JP6797963B2 - Anonymous processing target identification method, anonymous processing target identification system and program - Google Patents

Description

The present invention relates to anonymous processing of personal information.

Conventionally, with the enforcement of the revised Personal Information Protection Law, various technologies related to anonymous processing of personal information have been developed. For example, Patent Document 1 describes a privacy information evaluation server that processes a user's privacy information so as to satisfy k-anonymity.

Japanese Unexamined Patent Publication No. 2011-180839

The present invention is based on such a technique, and when personal information is stored across a plurality of tables, an individual who should refer to the plurality of tables and be a candidate for anonymous processing. The purpose is to retrieve information.

In order to solve the above problems, the present invention has a personal information storage unit that stores a plurality of personal information tables that store a plurality of sets of attribute values including a personal ID, and a specific individual's extracted from publicly known information. It is an anonymous processing target identification method executed in a system including a publicly known information storage unit that stores a plurality of publicly known information tables that store a plurality of sets of attribute values that lead to identification, and is described above with reference to the plurality of personal information tables. Each of the set of attribute values stored in the publicly known information table has a search step for searching the personal ID associated with the set of attribute values as information indicating a candidate for anonymous processing, and the search step. Is one attribute value that constitutes the set of n attribute values from the plurality of personal information tables when the set of n attribute values stored in the publicly known information table is to be processed. A table specifying step for specifying a personal information table including the attribute of 1 and a personal ID specifying step for specifying a personal ID associated with the one attribute value in the personal information table specified by the table specifying step. The table specifying step is a step of sequentially specifying a table including the attributes of the attribute values for each of the attribute values constituting the n set of attribute values, and the personal ID specifying step is a step of specifying the personal ID. When the personal ID is specified in order for each of the attribute values constituting the n attribute value set, in the second and subsequent specific processes, the personal ID specified in the previous specific process and the processing target An anonymous processing target identification method characterized in that the personal ID associated with the attribute value is specified, and the nth identification process is a step of specifying the personal ID as information indicating a candidate for an anonymous processing target. I will provide a.

In a preferred embodiment, the anonymous processing target identification method compares the number of personal IDs searched by the search step with respect to a set of attribute values stored in the publicly known information table, and the number of personal IDs. When is equal to or less than the threshold value, a determination step of determining the set of attribute values including the personal ID in the plurality of personal information tables as an anonymous processing target and an attribute value determined to be an anonymous processing target by the determination step. It further has an anonymous processing step of performing anonymous processing on the set of.

In another preferred embodiment, the anonymous processing target identification method compares the number of personal IDs searched by the search step with a threshold value for a set of attribute values stored in the publicly known information table, and compares the personal IDs with the threshold value. When the number of is equal to or less than the threshold value, the set of attribute values including the personal ID in the plurality of personal information tables is determined to be an anonymous processing target by the determination step and the determination step. It further has a notification step of notifying the user of the set of attribute values as an anonymous processing target.

In a more preferred embodiment, the anonymous processing target identification method further includes a threshold setting step of setting the threshold value based on the number or type of attribute values constituting the one set of attribute values, and the determination step comprises. This is a step of comparing the number of personal IDs with the threshold value set by the threshold value setting step.

In a further preferred embodiment, the anonymous processing target identification method sets a priority for each attribute included in the publicly known information table according to the number of attribute values stored in the publicly known information table. Further having a step, the table specifying step is a step of specifying a table for each of the attribute values constituting the n attribute value set in the order according to the priority set by the priority setting step. Is.

In a further preferred embodiment, the publicly known information storage unit stores a plurality of publicly known information tables, and the anonymous processing target identification method is based on the attributes included in the plurality of personal information tables from the plurality of publicly known information tables. The search step further includes a table selection step for selecting a publicly known information table, and the search step refers to the plurality of personal information tables and sets a set of attribute values stored in the publicly known information table selected by the table selection step. For each of the above, it is a step of searching for the personal ID associated with the set of the attribute values as the information indicating the anonymous processing target.

Further, the present invention has a personal information storage unit that stores a plurality of personal information tables that store a plurality of sets of attribute values including a personal ID, and an attribute value that is extracted from publicly known information and leads to identification of a specific individual. With reference to the public information storage unit that stores a publicly known information table that stores a plurality of sets and the plurality of personal information tables, each of the attribute value sets stored in the public information table corresponds to the attribute value set. When a search unit for searching the attached personal ID as information indicating an anonymous processing target is provided, and the search unit targets a set of n attribute values stored in the publicly known information table as a processing target. , A table specifying unit that specifies a personal information table including an attribute of one attribute value that constitutes the set of n attribute values from the plurality of personal information tables, and an individual specified by the table specifying unit. In the information table, the information table includes a personal ID specifying unit that specifies the personal ID associated with the one attribute value, and the table specifying unit is for each of the attribute values constituting the n set of attribute values. , The table including the attribute of the attribute value is specified in order, and when the personal ID specifying unit sequentially specifies the personal ID for each of the attribute values constituting the set of n attribute values, the second and subsequent times are performed. In the specific process, the personal ID that is the personal ID specified in the previous specific process and is associated with the attribute value of the processing target is specified, and in the nth specific process, the personal ID is anonymously processed. Provided is an anonymous processing target identification system characterized in that it is specified as information indicating a candidate of.

Further, the present invention has a personal information storage unit that stores a plurality of personal information tables that store a plurality of sets of attribute values including a personal ID, and an attribute value that is extracted from publicly known information and leads to identification of a specific individual. A computer equipped with a publicly known information storage unit that stores a plurality of sets of publicly known information tables refers to a plurality of personal information tables, and for each of the sets of attribute values stored in the publicly known information table, the attribute value This is a program for executing a search step of searching for a personal ID associated with a set of, as information indicating an anonymous processing target, and the search step has n attributes stored in the publicly known information table. When a value set is to be processed, a table specifying step for specifying a personal information table including an attribute of one attribute value constituting the n attribute value sets from the plurality of personal information tables. In the personal information table specified by the table specifying step, the personal ID specifying step for specifying the personal ID associated with the one attribute value is provided, and the table specifying step has the n attributes. For each of the attribute values constituting the value set, the step of sequentially specifying the table containing the attribute of the attribute value, and the personal ID specifying step is the step of specifying the attribute values constituting the n attribute value sets. When the personal ID is specified in order for each, in the second and subsequent specific processes, the personal ID specified in the previous specific process and associated with the attribute value to be processed is specified. The nth identification process provides a program characterized in that it is a step of identifying a personal ID as information indicating a candidate for anonymous processing.

According to the present invention, when personal information is stored over a plurality of tables, it is possible to search for personal information that should be a candidate for anonymous processing by referring to the plurality of tables.

Block diagram showing an example of the functional configuration of the anonymous processing system 1 The figure which shows an example of the patient information table T1 The figure which shows an example of the disease information table T2 The figure which shows an example of the prescription information table T3 The figure which shows an example of the hospitalization history information table T4 Diagram showing an example of article table T5 Flow diagram showing an example of anonymous processing Explanatory drawing of a concrete operation example of anonymous processing Explanatory drawing of a concrete operation example of anonymous processing Explanatory drawing of a concrete operation example of anonymous processing

1. 1. Embodiment Anonymous processing system 1 according to an embodiment of the present invention will be described with reference to the drawings.
The anonymous processing system 1 is a system for performing anonymous processing on personal information (particularly medical information) provided to a data user. In this system, when performing anonymous processing on personal information, only personal information that leads to identification of a specific individual is extracted based on publicly known information such as news articles, and only the extracted personal information is anonymously processed. .. Therefore, the usefulness of personal information that does not lead to the identification of a specific individual can be maintained.

1-1. Configuration FIG. 1 is a block diagram showing an example of the functional configuration of the anonymous processing system 1. The anonymous processing system 1 shown in the figure is composed of one or more servers, and has a provided data storage unit 2, a known information storage unit 3, a search unit 4, a determination unit 5, and an anonymous processing unit 6 as its functions. .. Among these functions, the provided data storage unit 2 and the publicly known information storage unit 3 are realized by a storage device such as an HDD. On the other hand, the search unit 4, the determination unit 5, and the anonymous processing unit 6 are realized by the processor executing the program stored in the storage device. This program is a program that can be distributed via a network such as the Internet or a non-temporary recording medium. Each function will be described below.

The provided data storage unit 2 is a database provided to the data user, and stores the provided data DB 21 to be anonymously processed. The provided data DB 21 stored in the provided data storage unit 2 is composed of five personal information tables each storing a plurality of sets of a plurality of attribute values. Specifically, it is composed of a patient information table T1, a disease information table T2, a prescription information table T3, and an hospitalization / discharge history information table T4 (hereinafter, collectively referred to as "medical information table T"). Hereinafter, each table will be described.

FIG. 2 is a diagram showing an example of the patient information table T1. The patient information table T1 shown in the figure stores attribute values for each of the three attributes, that is, the patient ID, the date of birth, and the gender. IDs of A1, A3, and A4 are attached to these three attributes. Here, the reason why A2 is missing as the ID is that the facility code, which is an attribute to which A2 should be attached, is deleted from the patient information table T1 in advance. Of these three attributes, the patient ID is the primary key in the patient information table T1. However, in the other tables described below, the patient ID is not the primary key, so the same patient ID may appear across multiple rows of the table.

FIG. 3 is a diagram showing an example of the disease information table T2. The disease information table T2 shown in the figure stores attribute values for each of the attributes such as patient ID, clinical department classification, main disease flag, suspicion flag, disease, disease start date, and disease end date. Among these attributes, the department classification, the main disease flag, the suspicion flag, the disease, the disease start date and the disease end date are given IDs of A5 to A10.

FIG. 4 is a diagram showing an example of the prescription information table T3. The prescription information table T3 shown in the figure stores attribute values for each of the attributes such as patient ID, clinical department classification, entry / exit classification, prescription date, drug, dose, number of prescriptions, and hospital / outside classification. Among these attributes, IDs A11 to A16 are assigned to the entry / exit classification, prescription date, drug, dose, number of prescriptions, and hospital / outside classification.

FIG. 5 is a diagram showing an example of the hospitalization / discharge history information table T4. The hospitalization / discharge history information table T4 shown in the figure stores attribute values for each of the attributes such as patient ID, clinical department classification, hospitalization date, and discharge date. Of these attributes, the date of admission and the date of discharge are given IDs A21 to A22.
The above is the description of the provided data storage unit 2.

Next, the publicly known information storage unit 3 stores the publicly known information DB 31, which is a database collated with the provided data DB 21. The publicly known information DB 31 stored in the publicly known information storage unit 3 is composed of a publicly known information table that stores a plurality of sets of attribute values that lead to identification of a specific individual. Specifically, it is composed of the article table T5 illustrated in FIG. The article table T5 shown in the figure shows two attributes, that is, an article ID and an article original text, and other attributes including attributes A1 to A16 and A21 to A22 (hereinafter, collectively referred to as "attribute A"). Store the attribute value for each. Each record constituting this article table T5 is input by the operator by collecting, analyzing, and inputting publicly known information such as academic papers, academic journals, news articles, and information that is merely published about medical accidents. As the publicly known information, it is preferable that the information is easily available and the information can be easily matched.

Next, the search unit 4 searches the provided data DB 21 for each of the articles stored in the article table T5 using the attribute value of the attribute A of the article as a search condition, and the patient associated with the attribute value. The ID is searched as information indicating a candidate for anonymous processing. For example, the record of the article to be processed stores the attribute A4 "male", the attribute A8 "cerebral infarction", the attribute A11 "hospitalization", the attribute A13 "drug B200mg" and the attribute A21 "November 22, 2018". If so, the provided data DB 21 is searched using these attribute values as search conditions, and the patient ID associated with all of them is searched. In order to perform such a search, the search unit 4 has a table identification unit 41 and an ID identification unit 42.

The table specifying unit 41 specifies the medical information table T including the attribute A of the attribute value in the providing data DB 21 for the attribute value of the article to be processed. For example, when the attribute value to be processed is the attribute A4 "male", the patient information table T1 including the attribute A4 of the attribute value is specified in the provided data DB 21. When the number of attribute values of the article to be processed is n (integer of 2 or more), the table specifying unit 41 sequentially specifies the medical information table T for each of the n attribute values.

When the medical information table T is specified by the table specifying unit 41 for the attribute value of the article to be processed, the ID specifying unit 42 searches the specified medical information table T using the attribute value as a search condition. The patient ID associated with the attribute value is specified. For example, when the patient information table T1 is specified by the table specifying unit 41 for the attribute A4 "male", the specified patient information table T1 is searched using the attribute A4 "male" as a search condition, and the attribute A4 is searched. Identify the patient ID associated with the "male". When the number of attribute values of the article to be processed is n (integer of 2 or more), the ID specifying unit 42 specifies the patient ID in order for each of the n attribute values. At that time, in the second and subsequent specific processes, by setting the patient ID specified in the previous specific process as an additional condition, it corresponds to the attribute value of the processing target in the patient ID specified in the previous specific process. Identify the attached patient ID. Then, in the nth identification process, the personal ID is specified as information indicating a candidate for anonymous processing.
The above is the description of the search unit 4.

Next, when the patient ID is searched by the search unit 4 for the article to be processed, the determination unit 5 compares the number of the searched patient IDs with the threshold value. Here, the threshold value to be compared with the patient ID is "1". Then, as a result of the comparison, when the former is less than or equal to the latter (that is, when the number of searched patient IDs is "1"), the patient ID is associated with the provided data DB 21. The set of attribute values is determined to be an anonymous processing target. This is because the existence of only one patient ID may mean that the patient identified by the patient ID may be identified based on the set of attribute values associated with the patient ID.

The anonymous processing unit 6 performs anonymous processing on a set of attribute values determined to be an anonymous processing target by the determination unit 5. Specifically, the set of attribute values determined to be anonymously processed is deleted from the provided data DB 21 (record deletion).
The above is the description of the configuration of the anonymous processing system 1.

1-2. Operation Next, the anonymous processing processed by the anonymous processing system 1 described above will be described with reference to the flow chart illustrated in FIG. 7. The anonymous processing process shown in the figure is executed for each article stored in the publicly known information DB 31.

The search unit 4 of the anonymous processing system 1 decomposes the set of attribute values of the article to be processed (step S1), and executes the patient ID search loop L for each of the decomposed attribute values. In this patient ID search loop L, the search unit 4 searches the provided data DB 21 for the attribute value of the processing target using the attribute value of the attribute A of the article as a search condition, and the patient ID associated with the attribute value. Is searched (step S2). Specifically, the table specifying unit 41 specifies the medical information table T including the attribute A of the attribute value to be processed in the providing data DB 21, and the ID specifying unit 42 processes the specified medical information table T. The target attribute value is searched as a search condition, and the patient ID associated with the attribute value is specified. As a result of this search, if the number of searched patient IDs is "0" (YES in step S3), the patient ID search loop L is exited, and the anonymous processing process ends. On the other hand, if the number of searched patient IDs is other than "0" as a result of the above search (NO in step S3), the search unit 4 adds the searched patient IDs in the next search. It is set as a condition (step S4). Then, when the search unit 4 searches for the patient ID for all the attribute values of the article to be processed, the search unit 4 ends the patient ID search loop L. On the other hand, if the patient ID search has not been executed for all the attribute values, the process returns to step S2, and the patient ID is searched for the next attribute value. At that time, the ID specifying unit 42 searches the medical information table T specified by the table specifying unit 41 for the patient ID specified in the previous search process as a search condition in addition to the attribute value of the processing target. Identify the patient ID associated with the attribute value.

As a result of the patient ID search loop L, when the patient ID is searched by the search unit 4, the determination unit 5 compares the number of the searched patient IDs with the threshold value (step S5). As a result of this comparison, when the former is less than or equal to the latter (that is, when the number of searched patient IDs is "1") (YES in step S5), the patient ID and the provided data DB 21 correspond. The attached set of attribute values is determined to be an anonymous processing target, and the anonymous processing unit 6 performs anonymous processing processing on the set of attribute values (step S6). Specifically, the anonymous processing unit 6 deletes the set of the attribute values from the provided data DB 21. On the other hand, as a result of the above comparison, when the former is larger than the latter (that is, when the number of searched patient IDs is not "1") (NO in step S5), the anonymous processing process ends.
The above is the description of the anonymous processing process.

Next, a specific operation example of the anonymous processing process described above will be described with reference to the explanatory diagrams illustrated in FIGS. 8 to 10. In the operation example described below, the articles to be processed include attribute A4 "male", attribute A8 "cerebral infarction", attribute A11 "hospitalization", attribute A13 "drug B200mg" and attribute A21 "November 22, 2018". Suppose an article that stores a record.

The search unit 4 of the anonymous processing system 1 decomposes the above-mentioned set of attribute values of the article to be processed (step S1), and executes the patient ID search loop L for each of the decomposed attribute values. The search unit 4 first searches for the patient ID for the attribute A4 "male" among these decomposed attribute values (step S2). At that time, the table specifying unit 41 specifies the patient information table T1 including the attribute A4 of the attribute A4 “male”. Then, the ID specifying unit 42 searches the specified patient information table T1 using the attribute A4 "male" as a search condition, and identifies the attributes A1 "1" and "3" associated with the attribute value. To do. As a result of this search, two patient IDs have been searched (NO in step S3), so the search unit 4 sets the searched attributes A1 "1" and "3" as additional conditions for the next search. (Step S4).

Next, the search unit 4 searches for the patient ID for the attribute A8 “cerebral infarction” (step S2). At that time, the table specifying unit 41 identifies the disease information table T2 including the attribute A8 of the attribute A8 “cerebral infarction”. Then, the ID specifying unit 42 searches the specified disease information table T2 for the attributes A1 "1" and "3" specified in the previous search process in addition to the attribute A8 "cerebral infarction" (A8 "". Search as "cerebral infarction" AND (attribute A1 "1" OR attribute A1 "3")) and specify attributes A1 "1" and "3" associated with the attribute value. As a result of this search, two patient IDs have been searched (NO in step S3), so the search unit 4 sets the searched attributes A1 "1" and "3" as additional conditions for the next search. (Step S4).

Next, the search unit 4 searches for the patient ID for the attribute A11 “hospitalization” (step S2). At that time, the table specifying unit 41 specifies the prescription information table T3 including the attribute A11 of the attribute A11 “hospitalization”. Then, the ID specifying unit 42 searches the specified prescription information table T3 for the attributes A1 "1" and "3" specified in the previous search process in addition to the attribute A11 "hospitalization" (A11 "hospitalization"). "AND (attribute A1" 1 "OR attribute A1" 3 "), and the attributes A1" 1 "and" 3 "corresponding to the attribute value are specified. As a result of this search, two patient IDs have been searched (NO in step S3), so the search unit 4 sets the searched attributes A1 "1" and "3" as additional conditions for the next search. (Step S4).

Next, the search unit 4 searches for the patient ID for the attribute A13 “drug B 200 mg” (step S2). At that time, the table specifying unit 41 specifies the prescription information table T3 including the attribute A13 of the attribute A13 “drug B 200 mg”. Then, the ID specifying unit 42 adds the attribute A13 “drug B 200 mg” and the attributes A1 “1” and “3” specified in the previous search process in the specified prescription information table T3 as search conditions (A13 “A13”. Search as drug B 200 mg "AND (attribute A1" 1 "OR attribute A1" 3 ") and specify the attribute A1" 1 "corresponding to the attribute value. As a result of this search, one patient ID was searched (NO in step S3), so the search unit 4 sets the searched attribute A1 "1" as an additional condition for the next search (step S4). ..

Next, the search unit 4 searches for the patient ID for the final attribute A21 “November 22, 2018” (step S2). At that time, the table specifying unit 41 specifies the hospitalization / discharge history information table T4 including the attribute A21 of the attribute A21 “November 22, 2018”. Then, the ID specifying unit 42 searches the specified hospitalization / discharge history information table T4 for the attribute A1 "1" specified in the previous search process in addition to the attribute A21 "November 22, 2018" (A21). Search as "November 22, 2018" AND attribute A1 "1") and specify the attribute A1 "1" associated with that attribute value. As a result of this search, one patient ID was searched (NO in step S3), so the search unit 4 sets the searched attribute A1 "1" as an additional condition for the next search (step S4). ..
As a result of the patient ID search loop L described above, the attribute A1 "1" is searched.

Since only one patient ID is searched (YES in step S5), the anonymous processing unit 6 sets the searched attribute A1 "1" and the set of attribute values associated with the provided data DB 21. Anonymous processing is performed (step S6). Specifically, the set of attribute values is deleted from the provided data DB 21.
The above is the description of the operation example of the anonymous processing process.

In the above operation example, only one medical information table T is specified for one attribute value, but a plurality of medical information tables T may be specified depending on the attribute value. For example, since the attribute A5 is included in the three medical information tables T of the disease information table T2, the prescription information table T3, and the hospitalization / discharge history information table T4, when the patient ID is searched for the attribute value of the attribute A5, the patient ID is searched. The patient ID will be searched for in each of these three medical information tables T.

According to the anonymous processing system 1 described above, medical information provided to a data user is stored across a plurality of tables, and even if those tables cannot be simply combined, the plurality of such tables can be combined. Medical information that can identify a specific individual can be extracted from the table, and the extracted medical information can be processed anonymously.

2. 2. Modification Example The above embodiment may be modified as follows. The following modifications may be combined with each other.

2-1. Modification 1
The number and types of attributes A of the provided data DB 21 and the article table T5 are merely examples. The number and types of attributes A are not limited to the examples shown in FIGS. 2 to 6.

2-2. Modification 2
Each record in the article table T5 may be automatically generated based on publicly known information using named entity recognition.

2-3. Modification 3
The anonymous processing unit 6 may delete the cell instead of deleting the record described above. Specifically, among the set of attribute values determined to be anonymously processed by the determination unit 5, the attribute value having the same attribute A as any of the attribute values of the article to be processed is deleted from the provided data DB. It may be. At that time, among the attribute values of the articles to be processed, the attribute A having the highest frequency of appearance of the attribute value is specified in the article table T5, and the attribute value of the specified attribute A is deleted from the provided data DB. You may.

Further, as another anonymous processing process, generalization, top (bottom) coding, or item deletion may be performed. Specifically, in the provided data DB 21, all the attribute values of any of the attribute values of the articles to be processed are generalized, top (bottom) coded, or deleted. May be good. At that time as well, generalization or the like may be performed on all the attribute values of the attribute A having the highest frequency of appearance of the attribute values in the article table T5 among the attribute values of the articles to be processed.

2-4. Modification 4
When the table specifying unit 41 specifies the medical information table T for each of the attribute values of the articles to be processed, the table specifying unit 41 specifies the medical information table T in the order according to the priority set for the attributes of those attribute values. It may be. For example, the attribute values of the articles to be processed are attribute A4 "male", attribute A8 "cerebral infarction", attribute A11 "hospitalization", attribute A13 "drug B200mg" and attribute A21 "November 22, 2018". Assuming that these attribute values are arranged in descending order of priority of the attributes, the table specifying unit 41 specifies the medical information table T in order from the attribute A4 "male".

Here, the priority set for each attribute is set based on the appearance frequency of the attribute value in the article table T5. Specifically, the priority is set so that the higher the frequency of appearance of the attribute value in the article table T5, the higher the priority. As another example, the priority may be predetermined for each attribute.

2-5. Modification 5
The threshold value referred to by the determination unit 5 does not necessarily have to be “1”. For example, it may be "2" or "3".
Further, the threshold value referred to by the determination unit 5 may be set based on the number or type of attribute values of the article to be processed. Specifically, the threshold value may be increased in proportion to the number of attribute values. Alternatively, the threshold value may be increased in proportion to the frequency of appearance in the article table T5 of the attribute value having the same attribute value and the attribute A. At that time, when a plurality of attribute values exist, the threshold value may be increased in proportion to the highest frequency of appearance among them.

2-6. Modification 6
The anonymous processing by the anonymous processing unit 6 may be omitted, and the operator may be notified of the set of attribute values determined to be the anonymous processing target by the determination unit 5 as the anonymous processing target. Specifically, a set of attribute values to be anonymously processed may be displayed on the display. The operator who receives the notification of the anonymous processing target performs the anonymous processing by himself / herself.

Alternatively, the determination process by the determination unit 5 may be omitted, and the patient ID searched by the search unit 4 may be notified to the operator as information indicating a candidate for anonymous processing. Specifically, the searched patient ID may be displayed on the display as a candidate for anonymous processing. Upon receiving the notification of the anonymous processing target, the operator himself / herself determines the necessity of the anonymous processing, and if necessary, performs the anonymous processing by himself / herself.

2-7. Modification 7
Some of the attributes A of the publicly known information DB 31 may have no attribute values at all. When such an attribute A exists, in order to reduce the processing cost, an intermediate database in which the attribute A is deleted is created in the provided data DB 21, and the created intermediate database is matched with the publicly known information DB 31 to be anonymous. The processing may be performed.

2-8. Modification 8
The anonymous processing system 1 targets medical information for anonymous processing, but the personal information subject to the processing is not limited to this. For example, personal information such as data related to household power consumption, purchase data accumulated with the use of a credit card, and railway boarding / alighting data may be subject to anonymous processing.

2-9. Modification 9
The anonymous processing system 1 stores a plurality of article tables created based on publicly known information in different fields in order to enable anonymous processing for various personal information as illustrated in the modification 8. Or, the article table to be matched may be selected according to the personal information table to be processed. When selecting the article table to be matched, the attributes of the personal information table to be processed may be referred to. For example, the article table to be matched may be selected by referring to the conversion table that associates the attribute name with the article table ID.

2-10. Modification 10
In step S1 of the anonymous processing process described above, the search unit 4 may exclude the attribute value of the dynamic attribute from the attribute values of the article to be processed from the processing target. Here, the dynamic attribute is an attribute that constantly changes, such as a test value and information on a meal.

1 ... Anonymous processing processing system, 2 ... Provided data storage unit, 3 ... Public information storage unit, 4 ... Search unit, 5 ... Judgment unit, 6 ... Anonymous processing processing unit, 21 ... Provided data DB, 31 ... Public information DB, 41 ... Table specific part, 42 ... ID specific part, T1 ... Patient information table, T2 ... Disease information table, T3 ... Prescription information table, T4 ... Hospitalization / discharge history information table, T5 ... Article table

Claims (7)

A personal information storage unit that stores a plurality of personal information tables that store a plurality of sets of attribute values including a personal ID.
An anonymous processing target identification method executed in a system including a publicly known information storage unit that stores a publicly known information table that stores a plurality of sets of attribute values that are extracted from publicly known information and lead to identification of a specific individual.
For each attribute included in the publicly known information table, a priority setting step for setting a priority according to the number of attribute values stored in the publicly known information table, and
With reference to the plurality of personal information tables, for each of the attribute value sets stored in the publicly known information table, the personal ID associated with the attribute value set is information indicating candidates for anonymous processing. and a search step of searching a,
The search step
When the set of n attribute values stored in the publicly known information table is to be processed, the attribute of one attribute value constituting the set of n attribute values from the plurality of personal information tables. Table identification steps to identify personal information tables, including
In the personal information table specified by the table specifying step, the personal information table has a personal ID specifying step for specifying the personal ID associated with the one attribute value.
In the table specifying step, in the order according to the priority set by the priority setting step , for each of the attribute values constituting the n set of attribute values, the table containing the attribute of the attribute value is sequentially arranged. It ’s a step to identify
In the personal ID identification step, when the individual IDs are sequentially specified for each of the attribute values constituting the set of n attribute values, in the second and subsequent identification processes, the individual IDs specified in the previous identification process are used. The feature is that the personal ID associated with the attribute value of the processing target is specified, and the nth specific processing is a step of specifying the personal ID as information indicating a candidate for anonymous processing. Anonymous processing target identification method. The number of personal IDs searched by the search step is compared with the threshold value for one set of attribute values stored in the publicly known information table, and when the number of personal IDs is equal to or less than the threshold value, the plurality of personal IDs are compared. A determination step for determining a set of attribute values including the personal ID in the personal information table as an anonymous processing target, and
The method for identifying an anonymous processing target according to claim 1, further comprising an anonymous processing processing step of performing anonymous processing processing on a set of attribute values determined to be an anonymous processing target by the determination step. The number of personal IDs searched by the search step is compared with the threshold value for one set of attribute values stored in the publicly known information table, and when the number of personal IDs is equal to or less than the threshold value, the plurality of personal IDs are compared. A determination step for determining a set of attribute values including the personal ID in the personal information table as an anonymous processing target, and
The method for identifying an anonymous processing target according to claim 1, further comprising a notification step of notifying the user of a set of attribute values determined to be an anonymous processing target by the determination step as an anonymous processing target. Further comprising a threshold setting step of setting the threshold based on the number or type of attribute values constituting the one set of attribute values.
The anonymous processing target identification method according to claim 2 or 3, wherein the determination step is a step of comparing the number of the individual IDs with the threshold value set by the threshold value setting step. The publicly known information storage unit stores a plurality of publicly known information tables and stores them.
Further having a table selection step of selecting a publicly known information table from the plurality of publicly known information tables based on the attributes included in the plurality of personal information tables.
The search step refers to the plurality of personal information tables, and each of the set of attribute values stored in the publicly known information table selected by the table selection step is associated with the set of attribute values. The method for identifying an anonymous processing target according to any one of claims 1 to 4 , wherein the step is to search for an individual ID as information indicating an anonymous processing target. A personal information storage unit that stores a plurality of personal information tables that store a plurality of sets of attribute values including a personal ID.
A public information storage unit that stores a public information table that stores a plurality of sets of attribute values that are extracted from public information and that lead to identification of a specific individual.
A priority setting unit that sets a priority according to the number of attribute values stored in the public information table for each attribute included in the public information table.
With reference to a plurality of personal information tables, for each of the set of attribute values stored in the publicly known information table, the personal ID associated with the set of attribute values is searched for as information indicating an anonymous processing target. Equipped with a search unit
The search unit
When the set of n attribute values stored in the publicly known information table is to be processed, the attribute of one attribute value constituting the set of n attribute values from the plurality of personal information tables. Table identification part that identifies the personal information table including
In the personal information table specified by the table specifying unit, the personal ID specifying unit that specifies the personal ID associated with the one attribute value is provided.
The table specifying unit sequentially arranges a table containing the attributes of the attribute values for each of the attribute values constituting the n set of attribute values in the order according to the priority set by the priority setting unit. Identify and
When the personal ID specifying unit sequentially specifies the personal ID for each of the attribute values constituting the n set of attribute values, in the second and subsequent specific processes, the personal ID specified in the previous specific process is used. Anonymous, which is characterized in that the personal ID associated with the attribute value of the processing target is specified, and in the nth identification processing, the personal ID is specified as information indicating a candidate for anonymous processing target. Processing target identification system. A personal information storage unit that stores a plurality of personal information tables that store a plurality of sets of attribute values including a personal ID.
A computer provided with a publicly known information storage unit that stores a publicly known information table that stores a plurality of sets of attribute values that are extracted from publicly known information and that lead to identification of a specific individual.
For each attribute included in the publicly known information table, a priority setting step for setting a priority according to the number of attribute values stored in the publicly known information table, and
With reference to a plurality of personal information tables, for each of the set of attribute values stored in the publicly known information table, the personal ID associated with the set of attribute values is searched for as information indicating an anonymous processing target. A program for performing search steps and
The search step
When the set of n attribute values stored in the publicly known information table is to be processed, the attribute of one attribute value constituting the set of n attribute values from the plurality of personal information tables. Table identification steps to identify personal information tables, including
In the personal information table specified by the table specifying step, the personal information table has a personal ID specifying step for specifying the personal ID associated with the one attribute value.
In the table specifying step, in the order according to the priority set by the priority setting step , for each of the attribute values constituting the n set of attribute values, the table containing the attribute of the attribute value is sequentially arranged. It ’s a step to identify
In the personal ID identification step, when the individual IDs are sequentially specified for each of the attribute values constituting the set of n attribute values, in the second and subsequent identification processes, the individual IDs specified in the previous identification process are used. The feature is that the personal ID associated with the attribute value of the processing target is specified, and the nth specific processing is a step of specifying the personal ID as information indicating a candidate for anonymous processing. Program to be.