Clinical data management system, clinical data privacy protection method, equipment and medium

Abstract

The invention provides a clinical data management system, a clinical data privacy protection method, equipment and a medium. Obtaining an identity identifier corresponding to the medical institution identity information of the requester and a patient anonymous identifier associated with the medical record text data; performing medical semantic analysis on clinical contents in the medical record text data, identifying a plurality of sensitive entities containing diagnosis and treatment features, physiological indexes and personal identifiers of patients, associating medical contexts of the sensitive entities, and generating a specified replacement seed value for each sensitive entity based on anonymous identifiers of the patients; and for each sensitive entity, determining corresponding replacement content from a preset desensitization rule base according to the medical context of the sensitive entity and the replacement seed value. And finally, replacing each sensitive entity with the corresponding replacement content, and generating a desensitized clinical text associated with the anonymous identifier of the patient. According to the scheme, context-aware privacy protection can be realized in a clinical data sharing environment.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of clinical data management, and more particularly, the present application relates to a clinical data management system, a clinical data privacy protection method, equipment and a medium. BACKGROUND

[0002] Under the background of rapid development of medical informatization, the clinical data management system has become an important platform for medical institutions to store, share and manage patient clinical data. With the increasingly wide application of medical big data, medical record text data plays a key role in clinical research, teaching and training, cross-institutional collaboration and artificial intelligence assisted diagnosis. Privacy protection not only ensures the safety of patients' personal information, but also promotes data circulation and utilization, improves medical service efficiency, reduces the risk of data leakage, and enables medical institutions to achieve compliance and sustainable data sharing in complex medical environments. Therefore, it has become a necessary means to enhance data value in the field of medical informatization to build an efficient and reliable clinical data privacy protection mechanism in the clinical data management system.

[0003] Existing clinical data privacy protection technologies mostly rely on simple anonymization processing, such as directly replacing names, ID numbers and other explicit identifiers, or using k-anonymization algorithms for data aggregation. However, these methods have obvious limitations when dealing with complex medical record text data. Specifically, existing methods are difficult to fully integrate medical semantic context and patient dynamic characteristics, and cannot accurately depict the privacy risks of sensitive entities in different diagnosis and treatment scenarios, resulting in a lack of pertinence and robustness in the de-sensitization results. For example, when medical record text involves the cross-relation of physiological indicators, diagnosis and treatment characteristics and personal identifiers, traditional de-sensitization methods usually cannot dynamically adjust the strategy, which may easily lead to semantic distortion or residual implicit privacy leakage, reducing data usability and security. Therefore, how to achieve context-aware privacy protection in a clinical data sharing environment has become a difficult problem in the industry. SUMMARY

[0004] The present application provides a clinical data management system, a clinical data privacy protection method, equipment and a medium, which can achieve context-aware privacy protection in a clinical data sharing environment.

[0005] In a first aspect, the present application provides a clinical data privacy protection method, comprising the following steps: When a request to access medical record text data is received, an identity identifier corresponding to the medical institution identity information of the requester is obtained, and a patient anonymous identifier associated with the medical record text data is obtained; Performing medical semantic analysis on the clinical content in the medical record text data, identifying a plurality of sensitive entities containing patient diagnosis and treatment characteristics, physiological indicators and personal identifiers, and associating the medical context in which each sensitive entity is located; generating a designated replacement seed value for each sensitive entity based on the patient anonymous identifier; For each sensitive entity, determining the corresponding replacement content from a preset desensitization rule library according to the medical context in which the sensitive entity is located and the replacement seed value; replacing each sensitive entity with the corresponding replacement content to generate desensitized clinical text associated with the patient anonymous identifier.

[0006] In some embodiments, when receiving a request to access medical record text data, obtaining an identity identifier corresponding to the medical institution identity information of the requester, and a patient anonymous identifier associated with the medical record text data specifically includes: verifying whether the medical institution identity information of the requester meets the preset access authorization list; If the verification is passed, extracting a unique identity identifier associated with the medical institution identity information from the preset identity mapping table; Based on the metadata or associated database of the medical record text data, querying and obtaining the patient anonymous identifier corresponding to the medical record text data.

[0007] In some embodiments, the medical semantic analysis is performed on the clinical content in the medical record text data to identify a plurality of sensitive entities containing patient diagnosis and treatment characteristics, physiological indicators and personal identifiers, and the medical context in which each sensitive entity is located specifically includes: Performing word segmentation processing and entity recognition on the medical record text data to extract potential sensitive entities, the sensitive entities including one or more of name, age, diagnosis code, test value, treatment plan, treatment time, treatment department and attending physician name; Performing semantic analysis on the identified sensitive entities to associate their context information in the medical record text, the context information including the chapter to which the sensitive entity belongs and the adjacent medical terms, the chapter including chief complaint, history of present illness or diagnosis discussion; Based on the medical ontology knowledge base, filtering and confirming the type and sensitivity level of the sensitive entity, binding each sensitive entity with a preset medical context to form a list of annotated entity-context pairs.

[0008] In some embodiments, generating a designated replacement seed value for each sensitive entity based on the patient anonymous identifier specifically includes: Taking the patient anonymous identifier and the identity identifier of the requester as the base value, using the type and position index of each sensitive entity, and calculating a unique replacement seed value through a pseudo-random number generator; Verifying the uniqueness and irreversibility of the replacement seed value, and setting the replacement seed values of different patients or different entities of the same patient or different requesters to be not repeated; temporarily associating the generated replacement seed value with the corresponding sensitive entity to form a seed value mapping table.

[0009] In some embodiments, for each sensitive entity, determining the corresponding replacement content from a preset de-identification rule library according to the medical context in which the sensitive entity is located and the replacement seed value specifically comprises: querying the access permission level corresponding to the requester identifier and the access scenario from a preset permission matrix to determine the sensitive entity granularity allowed to be disclosed; According to the type of the sensitive entity and the medical context in which the sensitive entity is located, matching the applicable de-identification strategy from the de-identification rule library; Using the replacement seed value, parameterizing and adjusting the matched de-identification strategy to generate personalized replacement content, replacing the specific age with an age range and replacing the name with a pseudonym based on the replacement seed value.

[0010] In some embodiments, replacing each sensitive entity with the corresponding replacement content to generate de-identified clinical text associated with the patient anonymous identifier specifically comprises: Traverse all sensitive entities in the medical record text data, and replace them in order with the determined replacement content while preserving the structure and non-sensitive parts of the original text; Performing consistency checking on the replaced text, setting the medical context as logical coherence and semantic integrity; Bind the generated de-identified clinical text with a temporary session identifier, and add a watermark or metadata tag, wherein the temporary session identifier is associated with the patient anonymous identifier in the audit log.

[0011] In some embodiments, the method further comprises: After generating the de-identified clinical text, recording the requester's identity identifier, access time and de-identification operation log to form an audit chain; If the access permission is changed or the patient's privacy preference is updated, send a notification to the requester who has obtained the de-identified text, requiring to stop using and destroy, while retaining the notification record for audit; Analyzing the historical de-identification operation and updating the de-identification rule library.

[0012] In a second aspect, the present application provides a clinical data management system, which comprises a clinical data privacy protection unit, and the clinical data privacy protection unit specifically comprises: When receiving a request to access medical record text data, the acquisition module is used to acquire an identity identifier corresponding to the medical institution identity information of the requester, and a patient anonymous identifier associated with the medical record text data; The processing module is configured to perform medical semantic analysis on the clinical content in the medical record text data, identify a plurality of sensitive entities containing patient diagnosis and treatment features, physiological indicators and personal identifiers, and associate the medical context in which each sensitive entity is located. The processing module is further configured to generate a designated replacement seed value for each sensitive entity based on the patient anonymous identifier. The processing module is further configured to determine, for each sensitive entity, corresponding replacement content from a preset desensitization rule library according to the medical context in which the sensitive entity is located and the replacement seed value. The execution module is configured to replace each sensitive entity with the corresponding replacement content to generate desensitized clinical text associated with the patient anonymous identifier.

[0013] In a third aspect, the present application provides a computer device, which comprises a memory and a processor, the memory stores a code, and the processor is configured to acquire the code and execute the clinical data privacy protection method described above.

[0014] In a fourth aspect, the present application provides a computer readable storage medium, which stores a computer program, and the computer program is executed by a processor to implement the clinical data privacy protection method described above.

[0015] The technical scheme provided by the embodiments of the present application has the following beneficial effects: In the embodiments of the present application, when a request for accessing medical record text data is received, an identifier corresponding to the medical institution identity information of the requester and a patient anonymous identifier associated with the medical record text data are acquired. The clinical content in the medical record text data is subjected to medical semantic analysis, and a plurality of sensitive entities containing patient diagnosis and treatment features, physiological indicators and personal identifiers are identified, and the medical context in which each sensitive entity is located is associated. A designated replacement seed value is generated for each sensitive entity based on the patient anonymous identifier. For each sensitive entity, corresponding replacement content is determined from a preset desensitization rule library according to the medical context in which the sensitive entity is located and the replacement seed value. Each sensitive entity is replaced with the corresponding replacement content to generate desensitized clinical text associated with the patient anonymous identifier.

[0016] It can be seen that when the application receives a request for accessing medical record text data, access control and data association are performed based on the medical institution identity information of the requester and the patient anonymous identifier, which can ensure the legality of data access and the anonymization processing of the patient identity, thereby making up for the deficiency of ignoring access authentication in the traditional desensitization method, avoiding the risk of unauthorized data leakage; secondly, through medical semantic analysis of the medical record text data, sensitive entities are identified and their medical context is associated, realizing fine analysis of clinical content, so that the desensitization process not only targets explicit personal information, but also takes into account the implicit privacy risks of diagnosis and treatment characteristics and physiological indicators, enhancing the comprehensiveness and accuracy of privacy protection; then, based on the patient anonymous identifier, a replacement seed value is generated, and the replacement content is determined from the preset desensitization rule library in combination with the medical context, effectively integrating the desensitization mechanism of randomization and context adaptation, ensuring that the replaced content not only maintains the coherence and practical value of clinical semantics, but also avoids the risk of desensitization based on fixed rules being easily reverse-engineered, realizing dynamic and irreversible protection of sensitive entities; finally, the desensitized clinical text is generated by replacing the sensitive entities with the corresponding content, and is associated with the patient anonymous identifier, ensuring the traceability of desensitized data and safe sharing among medical institutions, further improving the efficiency of clinical research, data analysis and cross-institution cooperation, while significantly reducing the possibility of privacy leakage, further ensuring the consistency and security of desensitized text in multi-user access scenarios through the association mechanism of the patient anonymous identifier, not only improving the robustness and adaptability of privacy protection, but also enhancing the usability and compliance of clinical data; in summary, the scheme of the application can realize efficient and context-aware privacy protection in a clinical data sharing environment, thereby enhancing the dynamic response capability to patient sensitive information and effectively improving the security and practical value of medical record text data in medical institutions. BRIEF DESCRIPTION OF DRAWINGS

[0017] Figure 1 is an exemplary flowchart of a clinical data privacy protection method according to some embodiments of the application; Figure 2 is an exemplary flowchart of generating a replacement seed value according to some embodiments of the application; Figure 3 is an exemplary flowchart of determining replacement content according to some embodiments of the application; Figure 4 is a structural schematic diagram of a clinical data privacy protection unit according to some embodiments of the application; Figure 5 is a structural schematic diagram of a computer device for implementing a clinical data privacy protection method according to some embodiments of the application. DETAILED DESCRIPTION

[0018] For a better understanding of the above technical solutions, the above technical solutions will be described in detail below in conjunction with the drawings in the specification and specific embodiments. Reference Figure 1 The figure is an exemplary flow chart of a clinical data privacy protection method according to some embodiments of the present application, which mainly includes the following steps: In step 101, when a request to access medical record text data is received, an identity identifier corresponding to the medical institution identity information of the requester is obtained, and a patient anonymous identifier associated with the medical record text data is obtained.

[0019] The identity identifier is uniquely associated with the medical institution identity information of the requester, ensuring that the identities of different requesters are not repeated, enabling traceability of access behavior, supporting the accuracy and security of privacy protection. The patient anonymous identifier refers to the conversion of the patient's real identity into an anonymous form of identification according to the privacy rules of the Personal Information Protection Law, which is associated with the medical record text data and can be obtained through the metadata of the medical record text data or the associated database query; in clinical data privacy protection, it is not only one of the base values for generating each sensitive entity replacement seed value, but also associated with the temporary session identifier in the audit log, ultimately assisting in generating desensitized clinical text associated with itself, achieving a balance between patient privacy protection and reasonable use of clinical data, which will not be described here.

[0020] In some embodiments, when a request to access medical record text data is received, an identity identifier corresponding to the medical institution identity information of the requester is obtained, and a patient anonymous identifier associated with the medical record text data is obtained, specifically including: Verify whether the medical institution identity information of the requester meets the preset access authorization list; if the verification is passed, extract the unique identity identifier associated with the medical institution identity information from the pre-set identity mapping table; Based on the metadata or associated database of the medical record text data, query and obtain the patient anonymous identifier corresponding to the medical record text data.

[0021] Wherein, the preset access authorization list, for example, the medical institution identity information can be a hospital code, and the access authorization list can be a list of hospital codes allowed to access, which is not limited here.

[0022] It should be noted that the patient anonymous identifier in the present application can be generated by hashing the patient's original identifier, which has the anonymity and uniqueness of the identifier data. In the present application, the patient anonymous identifier generated by hashing is arranged in a matrix according to the association with the medical record metadata (such as the data describing the attributes of the medical record, such as the time of visit, department, medical record number, etc.), so that the patient anonymous identifier is not only an identity symbol, but also can bind the corresponding medical record data, making it convenient to query the patient anonymous identifier from the medical record metadata, which will not be described here.

[0023] In step 102, medical semantic analysis is performed on the clinical content in the medical record text data to identify a plurality of sensitive entities containing patient diagnosis and treatment characteristics, physiological indicators and personal identifiers, and associate the medical context in which each sensitive entity is located.

[0024] The medical context refers to the chapter and adjacent medical terms in which the sensitive entity belongs in the medical record text. The medical semantic analysis refers to converting the medical record text data into an entity data set with medical markers through semantic processing. In some embodiments, the medical semantic analysis is performed on the clinical content in the medical record text data to identify a plurality of sensitive entities containing patient diagnosis and treatment characteristics, physiological indicators and personal identifiers, and associate the medical context in which each sensitive entity is located. Specifically, the medical semantic analysis includes: The medical record text data is subjected to word segmentation processing and entity recognition to extract potential sensitive entities, which include one or more of name, age, diagnosis code, test value, treatment plan, visit time, visit department and attending physician name; The semantic analysis of the identified sensitive entities is performed. In specific implementation, the surrounding text of the sensitive entity can be extracted to obtain the adjacent medical terms of the sensitive entity in the medical record text and the chapter of the medical record to which the sensitive entity belongs. The chapter can include chief complaint, history of present illness or diagnosis discussion or other content, which is not specifically limited here. The type and sensitivity level of the sensitive entity are confirmed, and the medical context information in the medical record text is associated, that is, each sensitive entity is bound with the medical context in which the sensitive entity is located to form an annotated entity-context list. In specific implementation, medical knowledge verification needs to be matched, for example, the medical meaning of the sensitive entity is judged in combination with a medical ontology knowledge base to determine the type and sensitivity level of the sensitive entity, for example, to determine that Zhang San belongs to a personal identifier, 120 / 80 mmHg belongs to a physiological indicator, and pneumonia belongs to a diagnosis. Then, the context association is established to bind the sensitive entity with the extracted surrounding text + belonging chapter to form the correspondence between the entity and the medical context, generate an entity-context annotation list. The annotation list is a structured list formed by binding each sensitive entity with its corresponding key information after the sensitive entities in the medical record text data are identified and semantically analyzed. Details are not described here.

[0025] The entity recognition is to identify the key markers of the sensitive entity. Different key markers exist for different types of sensitive entities, for example: the name as a personal identifier type sensitive entity has a key marker in the form of a specific string, by which the name sensitive entity can be identified; the diagnosis code as a diagnosis and treatment characteristic type sensitive entity has a key marker in the form of ICD, from which the suitable desensitization strategy code is matched according to the type of the sensitive entity and the medical context in which the sensitive entity is located, by which the diagnosis code sensitive entity can be identified. Details are not described here. In addition, the context information in which the sensitive entity is located is extracted according to the extracted sensitive entity. For example, the medical context information in a time window of a predetermined number of words before and after the sensitive entity can be extracted, and details are not described herein.

[0026] In step 103, a specified replacement seed value is generated for each sensitive entity based on the patient anonymous identifier.

[0027] In the desensitization process, the sensitive entity needs to exhibit random characteristics to reflect the instantaneous change of privacy protection. Therefore, a replacement seed value is used in the present application. The replacement seed value is a unique value for individual desensitization of the sensitive entity. Each sensitive entity needs to generate a replacement seed value. In some embodiments, as shown in the following formula, the replacement seed value is generated based on the patient anonymous identifier for each sensitive entity. Figure 2 As shown in the following formula, the replacement seed value is generated based on the patient anonymous identifier for each sensitive entity. The following method can be used: In step 1031, the patient anonymous identifier and the identity identifier of the requester are used as base values, and a unique replacement seed value is calculated by a cryptographic secure pseudo-random number generator (CSPRNG) using the type and position index of each sensitive entity. In the implementation, first, the core base value for generating the replacement seed value is determined, that is, the patient anonymous identifier (which is used to associate the patient identity and ensure anonymity) and the identity identifier of the requester (which is used to distinguish the identity information of different access or operation subjects). These two base values are the basis for ensuring that the replacement seed value is bound to the specified patient and the specified requester. Second, the key information of each sensitive entity is included, that is, the type of the sensitive entity (such as personal identification, diagnosis, physiological indicator, etc.) and the position index (such as the specific position marker of the sensitive entity in the medical record text to ensure the uniqueness of the positioning), so as to avoid the repetition of the replacement seed value due to the different attributes or positions of the sensitive entity. Finally, the core base value, the dynamic salt value, and the key information of the sensitive entity (that is, the type and position index of the sensitive entity) are integrated and input into the CSPRNG for calculation to generate a unique replacement seed value. It should be noted that other information, such as a medical record unique identifier, can be input into the entropy source according to the actual situation to ensure that the same type of entity of the same patient is input into the combination in different medical records, which is only used as an example for illustration. Other input entropy source information can also be used, and details are not limited herein. In step 1032, the uniqueness and irreversibility of the replacement seed value are verified. The replacement seed values ​​for different patients, different entities of the same patient, or different requesters are set to be unique. The uniqueness is achieved by using the patient's anonymous identifier + requester's identity identifier + dynamic salt value + sensitive entity type and location index as a unique combination input. Calculated by CSPRNG, it can be ensured that the seed values ​​for different patients, different entities of the same patient, and different requesters are not repeated. The irreversibility depends on the one-way calculation characteristic of CSPRNG, and the patient's anonymous identifier is mostly an irreversible hash result, so it is impossible to deduce the original information from the replacement seed value. This will not be elaborated here. In step 1033, the generated replacement seed value is temporarily associated with the corresponding sensitive entity to form a seed value mapping table. Specifically, this involves preparing association elements, organizing the identified sensitive entities (including key information such as type and location index) and their corresponding unique replacement seed values; then establishing a one-to-one mapping, that is, binding the key information of each sensitive entity with the corresponding replacement seed value to ensure that the entity and the seed value correspond uniquely; finally, constructing a mapping table, that is, integrating the above mapping relationships according to a preset format (such as a structured table) to form a temporarily stored seed value mapping table.

[0028] In step 104, for each sensitive entity, the corresponding replacement content is determined from the preset desensitization rule base based on the medical context of the sensitive entity and the replacement seed value.

[0029] Among them, reference Figure 3 In some embodiments, for each sensitive entity, determining the corresponding replacement content from a preset desensitization rule base based on the medical context of the sensitive entity and the replacement seed value specifically includes: At step 1041, the requestor identifier and the access scenario corresponding access permission level are queried, and the allowed sensitive entity granularity for disclosure is determined from the preset permission matrix in combination with the sensitive entity sensitivity (for example, high sensitivity: HIV / mental illness; medium sensitivity: tumor stage; low sensitivity: common cold), wherein the sensitive entity granularity is the information detail level of the sensitive entity allowed to be disclosed to the requestor. In specific implementation, the following manner can be used, for example, core query information is collected, that is, the requestor identifier (such as requestor role ID, account identifier, etc.) and the specific access scenario (such as clinical research, medical insurance audit, statistical analysis, etc.) of the current operation are obtained; then the permission matrix entry is matched, that is, in the preset permission matrix, the requestor identifier, the access scenario, and the sensitive entity sensitivity are used as three query conditions to locate the corresponding access permission level (for example, first-level, second-level, and third-level permissions); and finally the sensitive entity disclosure granularity is determined, that is, according to the matched access permission level, the allowed sensitive entity granularity rule corresponding to the level in the permission matrix is extracted (for example, the specific value of the high sensitive entity needs to be authorized and disclosed in the diagnosis and treatment scenario, and the high sensitive entity only discloses "yes / no" in the scientific research scenario), the sensitive entity granularity determination is completed, and it needs to be noted that the above-mentioned permission matrix is used to associate the requestor permission level, the access scenario, the sensitive entity sensitivity, and the clinical data parameter characteristics (such as data type, sensitivity), and to clearly define the allowed sensitive entity granularity under different combinations, which can provide a unified judgment basis for the permission control of clinical data access. In specific implementation, the history record accessed can be used to reverse correct the permission matrix, which is not described herein again. At step 1042, the applicable desensitization strategy is matched from the desensitization rule library according to the type of the sensitive entity and the medical context in which the sensitive entity is located, and the desensitization strategy can include generalization, forgery, or masking. In specific implementation, the following manner can be used, for example, first, the key matching information is extracted, that is, the confirmed sensitive entity type (such as personal identification, diagnosis, and physiological indicator) and the medical context (such as the chapter of the medical record to which it belongs and the adjacent medical terms) bound to the sensitive entity are obtained; then the desensitization rule library is searched, that is, the sensitive entity type and the medical context are used as double retrieval conditions to screen the rule entries containing the combination conditions in the preset desensitization rule library; and finally the applicable desensitization strategy is determined, that is, from the screened rule entries, the desensitization strategy completely matched with the current entity type and medical context is extracted, for example, the personal identification class entity corresponds to the pseudonym replacement strategy, and the diagnosis class entity corresponds to the generalization to the disease category strategy in a specific chapter, and the strategy matching is completed. At step 1043, the matched de-identification strategy is parameterized adjusted using the replacement seed value, and the personalized replacement content is finally generated based on the allowed disclosure granularity of sensitive entities, for example, replacing a specific age with an age range, and replacing a name with a pseudonym based on the replacement seed value, which is only used as an example and does not limit the present application. The parameterized adjustment of the matched de-identification strategy using the replacement seed value can be achieved in the following manner. First, the basic parameter template of the de-identification strategy is parsed, i.e., the preset basic parameter template of the matched de-identification strategy is extracted, wherein each de-identification strategy (such as pseudonym replacement, age generalization, and diagnosis code simplification) includes adjustable core parameters, for example: if the de-identification strategy is a pseudonym replacement, the basic parameter template can include the following core parameters: pseudonym character length (default 2-3 characters), character source library (preset surname library / name library), and repetition rate threshold (≤5%), which is only used as an example and does not limit the present application; if the de-identification strategy is age generalization, the basic parameter template can include the following core parameters: generalization interval interval (default 5 years / 10 years), and interval starting value (such as 0 years, 18 years), which is only used as an example and does not limit the present application. In actual use, these parameters need to be dynamically adjusted in combination with the replacement seed value, rather than using the default values.

[0030] Secondly, the mapping rule of the replacement seed value and the parameters is determined, i.e., a preset replacement seed value-parameter mapping rule library is called according to the type of the current sensitive entity, wherein the replacement seed value-parameter mapping rule library defines the association logic between the replacement seed value and the basic parameters based on the numerical characteristics of the replacement seed value (such as parity, numerical interval, and modulus operation result). For example: for numerical sensitive entities such as age and blood pressure, the rule can be that the generalization interval interval is determined by the replacement seed value mod2 of the 3rd-4th numerical value; for text sensitive entities such as name and address, the rule can be that the index of the character library is respectively corresponding to the quotient / remainder of the replacement seed value of the 1st-2nd numerical value divided by the length of the preset character library.

[0031] Thirdly, the specific parameters are calculated by substituting the replacement seed value, i.e., the unique replacement seed value corresponding to the current sensitive entity is substituted into the above mapping rule to calculate the final execution parameters of the de-identification strategy. Finally, the parameters are verified and adaptively corrected, i.e., the final parameters calculated are substituted into the de-identification strategy to verify whether they meet the requirements of privacy protection and data availability at the same time: if the parameters cause the de-identified data to lose clinical significance, for example, the age generalization interval is too large, and 25 years old is classified into 0-50 years old, then the starting value and length are recalculated based on the first four numerical values of the replacement seed value to ensure that the interval meets the clinical grouping logic; if the parameters cause the replacement content repetition rate to exceed the standard, for example, the pseudonym repetition rate is >5%, then the last three numerical values of the replacement seed value are called again to update the character library index to ensure the parameter adaptability.

[0032] It should be noted that the clinical data of the present application is high in sensitive area, and these positions naturally exist privacy mutations. In traditional desensitization, the permission uniformity assumes that the weights of each entity are equal, but the actual medical record text non-uniformity will distort the desensitization time. The interference degree of text non-uniformity on desensitization can be quantified by access scenario, and then the desensitization strategy is adjusted. Specifically, the following methods can be used, that is: First, identify the non-uniformity characteristics of medical record text, that is, extract the distribution characteristics and expression characteristics of sensitive entities in clinical medical record text data. The distribution characteristics, for example, the difference in entity distribution density in different chapters, the expression characteristics, for example, the difference in expression forms such as full name, abbreviation, etc. of the same sensitive entity, and the specific forms of text non-uniformity are determined. Second, set the quantitative index according to the access scenario, that is, set the quantitative index of desensitization effect according to the core data demand of the current access scenario (such as diagnosis and treatment scenario, research scenario), for example, the diagnosis and treatment scenario focuses on the positioning accuracy rate of sensitive entities and the matching accuracy rate of desensitization strategy and entity type, the research scenario focuses on the statistical consistency of generalized data and the replacement repetition rate of sensitive entities, and the index is highly adapted to the scene demand. Third, calculate the index deviation value, that is, obtain the ideal index value without text non-uniformity. The ideal index value can be based on the standardized text sample preset and the actual index value containing text non-uniformity. The influence degree of text non-uniformity on desensitization effect is quantified by calculating the difference or deviation rate between the two, for example, positioning accuracy rate deviation rate = (ideal accuracy rate-actual accuracy rate) / ideal accuracy rate x 100%). Finally, the interference degree level is determined, and the desensitization strategy is adjusted according to the interference degree level, that is, the interference degree level is determined according to the index deviation threshold in different access scenarios, for example, the positioning accuracy rate deviation rate > 10% in the diagnosis and treatment scenario is high interference, and the statistical consistency deviation rate ≤ 5% in the research scenario is low interference. Adjust the desensitization strategy according to the interference degree level, that is, if it is high interference, the sensitive entity positioning method can be optimized or multiple expression entities can be adapted. The sensitive entity positioning method can be optimized, for example, dense chapter by chapter scanning, and multiple expression entities can be adapted, for example, for the case where the same type of sensitive entity in clinical data has multiple different expression forms, such as diagnosis entity acute myocardial infarction, which may appear as acute myocardial infarction, AMI, acute coronary artery occlusion causing myocardial infarction, etc. Physiological index entity systolic pressure may appear as systolic pressure, SBP, high pressure, etc. By adding multiple expression mapping logic in the desensitization strategy, the system can identify that these different expressions all belong to the same sensitive entity, and then apply the corresponding desensitization rules uniformly. If it is low interference, the sensitive strategy parameters are implemented directional small optimization, for example, for numerical generalization accuracy, replacement repetition rate threshold and other key dimensions, the adjustment range is controlled according to the interference degree and scene demand, which is not described here.

[0033] In addition, it should be noted that the above access scenario is a physical model for describing clinical data access. The rule is that the diagnosis and treatment scene needs accurate data, and the scientific research scene needs generalized data. In the diagnosis and treatment scene, medical staff need to formulate a diagnosis and treatment plan based on the specific and accurate clinical data of the patient (for example, accurate ICD diagnosis code, real-time physiological index value, complete medical history details). The accuracy of the data directly affects the correctness of the diagnosis and treatment decision, so accurate data reflecting the true situation of the individual patient needs to be disclosed. In the scientific research scene, researchers are concerned about the regularity of group data (such as the incidence of a certain disease, treatment effect statistics), and there is no need to know the accurate information of individual patients. Generalization processing (for example, specific age is classified into age groups, and specific diagnosis code is simplified into disease categories) can protect patient privacy while meeting the needs of data statistical analysis for scientific research, and avoid individual privacy leakage.

[0034] The above embodiments are only illustrative and not specifically limited. In specific implementation, the disclosure granularity can be calculated using the access permission level to replace the traditional fixed permission to compensate for the impact of scene changes on access. Here, no specific limitation is made.

[0035] According to the matched desensitization strategy, the actual adjustment of the strategy on the current text is queried from the preset desensitization rule library. Since the sensitive entity contains rich types, its actual adjustment is not determined by a single type, but the type is crucial to the adjustment. The adjustment calculated can be used to compensate for the characteristics of the generated replacement content. The purpose of compensation is to correct the system error caused by using the preset strategy to identify sensitive entities. The compensated content is the determined replacement content. Here, no further description is made. It should be noted that the desensitization strategy in this application can be dynamically perceived through coordination with the replacement seed value, thereby solving the problem of clinical data uncertainty, and the permission error can be eliminated through accurate matching of the permission matrix. Here, no further description is made.

[0036] In step 105, each sensitive entity is replaced with the corresponding replacement content to generate a desensitized clinical text associated with the patient anonymous identifier.

[0037] In some embodiments, replacing each sensitive entity with the corresponding replacement content to generate a desensitized clinical text associated with the patient anonymous identifier can be specifically implemented in the following manner, that is: All sensitive entities in the medical record text data are traversed, and the starting index (S) and ending index (E) of the sensitive entity are located. The entity is sequentially replaced with the determined replacement content, for example, the original text is cut into a front context fragment and a rear context fragment, and spliced into a front context fragment + replacement content + rear context fragment, while the structure and non-sensitive part of the original text are preserved; If there are consecutive sensitive entities, the index offset of the subsequent entity is adjusted synchronously after replacement; and consistency check is performed on the replaced text. The generated desensitized clinical text is bound to a temporary session identifier, and a watermark or metadata tag is added, wherein the temporary session identifier is associated with the patient anonymous identifier in the audit log. If the sensitive entity is outside the context, the replacement content is inserted directly after the context fragment (the original text structure is retained).

[0038] In addition, in some embodiments, the application can also use a content-privilege combined weight, that is, the weight not only considers the access scenario, but also combines the replacement content to construct a revised weight, so that the desensitization calculation is more in line with the actual physical characteristics of the text, while enhancing the pertinence to the privacy signal, ultimately improving the accuracy and reliability of the privacy protection of clinical data in multiple scenarios, in addition, invalid entities can also be filtered in combination with the direction of sensitive entities, the direction of entities is identified through semantic analysis, and only entities with matching directions are assigned weights to filter sensitive entities with opposite directions.

[0039] It should be noted that in the prior art, whether it meets the mutation characteristics of a certain privilege is determined by whether the access privilege is greater than a preset threshold, or whether the access privilege is unique to privacy, so that normal privilege mutations and mutations caused by privacy can be distinguished, and non-privacy interference can be excluded. In the present embodiment, the weight distribution is driven by the access scenario, replacing the traditional average algorithm, so that entities closer to privacy have more power.

[0040] In some embodiments, the method further comprises: after generating the desensitized clinical text, recording the identity identifier of the requester, the access time and the desensitization operation log to form an audit chain; if the access privilege change or the patient privacy preference update is detected, sending a notification to the requester who has obtained the desensitized text, requiring to stop using and destroying, while retaining the notification record for auditing; analyzing the historical desensitization operation according to data availability indicators, privacy risk indicators and user feedback indicators, wherein the data availability indicators are, for example, a statistical error rate ≤10%, a clinical semantic integrity ≥90%, the privacy risk indicators are, for example, an anti-cracking rate ≤5%, a compliance standard rate =100%, and the user feedback indicators are, for example, a satisfaction score ≥80 points; if the availability indicators do not meet the standards, adjust the desensitization strategy parameters, for example, narrow the interval range; if the risk indicators exceed the standards, upgrade the desensitization strength, for example, from generalization to mask + pseudo-random replacement; after 100 data small range tests and effect verification, the updated desensitization rule library is deployed in full amount.

[0041] It should be noted that, as a preferred embodiment, the permission matrix is to map the access permission level and the sensitive entity sensitivity to a specific access level, wherein the access level is divided into diagnosis and treatment, scientific research and statistics, and in actual implementation, for example, in the diagnosis and treatment scene, the high sensitive entity needs to be authorized to disclose the specific value, and the medium / low sensitive entity discloses the specific value according to the authorization requirement; in the scientific research scene, the high sensitive entity is generalized as yes / no, and the medium / low sensitive entity is generalized as an interval value; in the statistical scene, all sensitive entities are aggregate values, and the actual permission can also be partitioned based on privacy performance and data level, rather than simply access level, which is only for illustration and is not limited.

[0042] In addition, another aspect of the present application, in some embodiments, the present application provides a clinical data privacy protection system, which comprises a clinical data privacy protection unit, which is described with reference to Figure 4 The figure is a structural schematic diagram of a clinical data privacy protection unit according to some embodiments of the present application, which specifically comprises an acquisition module 401, a processing module 402 and an execution module 403, which are described as follows: The acquisition module 401 is mainly used to acquire the identity identifier corresponding to the medical institution identity information of the requester and the patient anonymous identifier associated with the medical record text data when receiving the request for accessing the medical record text data in the present application. The processing module 402 is mainly used to perform medical semantic analysis on the clinical content in the medical record text data, identify a plurality of sensitive entities containing patient diagnosis and treatment characteristics, physiological indicators and personal identifiers, and associate the medical context in which each sensitive entity is located in the present application. The processing module 402 is also used to generate a specified replacement seed value for each sensitive entity based on the patient anonymous identifier in the present application. In addition, the processing module 402 is also used to determine the corresponding replacement content from the preset desensitization rule library for each sensitive entity according to the medical context in which the sensitive entity is located and the replacement seed value in the present application. The execution module 403 is mainly used to replace each sensitive entity with the corresponding replacement content to generate a desensitized clinical text associated with the patient anonymous identifier in the present application.

[0043] In addition, the present application also provides a computer device, which comprises a memory and a processor, the memory stores a code, and the processor is configured to acquire the code and execute the above-mentioned clinical data privacy protection method.

[0044] In some embodiments, with reference to Figure 5FIG. 1 is a schematic diagram of a computer device for implementing a method for protecting clinical data privacy according to some embodiments of the present application. The method in the above embodiments can be implemented by the computer device shown in FIG. 1, which comprises at least one processor 101, a communication bus 102, a memory 103, and at least one communication interface 104. Figure 5 The computer device shown in FIG. 1 comprises at least one processor 101, a communication bus 102, a memory 103, and at least one communication interface 104.

[0045] The processor 101 can be a general central processing unit (CPU), an application specific integrated circuit (ASIC), or one or more processors for controlling the execution of the method for protecting clinical data privacy in the present application.

[0046] The communication bus 102 can comprise a path for transmitting information between the above components.

[0047] The memory 103 can be a read only memory (ROM) or other type of static storage device that can store static information and instructions, a random access memory (RAM) or other type of dynamic storage device that can store information and instructions, an electrically erasable programmable read only memory (EEPROM), a compact disc read only memory (CDROM) or other optical disk storage, a magnetic disk or other magnetic storage device, or any other medium capable of carrying or storing desired program code in the form of instructions or data structures and that can be accessed by a computer, but not limited to. The memory 103 can exist independently and be connected to the processor 101 through the communication bus 102. The memory 103 can also be integrated with the processor 101.

[0048] The memory 103 is used to store program code for executing the scheme of the present application and is controlled by the processor 101 for execution. The processor 101 is used to execute the program code stored in the memory 103. The program code can include one or more software modules. The generation of the replacement seed value in the above embodiments can be implemented by one or more software modules in the program code of the processor 101 and the memory 103.

[0049] The communication interface 504, using any transceiver-type device, is used to communicate with other devices or communication networks, such as Ethernet, radio access network (RAN), wireless local area networks (WLAN), etc.

[0050] In a particular implementation, as one example, a computer device can include multiple processors, each of which can be a single CPU processor or a multi-CPU processor. A processor here can refer to one or more devices, circuits, and / or processing cores for processing data, such as computer program instructions.

[0051] The computer device described above can be a general-purpose computer device or a special-purpose computer device. In a particular implementation, the computer device can be a desktop computer, a laptop computer, a network server, a personal digital assistant (PDA), a mobile phone, a tablet computer, a wireless terminal device, a communication device, or an embedded device. The embodiments of the present application do not limit the type of computer device.

[0052] In addition, the present application also provides a computer-readable storage medium, which stores a computer program. The computer program is executed by a processor to implement the clinical data privacy protection method described above.

[0053] Although the preferred embodiments of the present application have been described, those skilled in the art can make additional changes and modifications to the embodiments once they know the basic inventive concept. Therefore, the appended claims are intended to cover all changes and modifications falling within the scope of the present application.

[0054] Obviously, those skilled in the art can make various modifications and variations to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalent technologies, the present application also intends to include these modifications and variations.

Claims

1. A method for protecting the privacy of clinical data, characterized in that, The method includes: When a request to access medical record text data is received, the identity identifier corresponding to the medical institution identity information of the requester and the patient anonymity identifier associated with the medical record text data are obtained. Medical semantic analysis is performed on the clinical content in the medical record text data to identify multiple sensitive entities containing patient diagnosis and treatment characteristics, physiological indicators and personal identifiers, and to associate the medical context in which each sensitive entity is located. Based on the patient's anonymous identifier, a specified replacement seed value is generated for each sensitive entity; For each sensitive entity, the corresponding replacement content is determined from the preset desensitization rule base based on the medical context of the sensitive entity and the replacement seed value. Each sensitive entity is replaced with its corresponding replacement content to generate desensitized clinical text associated with the patient's anonymity identifier.

2. The method according to claim 1, characterized in that, When a request to access medical record text data is received, obtaining the identity identifier corresponding to the medical institution identity information of the requester, and the patient anonymity identifier associated with the medical record text data specifically includes: Verify whether the requester's medical institution identity information matches the preset access authorization list; If the verification is successful, a unique identifier associated with the medical institution's identity information is extracted from the preset identity mapping table; Based on the metadata or associated database of the medical record text data, query and obtain the patient anonymity identifier corresponding to the medical record text data.

3. The method according to claim 1, characterized in that, Medical semantic analysis is performed on the clinical content of the medical record text data to identify multiple sensitive entities containing patient diagnosis and treatment characteristics, physiological indicators, and personal identifiers, and the medical context in which each sensitive entity is located is associated, specifically including: The medical record text data is segmented and entity recognized to extract potential sensitive entities, which include one or more of the following: name, age, diagnosis code, test value, treatment plan, consultation time, consultation department, and attending physician's name. Semantic parsing is performed on the identified sensitive entities to associate them with their medical context information in the medical record text. The medical context information includes the chapter to which the sensitive entity belongs and adjacent medical terms. The chapter includes the chief complaint, present illness history, or diagnostic discussion.

4. The method according to claim 1, characterized in that, Based on the patient anonymity identifier, generating a specified replacement seed value for each sensitive entity specifically includes: The patient's anonymous identifier and the requester's identity identifier are used as base values; A unique replacement seed value is calculated using a pseudo-random number generator, based on the type and location index of each sensitive entity.

5. The method according to claim 1, characterized in that, For each sensitive entity, based on the medical context of the sensitive entity and the replacement seed value, the corresponding replacement content is determined from the preset desensitization rule base, specifically including: Query the requester's identity identifier and the access permission level corresponding to the access scenario, and determine the granularity of sensitive entities that are allowed to be disclosed from the preset permission matrix; Based on the type of sensitive entity and the medical context in which the sensitive entity is located, an applicable desensitization strategy is matched from the desensitization rule base; Using the replacement seed value, the matched desensitization strategy is parameterized and adjusted to generate personalized replacement content.

6. The method according to claim 1, characterized in that, Replacing each sensitive entity with its corresponding replacement content to generate desensitized clinical text associated with the patient's anonymity identifier specifically includes: Iterate through all sensitive entities in the medical record text data and replace them with the determined replacement content in sequence, while preserving the original text structure and non-sensitive parts; Perform a consistency check on the replaced text; The generated desensitized clinical text is bound to a temporary session identifier and watermarked or marked with metadata, wherein the temporary session identifier is associated with the patient anonymity identifier in the audit log.

7. The method according to claim 1, characterized in that, The method further includes: After generating the desensitized clinical text, the requester's identity identifier, access time, and desensitization operation log are recorded to form an audit chain; If a change in access permissions or an update to a patient's privacy preferences is detected, a notification is sent to the requester who has obtained the anonymized text, requesting them to stop using it and destroy it, while retaining a record of the notification for auditing purposes; Analyze historical de-identification operations and update the de-identification rule base.

8. A clinical data management system, which employs the method described in any one of claims 1 to 7 for clinical data privacy protection, the system comprising a clinical data privacy protection unit, characterized in that, The clinical data privacy protection unit specifically includes: The acquisition module is used to acquire, when a request to access medical record text data is received, an identity identifier corresponding to the medical institution identity information of the requester, and a patient anonymity identifier associated with the medical record text data; The processing module is used to perform medical semantic analysis on the clinical content in the medical record text data, identify multiple sensitive entities containing patient diagnosis and treatment characteristics, physiological indicators and personal identifiers, and associate the medical context in which each sensitive entity is located. The processing module is also used to generate a specified replacement seed value for each sensitive entity based on the patient's anonymous identifier; The processing module is also used to determine the corresponding replacement content from a preset desensitization rule base for each sensitive entity, based on the medical context of the sensitive entity and the replacement seed value. The execution module is used to replace each sensitive entity with the corresponding replacement content and generate desensitized clinical text associated with the patient's anonymity identifier.

9. A computer device, characterized in that, The computer device includes a memory and a processor, the memory storing code, and the processor being configured to retrieve the code and execute the clinical data privacy protection method as described in any one of claims 1 to 7.

10. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by a processor, it implements the clinical data privacy protection method as described in any one of claims 1 to 7.

Images