WO2002039341A1

WO2002039341A1 - Anonymizing method and system therefor, method for making personal information anonymous and transferring it, and system therefor

Info

Publication number: WO2002039341A1
Application number: PCT/JP2001/009073
Authority: WO
Inventors: Ken Aoshima; Yuji Miura; Tetsuya Takeda
Original assignee: Mitsui Knowledge Industry; Genox Research, Inc.
Priority date: 2000-11-07
Filing date: 2001-10-16
Publication date: 2002-05-16
Also published as: JPWO2002039341A1; AU2001295938A1

Abstract

The clinical information on a sample donor and a sampled specimen are made anonymous. A doctor in charge of a clinical examination section of a hospital side acquires patient information on a specimen donor (patient), examines the patient information, and stores the patient information and the examination information in a patient information managing system of a personal identification management room. A researcher of the hospital side acquires a consent of the sample donor according to the instruction of the chief researcher of the research section. The doctor in charge samples primary specimens (sample) such as of blood or serum, and a personal identification information manager anonymize the specimen number (specimen number before anonymization) and attaches a bar code corresponding to the anonymized specimen number (anonymous specimen number) to a container containing the specimen. A combinable anonymization correspondence table for combining the unanonymized specimen number and the anonymized specimen number is stored in an anonymizing system. The anonymous patient information, the clinical anonymous information and the anonymous specimen are supplied to the research section.

Description

Description ^j Anonymization method and system, and information related to individuals

Method and system for anonymous transport

The present invention relates to an anonymization method and a system thereof, and a method and system for anonymously transferring information relating to personal information, and more particularly to personal information of a sample provider who provides a sample used for gene analysis research. An anonymization method for anonymizing and transporting anonymous data and its system. Background art

At present, genome sequencing is progressing rapidly, and the whole genome sequence of multicellular organisms, nematodes, and even Drosophila has been determined, following microorganisms such as Bacillus subtilis, Escherichia coli, cyanobacteria, and yeast. A draft sequence has been published for the human genome sequence. Under these circumstances, the focus of genomics research is to focus on genome function analysis, including expression of genomic genes, and analysis of polymorphisms among individuals, from sequencing to a large number of genes or the entire genome. We are moving to post-genome research.

In particular, in recent years, the single-nucleotide polymorphism SNP (Single Nucleotide SNP) has received the most attention in the medical field, such as elucidation of the causes of human diseases, diagnosis, treatment and prevention. SNP literally means a difference due to substitution, insertion or deletion of one base on a DNA sequence. It has been estimated that 99.9 percent (%) of the human nucleotide sequences are identical and differ by 0.1 percent. Thus, approximately one to three million SNP sites, equivalent to 0.1% of a 3 billion base pair human genome, are expected. I have.

Since the number of SNPs is extremely large, they are considered to be optimal for individualizing the genetic background of each individual. (Differences in ease and drug responsiveness) are expected to be identified, making it possible to receive tailor-made treatment. Therefore, providing the medical information accumulated (or to be collected) at medical institutions to genomics research will be indispensable for future gene analysis. Disclosure of the invention

Technical problems to be solved by the invention

However, if the specimen, patient information, and medical information were directly provided to the research institution, there was a problem that the privacy and human rights of individuals could be violated. That is, the information of the individual who provided the sample is linked to the genetic information analyzed from the sample, resulting in social discrimination such as employment, marriage, health insurance, life insurance, etc. Various social issues may arise.

The present invention has been made in view of such circumstances, and it is necessary that hospitals anonymize specimens and patient information and medical treatment information, and that genetic information obtained from specimens is linked to a specific individual at a research institution. And protect human rights and privacy of individuals.

More specifically, there is a risk of leakage of personal information when transferring information about specimens and patients, so at least anonymization processing is performed on identification symbol strings for information on specimens and patients. It is inevitable to apply However, simply (for example, random) anonymization processing results in a meaningless symbol string, which makes it difficult for the operator to distinguish individual specimens or information, and also becomes aware of operation errors. There is a problem that can not be done.

A further problem is that once anonymized, it becomes impossible to know the interrelationship of samples or information at all. This condition is fatal for genetic analysis studies. In other words, in gene analysis research, it is not realistic to specify the sequence of a sample in a dark cloud, so it is necessary to narrow down in advance the sites to be subjected to gene analysis based on the medical information of the corresponding patient as a clue. Because there is.

Solution

The problem to be solved in the present case can be solved by the following first invention to fifth invention and the invention in which aspects thereof are further limited. First, the first invention is a method and system for anonymizing personal information.

Generating or inputting first identification information capable of identifying an individual; storing first information relating to a predetermined individual in association with the first identification information;

At least the second identification information configured to include a symbol string that shares a part of the first identification information and has a necessary number of digits so that the second information related to the individual can be identified. Generating individual second information to be identifiable;

Issuing instructions for associating the generated second identification information with each second information;

Generating third identification information that corresponds to the second identification information on a one-to-one basis and that cannot infer the first identification information; A step of storing correspondence information between the second identification information and the third identification information;

Canceling the association of the second information with the second identification information, and simultaneously issuing an instruction for associating the third identification information with the second information. The method and the system.

In addition, the present invention relates to the first invention,

The association is limited to issuing a percode label corresponding to the second to third identification information to the medium on which the second information is recorded and physically attaching the label,

Dissolving the association is limited to physically peeling the label,

Issuing the instruction is limited to displaying the instruction for the series of operations in a recognizable format.

Alternatively, in the present invention, the association in the first invention is limited to storing the second information in a searchable manner using the second to third identification information as a search element,

Dissolving the association with the second identification information and simultaneously instructing the association with the third identification information means changing the search element of the second information from the second identification information to the third identification information And remember it again,

Issuance of the above instruction is limited to execution of the series of processes.

The second invention is a method for anonymizing personal information, that is, a system thereof,

Generating or inputting first identification information capable of identifying an individual; writing first information relating to a predetermined individual in association with the first identification information; Steps to remember,

At least, the second identification information that shares a part of the first identification information and has a symbol string having a necessary number of digits so that the second information relating to the individual can be identified is identified. Generating individual second information so that it is identifiable;

At least, the third identification information, which shares a part of the first identification information and is composed of a symbol string having a necessary number of digits so that the third information relating to the individual can be identified, Generating the third information of the information to be identifiable;

Issuing an instruction for associating the generated third identification information with each third information;

Next, the second identification information and the third identification information correspond to the one-to-one correspondence with the first identification information, and the first identification information is a symbol string that cannot be analogized, and

The fourth identification information and the fifth identification in which a symbol string corresponding to the symbol string corresponding to the first identification information shared by both the second identification information and the third identification information are commonly included in a part thereof. Generating information,

Storing first correspondence information between the second identification information and the fourth identification information;

Storing second correspondence information between the third identification information and the fifth identification information; and

Canceling the second and third identification information for the second and third information, and simultaneously issuing an instruction for associating the fourth and fifth identification information with each other;

Method for anonymizing information relating to an individual, comprising: System.

Further, in the present invention, in the second invention,

The second information is diagnostic finding information on the corresponding individual, the third information is a specimen identification symbol on the corresponding individual, and the associating makes the corresponding identification information searchable as a search element. To remember,

Resolving the second and third identification information with respect to the second and third information, and simultaneously associating the fourth and fifth identification information, means that the search element of the second and third information is Changing from the second and third identification information to the fourth identification information and the fifth identification information, and re-storing them.

The issuance of the instruction includes an instruction limited to executing the series of processes.

Further, the third invention is a method and system for anonymizing information relating to an individual,

At least, the second identification information, which shares a part of the first identification information and has a symbol string having the required number of digits so that the diagnostic finding information on the individual can be identified, Generating such that the second information of the information is identifiable;

Storing each of the diagnostic finding information as a search element using the generated second identification information;

At least the third identification information, which shares a part of the first identification information and is composed of a symbol string having a required number of digits so that the sample relating to the individual can be identified, Generating to be identifiable; Issuing an instruction for associating each sample with the generated third identification information;

Issuing an instruction to change the search element relating to the diagnostic finding information from the second identification information to the fourth identification information and to store it again;

Canceling the association of the sample with the third identification information, and simultaneously issuing an instruction of association with the fifth identification information;

And a system for anonymizing information relating to an individual.

Further, in the present invention, in the first to third invention,

Also included is one that further includes a step of issuing an instruction to disable connection, which deletes part or all of the storage of the correspondence information.

On the other hand, the fourth invention is a method of anonymously transferring information relating to an individual or a system thereof,

At least, the second identification information, which shares a part of the first identification information and includes a symbol string having the necessary number of digits so that the second information relating to the individual can be identified, Generating such that the second information of the information is identifiable;

The fourth identification information and the fifth slime which include a symbol string corresponding to the symbol string relating to the first identification information shared by both the second identification information and the third identification information in a part thereof. Generating another information;

Canceling the second and third identification information for the second and third information, and simultaneously issuing an instruction for associating the fourth and fifth identification information;

The second and third information associated with the fourth and fifth identification information Instructing the destination of the transfer to be transferred, and separately storing the transferred second and third information in association with the fourth and fifth identification information.

This is a method for anonymously transferring information related to individuals, which is characterized by the following:

Further, the present invention provides the above-mentioned fourth invention,

The second information is diagnostic finding information on the corresponding individual, the third information is a specimen identification symbol on the corresponding individual, and the associating means that the corresponding identification information can be searched as a search element. , And,

Resolving the second and third identification information with respect to the second and third information, and simultaneously associating the fourth and fifth identification information, means that the search element of the second and third information is Changing from the second and third identification information to the fourth and fifth identification information and re-storing them,

The term “transporting” refers to transmitting and receiving by communication means,

Further, a fifth invention is a method and system for anonymously transferring information relating to an individual,

At least the second identification information, which shares a part of the first identification information and is composed of a symbol string having the necessary number of digits so that the diagnostic finding information on the individual can be identified, Generating the two pieces of information so that they can be identified; Storing each of the diagnostic finding information as a search element using the generated second identification information;

At least the third identification information, which shares a part of the first identification information and is composed of a symbol string having a required number of digits so that the sample relating to the individual can be identified, is identified by each individual sample. Generating the sample so that the sample can be generated; and issuing an instruction for associating each sample with the generated third identification information;

Next, each of the second identification information and the third identification information has a one-to-one correspondence, and the first identification information is a symbol string that cannot be inferred, and the second identification information and A step of generating fourth identification information and fifth identification information in which a symbol string corresponding to the symbol string relating to the first identification information shared by the third identification information is included in a part thereof; ,

Storing first correspondence information between the second identification information and the fourth identification information; and

Instructing transfer of diagnostic information that can be searched using the fourth identification information as a search element and a sample associated with the fifth identification information to a common transfer destination, respectively;

The transferred diagnostic information is stored separately as the fourth identification information as a search element. And steps

The fifth identification information associated with the transferred sample is detected, and a symbol string corresponding to the symbol string related to the first identification information, which is included in common with the fourth identification information, is used for the sample. Issuing an instruction to read the corresponding diagnostic information;

In addition, the present invention includes those in the fifth invention in which the step of erasing a part or all of the storage of the correspondence information is further limited. Beneficial effect

As described above, according to the anonymization system and the anonymization method according to the present invention, and the method for anonymously transferring information relating to an individual and the system thereof, the first information relating to a predetermined individual Storing the second information relating to the individual in association with the second identification information capable of identifying the second information; Storing correspondence information that associates the first identification information with the second identification information, and, if necessary, deleting the correspondence information and anonymizing the individual corresponding to the second information so that the individual cannot be identified. Therefore, by deleting the corresponding information as necessary, it is possible to prevent the second information from being linked to a specific individual and the first information, and to protect the human rights and privacy of the individual. The ability.

Therefore, it is possible to exchange specimens and various information between the two systems such as the hospital and the laboratory while securing anonymity.

As described above, the present invention can be applied to individual Improve the operability and discrimination of samples and information, prevent operational errors, etc., and at the same time, grasp the mutual relationship between samples and information, that is, make it possible to distinguish samples and information related to the same patient Is what you do. BRIEF DESCRIPTION OF THE FIGURES

FIG. 1 is a diagram showing a procedure of a genetic analysis study using the anonymization system of the present invention.

FIG. 2 is a block diagram showing a network configuration example and a device configuration example of the anonymization system of the present invention.

FIG. 3 is a diagram showing a series of flows from sample collection to anonymization and delivery of medical treatment data.

FIG. 4 is a diagram showing an example of a collection information registration screen of the anonymization system.

FIG. 5 is a diagram showing an example of a connectable anonymization correspondence table.

6, FIG at Oh O ₀ showing an example of a Fomatsu bets anonymous pre specimen number and anonymous specimen number

FIG. 7 is a diagram showing the meaning of each code.

FIG. 8 is a diagram showing an example of a user authentication screen of the anonymization system.

FIG. 9 is a diagram showing an example of a contactable anonymization instruction screen of the anonymization system. FIG. 10 is a diagram illustrating a percode print execution screen.

FIG. 11 is a diagram showing an example of a medical information download instruction screen.

FIG. 12 is a diagram showing an example of a connection impossible anonymization instruction screen. Explanation of reference numerals

1 Clinical laboratory

2 Personal Identification Information Management Office

3 Patient information management system 4 Anonymization system

5 Research Division

6 Lab

7 Genome analysis room

8 FW

9 P roy server

10 Internet

21, 61 W i n d o w s N T S e r v er

22, 62, 72 storage devices

23, 64 bar code printer

63 Controller

65 PLC

66,68 PC

67 AFFYMETRIX ARRAYER & GENEARRAY S

CANNER

69 Barcode Reader

71 UNIX Server BEST MODE FOR CARRYING OUT THE INVENTION

As shown in FIGS. 1 to 3 and 7, the present invention includes a hospital system including an anonymization system and a patient information management system, an experimental sample management system and a basic genome data management system. It consists of a laboratory system, both of which are linked organically by the distribution of specimens and the communication of patient information.

Specifically, the technical problem to be solved is first solved by adopting the symbol string for specimen identification shown in FIG. There o

In Fig. 6, information on the project category, specimen category, etc. is useful to the operator. Moreover, identification information such as date and serial number is simple and effective in operability. In some cases, it is preferable to adopt a sample identification symbol string as shown in FIG. That is, it is useful to include a symbol string related to a personal identifier such as a patient ID in the symbol string.

In the first place, the danger of information leakage is due to the fact that the process of anonymization processing can be traced back in order to grasp the mutual relevance of samples, etc. If the subsequent operations can be performed without accessing the host with the anonymization system again after the processing, the danger of identifying the individual concerned with the sample or information is substantially eliminated. In other words, as long as access to the host containing the anonymization system is permitted, the danger of reading out the anonymization correspondence table in the anonymization process cannot be completely eliminated. In particular, when samples and information are exchanged across multiple institutions such as hospitals and laboratories, it is dangerous because outsiders can access the host.

As a concrete method for this, complete anonymization can be realized by deleting the correspondence table itself for the anonymization process so that no one can access the correspondence table for anonymization. Depending on how the specimens are collected, this method is a reliable anonymization method. This is an anonymization method that cannot be linked.

However, with this method, it is not possible to refer to diagnostic findings, etc., and it is not possible to grasp the linkage between samples, such as when multiple samples of the same patient are collected with a time difference. It is often inconvenient in analytical research.

Therefore, as a technique for ensuring anonymity without causing such inconvenience, various additional information is added to the identification information of the specimen or information. It is effective to perform so-called data flow-type transmission control, in which the same information is sent and other information that is expected to be referenced is subjected to the same anonymization process and sent separately. This eliminates the need to access the required information to the host, and enables the local information to be obtained on information on the required mutual relevance and processing procedures.

Further, a specific system of the present invention will be described in detail.

FIG. 1 shows the procedure of a genetic analysis study including the anonymization system of the present invention.

As shown in the figure, there is a clinical laboratory 1 on the hospital side, in which the doctor in charge obtains patient information of the sample provider (patient), performs medical treatment, and manages patient information and medical information with personal identification information. It is supplied to the patient information management system 3 in room 2 and stored. In addition, the hospital researcher obtains the consent of the sample provider under the direction of the researcher, who will be described later, and gives the sample doctor blood, serum, buffy coat, etc. to the attending physician. Instruct to collect primary specimens (samples) such as tissues and cells. The attending physician who receives this instruction collects primary samples (samples) such as blood, serum, buffycoat, tissues, and cells from the sample donors. Next, anonymization processing is performed on the sample numbers assigned to these samples (samples). Then, a label printed with a percode corresponding to the anonymized sample number (anonymous sample number) is attached to the container containing the sample.

The linkable anonymization correspondence table (code table) that links the anonymized sample number (anonymous sample number) attached to the sample to the sample number before anonymization (anonymous sample number) is an anonymization system. 4 and the patient information corresponding to the sample can be obtained as needed. Deleting the record corresponding to a predetermined sample from this anonymized correspondence table prevents the sample from identifying the provider from the sample. Anonymization can be performed.

The anonymized patient information and medical treatment information and the anonymized specimen (sample) are provided to the research department 5 on the research side. At this time, the patient information and the medical treatment information can be provided by recording on a recording medium such as a floppy disk, or can be provided via a network by encrypting using an anore algorithm such as DES (data encryption standar d). . Of course, the encryption method is not limited to DES, but can be encrypted by various other methods.

The head of the research institution that gives instructions to the researcher at the hospital mentioned above is the head of the research institution, and the head of research submits a research instrument draft to the head of the research institution. I do. The head of the research institution will delegate the decision on this research proposal to the Ethics Committee. Once approved by the Ethics Committee, the Principal Investigator will give prescribed instructions to the hospital researcher to conduct research in accordance with the research protocol.

Figure 2 shows the specific equipment configuration and network of the personal identification information management room 2 on the hospital side and the research department 5 (consisting of the laboratory 6 and the genome analysis room 7) on the research side shown in Figure 1. It is a block diagram which shows the example of a lock structure. As shown in the figure, the patient information management system 3 and the anonymization system in the personal identification information management room use the Windows NT server 21 (executing programs for managing the patient information and performing the anonymization process). Windows stores the Microsoft Corporation's trademark or registered trademark in the United States of America and other countries), and a program that performs processing for managing patient information and anonymization processing, and stores patient information. Management TO A storage device 22 such as a hard disk on which a RDBMS (relationaldatabase management system) is built, and a percode printer (BP) or label that prints the parcode on the label. Printer) 23 etc. These devices are connected by LAN (1 oc 1 area network). On the other hand, the research division 5 is composed of a laboratory 6 and a genome analysis room 7, and the laboratory 6 has a Windows NT server 61 and a storage device 62 on which a database in which data of experimental samples is registered is constructed. 3 controller 63 for controlling experimental equipment (not shown), per code printer (BP) 64 for printing per code, sequencer 65, personal computer (PC) 66 for controlling sequencer 65, and AFFYMETR IX ARRAYER & GENEARRAY S CANNER (AFF YME TRIX and GENE ARRAY are registered trademarks of AF F YMETR IX, Inc.) 67, AF FYMETR IX ARRAYER & PC 68 that controls GENEARRAY S CANNER 67, and read the corresponding data and read the corresponding data. And a bar code reader 69 for outputting. The genome analysis room 7 includes a UNIX server 71 for executing a program for performing a genome analysis, and a storage device 721 for storing basic genome data. These devices are connected via a LAN in the research institution, and are connected to the Internet 10 via a firewall (FireWall (FW)) 8. A proxy server 9 is connected to the LAN within the research institution.

Next, with reference to FIG. 3, a flow of a series of processes from sample collection to delivery of patient-related information such as anonymized medical information and patient information will be described. First, the doctor in charge on the clinical side (hospital side) provides medical treatment to the sample provider (patient) and obtains medical information. The obtained medical information (such as medical records), personal identification information for identifying each patient, such as the patient's name, date of birth, gender, address, telephone number, fingerprint, medical record number, etc., and disease history, etc. Is registered in the patient information management system 3. Next, the clinical researcher (hospital researcher) receives informed consent (IC) from the sample provider (with consent based on a sufficient explanation of the research content).

Next, based on the instructions of the clinical researcher, the attending physician collects primary samples (primary samples) such as blood, serum, buffycoat, tissues, and cells from the sample donors. Next, according to the collection information registration screen shown in Fig. 4, the collection information on the collected primary sample is registered. For example, input the project name, team name, patient number, doctor in charge, sample number, date and time of provision, sample type, sample amount, special notes, etc., and manage the project name, team name, patient number and patient information. Register for system 3. Then, the collection information such as the doctor in charge, the sample number, the provision date and time, the sample classification, the collection amount, and special instructions are registered in the anonymization system 4.

Next, the anonymization system 4 performs linkable anonymization on the sample number of the collected sample, and creates and stores a linkable anonymization correspondence table (code table) as shown in FIG. The linkable anonymization correspondence table shows the date of anonymization, the sample number (sample number before anonymization before anonymization), and the linkable anonymized sample that is the linkable anonymized sample number. Numbers are associated with each other. In the case of this example, the connectable anonymized sample number corresponding to the sample number “0 C 00 9 1 4 1 0 1” is “A 3 7 3 0 C 0 1”. In addition, the connectable anonymized sample number corresponding to the sample number “0S00914001” is “A57330S01”. The linkable anonymization correspondence table can be encrypted if necessary.

In a hospital, various information such as patient information and a linkable anonymization correspondence table is exchanged via a LAN (local area network), so that information such as patient information and a linkable anonymization correspondence table is encrypted by a predetermined method. It is possible to prevent information from leaking to persons other than those concerned. here, The method of encryption is not particularly limited.

Figure 6 shows an example of the format of the anonymous sample number (sample number before anonymization) and the anonymous sample number (linkable anonymized sample number). Anonymous Sample numbers consist of the project category (PJ category) (stomach cancer, lung cancer, etc.), sample category (blood, cells, etc.), date of collection, serial number, etc. Category (hospital identification number (for example, A: National Cancer Center, B: National Psychiatry & Neurology Center, C: National Cardiovascular Center, D: National International Medical Center, E: National Children's Hospital, F: National Pharmaceutical) Food Sanitation Research Institute)), sample number, sample classification, and serial number. The anonymized patient ID is composed of the upper 5 digits including the institution classification and the sample number. This secret

Named patient ID is common in each institution.

As shown in Fig. 7, sample category “0B” is blood (sample type is primary sample), “0S” is skin (sample type is primary sample), and “00” is organ (sample type is 1). “0C” is cells (sample type is secondary sample), “0U” is cultured cells (sample type is secondary sample), “0T” is stimulator cells (sample type is 2nd and 3rd sample) , “0R” is mRNA (messenger RNA) (sample type is 2nd and 3rd sample), “0D” is cDNA (complementary DNA) (sample type is 2nd and 3rd sample), “0G” "" Means gene DNA (specimen types are 2nd and 3rd samples), respectively.

In this case, the number 3 and the serial number will be associated with personal information such as name as the first identification information, and the symbol string related to the date and serial number will be the second identification information. Is shared by the symbol string for specimen identification before anonymization. Of course, in addition to the date and the serial number, it is needless to say that, for example, a personal ID such as a patient number can be used as the first identification information, and a symbol string relating to these can be shared with the second identification information. Absent.

The anonymous sample number is one-to-many with the hospital management ID (for example, a chart number). There is a relationship, and multiple samples of the same patient can be distinguished by the last two digits of the nine digits. In the anonymized sample number (anonymous sample number), the number corresponding to the patient (four digits (four digits excluding the first one of the top five digits)) is a random number (including the alphabet). Assigned. In the case of consolidation anonymization, the same patient is assigned the same number.

The anonymization system 4 converts the anonymous sample number into an anonymous sample number (linkable anonymized sample number) in accordance with the format shown in FIG. The conversion from the linkable anonymized sample number to the sample number can be performed based on the linkable anonymized correspondence table shown in FIG.

The linkable anonymization correspondence table shown in Fig. 5 is accessible only to the personal identification information manager in the personal identification information management room 2 on the hospital side, and logs a browsing history indicating that the linkable anonymization correspondence table was opened. In addition to suppressing the leakage of information to the outside, such as by leaving information as it is, in the event that information is leaked to the outside, it is possible to identify when and who took the information. Furthermore, the browsing of the linkable anonymization correspondence table is, for example, limited to 10 per day (or per time), so that a large number of discs cannot be viewed at one time. By doing so, the damage can be minimized. In addition, it is possible to leave a log indicating that an operation to instruct printing is performed to print the linkable anonymization correspondence table. FIG. 8 shows a user authentication screen in the anonymization system 4. When viewing the linkable anonymization correspondence table, etc., the personal identification information administrator enters the project ID, team ID, user ID, and password, and as a result of the user authentication, Once the personal identification information administrator is authenticated, the user can log in with the authority of the personal identification information administrator, and perform fingerprint verification using a fingerprint reader (not shown) to authenticate the user. It is also possible to perform not only fingerprints but also iris and other User authentication by Litas is also possible. Also, the linkable anonymization correspondence table can be encrypted and stored by a method known only to the personal identification information administrator. As a result, leakage of information to the outside can be further suppressed.

The anonymization system 4 generates a par code indicating the connectable anonymized sample number (anonymous sample number) obtained by performing the connectable anonymization of the sample number, and prints a relabel or the like by the par code printer ₂₃ . Can be printed on media.

FIG. 9 shows an example of a screen for instructing connection possible anonymization. As shown in the figure, the data on the collected samples is searched based on the date of providing the sample, patient number, and patient name (sample number, sample classification (kidney, heart, etc.), and the sample to be linked is anonymized. By clicking on the selected main function corresponding to, using a mouse, etc., the user can click on the “Execute linkable anonymization” button with a mouse, etc., to execute the linkable anonymization process. At this time, the printing of the par code indicating the anonymized sample number that can be connected is started at the same time, and the image of the par code is displayed on the screen as shown in FIG.

The label printed with the barcode is affixed to the corresponding sample container by the personal identification information manager. After that, the sample with the label printed with the percode indicating the linkable anonymized sample number is provided to the research department 5.

Next, the patient information (patient related information) registered in the patient information management system 3 is downloaded. In that case, as shown in Fig. 11, a list of connectable anonymized patients is displayed on the screen. In the list of connectable anonymized patients, a selection field, a provision date, and a connectable anonymized sample number are displayed for each record. Next, the desired linkable anonymized sample number is The selection field is selected by clicking with a mouse or the like. As a result, it is possible to download the medical information (patient information) of a sample that has been anonymized to be connectable or non-connectable.

Next, anonymize patient information. Anonymization of patient information can be performed by deleting or processing items that can identify individual patients in patient information. For example, if a patient's name and address are deleted from patient information, it will be difficult to identify the individual patient. In addition, if the date of birth is deleted, it becomes more difficult to identify individual patients. Alternatively, if all items such as name, address, telephone number, fingerprint, and chart number are completely deleted from the patient information, it becomes impossible to identify the individual patient. Alternatively, only the date of birth is deleted and the date of birth is deleted. Or, convert the date of birth to data indicating the actual age. In this way, the patient information is anonymized.

Thereafter, the patient information is encrypted as needed. The encrypted patient information is recorded on a recording medium such as a floppy disk and provided to the research side. Alternatively, it is provided to the research side via a predetermined network such as the Internet. The encrypted patient information provided to the research side is registered and stored in a predetermined storage device while being encrypted or after being decrypted.

Once the specimens passed to the research side are collectively anonymized to be unconnectable, first, as shown in Fig. 12, the specimens to be unoperable and anonymized are given to the hospital. Next, read the bar code printed on the label attached to the sample, enter the concatenated anonymized sample number (the upper five digits of the anonymous sample number, the anonymized patient ID), and enter the number of samples. As shown in FIG. 12, the corresponding linkable anonymized sample number is displayed on the screen.

Next, when you click the “Consolidation anonymization execution” button, a confirmation screen is displayed. Click the “Consolidation anonymization execution” button again to execute the consolidation anonymization processing. . Specifically, Fig. 5 The corresponding record in the linked consolidation anonymization correspondence table is deleted, the anonymous sample number is reassigned, and a percode indicating the newly reassigned anonymous sample number is printed on the label. The reassignment of the anonymous sample number is performed as follows. First, an anonymous sample number is generated by randomly generating the 4-digit sample number shown in Fig. 6 and adding the institution classification, sample classification, and serial number.The anonymous sample number overlaps with the existing anonymous sample number. Decide whether to do it. If they overlap, the above processing is repeated. If the generated anonymous sample number does not overlap with an existing anonymous sample number, the anonymous sample number is used as a new anonymous sample number. The personal identification information manager peels off the label with the connectable anonymized number from the container containing the sample, pastes the newly generated label with the anonymous sample number on the sample container, and sends it to the research side. provide.

If you specify that medical information should be downloaded before clicking the “Unable to anonymize” button, the patient information including the medical information stored in the patient information management system 3 is automatically set. Is downloaded. The patient information is anonymized in the same manner as described above, encrypted if necessary, recorded on a recording medium such as a floppy disk, and provided to the research side. Alternatively, it is provided to the research side via a network such as the Internet. · '

For the sample provided by the hospital to the research side, the barcode reader 69 reads the per-code information (anonymous sample number) printed on the label attached to the sample and associates it with patient information. . That is, the anonymized patient ID of the anonymous sample number of the sample read by the percode reader 69 (upper five digits of the anonymous sample number) and the anonymized patient ID included in each patient information are associated with each other. That is, the patient information is managed by the anonymized patient ID. Therefore, even if unlinkable anonymization is performed, The corresponding medical information can be obtained and used for subsequent research.

Also, in the case where a previously collected sample and the medical information of the provider who provided the sample already exist in a predetermined place, when the sample is made connectable and anonymous, in the same manner as described above, Generates an anonymous sample number corresponding to the sample number (pre-anonymous sample number) represented by the barcode printed on the label attached to the sample, creates a linkable anonymization correspondence table, and creates an anonymous sample. And store it in the chemical system 4 etc. The above-mentioned predetermined place is, for example, a cell bank that stores a set of specimens and medical information collected at a hospital and provides the stored specimens and medical information to a predetermined research institution as needed. Can be considered.

To anonymize the above anonymized sample that can be linked, first read the barcode printed on the label attached to the sample, as shown in Figure 12, and then connect the anonymized sample that can be linked. Enter the number (the upper 5 digits of the anonymous sample number of the anonymized patient ID) and enter the number of samples. The corresponding connectable anonymous sample number is displayed on the screen.

Next, if you click the “Consolidation impossible anonymization” button, a confirmation screen will be displayed. If you click the “Consolidation impossible anonymization” button again, the consolidation impossible anonymization process will be executed. Specifically, the corresponding record in the linkable anonymization correspondence table shown in Fig. 5 is deleted, the anonymous sample number is re-assigned, and the parser indicating the newly re-assigned anonymous sample number is deleted. The code is printed on the label. The reassignment of the anonymous sample number is performed as follows. First, a four-digit sample number shown in Fig. 6 is randomly generated, an anonymous sample number is generated by adding the institution category, sample category, and serial number. Determine if they overlap. If they overlap, the above processing is repeated. And generated If the anonymous sample number does not overlap with the existing anonymous sample number, the anonymous sample number is used as the new anonymous sample number. The personal identification information manager removes the label printed with the connectable anonymized number from the container containing the sample, affixes the newly generated label printed with the anonymous sample number to the sample container, and To provide.

Further, when a certain sample is discarded, the anonymous sample number of the discarded sample is input, and when the discard is notified, the Windows NT server 61 deletes the patient information from the experimental sample DB in the storage device 62. Also, when the hospital inputs the anonymous sample number of the discarded sample and notifies that the discard has been performed, the Windows NT server 22 stores the medical information corresponding to the discarded sample in the storage device 21. From patient information.

Next, the correspondence between each sample and each piece of information will be described. On the hospital side, the specimen is associated with the medical information (patient information) by the specimen number (9-digit specimen number in Fig. 9) and the patient number (patient number in Fig. 9) of each record registered as the collection information. I have. A correspondence table (FIG. 5) between the sample number and the connectable anonymized sample number is stored in the hospital-side anonymization system 4 or the like. On the other hand, on the research side, the anonymized patient ID consisting of the upper five digits of the concatenated anonymized sample number corresponds to the sample information of the sample corresponding to the concatenated anonymized sample number and the anonymized medical information. It is attached.

There is a one-to-many correspondence between patient numbers and sample numbers, and sample numbers can identify multiple samples collected from the same patient. Then, a connectable anonymized sample number corresponding to the sample number one-to-one is generated, and the sample number and the connectable anonymized sample number are associated with each other by the correspondence information in the connectable anonymized correspondence table. Therefore, by deleting the corresponding information corresponding to the predetermined connectable anonymized sample number in the connectable anonymization correspondence table, either anonymization of non-connectable or connectable anonymization can be performed for each sample. What to do Can be.

Also, for example, a patient number is assigned to the sample instead of the sample number, and the sample collected from each patient is first identified by the patient number, and a concatenated anonymized sample is used instead of the patient number assigned to the sample. A new number is generated, the generated linkable anonymized sample number is assigned to the sample instead of the patient number, and the linkable anonymization support consisting of the correspondence information that associates the patient number with the linkable anonymized sample number You can also create a table. In this case, by deleting corresponding information corresponding to a predetermined connectable anonymized sample number in the connectable anonymized correspondence table, a sample to which a connectable anonymized sample number corresponding to the patient is assigned for each patient. Unlinkable anonymization can be performed for.

Next, the backup process of the patient information management system 3 and the anonymization system 4 will be described. The patient information management system 3 stores patient information and medical treatment information. This information is stored in a storage device such as a hard disk for backup (not shown), a floppy disk, CD-R (com ρ actdisc-recordable), CD-RW, and comactdisc- in accordance with a predetermined program of the Windows NT server 21. rewritable) and regularly backed up to recording media. The packed patient information and medical information are periodically collated with the current patient information and medical information stored in the patient information management system 3, and the packed patient information and medical information are periodically compared. When the information and the current patient information and medical information stored in the patient information management system 3 are different, the patient information and medical information are backed up. In this way, restoration is realized without contradiction.

Also, the anonymization system 4 has a linkable anonymization correspondence table. This linkable anonymization correspondence table is provided by Windows NT Server 21. In accordance with a predetermined program, the data is periodically backed up to a storage device such as a hard disk for backup (not shown) or a recording medium such as a floppy disk, CD-R, or CD-RW. Then, the packed linkable anonymization correspondence table is compared with the current linkable anonymization correspondence table stored in the anonymization system 4, and the packed linkable anonymization correspondence table and the anonymization are compared. When the current linkable anonymization correspondence table stored in the system 4 is different, a backup of the linkable anonymization correspondence table is performed.

Further, log information such as operation history when the linkable anonymization correspondence table is updated can be stored in a storage device such as a hard disk, or can be recorded on a recording medium such as a magnetic tape. As a result, even if part of the linkable anonymization correspondence table (for example, current data) is lost, the current linkable anonymization correspondence table can be restored from the log information. In this way, a restorer is realized without contradiction.

If the linkable anonymization correspondence table and log information are stored in a system called RA ID (Redundant Arr. 'Aysof Inexpensive Dinks), the reliability can be further improved. Here, RA ID is a storage method that achieves high reliability and performance by storing information redundantly on multiple hard _disks.c Also, the linkable anonymization correspondence table and log information The security can be further improved by recording the information on physically independent recording media or storing the information separately in a storage device different from the storage device in which other information is stored. For example, if the linkable anonymization correspondence table is regularly backed up to a hard disk or magnetic tape every day, even if the current linkable anonymization correspondence table is lost, the linkable anonymization correspondence table and the connection link anonymization correspondence table of last year are lost. The current linkable anonymization correspondence table can be restored based on the link information. In this way, the linkable anonymization correspondence table and the log information are packed up in a storage device or a recording medium that is physically different from other information such as patient information and medical information. Therefore, even if a part of the linkable anonymization correspondence table is lost or a part of the backup data is lost, the damage caused by the loss can be minimized.

Further, the program for performing the above-described processing can be provided by recording it on various recording media such as a CD-ROM (compatctsdiscr eadonry), a DVD (digitalvverrs), a floppy disk, and a memory card. Then, the program controls the operation of the Windows NT servers 21 and 61, and the Windows NT server 21) 61 controlled by the program executes predetermined processing instructed by the programs.

In the above embodiment, the label on which the percode is printed is attached to the specimen, but other codes other than the percode may be used.

Further, the configuration and operation of the above embodiment are examples, and it is needless to say that the configuration and operation can be appropriately changed without departing from the spirit of the present invention.

Claims

The scope of the claims

1. A method of anonymizing personal information,

Generating third identification information that corresponds to the second identification information on a one-to-one basis and that cannot infer the first identification information;

A step of storing correspondence information between the second identification information and the third identification information;

Canceling the association of the second information with the second identification information, and simultaneously issuing an instruction for associating the third identification information with the second information. Method.

2. The association means that a bar code label corresponding to the second to third identification information is issued to a medium on which the second information is recorded, and the label is physically affixed. Yes,

Claim 1 means that the association is canceled means that the label is physically peeled off, and that issuing the instruction means that the instruction about the series of operations is displayed in a recognizable format. How to anonymize the information pertaining to the listed individual.

3. The association is to store the second information in a searchable manner using the second to third identification information as a search element,

Dissolving the association with the second identification information and simultaneously instructing the association with the third identification information means changing the search element of the second information from the second identification information to the third identification information And remember again,

The method for anonymizing information pertaining to an individual according to claim 1, wherein issuing the instruction means executing the series of processes.

4. A method of anonymizing personal information,

At least, the third identification information is configured to have a symbol string that shares a part of the first identification information and has a necessary number of digits so that the third information relating to the individual can be identified. Generating individual tertiary information so that it is identifiable;

Next, each of the second identification information and the third identification information has a one-to-one correspondence, and the first identification information is a symbol string that cannot be inferred, and the second identification information and The first identification information shared by the third identification information Generating a fourth identification information and a fifth identification information in which a symbol string corresponding to the symbol string relating to the information is included in a part thereof in common;

A method for anonymizing information relating to individuals, which is characterized by having:

5. The second information is diagnostic finding information on the corresponding individual, the third information is a specimen identification symbol on the corresponding individual, and the associating searches for the corresponding identification information as a search element. To remember as much as possible,

5. The method according to claim 4, wherein issuing the instruction means executing the series of processes.

6. A method of anonymizing personal information,

At least a symbol string that shares a part of the first identification information and has the necessary number of digits so that the diagnostic finding information on the individual can be identified. Generating second identification information to be identified so that each piece of second information is identifiable;

At least the third identification information, which shares a part of the first identification information and is composed of a symbol string having a required number of digits so that the sample relating to the individual can be identified, Generating the identification information so as to be identifiable; and issuing an instruction for associating each sample with the generated third identification information;

Next, each of the second identification information and the third identification information corresponds to 1 对 1, and the first identification information is a symbol string that cannot be inferred, and the second identification information and A step of generating fourth identification information and fifth identification information in which a symbol string corresponding to the symbol string relating to the first identification information shared by the third identification information is included in a part thereof; ,

A method for anonymizing information relating to an individual, comprising:

7. Unable to delete part or all of the storage of the correspondence information Issue the instruction for

The method for anonymizing personal information according to any one of claims 1 to 7, further comprising:

8. Anonymous transfer of personal information,

Storing first correspondence information between the second identification information and the fourth identification information; Storing second correspondence information between the third identification information and the fifth identification information;

Canceling the second and third weaving information for the second and third information, and simultaneously issuing an instruction for associating the fourth and fifth identification information;

Instructing the required destination to transfer the second and third information associated with the fourth and fifth identification information;

Separately storing the transferred second and third information in association with the fourth and fifth identification information;

A method for anonymously transferring information relating to individuals, comprising:

9. The second information is diagnostic finding information on the corresponding individual, the third information is a specimen identification symbol on the corresponding individual, and the associating searches for the corresponding identification information as a search element. To remember as much as possible,

9. The method according to claim 8, wherein issuing the instruction means executing the series of processes.

10. Anonymous transfer of personal information,

Generating or inputting first identification information capable of identifying an individual; storing first information relating to a predetermined individual in association with the first identification information; At least the second identification information, which shares a part of the first identification information and has a symbol string having a required number of digits so that the diagnostic finding information on the individual can be identified, Generating the information to be identifiable;

Canceling the association of the sample with the third identification information, and simultaneously issuing an instruction of association with the fifth identification information; Instructing transfer of diagnostic information that can be searched using the fourth identification information as a search element and a sample associated with the fifth identification information to a common transfer destination, respectively;

A step of separately storing the transferred diagnostic information as the fourth identification information as a search element;

1 1. The step of erasing part or all of the storage of the correspondence information

The method according to any one of claims 8 to 10, further comprising anonymously transferring information relating to the individual described in any one of claims 8 to 10.

1 2. This is a system for anonymizing personal information,

First identification information generating means for generating or inputting first identification information capable of identifying an individual;

First storage means for storing first information relating to a predetermined individual in association with the first identification information;

At least, the second identification information, which shares a part of the first identification information and includes a symbol string having the necessary number of digits so that the second information relating to the individual can be identified, Second identification information generating means for generating the second information of the second identification information so as to be identifiable;

First instruction issuing means for issuing an instruction for associating the generated second identification information with each piece of second information; A third identification information generating unit that generates third identification information that corresponds to the second identification information on a one-to-one basis and that cannot infer the first identification information;

Second storage means for storing correspondence information between the second identification information and the third identification information;

A second instruction issuing means for canceling the association with the second identification information corresponding to the second information and simultaneously issuing an instruction for associating the third identification information;

A system for anonymizing information relating to individuals, comprising:

13. The association is to issue a percode label corresponding to the second to third identification information to the medium on which the second information is recorded, and to physically attach the label,

Claim 12: To cancel the association means to physically peel off the label, and to issue the instruction means to display the instruction for the series of operations in a recognizable format. A system for anonymizing the information pertaining to individuals as described in.

14. The association is to store the second information in a searchable manner using the second to third identification information as a search element.

The system for anonymizing information relating to an individual according to claim 12, wherein issuing the instruction means executing the series of processes.

1 5. This is a system for anonymizing personal information.

First information about a predetermined individual is recorded in association with the first identification information. The first storage means to remember

First instruction issuing means for issuing an instruction for associating the generated second identification information with each piece of second information;

At least, the third identification information is configured to have a symbol string that shares a part of the first identification information and has a necessary number of digits so that the third information relating to the individual can be identified. A third identification information generating means for generating individual third information so as to be identifiable;

Second instruction issuing means for issuing an instruction for associating the generated third identification information with each third information;

The second identification information and the third identification information correspond one-to-one with each other, and the first identification information is a symbol string which cannot be inferred, and the second identification information and the second identification information The fourth and fifth identification information generating the fourth identification information and the fifth identification information in which a symbol string corresponding to the symbol string related to the first identification information shared by the three identification information is included in a part thereof. Fifth identification information generating means,

Second storage means for storing first correspondence information between the second identification information and the fourth identification information;

Third storage means for storing second correspondence information between the third identification information and the fifth identification information;

A third and fourth instruction issuing means for canceling the second and third identification information for the second and third information and simultaneously issuing an instruction relating the fourth and fifth identification information to the second and third information; A system for anonymizing information relating to an individual, comprising:

16. The second information is diagnostic finding information on the corresponding individual, the third information is a specimen identification symbol for the corresponding individual, and the associating is using the corresponding identification information as a search element. To be memorable in a searchable way

The system for anonymizing information concerning an individual according to claim 15, wherein issuing the instruction means executing a series of the processing.

1 7. This is a system for anonymizing personal information.

At least the second identification information, which is composed of a symbol string that shares a part of the first identification information and has a necessary number of digits so that the diagnostic finding information on the individual can be identified, Second identification information generating means for generating diagnostic finding information so that it can be identified;

A second storage unit for storing each diagnostic finding information as the search element with the generated second identification information;

At least the third identification information, which shares a part of the first identification information and has a symbol string having a necessary number of digits so that the specimen of the individual can be identified, Third identification information generating means for generating a sample so that the sample can be identified; First instruction issuing means for issuing an instruction for associating each sample with the generated third identification information;

A second instruction issuing means for issuing an instruction for associating the generated third identification information with each sample;

The second identification information and the third identification information correspond one-to-one with each other, and the first identification information is a symbol string that cannot be inferred, and the second identification information and the second identification information The fourth and fifth identification information generating the fourth identification information and the fifth identification information in which a symbol string corresponding to the symbol string related to the first identification information shared by the three identification information is included in a part thereof. Fifth identification information generating means, second storage means for storing first correspondence information between the second identification information and the fourth identification information,

Third instruction issuing means for issuing an instruction to change the search element related to the diagnostic finding information from the second identification information to the fourth identification information and to store it again;

A fourth instruction issuing means for canceling the association of the sample with the third identification information and simultaneously issuing an instruction of association with the fifth identification information, the information relating to the individual being anonymous. System.

18. The connection disable instruction means for issuing an instruction to erase part or all of the storage of the correspondence information is provided.

The system for anonymizing personal information according to any one of claims 12 to 17, further comprising:

1 9. A system for anonymously transferring information relating to an individual, comprising: first identification information generating means for generating or inputting first identification information capable of identifying an individual;

First information about a predetermined individual is recorded in association with the first identification information. The first storage means

At least, the second identification information that shares a part of the first identification information and has a symbol string having a necessary number of digits so that the second information relating to the individual can be identified is identified. A second identification information generating means for generating individual second information so as to be identifiable;

At least the third identification information, which shares a part of the first identification information and has a symbol string having a necessary number of digits so that the third information relating to the individual can be identified, is provided. A third identification information generating means for generating individual third information so as to be identifiable;

The first identification information is a symbol string that cannot be inferred by analogy, and the second identification information and the third identification information correspond to the second identification information and the third identification information, respectively. The fourth and fifth generating the fourth identification information and the fifth identification information in which a symbol string corresponding to the symbol string relating to the first identification information shared by both of the identification information is included in a part thereof. 5 identification information generating means, a second storage means for storing first correspondence information between the second identification information and the fourth identification information,

Third and fourth instruction issuing means for canceling the second and third identification information for the second and third information, and simultaneously issuing an instruction for associating the fourth and fifth identification information,

The second and third information associated with the fourth and fifth identification information Fifth instruction issuing means for instructing the destination of the transfer, and the fourth and fifth means for separately storing the transferred second and third information in association with the fourth and fifth identification information. Storage means and

A system for anonymously transferring information relating to individuals, comprising:

20. The second information is diagnostic finding information about the corresponding individual, the third information is a specimen identification symbol for the corresponding individual, and the associating is using the corresponding identification information as a search element. To be memorable in a searchable manner,

The system according to claim 19, wherein issuing the instruction means executing a series of the processing.

2 1. A system for anonymously transferring information relating to an individual, comprising: first identification information generating means for generating or inputting first identification information capable of identifying an individual;

At least the second identification information, which shares a part of the first identification information and is composed of a symbol string having a necessary number of digits so that the diagnostic finding information on the individual can be identified, Second identification information generating means for generating the finding information so that it can be identified; A second storage unit for storing each diagnostic finding information as the search element with the generated second identification information;

At least the third identification information, which shares a part of the first identification information and has a symbol string having the required number of digits so that the sample of the individual can be identified, Third identification information generating means for generating a sample so that it can be identified;

First instruction issuing means for issuing an instruction for associating each sample with the generated third identification information;

The first identification information is a symbol string that cannot be inferred by analogy with the second identification information and the third identification information, respectively, and the second identification information and the third identification information The fourth and fifth generating the fourth identification information and the fifth identification information in which a symbol string corresponding to the symbol string relating to the first identification information shared by both of the identification information is included in a part thereof. 5 Identification information issuing means,

Fourth instruction issuing means for canceling the association of the sample with the third identification information and simultaneously issuing an instruction of association with the fifth identification information, and a diagnosis capable of searching using the fourth identification information as a search element Instructs the transfer of the information and the sample associated with the fifth identification information to the common transfer destination. A fifth instruction issuing means,

Fourth storage means for separately storing the transferred diagnostic information as fourth identification information as a search element;

Fifth identification information associated with the transferred sample is detected, and a symbol string corresponding to the symbol string related to the first identification information, which is included in common with the fourth identification information, is assigned to the sample. A sixth instruction issuing means for issuing an instruction to read out the corresponding diagnostic information, and

2 2. A means for disabling connection that deletes part or all of the storage of the

The system according to any one of claims 19 to 21, further comprising anonymously transferring information relating to an individual.