session key] used for encrypting the subject personal information database file 212 in the facility and a key used for further encrypting.

  Next, the web server 11 is a computer that responds with data corresponding to a message (HTTP request message) requested by a client when the CPU 23 reads and executes web server service software stored in the hard disk 24. In addition to the above web server service software, the hard disk 24 of the web server 11 includes the EDC server software 111, the subject personal information management client software installation program 112, the subject personal information management server software 113 shown in FIG. A copy 114 of the facility subject personal information database for each facility 2 (limited to those in which the personal information management system is operated in conjunction with the server 113) is included.

  The EDC server software 111 is a program or a program group including various CGI programs and servlets for realizing an EDC system. That is, when the CPU 23 that has read the EDC server software 111 receives a message addressed to the URL of the EDC service, the CPU 23 responds with screen data for displaying the entrance screen shown in FIG. 6 on the display 28 of the terminal 22. Thereafter, when a message addressed to the URL of any screen of the EDC service is received, screen data for displaying the corresponding screen is responded. When a data registration request message including clinical data as a parameter is received, the clinical data of the clinical data is received. Registration to the test database 122 is instructed to the database server 12. Further, upon receiving the download request message of the subject personal information management client software installation program 112 from each terminal 22, the CPU 23 that has read the EDC server software 111 reads it from the hard disk 24 and responds to the message transmission source terminal 22. To do.

  The subject personal information management client software installation program 112 is prepared for each clinical trial to be performed and for each trial participating facility, and is downloaded to the hard disk 29 for the subject personal information management client software 222 and the CPU 26 of the terminal 22 that has downloaded the program. This is a program for installing the system setting information file 223. Therefore, the subject personal information management client software installation program 112 includes compressed subject personal information management client software 222, a system setting information file 223, and an installer. The function of the subject personal information management client software installation program 112 will be described in the explanation part of the terminal 22.

  The subject personal information management server software 113 is linked with the subject personal information management client software 222 installed in each terminal 22, and a master key request message from the CPU 26 of the terminal 22 executing the subject personal information management client software 222. , The facility master key uniquely corresponding to the test participating facility to which the terminal 22 belongs is read out from the test participating facility master key database 123 of the database server 12 and responded, and similarly, a copy (encryption) of the subject personal information database 212 is encrypted. When the upload request message is received, the copy 114 transmitted from the terminal 22 by a protocol such as FTP (File Transfer Protocol) is stored in the hard disk 24. Further, when a download request message for a copy (encrypted file) of the subject personal information database 212 is received from any terminal 22, a copy (encryption) of the subject personal information database 212 corresponding to the test participating facility 2 to which the terminal 22 belongs. ) Is read from the hard disk 24 and responds.

Next, the file server 21 of each test participating facility 2 is a computer that stores a known file server program in the hard disk 24 and executes the file server program by the CPU 23. Then, the CPU 23 of the file server 21 divides the inside of the hard disk 24 logically into a multi-hierarchy and a large number of directories having a tree structure with each other in accordance with the function of the file server program. One of them is a data directory, and a local user database 211 and a subject personal information database 212 are constructed and stored. Here, the subject personal information database 212 is a database storing the personal information and clinical data for each subject, and is filed in a state of being always encrypted by a facility session key described later and stored in the hard disk 24. And is decrypted by the facility session key only while each terminal 22 accesses. The local user database 211 is a database that is used only when the personal information management system is operated locally at the test participating facility 2, and has the authority to access the subject personal information database 212 by operating the terminal 22. The user ID and password (local account) of the user (doctor, clinical trial coordinator) are registered.

  Next, the terminal 22 of each test participating facility 2 stores a web browser program 221 in the hard disk 29, and the CPU 26 reads and executes this web browser program to transmit a message to the web server 11. Activating the EDC server software 111, obtaining desired screen data, displaying a screen based on the screen data on the display 28, and transmitting information input in an input field in the screen to the web server 11. Can do. Further, the terminal 22 downloads the subject personal information management client software installation program 112 from the web server 11 according to the function of the web browser program 221. When the CPU 26 reads and executes the subject personal information management client software installation program 112, the subject personal information management client software 222 and the system setting information file 223 are installed in a predetermined directory in the hard disk 29.

  This system setting information file 223 includes a system ID (that is, a test ID that is identification information for uniquely identifying a clinical trial to be performed), a URL of an EDC system realized by the EDC server software 111, and subject personal information management. The URL of the server software 113 and the built-in master key are stored. The built-in master key is used for encrypting and decrypting a facility session key, which will be described later, when the personal information management system is operated locally in the test participating facility. However, this system setting information file is previously encrypted on the clinical trial data center 1 side in a secret format that can be decrypted only by the CPU 26 that executes the corresponding subject personal information management client software 222. Since the subject personal information management client software 222 does not externally output the decrypted information, the built-in master key is exploited, the facility session key described later is illegally decrypted, and the subject personal information database 212 is illegally used. There is no fear of being done.

The CPU 26 that has read the subject personal information management client software 222 first generates a facility setting file 274 in the hard disk 29 based on information input from the user. The facility setting file 274 is uniquely generated in the facility ID, which is identification information for uniquely identifying the test participating facility, the facility name of the test participating facility, and the test participating facility 2, and is stored in the subject personal information database 214. The facility session key used to encrypt and decrypt the data (corresponding to the encryption key and the decryption key), the data directory of the subject personal information database 214, and the operation format (data center and Whether it is linked operation or local operation). Note that the facility session key is a data stored in the subject personal information database 212 in the case of local operation using the built-in master key in the case of local operation and through processing according to the subject personal information management client software 222. Each access is encrypted using the facility master key notified from the clinical trial data center 1 (an encryption key created in advance for each trial participating facility 2 on the clinical trial data center 1 side) It is stored in the setting file 224. Since the subject personal information management client software 222 does not externally output the facility master key notified from the clinical trial data center 1, the subject session information key 212 may be illegally decrypted and the subject personal information database 212 may be illegally used. There is no. In addition, since the facility setting file 224 is encrypted with the facility master key or the built-in master key, the facility setting file 224 is backed up by copying it to a removable storage medium with peace of mind, and other facilities in the facility participating facility 2 Distributed to the terminal 2. However, since this facility setting file 224 is not provided to the clinical trial data center 1, the facility session key is decrypted by the facility master key in the clinical data center 1 and uploaded as described later. It is possible to prevent the personal information in the copy 114 from being illegally decrypted and leaking the personal information of the subject.

  The CPU 26 that has read the subject personal information management client software 222 decrypts the facility session key in the facility setting file 224 using the built-in master key or the facility master key, and decrypts the subject personal information database 212 using the facility session key. The personal information of the subject input by the subject individual operator (doctor, clinical trial coordinator) is registered. After such registration, the CPU 26 that has read the test subject personal information management client software 222 decrypts the test subject personal information database 212 again, and if the linked operation with the data center is performed, the encrypted test subject personal information database 212. A file (personal information file) in which a copy 114 of this is stored is uploaded to the web server 11 of the clinical trial data center 1 (the file storing the uploaded copy 114 is then managed by any one of the terminals 22 by the subject personal information management). When the client software 222 is activated, it is downloaded and overwritten on the file of the subject personal information database 212 on the file server 21.)

3. Processing Next, in order to realize the personal information management system according to the present embodiment, processing executed by each of the devices 11, 12, 21, and 22 that have read the various programs described above is based on the flowcharts of FIGS. I will explain.

(1) Download of the subject personal information client software installation program 112 by the web browser software 221 Since the web browser software 221 is commercially available, when a URL is directly input, an HTTP request message is transmitted to the URL. In response to the response, the HTTP response message is received, and the screen is displayed on the display 28 based on the screen data transmitted by the message. Further, for example, when a link item (anchor tag) is included in the screen data and the link item is operated by an operator, the HTTP is addressed to the link destination URL incorporated in the link item. Send a request message. In addition, when the send button is included in the screen data, the operator operates the send button with information set in the text box, check box, radio button, etc. corresponding to the send button. In such a case, an HTTP request message including these pieces of information as parameters is transmitted to the URL incorporated in the transmission button.

  Therefore, the operator operates the input device 19 of the terminal 22 and inputs an appropriate command to the web browser software 221 to transmit an HTTP request message (EDC activation message) to the URL of the EDC system. Then, the EDC activation request message is received by the web server 11 of the clinical trial data center 1, and the CPU 23 of the web server 11 (hereinafter simply referred to as “web server 11”) analyzes the URL in the message. Thus, the EDC server software 111 is activated.

  The web server 11 that has started up the EDC server software 111 displays the entrance screen shown in FIG. 6 on its display 28 when the CPU 26 of the terminal 22 executing the web browser software 221 reads in accordance with the EDC server software 111. The screen data is transmitted to the request source terminal 22. Hereinafter, such transmission of the screen data to the terminal 22 is simply expressed as “˜display the screen on the terminal 22”.

  The entrance screen shown in FIG. 6 includes an ID entry field 30, a password entry field 31, and a login button 32. The screen data includes the web browser software 221 that is executed when the operator operates the login button 32 with the character strings written in the fields 30 and 31 using the input device 19 of the terminal 22, respectively. The setting of causing the CPU 26 of the terminal 22 to transmit to the web server 11 an HTTP request message (login request message) that includes the character strings entered in the fields 30 and 31 as parameters indicating the ID and password, respectively. include.

  Thus, the web server 11 that has received the login request message transmitted from the terminal 22 extracts the ID and password from the received login request message, and the same account as the ID and password is registered in the EDC user database 121. Check if it is. If such an account is not registered, a warning screen is displayed on the terminal 22 as an unauthorized access, but if such an account is registered, the web server 11 displays the menu shown in FIG. A screen is displayed on the terminal 22. As shown in FIG. 7, this menu screen includes a clinical data input button 33, a download button 34, and a logout button 35. The screen data includes the data when each button 33-35 is operated. A setting for transmitting the message to the web server 11 is incorporated.

  When receiving a message indicating that the download button 34 has been operated from the terminal 22 displaying this menu screen, the web server 11 transmits the subject personal information management client software installation program 112 to the terminal 22.

  Thereafter, when receiving a message indicating that the logout button 35 has been operated from the terminal 22 displaying the menu screen, the web server 11 ends the processing by the EDC server software 111.

(2) Installation of the subject personal information management client software 222 by the subject personal information management client software installation program 112 On the other hand, in the terminal 22 that has downloaded the subject personal information management client software installation program 112, the subject personal information management client software installation program 112 When the installer is executed, the installer function displays a dialog asking the operator for the installation destination directory. When the operator selects the installation destination directory from the dialog, the subject personal information management is performed in the selected directory. The client program 222 and the system setting information file 223 are installed.

(3) System Initial Setting by Subject Personal Information Management Client Software 222 In the terminal 22 in which the subject personal information management client software 222 and the system setting information file 223 are installed as described above, the operator uses the input device 19 to When the activation command for the subject personal information management client software 222 is input, the CPU 26 of the terminal 22 reads the subject personal information management client software 222, and in accordance with the subject personal information management client software 222, the flowcharts of FIGS. The process shown is executed.

  In the first step S001 after starting this processing, the CPU 26 of the terminal 22 operating in accordance with the subject personal information management client software 222 (hereinafter simply referred to as “terminal 22”) has the facility setting file 224 in the hard disk 29. Check if you are doing. If the facility setting file 224 already exists, the subject personal information management client software 222 is activated in the past, and it is determined that the processing from S002 to S016 has already been completed. Proceed to S101.

  On the other hand, if the facility setting file 224 does not yet exist, the terminal 22 determines that the subject personal information management client software 222 is activated for the first time, and advances the process to S002. In S002, the terminal 22 displays the facility setting file check screen shown in FIG. As shown in FIG. 8, on this facility setting file check screen, a facility for selecting whether to newly create a facility setting file 224 or to copy and use a facility setting file 224 already created in another terminal 22 When a copy of an existing file is selected by the setting file option button group 36 or the facility setting file option button 36, the location where the copy source facility setting file exists (for example, temporarily in the terminal 22). A file position designation field 37 for specifying a path to the (removable media loaded), a creation button 38 and a cancel button 39 are included. When the cancel button 39 is operated, the terminal 22 finishes the process according to the subject personal information management client software 222, and “newly created” is selected by the facility setting file option button group 36. If the creation button 38 is operated, the process proceeds to S005, “Copy existing file” is selected by the facility setting file option button group 36, and the path is designated in the file location designation field 37. If the creation button 38 is operated in the state of being, the process proceeds to S004.

  In S 004, the terminal 22 reads the facility setting file 242 from the location corresponding to the path specified in the file location specification field, and copies it to the same folder as the subject personal information management client software 222 in the hard disk 29. When S004 is completed, the terminal 22 advances the process to S016 as it is.

  On the other hand, in S005, the terminal 22 displays the system initial setting screen shown in FIG. As shown in FIG. 9, the system initial setting screen includes a system operation method selection option button group 40, a data storage destination entry field 41, a facility ID entry field 42, and a system initialization button 57.

  The system operation method selection option button group 40 includes a plurality of option buttons for selecting whether to operate the subject personal information management system in cooperation with the server or to operate it locally without cooperation. The storage destination entry column 41 is a column in which the URL of the data storage directory of the file server 21 in the test participating facility 2 is input. The facility ID entry column 42 is a column in which a character string designated in advance from the clinical trial data center 1 is input as the ID of the trial participating facility. When the system initialization button 57 is operated while the character string is input in each column 41 to 42, the terminal 22 uses the information input in each column 41 to 42 and the system operation method selection option button group 40. The type of the selected system operation method is set as “setting data” in the RAM 27, and the process proceeds to S006.

In S006, the terminal 22 generates a random number, creates a facility session key based on the random number (corresponding to a key issuing means), and generates an initial subject personal information database 212 on the RAM 27.

  In the next S007, the terminal 22 checks the type of the system operation method included in the setting data saved in the RAM 27 in S005, and proceeds to S012 if “link with server” is selected, If “local” is selected, the process proceeds to S008.

  In S008, the terminal 22 generates an initial file of the local user database 211 in the data storage directory of the file server 21. If the file of the local user database 211 created in the past already exists, it is initialized.

  In the next S009, the terminal 22 displays the local user setting screen shown in FIG. As shown in FIG. 10, in this local user setting screen, information such as the user ID, password, and name (user name) of each doctor and the study coordinator who are authorized to access in the study participating institution is shown in each row. A table 43 that can be entered and a save complete button 44 are included. When the operator operates the save completion button 44 in the state where the user ID, password, and user name are entered in each row of Table 43 for each doctor and clinical trial coordinator who are authorized to access in the study participating facility 2, the terminal 22 generates a local account of each doctor and clinical trial coordinator who is authorized to access at the trial participating facility based on the information input in the table 43 and registers it in the local user database 211.

  In the next S010, the terminal 22 temporarily decrypts the system setting information file 223 encrypted in the private format as described above, reads the built-in master key, and uses the built-in master key. A copy of the facility session key generated in S006 is encrypted. As soon as the encryption is completed, the system setting information file 223 is returned to the original state, and the read-in built-in master key is completely erased from the terminal 22. The terminal 22 saves the encrypted facility session key in the facility setting file 224 together with the setting data saved in the RAM 27 in S005 and stores it in the hard disk 29.

  In the next S011, the terminal 22 encrypts the local user database 211 in the file server 21 using the original facility session key. When S011 is completed, the terminal 22 advances the process to S015.

  On the other hand, in S012, which is executed when “interlock with server” is selected, the terminal 22 displays the system initialization login screen shown in FIG. As shown in FIG. 11, the system initialization login screen includes an ID entry field 54, a password entry field 55, and a login button 56.

Then, when the operator operates the login button 56 in a state where the character strings are respectively written in the fields 54 and 55 in the system initial login screen using the input device 19 of the terminal 22 in the terminal 22, in the next S013, The web browser software 221 is activated, and an HTTP request message (facility master key request message) including the character strings entered in the fields 54 and 55 as parameters indicating ID and password is transmitted to the web server 11. The web server 11 that has received the facility master key request message activates the subject personal information management server software 113. Then, according to the subject personal information management server software 113, it is checked whether an account including the same user ID and password as those included in the cooperation request message is registered in the EDC user database 121. If such an account is registered, the facility ID is read from the account, the facility master key corresponding to the facility ID is read from the test participating facility master key database 123, and the response is sent to the message transmission source terminal 22. To do.

  In the next S014, the terminal 22 encrypts the copy of the facility session key generated in S006 using the facility master key acquired in S013 (key encryption means). The terminal 22 stores the encrypted facility session key in the facility setting file 224 together with the setting data saved in the RAM 27 in S005, and stores it in the hard disk 29 (key storage means). . When S014 is completed, the terminal 22 advances the process to S015.

  In S015, the subject personal information database 211 on the RAM 27 is encrypted using the original facility session key, and is converted into a file and stored in the data storage directory of the file server 21. When the encryption is completed, the terminal 22 immediately deletes the original facility key and the built-in master key or the facility master key. Thus, when S015 is completed, the terminal 22 advances the process to S016.

  In S016, the terminal 22 displays the system initial setting screen shown in FIG. As shown in FIG. 12, this system initial setting screen includes an OK button 48. When this OK button 48 is operated, the terminal 22 advances the processing to S101.

  In S <b> 101, the terminal 22 tries to set an exclusive lock on the file in the subject personal information database 212 on the file server 21. As a result, if the file of the subject personal information database 212 on the file server 21 is in an exclusive lock by another terminal 22, the setting of the exclusive lock has failed, so the terminal 22 in FIG. After the system busy message shown is displayed on the display 28, the process according to the subject personal information management client software 222 is terminated.

  On the other hand, if the file in the subject personal information database 212 on the file server 21 is not in an exclusive lock by another terminal 22, the exclusive lock is successfully set for this, and the terminal 22 advances the process to S103. .

  In S <b> 103, the terminal 22 reads the data storage directory and the system operation method type from the setting data in the facility setting file 224.

  In S104, the terminal 22 displays the system login screen shown in FIG. As shown in FIG. 13, the system login screen includes an ID entry field 45, a password entry field 46, and a login button 47. When the operator operates the login button 47 in a state where a character string is written in each of the columns 45 and 46 in the system login screen using the input device 19 of the terminal 22, the terminal 22 displays the columns 45 and 46. After the written information is saved in the RAM 27, the process proceeds to S105.

  In S105, the terminal 22 checks the type of the system operation method read in S103, and proceeds to S109 if “interlock with server” is selected, and if “local” is selected. The process proceeds to S106.

In S106, the terminal 22 temporarily decrypts the system setting information file 223 encrypted in the private format as described above, reads out the built-in master key, and encrypts it from the facility setting file 224. Read the facility session key. Then, the terminal 22 decrypts the facility session key using the decrypted internal master key. As soon as the decryption is completed, the system setting information file 223 is restored to the original state, and the read internal master key is completely erased from the terminal 22.

  In the next S107, the terminal 22 reads the file of the local user database 211 stored in the data storage directory read in S103 in the file server on the RAM 27, and uses the facility session key decrypted in S106. Decrypt.

  In the next step S108, the terminal 22 checks whether or not the local account including the same user ID and password stored in the RAM 27 in step S104 is stored in the local user database 211 decrypted in step S107. To do. If the local account is not registered, the process returns to S104 to re-enter the ID and password. On the other hand, if such an account is registered, the terminal 22 advances the process to S114.

  On the other hand, in S109, which is executed when “Synchronize with server” is selected, the terminal 22 activates the web browser software 221, and uses the character strings entered in the fields 45 and 46 as the ID and password, respectively. An HTTP request message (authentication request message) included as a parameter indicating “” is transmitted to the web server 11. The web server 11 that has received the authentication request message activates the subject personal information management server software 113. Then, according to the subject personal information management server software 113, it is checked whether an account including the same user ID and password as those included in the authentication request message is registered in the EDC user database 121. If such an account is registered, a response indicating that the account is valid is returned to the request source terminal 22, and if such an account is not registered, a response indicating that the account is invalid is returned. It responds to the request source terminal 22.

  In step S110, the terminal 22 checks the content of the response from the web server 11. If the response indicates that the account is invalid, the terminal 22 returns the processing to step S104 to re-enter the ID and password. If the response is valid, the process proceeds to S111.

  In S111, the terminal 22 transmits an HTTP request message (facility master key request message) for requesting a facility master key to the web server 11 (corresponding to a master key download unit). The web server 11 that has received this facility master key request message reads out the facility master key corresponding to the facility ID included in the account from the test participating facility master key database 123 according to the subject personal information management server software 113, and sends the request source It responds to the terminal 22.

  In the next step S112, the terminal 22 reads the encrypted facility session key from the facility setting file 224. Then, the terminal 22 decrypts the facility session key using the facility master key acquired from the web server 11 in S111 (corresponding to a key decryption unit).

In the next S113, the terminal 22 transmits an HTTP request message (subject personal information database request message) for requesting a copy 114 of the facility subject personal information database to the web server 11 (corresponding to download means). The web server 11 that has received the subject personal information database request message reads out the file 114 of the copy of the facility subject personal information database 212 corresponding to the facility ID included in the account according to the subject personal information management server software 113, and requests it. It responds to the former terminal 22. The terminal 22 overwrites the data storage directory read out in S103 in the file server with the file of the copy 114 of the subject personal information database 212 downloaded in this way. When S113 is completed, the terminal 22 advances the process to S114.

  In S114, the terminal 22 reads the subject personal information database 212 in the file existing in the data storage directory read in S103 in the file server 21 on the RAM 27, and uses the facility session key decrypted in S106 or S112. And decrypting it (corresponding to decryption means).

  In the next S201, the terminal 22 reads the personal information of each subject from the file of the subject personal information database 212 decrypted in S114, and displays the subject personal information management screen shown in FIG. In this subject personal information management screen, a table 50 for displaying personal information for each subject read from the subject personal information database 212 in each row, and personal information of a new subject to be added to the table 50 are written. A personal information input area 58 having a plurality of text boxes, a data search button 51, a new issue button 52, a subject identification ID field 59, an EDC registration button 49, and a save end button 53 are included.

  In each row of the table 50 corresponding to each subject, “serial number”, “subject identification ID”, “patient name”, “medical chart number”, “initial last name”, “initial name”, “sex”, The fields of “date of birth”, “disease”, and “Ministry Ordinance Registration Number” are included. Among these, the serial number is a serial number of the row in the table. The subject identification ID is a unique subject identification number in the test participating facility 2. The patient name is the real name of the subject. The medical record number is an identification number attached to a record (medical record) of diagnosis / treatment performed on the subject in the test participating facility. The initial surname is a Roman initial of the subject's last name, and the initial name is the Roman initial of the subject's first name. The disease is the name of the disease that currently affects the subject. The case registration number is an identification number corresponding to the disease. Among these, the patient's name, initial surname, and initial name are information that can identify an individual, and by including this, personal information of the subject becomes personal information that should be protected. It is encrypted.

  The personal information input area 58 includes seven text boxes for inputting the patient's name, initial surname, initial name, date of birth, sex, and disease, among various information registered in the table 50. . When the operator inputs a new issue button 52 in a state where values are written in these text boxes using the input device 19, a new subject identification ID is generated, and this new subject identification ID and each text box are displayed. The personal information of the new subject consisting of the written value is added to the subject personal information database 212 on the RAM 27, and a new record (row) displaying the added personal information is added to the table 50.

  A data search button in a state in which personal information of a type corresponding to any one of the dialog boxes in the personal information input area 58 has been input, or a subject identification ID of any subject has been input in the subject identification ID field 59 When 51 is operated, the table 50 is scrolled, and the line that matches the input information is displayed in a highlighted state.

In the next S202, the terminal 22 waits for some operation on the subject personal information management screen displayed in S201. If the EDC registration button 49 is operated, the personal information of the subject corresponding to the subject identification ID inputted in the new input subject identification ID column 54 at that time (however, the subject's name, initial surname) , Excluding the initial name) is extracted from the table 50, the web browser software 221 is activated, and is transmitted to the EDC server software 111 on the web server 11 using the function of the web browser software 221. Thereafter, data exchange between the web browser software 221 and the EDC server software 111 allows the operator of the terminal 22 to register clinical trial information about the subject in the clinical trial database 122 together with the personal information. And the process which updates the clinical trial information registered in the clinical trial database 122 in association with the personal information can be executed. When S203 is completed, the terminal 22 returns the process to S202. The processes of S201 to S204 described above correspond to personal information update means.

  When the data search button 51 and the new issue button 52 are operated on the subject personal information management screen, the terminal 22 returns the process to S202 after performing the process as described above in S204.

  On the other hand, when the save end button 53 is operated on the subject personal information management screen, the terminal 22 advances the process to S205. In S205, the terminal 22 checks whether there has been a change in the contents (personal information) of the file in the subject personal information database 212 read into the RAM 27 in S201. If there is no change in the personal information, the terminal 22 advances the process to S207 as it is. On the other hand, if there is a change in the personal information, the terminal 22 encrypts the subject personal information database 212 existing on the RAM 27 in S206 using the facility session key decrypted in S106 or S112 ( This corresponds to encryption means), and is converted into a file and overwritten on the data storage directory on the file server 21. After completing S206, the terminal 22 advances the process to S207.

  In S207, the terminal 22 checks the type of the system operation method read in S103, and proceeds to S210 if “interlock with server” is selected, and if “local” is selected. The process proceeds to S208.

  In S208, the terminal 22 checks whether there is a change in the contents of the file of the local user database 211 read into the RAM 27 in S107. If there is no change, the terminal 22 proceeds directly to S212. If there is a change, the terminal 22 uses the facility session key decrypted in S106 in S209 to store the local user database 211 in the RAM 27. After encrypting the file and overwriting the data storage directory on the file server 21, the process proceeds to S212.

  On the other hand, in S210, the terminal 22 activates the web browser software 221 and transmits an HTTP request message (connection request message) for requesting connection to the web server 11.

  In next step S211, the terminal 22 uses the function of the web browser software 221 to store a file storing a copy 114 of the subject personal information database 212 existing in the data storage directory on the file server 21 with the subject personal information management server software. Is uploaded to the web server 11 (corresponding to upload means). When S211 is completed, the terminal 22 advances the process to S212.

In S <b> 212, the terminal 22 releases the exclusive lock on the file of the subject personal information database 212 on the file server 21. When S212 is completed, the terminal 22 ends the process according to the subject personal information management client software 222. Thus, when the process according to the subject personal information management client software 222 is completed, the plaintext subject personal information database 212 left in the RAM 27 of the terminal 22 disappears.

4). Operation According to Embodiment According to the personal information management system according to the present embodiment configured as described above, when the study coordinator or the principal doctor receives the study plan from the study sponsor at the study participating facility 2, the study coordinator Or, the chief physician selects a certain number of appropriate persons according to the clinical trial plan from patients who are hospitalized or hospitalized at the study participating facility 2 or who have been scouted from outside the study participating facility 2. With their consent, these individuals are determined as subjects in the trial.

  Then, the clinical trial coordinator or the chief physician operates the terminal 22 used by the self in the trial participation facility 2 to thereby make the individual test subject from the web server 11 (EDC server software 111) as described above. By downloading the information management client installation program 112 and executing the subject personal information management client installation program 112 on the terminal 22, the subject personal information management client software 222 and the system setting information file 223 are stored in a predetermined folder in the hard disk 29. install. As described above, the subject personal information management client software 222 that causes the terminal to function as a personal information management device is downloaded from the clinical trial data center 1 through the wide area network N such as the Internet or a dedicated line, so that it can be easily used. Can do.

  Next, the trial coordinator or the chief physician executes the subject personal information management client software 222 on the terminal 22. At this time, since the file of the subject personal information database 212 for the trial is not yet stored in the data storage directory of the file server 212, the facility setting file check screen (FIG. 8) is displayed on the display 28. (S001: yes, S002). However, at this time, since there is no facility setting file 224 for the trial in the study participating facility 2, the study coordinator or the chief doctor naturally selects “Create New” The creation button 38 is operated (S003: new creation). Then, a system initial setting screen (FIG. 9) is displayed on the display 28 (S005).

  The clinical trial coordinator or chief physician enters the path of a predetermined data storage directory in the file server 21 in the data storage destination entry field 41 of the system initial setting screen (FIG. 9), and participates in the trial in the facility ID entry field 42 When the identification information of the facility 2 is entered, the type of system operation format is appropriately selected, and the system initialization button 57 is operated, a facility session key that can be used only within the test participating facility is generated based on a random number. At the same time, an initial subject personal information database 212 is generated on the RAM 27 (S006). In the following description, the case where “linked with EDC server” is selected as the type of system operation format will be described as an example (S007: linked with server).

Then, a system initial login screen (FIG. 10) is displayed on the display of the terminal 22 (S012). Therefore, the clinical trial coordinator or the chief physician enters the login button in the state where the user ID and password assigned in advance by the clinical trial data center 1 are entered in the respective fields 54 and 55 in the system initial login screen. 56 is operated. Then, the web server 11 (subject personal information management server software 113) that has received these user IDs and passwords authenticates whether the same account as the combination of these user IDs and passwords is registered in the EDC user database 121, If registered, it is assumed that the authentication is successful, and the facility master key corresponding to the identification information of the test participating facility 2 included in the account is read from the test participating facility master key database 123, and the request source terminal 22 (S013).

  The terminal 22 first copies the facility session key to the trial participating facility 2 acquired from the clinical trial data center 1 in this way, using the facility master key, and then copies the copy using the facility master key. The data is encrypted and stored in the facility setting file 224 in the same directory on the hard disk 29 (S014). Further, after encrypting the subject personal information database 212 using the original facility session key, the original facility session key and the facility master key are discarded (S015).

  As described above, the facility setting file 224 is created in the terminal 22 used by the clinical trial coordinator or the chief doctor, and the file of the subject personal information database 212 is created in the file server 21. Therefore, the terminal 22 From then on, it becomes possible to access the subject personal information database 212, that is, to register the clinical data of the subject (S101).

  In addition, the clinical trial coordinator or the chief doctor can copy the facility setting file 224 from the hard disk 29 of the terminal 22 to a removable medium and distribute it to the other terminals 22 in the trial participating facility 2. That is, if the trial coordinator or doctor registered in the EDC user database 121 performs the same operation as described above on the other terminal 22, the subject personal information management client software installation program 112 is downloaded to the web server 11 (EDC server software 111). The personal information management client software 222 for the subject can be installed in the hard disk 29 of the terminal 22. Then, the subject personal information management client software 222 is started, “Copy existing file” is selected on the facility setting file check screen (S002, FIG. 8), and the facility setting file in the removable medium is displayed in the file location designation field 37. If the path of the directory storing 224 is entered and the creation button 38 is operated, the facility setting file 224 is copied from the removable medium to a predetermined directory on the hard disk 29 in the other terminal 22 (S004). . As a result, the other terminal 22 can access the subject personal information database 212, that is, register the clinical data of the subject, similarly to the terminal 22 used by the clinical trial coordinator or the principal doctor (S101). ~).

Further, when the subject personal information management client software 222 is started for the second time or later in the terminal 22 that already has the subject personal information management client software 222 and the facility setting file 224 as described above, the processing from S002 to S016 is performed. Is skipped (S001: yes), the subject personal information database 212 can be immediately accessed, that is, the clinical data of the subject can be registered (S101-).

When accessing the subject personal information database 212, the terminal 22 exclusively locks the file of the subject personal information database 212 on the condition that the other terminal 22 is not exclusively locked (S101: success), The facility master key is acquired from the web server 11 (subject personal information management server software 113) (S111), the facility session key is decrypted using the facility master key (S112), and the facility subject individual of the test participating facility A file storing a copy 114 of the information database 212 is downloaded, overwritten on the file server 21 (S113), and the subject personal information database 212 is decrypted on the RAM 27 using the decrypted facility session key. (S114). By following the above procedure, it is possible to access the subject personal information database 212 stored by the web server 11. That is, the contents are displayed on the table 50 in the subject personal information management screen (FIG. 15), and the personal information of each subject is added to the subject personal information database 212 through the subject personal information management screen (FIG. 15). (S201 to S204).

  When the personal information of each subject in the subject personal information database 212 is updated as described above (S205: Yes), the terminal 22 encrypts the updated subject personal information database 212 into a file. The file is overwritten on the file server 21 (S206), and this is uploaded to the web server 11 (subject personal information management server software 113). After that, when the processing by the subject personal information management client software 222 ends, the plaintext subject personal information database 212 remaining on the RAM 27 is erased.

  As described above, according to the present embodiment, in the test participation facility 2, the subject personal information database 212 is stored in the file server 21 in a state of being always encrypted and filed, and thus has no access authority. Even if a person (whose personal ID is not registered in the EDC user database 121 of the clinical trial center 1) or a person who has access authority but does not follow the proper procedure accesses the subject personal information database 212 , Can not know the contents.

  In addition, since the facility session key for decrypting the subject personal information database 212 is stored in the facility setting file 224 in an encrypted state, the facility session key has no access authority or has access authority. However, since a person who does not follow the proper procedure cannot obtain the plaintext facility session key used for decryption, the subject personal information database 212 is prevented from being decrypted illegally. The facility session key encrypted in this manner cannot be decrypted in the subject personal information database 212, so that it can be distributed within the test participating facility using removable media, or in the test participating facility in preparation for loss. Can be backed up.

  Since the encrypted copy 114 of the subject personal information base 212 is uploaded to the clinical trial data center 1 (web server 11) and backed up, the subject personal information database 212 on the file server 21 at the trial participating facility. Even if it is accidentally deleted or destroyed, the correct subject personal information database 212 can be restored using the copy 114 backed up in the clinical trial data center 1 (web server 11). Since the copy 114 of the subject personal information base 212 backed up in the clinical trial data center 1 (web server 11) in this way is encrypted using the facility session key, the facility session key exists. On the side of the clinical trial data center 1 (web server 11) that does not exist, even if the facility master key of the trial participating facility is available, it cannot be decrypted and the contents cannot be seen. Moreover, a person who illegally stole a copy 114 of the subject personal information base 212 from the clinical trial data center 1 (web server 11) cannot therefore steal the contents. As a result, according to the present embodiment, it is possible to strongly protect the personal information of the subject acquired at the test participating facility.

The block diagram which shows the schematic software structure of the computer network which is embodiment by this invention 1 is a block diagram showing a schematic hardware configuration of a computer network according to an embodiment of the present invention. Flow chart showing processing by subject personal information management client software Flow chart showing processing by subject personal information management client software Flow chart showing processing by subject personal information management client software The figure which shows the entrance screen of the EDC system Figure showing the menu screen Figure showing the facility settings file check screen Figure showing the system initial settings screen Figure showing the local user setting screen Figure showing the system initial login screen Figure showing the system initial settings screen Figure showing the system login screen Figure showing the system busy screen Figure showing the subject personal information management screen

Explanation of symbols

1 Clinical Trial Data Center 2 Study Participating Facility 11 Web Server 12 Database Server 21 File Server 22 Terminal 112 Subject Personal Information Management Client Software Installation Program 113 Subject Personal Information Management Server Software 121 EDC User Database 123 Study Participating Facility Master Key Database 212 Subject Individual Information database 221 Web browser software 222 Subject personal information management client software 224 Facility setting file

Claims (4)

A personal information management device for storing and storing personal information in a personal information file,
A communication device capable of communicating with a server device via a network;
An input device;
A storage device;
And key issue means for issuing a key,
Personal information updating means for updating personal information to be stored in the personal information file in accordance with information input through the input device;
An encryption means for encrypting the personal information using the key issued by the key issuing means after updating the personal information by the personal information updating means;
Upload means for uploading the personal information file storing the personal information encrypted by the encryption means to the server device using the communication device;
Download means for downloading the personal information file from the server device in accordance with information input through the input device;
Master key download means for downloading a predetermined master key from the server device;
Key encryption means for encrypting the key issued by the key issuing means using the master key;
Key storage means for storing the key encrypted by the key encryption means in the storage device;
A key decryption means for extracting a key stored in the storage device and decrypting the key using the master key;
Decryption means for decrypting the encrypted personal information in the personal information file downloaded by the download means using the key decrypted by the key decryption means;
A personal information management device comprising: an output device that outputs the content of the personal information decrypted by the decrypting means. The key encryption means, according to claim 1 Symbol placement of personal information management apparatus, characterized in that discarding the master key after encrypting the key. A computer having a communication device, an output device, and an input device capable of communicating with a server device via a network,
The key issue means for issuing a key,
Personal information updating means for updating personal information to be stored in the personal information file in accordance with information input through the input device;
An encryption means for encrypting the personal information using the key issued by the key issuing means after updating the personal information by the personal information updating means;
Upload means for uploading the personal information file storing the personal information encrypted by the encryption means to the server device using the communication device;
Download means for downloading the personal information file from the server device in accordance with information input through the input device;
Key encryption means for encrypting the key issued by the key issuing means using the master key;
Key storage means for storing the key encrypted by the key encryption means in the storage device;
Key decrypting means for extracting a key stored in the storage device and decrypting the key using the master key;
Decrypting means for decrypting an encrypted personal information file in the personal information file downloaded by the downloading means using the key decrypted by the key decrypting means, and decrypting by the decrypting means The personal information management program which functions as an output means for outputting the contents of the personalized information file using the output device. A personal information management system comprising a personal information management device and a server device connected to each other via a network in order to manage a personal information file storing personal information,
The server device
In response to each request from the personal information management device, a predetermined master key is responded to the personal information management device, and the encrypted personal information file uploaded by the personal information management device is stored in the disk device. Storing, reading the encrypted personal information file requested to be downloaded by the personal information management device from the disk device, and transmitting it to the personal information management device;
The personal information management device includes:
A communication device capable of communicating with a server device via a network;
An input device;
A storage device;
A key issuing means for issuing a key;
Master key download means for downloading the master key from the server device;
Personal information updating means for updating personal information to be stored in the personal information file in accordance with information input through the input device;
Personal information encryption means for encrypting the personal information using the key after updating the personal information by the personal information update means;
Upload means for uploading the personal information file storing the personal information encrypted by the personal information encryption means to the server device using the communication device;
Key encryption means for encrypting the key using the master key downloaded from the server device by the master key download means;
Key storage means for storing the key encrypted by the key encryption means in the storage device;
Download means for downloading the personal information file from the server device in accordance with information input through the input device;
Key decryption means for taking out a key stored in the storage device and decrypting the key using a master key;
Personal information decrypting means for decrypting encrypted personal information in the personal information file downloaded by the downloading means, using the key decrypted by the key decrypting means;
A personal information management system, comprising: an output device that outputs the content of the personal information decrypted by the personal information decrypting means.

Images