Anonymization processing method and system

Abstract

One of the embodiments of the present specification provides an anonymization processing method and system. The method can comprise: acquiring at least one candidate medical data set, each medical data set in the at least one candidate medical data set corresponding to an object, at least one medical image of the object being included in each medical data set; determining one or more target medical data sets based on the at least one candidate medical data set according to received instructions; performing batch anonymization processing on the one or more target medical data sets to obtain one or more anonymized medical data sets; and sending the one or more anonymized medical data sets to a server.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of data processing, in particular to an anonymization processing method and system. BACKGROUND

[0002] In the field of medical images, Digital Imaging and Communications in Medicine (DICOM) is a widely used file format standard for medical image processing, storage, transmission, and printing. The standard was created by the National Electric Manufacturers Association (NEMA) to help transmit and view medical images. DICOM images have a wide range of applications in fields such as remote consultation, academic conferences, multi-center clinical trials, artificial intelligence (AI), etc. Before sharing medical data including DICOM images to different users, it is usually necessary to anonymize the medical data, i.e. to delete, hide or replace the private information of the patient such as name, ID number, etc. to protect data privacy and security. In recent years, with the rapid development of cloud storage, cloud sharing and other technologies, the demand for sharing of medical data is also increasing. Therefore, it is necessary to provide an efficient private information processing method. SUMMARY

[0003] According to an aspect of the present application, a method for anonymization processing is provided. The method comprises obtaining at least one candidate medical data set and determining one or more target medical data sets based on the at least one candidate medical data set according to a received instruction. Each candidate medical data set in the at least one candidate medical data set corresponds to an object, and each candidate medical data set includes at least one candidate medical image of the object. The method further comprises performing anonymization processing on the one or more target medical data sets to obtain one or more anonymized medical data sets.

[0004] In some embodiments, determining one or more target medical data sets based on the at least one candidate medical data set according to the received instruction comprises: selecting one or more medical images from the at least one candidate medical data set as a group of target medical images based on the instruction; and designating one or more candidate medical data sets corresponding to the group of target medical images as the one or more target medical data sets.

[0005] In some embodiments, the instructions include information of a body part of interest, and the determining, according to the instructions, a set of target medical images based on the at least one candidate medical data set comprises: determining, according to the instructions, a medical image corresponding to the body part of interest from the at least one candidate medical data set; and designating the medical image corresponding to the body part of interest as the set of target medical images.

[0006] In some embodiments, the determining, according to the instructions, a medical image corresponding to the body part of interest from the at least one candidate medical data set comprises: identifying, according to the instructions, one or more candidate medical images in the at least one candidate medical data set to determine the medical image corresponding to the body part of interest.

[0007] In some embodiments, the method further comprises grouping the one or more candidate medical images based on body parts corresponding to the one or more candidate medical images in the at least one candidate medical data set.

[0008] In some embodiments, each of the at least one candidate medical data set includes one or more feature labels, and the instructions include information of at least one feature label of interest in the one or more feature labels. The selecting, according to the received instructions, one or more target medical data sets from the at least one candidate medical data set comprises: determining, according to the instructions, a sub-set of medical data under the at least one feature label of interest from the at least one candidate medical data set; and designating the sub-set of medical data under the at least one feature label of interest as the one or more target medical data sets.

[0009] In some embodiments, the one or more feature labels are selected from a combination of: a type of medical image, a body part corresponding to a medical image, a subject identification number, a time of examination, a type of examination, an examination parameter, a subject name, a subject gender, a subject age, a subject weight, whether the subject is pregnant, and whether the subject has a specific disease.

[0010] In some embodiments, the anonymizing the one or more target medical data sets comprises: using an anonymization algorithm to clear, hide, or replace private information text under one or more feature labels corresponding to the one or more target medical data sets.

[0011] In some embodiments, the anonymizing the one or more target medical data sets comprises, for each medical image in one or more medical images in the one or more target medical data sets, using an anonymization algorithm to clear, hide, or replace privacy information text displayed on the medical image.

[0012] In some embodiments, the method further comprises causing a list of information corresponding to the at least one candidate medical data set to be displayed via a terminal; causing the terminal to display an option to select from the at least one candidate medical data set; and obtaining the instruction input from the terminal to select the one or more target medical data sets.

[0013] In some embodiments, the method further comprises, after the anonymizing the one or more target medical data sets, updating the list of information, the updated list of information including anonymized privacy information text under one or more feature labels corresponding to the one or more target medical data sets; and causing the updated list of information to be displayed via a terminal.

[0014] In some embodiments, the causing the terminal to display the option to select from the at least one candidate medical data set comprises causing the terminal to display an option to select from one or more feature labels corresponding to the at least one candidate medical data set.

[0015] In some embodiments, the anonymizing the one or more target medical data sets comprises, in response to a one-click anonymization button displayed by a terminal being triggered, automatically performing batch anonymization on the one or more target medical data sets.

[0016] In some embodiments, the selecting, based on the received instruction, one or more target medical data sets from the at least one candidate medical data set comprises, in response to a one-click anonymization button displayed by a terminal being triggered, causing the terminal to display an option to select from among full anonymization functionality and partial anonymization functionality; in response to the partial anonymization functionality being selected, causing the terminal to display the option to select from the at least one candidate medical data set; and obtaining the instruction input from the terminal to select the one or more target medical data sets.

[0017] In some embodiments, the method further comprises sending the one or more anonymized medical data sets to a server.

[0018] According to another aspect of the present disclosure, there is provided a system for anonymization processing, comprising at least one storage medium storing at least one set of instructions; and at least one processor configured to communicate with the at least one storage medium. Wherein the at least one processor is instructed to cause the system to obtain at least one candidate medical data set, and determine one or more target medical data sets based on the at least one candidate medical data set according to received instructions, when executing the at least one set of instructions. Each of the at least one candidate medical data set corresponds to an object, and each of the at least one candidate medical data set comprises at least one candidate medical image of the object. The at least one processor is further instructed to cause the system to perform anonymization processing on the one or more target medical data sets to obtain one or more anonymized medical data sets.

[0019] According to yet another aspect of the present disclosure, there is provided a system for anonymization processing, comprising an obtaining module, a selecting module, and an anonymization processing module. The obtaining module is configured to obtain at least one candidate medical data set, each of the at least one candidate medical data set corresponding to an object, and each of the at least one candidate medical data set comprising at least one candidate medical image of the object. The selecting module is configured to determine one or more target medical data sets based on the at least one candidate medical data set according to received instructions. The anonymization processing module is configured to perform anonymization processing on the one or more target medical data sets to obtain one or more anonymized medical data sets.

[0020] According to yet another aspect of the present disclosure, there is provided a non-transitory computer-readable storage medium for anonymization processing. The non-transitory computer-readable storage medium comprises at least one set of instructions. When executed by at least one processor of a computer device, the at least one set of instructions instructs the at least one processor to perform a set of methods. The set of methods comprises obtaining at least one candidate medical data set, and determining one or more target medical data sets based on the at least one candidate medical data set according to received instructions. Each of the at least one candidate medical data set corresponds to an object, and each of the at least one candidate medical data set comprises at least one candidate medical image of the object. The set of methods further comprises performing anonymization processing on the one or more target medical data sets to obtain one or more anonymized medical data sets. BRIEF DESCRIPTION OF DRAWINGS

[0021] The present specification will be further explained in the way of example embodiments, which will be described in detail with reference to the accompanying drawings. These embodiments are not limiting, in which the same numbers refer to the same structures, wherein:

[0022] Figure 1 is a schematic diagram of an application scenario of a medical data processing system according to some embodiments of the present specification;

[0023] Figure 2 is a schematic diagram of exemplary hardware and / or software of a computing device according to some embodiments of the present specification;

[0024] Figure 3 is a schematic diagram of exemplary hardware and / or software of a terminal device according to some embodiments of the present specification;

[0025] Figure 4 is a schematic diagram of exemplary modules of a processing device according to some embodiments of the present specification;

[0026] Figure 5 is a schematic diagram of an anonymization processing method according to some embodiments of the present specification;

[0027] Figure 6 is a schematic diagram of a user interface of batch anonymization processing according to some embodiments of the present specification;

[0028] Figure 7 is a schematic diagram of a user interface of batch anonymization processing according to some embodiments of the present specification;

[0029] Figure 8 is a schematic diagram of a user interface of batch anonymization processing according to some embodiments of the present specification. DETAILED DESCRIPTION

[0030] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings needed to be used in the embodiment description will be briefly introduced below. However, those skilled in the art should understand that the present application can be implemented without these details. In other cases, in order to avoid unnecessary obscurity of the aspects of the present application, well-known methods, processes, systems, components and / or circuits have been described at a high level. It is obvious for those skilled in the art that various changes can be made to the disclosed embodiments, and the general principles defined in the present application can be applied to other embodiments and application scenarios without departing from the principles and scope of the present application. Therefore, the present application is not limited to the shown embodiments, but conforms to the broadest range consistent with the patentable scope.

[0031] The terminology used in the present application is for the purpose of describing particular example embodiments only and is not intended to be limiting. As used in the present application, the singular forms "a," "an," and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. It will be further understood that the terms "comprises," "comprising," "includes," and / or "including," when used in this specification, specify the presence of stated features, integers, steps, operations, elements, and / or components, but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or groups thereof.

[0032] It is to be understood that the terms "system," "engine," "unit," "module," and / or "block" used in the present application are merely used to differentiate different levels of different components, elements, parts, or assemblies in ascending order. However, these terms can be replaced by other expressions if the same purpose can be achieved.

[0033] It is to be understood that, unless the context clearly indicates otherwise, when a unit, engine, module, or block is referred to as being "on," "connected to," or "coupled to" another unit, engine, module, or block, it can be directly on, connected to, coupled to, or in communication with the other unit, engine, module, or block, or there can be intervening units, engines, modules, or blocks. In the present application, the term "and / or" can include any one or more of the associated listed items or combinations thereof.

[0034] Flowcharts in the present specification are used to illustrate operations performed by systems according to embodiments of the present specification, and the related descriptions are provided to help better understand the medical imaging method and / or system. It should be understood that the preceding or subsequent operations are not necessarily performed in sequence. Instead, each step can be processed in reverse order or simultaneously. Meanwhile, other operations can be added to these processes, or one or more steps can be removed from these processes.

[0035] This specification provides an anonymization method and system. This method and system can be used to process privacy information contained in medical data, thereby achieving anonymization of medical data to protect patient privacy. Traditional methods for anonymizing medical data typically involve selecting a single medical dataset, performing anonymization, and then sequentially selecting the next medical dataset to merge and complete the anonymization process. This approach is time-consuming and requires significant user time and effort. In the anonymization method provided in this specification, the processor can provide the user with the option to select from multiple candidate medical datasets. For example, the user can select all, select some, or select a category of candidate medical datasets based on feature labels to form the target medical dataset for anonymization. The medical dataset may include medical images, such as DICOM images, DICOM labels, information lists, etc. The terminal device can receive instructions from the user regarding the selected target medical dataset and transmit these instructions to the processor. The processor can perform batch anonymization processing on the target medical dataset to obtain one or more anonymized medical datasets. The processor can then upload the one or more anonymized medical datasets to a server. Compared with traditional methods, the anonymization method provided in this manual can quickly and efficiently anonymize large amounts of data, effectively protect the security of privacy information, save users' time and energy, and improve the user experience.

[0036] Figure 1 This is a schematic diagram illustrating the application scenarios of a medical data processing system according to some embodiments of this specification.

[0037] like Figure 1 As shown, the medical data processing system 100 may include a processing device 110, a network 120, a terminal device 130, a storage device 140, and a server 150. The various components of the system 100 can be interconnected via the network 120. For example, the processing device 110 and the terminal device 130 can be connected or communicate via the network 120. Similarly, the processing device 110 and the server 150 can be connected or communicate via the network 120.

[0038] Processing device 110 can process data and / or information obtained from at least one terminal device 130, storage device 140, or other components of medical data processing system 100. For example, processing device 110 can acquire medical data from storage device 140. Processing device 110 can also acquire data from medical imaging devices (…). Figure 1 (Not shown) The processing device 110 acquires a medical image of the object and anonymizes it. After anonymization, the processing device 110 can also send the anonymized medical data to the server 150.

[0039] A medical imaging device can be used to scan an object within a detection region to obtain scan data of the object. In some embodiments, the object can include a patient. The medical imaging device can scan a particular portion of the patient’s body (e.g., a head, a chest, an abdomen, etc.) or the entire body to acquire a medical image of the object. For example, the medical image can include a computed tomography (CT) image, a magnetic resonance (MR) image, an ultrasound image, a positron emission tomography (PET) image, an optical coherence tomography (OCT) image, etc., or any combination thereof.

[0040] In some embodiments, the processing device 110 can include one or more processors (e.g., a single-chip processor or a multi-chip processor). For example only, the processing device 110 can include a central processing unit (CPU), an application-specific integrated circuit (ASIC), an application-specific instruction-set processor (ASIP), a graphics processing unit (GPU), a physics processing unit (PPU), a digital signal processor (DSP), a field-programmable gate array (FPGA), a programmable logic device (PLD), a controller, a microcontroller unit, a reduced instruction set computer (RISC), a microprocessor, etc., or any combination thereof.

[0041] The network 120 can include any suitable network capable of facilitating the exchange of information and / or data of the medical data processing system 100. In some embodiments, at least one component of the medical data processing system 100 (e.g., the terminal device 130, the processing device 110, the storage device 140) can exchange information and / or data with at least one other component of the medical data processing system 100 via the network 120. For example, the processing device 110 can obtain medical data of one or more objects from the storage device 140 via the network 120. The network 120 can include a public network (e.g., the Internet), a private network (e.g., a local area network (LAN)), a wired network, a wireless network (e.g., an 802.11 network, a Wi-Fi network), a frame relay network, a virtual private network (VPN), a satellite network, a telephone network, routers, hubs, switches, server, database, or any combination thereof. For example, the network 120 can include a wired network, a wired network, a fiber-optic network, a telecommunications network, an intranet, a wireless local area network (WLAN), a metropolitan area network (MAN), a public switched telephone network (PSTN), a Bluetooth TM network, a ZigBee TM network, a near-field communication (NFC) network, etc., or any combination thereof. In some embodiments, the network 120 can include at least one network access point. For example, the network 120 can include wired and / or wireless network access points, such as base stations and / or Internet exchange points, via which at least one component of the medical data processing system 100 can connect to the network 120 to exchange data and / or information.

[0042] The terminal device 130 can communicate and / or connect with the processing device 110 and / or the storage device 140. In some embodiments, a user can interact with the processing device 110 through the terminal device 130 to send instructions. For example, the user can select a set of medical data from a set of candidate medical data for anonymization through the terminal device 130. For another example, the user can send an instruction to start performing batch anonymization through the terminal 130. In some embodiments, the terminal device 130 can include a mobile device 131, a tablet 132, a laptop 133, or the like, or any combination thereof. For example, the mobile device 131 can include a mobile control handle, a personal digital assistant (PDA), a smartphone, or the like, or any combination thereof.

[0043] In some embodiments, the terminal device 130 can include an input device, an output device, or the like. The input can include a keyboard input, a touch screen (e.g., with tactile or haptic feedback) input, a voice input, an eye tracking input, a gesture tracking input, a brain monitoring system input, an image input, a video input, or any other similar input mechanism. The input information received through the input device can be transmitted to the processing device 110 through, for example, a bus, for further processing. Other types of input devices can include a cursor control device, such as a mouse, a trackball, or cursor direction keys, or the like. The output device can include a display, a speaker, a printer, or the like, or any combination thereof. The output device can be used to show information to the user, provide functional options (such as an option to perform anonymization), or the like. In some embodiments, the terminal device 130 can be integrated with the processing device 110.

[0044] In some embodiments, the server 150 can be a single server or a group of servers. The group of servers can be centralized or distributed. In some embodiments, the server 150 can be local or remote. For example, the server 150 can receive a set of anonymized medical data from the processing 110 through the network 120. The server 150 can also send the received set of anonymized medical data to other external devices, such as sharing to other storage devices or terminal devices. In some embodiments, the server 150 can be implemented on a cloud platform. For example, the cloud platform can include a private cloud, a public cloud, a hybrid cloud, a community cloud, a distributed cloud, an inter-cloud, a multi-cloud, or the like, or any combination thereof.

[0045] The storage device 140 can store data, instructions, and / or any other information. For example, the storage device 140 can store medical image data of a subject acquired by a medical image device. In some embodiments, the storage device 140 can store data obtained from the processing device 110, the terminal device 130, and / or the server 150. For example, the storage device 140 can store a set of anonymized medical data processed by the processing device 110. In some embodiments, the storage device 140 can store data and / or instructions used by the processing device 110 to perform or use to complete the exemplary methods described in this specification. In some embodiments, the storage device 140 can include a mass storage, a removable storage, a volatile read / write memory, a read-only memory (ROM), etc., or any combination thereof. In some embodiments, the storage device 140 can be implemented on a cloud platform. In some embodiments, the storage device 140 can be integrated with the processing device 110 or other devices.

[0046] It should be noted that the foregoing description is only illustrative of the application and not intended to be limiting. Numerous variations and modifications will become apparent to those skilled in the art once the contents of the present application are appreciated. Features, structures, methods, and other characteristics of the exemplary embodiments described herein can be combined in various ways to obtain yet further exemplary embodiments. For example, the server 150 can also be a data storage device including a cloud computing platform (e.g., public cloud, private cloud, community and hybrid cloud, etc.). However, such variations and modifications do not depart from the scope of the present application.

[0047] Figure 2 is a schematic diagram of exemplary hardware and / or software of a computing device shown in accordance with some embodiments of the present application. As shown, the computing device 200 can include a processor 210, a memory 220, an input / output (I / O) interface 230, and a communication port 240. In some embodiments, the processing device 110 of the data processing system 100 can be implemented in the computing device 200. Figure 2

[0048] ​The processor 210 can execute computing instructions (program code) and perform the functions of the medical data processing system 100 described in the present application. The computing instructions can include programs, objects, components, data structures, procedures, modules and functions (the functions refer to specific functions described in the present application). For example, the processor 210 can perform batch anonymization processing on medical data obtained from any component of the medical data processing system 100. In some embodiments, the processor 210 can include a microcontroller, a microprocessor, a reduced instruction set computer (RISC), an application specific integrated circuit (ASIC), an application specific instruction set processor (ASIP), a central processing unit (CPU), a graphics processing unit (GPU), a physics processing unit (PPU), a microcontroller unit, a digital signal processor (DSP), a field programmable gate array (FPGA), an advanced RISC machine (ARM), a programmable logic device, and any circuit and processor capable of executing one or more functions, etc., or any combination thereof. For illustration only, Figure 2 The computing device 200 in FIG. 1 is described with only one processor, but it is noted that the computing device 200 in the present application can also include multiple processors.

[0049] The memory 220 can store data / information obtained from any other component of the medical data processing system 100. In some embodiments, the memory 220 can include a mass storage, a removable storage, a volatile read and write memory, and a read only memory (ROM), etc., or any combination thereof. The exemplary mass storage can include a disk, an optical disk, and a solid state drive, etc. The removable storage can include a flash drive, a floppy disk, an optical disk, a memory card, a compact disk, and a magnetic tape, etc. The volatile read and write memory can include a random access memory (RAM). The RAM can include a dynamic RAM (DRAM), a double data rate synchronous dynamic RAM (DDR SDRAM), a static RAM (SRAM), a thyristor RAM (T-RAM), and a zero-capacitor (Z-RAM), etc. The ROM can include a mask ROM (MROM), a programmable ROM (PROM), an erasable programmable ROM (EPROM), an electrically erasable programmable ROM (EEPROM), an optical disk ROM (CD-ROM), and a digital versatile disk ROM, etc.

[0050] The input / output interface (I / O) 230 can be used to input or output signals, data, or information. In some embodiments, the input / output interface 230 can enable a user to interface with the medical data processing system 100. In some embodiments, the input / output interface (I / O) 230 can include input devices and output devices. Example input devices can include one or more of a keyboard, a mouse, a touchscreen, a microphone, and the like, in any combination. Example output devices can include a display device, a speaker, a printer, a projector, and the like, or any combination thereof. An example display device can include one or more of a liquid crystal display (LCD), a light-emitting diode (LED)-based display, a flat panel display, a curved display, a television device, a cathode ray tube (CRT), and the like, in any combination. The communication port 240 can be connected to a network for data communication. The connection can be a wired connection, a wireless connection, or a combination of both. The wired connection can include a cable, an optical cable, a telephone line, and the like, or any combination thereof. The wireless connection can include one or more of Bluetooth, Wi-Fi, WiMax, WLAN, ZigBee, a mobile network (e.g., 3G, 4G, or 5G, and the like), and the like, in any combination. In some embodiments, the communication port 240 can be a standardized port, such as RS232, RS485, and the like. In some embodiments, the communication port 240 can be a specially designed port. For example, the communication port 240 can be designed according to the Digital Imaging and Communications in Medicine (DICOM) protocol.

[0051] Figure 3 is a schematic diagram of exemplary hardware and / or software components of a terminal device, according to some embodiments of the present application. The terminal device 130 in the medical data processing system 100 can be implemented on a terminal device 300. As shown in Figure 3 , the terminal device 300 can include a communication platform 310, a display 320, a graphics processing unit (GPU) 330, a central processing unit (CPU) 340, an I / O 350, a memory 360, and a storage 390. In some embodiments, any other appropriate components can also be included in the terminal device 300, including but not limited to a system bus or controller (not shown). In some embodiments, an operating system 370 (e.g., iOS TM , Android TM , Windows Phone TM ) and one or more applications 380 can be loaded from the storage 390 into the memory 360 for execution by the CPU 340. The applications 380 can include a browser or any other suitable mobile application for receiving and rendering information related to image processing or other information from the processing device 110. User interaction with the information stream can be implemented through the I / O 350 and provided to the processing device 120 and / or other components of the medical data processing system 100 through the network 120.

[0052] One aspect of this specification provides a method for anonymization processing, which can, for example... Figure 1 This is implemented in the medical data processing system 100 shown.

[0053] Figure 4 These are exemplary block diagrams of a processing apparatus according to some embodiments of this specification. Figure 4 As shown, the processing device 110 may include an acquisition module 410, a selection module 420, an anonymization processing module 430, and a sending module 440. These modules may be all or part of the hardware circuitry of the processing device 110. These modules may also be implemented as applications or instructions read and executed by the processing device 110. Furthermore, these modules may be any combination of hardware circuitry and application programs / instructions. For example, when the processing device 110 is executing an application program / instruction, these modules may be part of the processing device 110.

[0054] The acquisition module 410 can acquire data related to the anonymization processing system 100 from external devices and / or from other components within the anonymization processing system 100. For example, the acquisition module 410 can acquire at least one candidate medical data set from the storage device 140. In some embodiments, a medical data set may correspond to a single medical examination of an object, such as a medical imaging examination. The medical data set may include various forms of medical data, such as text, images, audio, video, etc. For example, the medical data set may include information records of the object, at least one medical image of the object (e.g., a patient), image tags of the at least one medical image, etc. The information records of the object may be records in text form, facilitating user access. For example, the information records of the object may be an information list, which may list information related to the object and / or the medical image, such as one or more of the following: body part corresponding to the medical image, object identification number, examination time, examination type, examination parameters, object name, object ID number, object social security number, object gender, object contact number, object home address, object age, object weight, whether the object is pregnant, and whether the object suffers from a specific disease. By way of example only, the medical image may be an ultrasound image, CT image, MR image, PET image, etc. In some embodiments, the medical image may be a DICOM image, and the image tag may be a DICOM tag.

[0055] The selection module 420 can determine one or more target medical data sets based on the at least one candidate medical data set according to the received instruction. In some embodiments, the terminal device 130 can display at least part of the information in the at least one candidate medical data set to the user, so that the user selects the one or more target medical data sets. After the terminal device 130 receives the instruction of the user about the selected target medical data set, the terminal device 130 can send the instruction to the processing device 110. The selection module 420 can determine the one or more target medical data sets based on the received instruction. In some embodiments, the selection module 420 can specify the sub-set of medical data under the at least one feature label of interest specified by the user as the one or more target medical data sets according to the feature label of each candidate medical data set in the at least one candidate medical data set. In some embodiments, the selection module 420 can determine the medical image corresponding to the body part of interest from the at least one candidate medical data set based on the instruction, and specify the medical image corresponding to the body part of interest as the one or more target medical images.

[0056] The anonymization processing module 430 can anonymize the one or more target medical data sets to obtain one or more anonymized medical data sets. For example, the anonymization processing module 430 can use an anonymization algorithm to remove, hide, or replace the private information text under one or more feature labels corresponding to the one or more target medical data sets. For another example, the anonymization processing module 430 can use an anonymization algorithm to remove, hide, or replace the private information text displayed on a medical image. In some embodiments, the anonymization processing module 430 can further generate a series of instructions to control the content displayed to the user on the terminal device 130. For example, the anonymization processing module 430 can send an instruction to the terminal device 130 to display a list of information corresponding to the at least one candidate medical data set through the terminal device 130; display an option for selecting from the at least one candidate medical data set on the terminal device 130; and obtain the instruction input from the terminal device 130 for selecting the one or more target medical data sets. For another example, the anonymization processing module 430 can update the list of information after the anonymization processing on the one or more target medical data sets, and the updated list of information includes the anonymized private information text under one or more feature labels corresponding to the one or more target medical data sets; and generate an instruction to display the updated list of information through the terminal device 130. In some embodiments, the anonymization processing module 430 can cause the terminal to display an option for selecting from one or more feature labels corresponding to the at least one candidate medical data set. The anonymization processing module 430 can automatically perform batch anonymization processing on the one or more target medical data sets in response to a one-click anonymization button displayed on the terminal being triggered. In some embodiments, in response to the one-click anonymization button displayed on the terminal being triggered, the anonymization processing module 430 can generate an instruction to cause the terminal to display an option for selecting from all anonymization functions and partial anonymization functions; in response to the partial anonymization function being selected, cause the terminal to display an option for selecting from the at least one candidate medical data set; and obtain the instruction input from the terminal for selecting the one or more target medical data sets.

[0057] The sending module 440 can send the one or more anonymized medical data sets to the server 150. In some embodiments, the sending module 440 can automatically send the anonymized medical data sets to the server 150 after the anonymization processing module 430 completes the anonymization processing of the target medical data set. Alternatively, the sending module 440 can send the anonymized medical data sets to the server 150 after the receiving module 410 receives the instruction from the user to upload the anonymized medical data sets. In some embodiments, the processor can upload at least a portion of the data sets selected by the user from the one or more anonymized medical data sets to the server according to the instruction from the user. In some embodiments, the sending module 440 can also send various instructions (e.g., the instructions generated by the anonymization processing module 430) to the terminal device 130 to control the content displayed to the user by the terminal device 130.

[0058] It should be noted that the above description is provided for the purpose of illustration only and is not intended to limit the scope of the present application. Various modifications and changes can be made by those of ordinary skill in the art based on the description of the present application. However, these modifications and changes do not depart from the scope of the present application. In some embodiments, any of the above-mentioned modules can be divided into two or more units. For example, the selection module 420 can be divided into two units, one of which can be configured to determine the target medical data set selected by the user from the one or more candidate medical data sets based on the received instruction from the user, and the other of which can be configured to group the candidate medical data sets according to the feature tags of the candidate medical data sets. In some embodiments, the processing device 110 can include one or more additional modules. For example, the processing device 110 can further include a storage module that can be configured to store data obtained or generated by other modules, for example, the storage module can store the anonymized medical data sets.

[0059] Figure 5 is an exemplary flowchart of an anonymization processing method according to some embodiments of the present specification. Specifically, the process 500 can be executed by a processor, for example, the processing device 110 in the medical data processing system 100, the processor 210 of the computing device 200, or the CPU 340 of the terminal device 300. In some embodiments, the process 500 can be stored in the form of a program or instructions in a storage device (such as the storage device 140 or the memory 220), and when the medical data processing system 100 (such as the processing device 110) executes the program or instructions, the process 500 can be implemented. In some embodiments, the process 500 can be executed by one or more modules in Figure 4

[0060] ​In step 502, the processing device 110 can obtain at least one candidate medical data set. For example, the processing device 110 can obtain the at least one candidate medical data set from the storage device 140. In some embodiments, step 502 can be performed by the obtaining module 410.

[0061] In some embodiments, one medical data set can correspond to one medical examination, such as a medical imaging examination, of one subject. The at least one candidate medical data set can include candidate medical data sets corresponding to multiple subjects. In some embodiments, one medical data set can also include data related to multiple medical examinations of one subject. A medical data set can include various forms of medical data, such as text, image, audio, video, etc. For example, a medical data set can include an information record of a subject, at least one medical image of a subject (e.g., a patient), an image tag of the at least one medical image, etc. The information record of a subject can be a record in text form, which can be easily reviewed by a user. For example, the information record of a subject can be an information list, which can list one or more of the following information of a subject and / or a medical image: a body part corresponding to a medical image, a subject identification number, an examination time, an examination type, an examination parameter, a subject name, a subject ID number, a subject social security number, a subject gender, a subject contact number, a subject home address, a subject age, a subject weight, whether the subject is pregnant, and whether the subject has a specific disease, etc. A medical imaging device can scan an entire body or a specific part of a body (e.g., a head, a chest, an abdomen, etc.) of a patient according to an imaging protocol to obtain a medical image of a subject. By way of example only, the medical image can be an ultrasound image, a CT image, an MR image, a PET image, etc. The medical image can be a two-dimensional image, a three-dimensional image, or a four-dimensional image. An image tag can be used to record information related to a medical image and / or a subject, such as a subject name, an examination date, a subject ID, a subject age, an examination type, important parameters in an imaging protocol, etc. In some embodiments, the medical image can be a DICOM image, and the image tag can be a DICOM Tag. In some embodiments, it can be required to upload a medical data set to a server (e.g., the server 130) before the medical data set can be used by the processing device 110. For example, a medical data set can be uploaded to the server 130 before the medical data set can be used by the processing device 110 to perform a medical examination of a subject. Figure 1server 150) for applications such as remote consultation, academic conference, multi-center clinical trial, artificial intelligence (AI) training, etc. Therefore, before uploading, the processing device 110 needs to anonymize the medical data to be uploaded, i.e. delete, hide or replace the privacy information of the patient, in order to protect the privacy and security of the data. The privacy information can include, but is not limited to, one or more of the following information: object name, object identification number, object address, object phone number, object ID number, object social security number, object weight, etc. In some embodiments, only part of the medical data sets in the at least one candidate medical data set needs to be anonymized and uploaded to the server.

[0062] In step 504, the processing device 110 can determine one or more target medical data sets based on the at least one candidate medical data set according to the received instruction. In some embodiments, step 504 can be performed by the selection module 420.

[0063] In some embodiments, the terminal device 130 can display at least part of the information in the at least one candidate medical data set to the user, so that the user determines the one or more target medical data sets. After receiving the instruction of the user about the determined target medical data set, the terminal device 130 can send the instruction to the processing device 110. The processing device 110 can determine the one or more target medical data sets based on the received instruction.

[0064] In some embodiments, the user can select all of the at least one candidate medical data set as the target medical data set. In some embodiments, the user can select a portion of the at least one candidate medical data set or a subset thereof as the target medical data set. A subset of a candidate medical data set can include all of the candidate medical data set or only a portion of the candidate medical data set. In some embodiments, each of the at least one candidate medical data set includes one or more feature tags. A feature tag can be used to identify the type of data in a medical data set. In some embodiments, a portion of the feature tags are present in the information list and a portion of the feature tags are present in the image tags of the medical images. In some embodiments, the feature tags can be present only in the information list or only in the image tags of the medical images. By way of example only, the feature tags can include one or more of the following: the type of medical image, the body part to which the medical image corresponds, the subject identification number, the examination time, the examination type, the examination parameters, the subject name, the subject gender, the subject age, the subject weight, whether the subject is pregnant, and whether the subject has a particular disease, etc. The user can view the one or more feature tags from the terminal device 130 and select one or more feature tags of interest from the one or more feature tags. Upon receiving the user's instruction regarding the selected feature tags of interest, the processing device 110 can determine a subset of the medical data under the at least one feature tag of interest from the at least one candidate medical data set as the target medical data set. As used herein, a "subset" includes a portion or all of the original candidate medical data set. For example, the subset can include only the information list of the subject; the subset can include only the medical images and the image tags of the subject; or the subset can include both the information list and the medical images of the subject. In some embodiments, the terminal device can provide the user with a user interface to select the contents to be included in the target medical data set, such as whether to include the medical images, the image tags, the information list, etc.

[0065] In some embodiments, the processing device 110 can obtain only one candidate medical data set in step 502. At least a portion of the medical data in the candidate medical data set (i.e., a subset) can be designated as the target medical data set in step 504. In some embodiments, the processing device 110 can obtain at least two candidate medical data sets in step 502, and the processing device 110 can designate a subset of at least one of the at least two candidate medical data sets as the target medical data set in step 502.

[0066] In some embodiments, the user can instruct the terminal device 130 to select a set of target medical images from the at least one candidate medical data set. For example, the instruction can include information of one or more body parts of interest. The processing device 110 can determine, based on the instruction, medical images corresponding to the body parts of interest from the at least one candidate medical data set as a set of target medical images (target medical data set).

[0067] In some embodiments, the processing device 110 can pre-process the at least one candidate medical data set to identify the body part corresponding to each medical image and record under a feature tag before the user selects the target medical data set. In this way, when the user selects the body part of interest, the processing device 110 can quickly respond to determine the medical images corresponding to the one or more body parts of interest as the target medical images. Alternatively, the processing device 110 can pre-group at least two medical images in the at least one candidate medical data set according to the body parts corresponding to the at least two medical images. For example, the processing device 110 can confirm a set of medical images corresponding to the head, a set of medical images corresponding to the abdomen, etc. When receiving the instruction of the user about the body part of interest, the processing device 110 can directly determine the group corresponding to the one or more body parts of interest according to the grouping information and designate the medical images in the group as the target medical images. In some embodiments, the processing device 110 can multi-level group the medical images according to different feature tags. For example, the processing device 110 can first group the medical images according to the corresponding body parts, and then group each set of medical images into one or more subgroups based on other feature tags such as examination type, subject gender, subject age, etc. In some embodiments, the processing device 110 can simultaneously group the medical images according to multiple feature tags. For example, the processing device 110 can first determine a set of ultrasound images corresponding to the liver according to the examination type and the corresponding body part category. Further, the processing device 110 can further group the set of ultrasound images corresponding to the liver into one subgroup of ultrasound images corresponding to the upper part of the liver, one subgroup of ultrasound images corresponding to the lower part of the liver, one subgroup of ultrasound images corresponding to the left lobe of the liver, one subgroup of ultrasound images corresponding to the right lobe of the liver, etc. according to the corresponding body part subcategory.

[0068] For example only, the terminal device 130 can search for examination parameters (such as various parameters of an imaging protocol) from the subject information record in the candidate medical data set to determine the body part corresponding to the medical images in the candidate medical data set. For another example, the terminal device 130 can pre-identify the body part corresponding to each medical image from the medical image using an image recognition algorithm, a machine learning model, etc. and record under a feature tag.

[0069] In some embodiments, the terminal device 130 can also process the at least one candidate medical data set in real time after the user issues an instruction about the body part of interest, identify the body part corresponding to the medical image in a manner similar to the above method, and determine the medical image corresponding to the one or more body parts of interest as the target medical image according to the information of the one or more body parts of interest.

[0070] In step 506, the processing device 110 can perform batch anonymization processing on the one or more target medical data sets to obtain one or more anonymized medical data sets. In some embodiments, step 506 can be completed by the anonymization processing module 430.

[0071] In some embodiments, the processing device 110 needs to perform anonymization processing on data in the form of information lists, medical images, and / or image labels, etc. in the one or more target medical data sets. For example, the information lists and image labels can contain private information text. Additionally or alternatively, the medical images can display private information text. In some embodiments, the processing device 110 can use an anonymization algorithm to clear, hide, or replace the private information text under one or more feature labels corresponding to the one or more target medical data sets. For example, the processing device 110 can delete all private data that needs to be anonymized from the one or more target medical data sets. Alternatively, the processing device 110 can replace the private data in the one or more target medical data sets with other values, such as random values, random text, etc. In some embodiments, the processing device 110 can use an anonymization algorithm to clear, hide, or replace the private information text displayed on the medical images in the one or more target medical data sets. The processing device 110 can perform text recognition on the medical images to find the private information text on the medical images. For example, if the private information text on the medical images is editable, the processing device 110 can directly edit the private information text displayed on the medical images to clear, hide, or replace the private information text with other content. If the private information text on the medical images is not editable, the processing device 110 can use a layer to cover the private information text that needs to be cleared, thereby hiding the private information text. In some embodiments, the processing device 110 can also insert text on the layer, thereby replacing the original displayed private information text with other content. By clearing, hiding, or replacing the private information text, the patient's privacy can be effectively protected.

[0072] In some embodiments, in order to perform batch anonymization processing, the processing device 110 can automatically sequentially anonymize the one or more target medical data sets. Alternatively, the processing device 110 can simultaneously anonymize at least two medical data sets in the one or more target medical data sets. In some embodiments, the processing device 110 can also batch process each item of information in each target medical data set that needs to be anonymized. In this way, automatic batch processing can greatly improve the efficiency of anonymization processing and save users' time and effort. In some embodiments, the user can customize the types of information that need to be anonymized, and the processing device 110 can perform anonymization according to the types of information that the user confirms need to be anonymized. In some embodiments, the processing device 110 can use various available anonymization algorithms, such as rule and dictionary-based algorithms, K-anonymity algorithms, L-diversity algorithms, T-closeness algorithms, differential privacy algorithms, machine learning model-based algorithms, and the like, without limitation in the present specification.

[0073] In step 508, the processing device 110 can send the one or more anonymized medical data sets to the server 150. In some embodiments, step 508 can be performed by the sending module 440.

[0074] In some embodiments, after completing step 506, the processing device 110 can automatically send the anonymized medical data sets to the server 150. Alternatively, the processing device 110 can send the anonymized medical data sets to the server 150 after receiving a user instruction to upload the anonymized medical data sets. In some embodiments, the processor can upload at least a portion of the anonymized medical data sets selected by the user from the one or more anonymized medical data sets to the server according to the user instruction. Alternatively, before uploading each medical data set, the processing device 110 needs to confirm whether the medical data set has been anonymized, if it is determined that the medical data set has been anonymized, the processing device 110 can upload the medical data set to the server; if it is determined that the medical data set has not been anonymized, the processing device 110 does not upload the medical data set, and can further send a prompt message to the user through the terminal device 130, informing the user that the medical data set has not been anonymized.

[0075] In some embodiments, the server can be a local server or a remote server. After receiving the anonymized medical data sets, the server can archive and classify them, and can also send the anonymized medical data sets to other servers or terminals according to user instructions to complete data sharing. Since the server receives anonymized medical data sets, the patient's privacy information is not easily leaked from the server side, and the security of the privacy information is well protected.

[0076] It should be noted that the above description of flow 500 is provided for illustrative purposes only and is not intended to limit the scope of the present application. Various modifications and changes can be made as would be obvious to a person of ordinary skill in the art having the benefit of this disclosure. It is intended, however, that the present application embrace all such modifications and changes and, accordingly, the above description to be regarded in an illustrative rather than a restrictive sense. In some embodiments, one or more operations can be omitted and / or one or more additional operations can be added. For example, processing device 110 can not group the medical images in all candidate medical data sets according to their corresponding body parts before anonymizing the target medical images, but can group the medical images in all anonymized medical data sets according to their corresponding body parts after completing the anonymization. In step 508, processing device 110 can upload the medical images in each group to the server for archiving. Other users can directly select the medical images in each group for observation, which is convenient and time-saving.

[0077] Figures 6-8 FIG. 6 is a schematic diagram of a user interface for batch anonymization according to some embodiments of the present disclosure. In some embodiments, processing device 110 or anonymization module 430 can generate instructions to control the content displayed to the user on the user interface.

[0078] In some embodiments, terminal device 130 can integrate the information list corresponding to the at least two candidate medical data sets together and display to the user. For example, as shown in FIG. 6, terminal device 130 can display the information list corresponding to the at least two candidate medical data sets in the same window, or in different windows. Figure 6As shown, the Patient List 610 (corresponding to the information list mentioned above) displays the patient identification (Patient ID), patient name (Patient Name), exam type (Exam Type), and exam date (Exam Date) for the user to view. In some embodiments, the user can first select the target medical data set(s) to be anonymized, and then click the One-Click Anonymization button 620. Upon detecting that the One-Click Anonymization button 620 is triggered, the terminal device 130 can send an instruction to perform anonymization to the processing device 110. The processing device 110 can automatically perform batch anonymization on the target medical data set(s) according to the instruction. In some embodiments, upon detecting that the One-Click Anonymization button 620 is triggered, the terminal device 130 can display options for selecting between full anonymization and partial anonymization. In response to the partial anonymization being selected, the terminal device 130 can display options for selecting from the at least two candidate medical data sets. For example, the terminal device 130 can provide the user with an option to select “All” on the user interface, and the user can click “All” to instruct that all the candidate medical data sets are determined as the target medical data set(s). For another example, the user can manually check one or more candidate medical data sets to instruct that the checked candidate medical data sets are determined as the target medical data set(s).

[0079] In some embodiments, after the target medical data set(s) are anonymized, the processing device 110 can update the information list to include the anonymized private information text under the feature label(s) corresponding to the target medical data set(s). The processing device 110 can send the updated information list to the terminal device 130 for display. Referring to FIG. 6B, the Patient List 630 is an example of the updated information list after anonymization. As can be seen, the patient identification, patient name, and exam date in the Patient List 630 have been replaced, while the specific information of the exam type that does not involve privacy is retained. In some embodiments, the multiple information records corresponding to the same patient can also be found according to the anonymized patient identification. Figure 6

[0080] Figure 7 is another example of the user interface for anonymization. Compared with Figure 6 , the One-Click Anonymization button 620 is replaced by the Full Anonymization button 640 and the Partial Anonymization button 650. In some embodiments, the terminal device 130 can display the options for selecting between full anonymization and partial anonymization upon detecting that the Full Anonymization button 640 or the Partial Anonymization button 650 is triggered. In response to the partial anonymization being selected, the terminal device 130 can display options for selecting from the at least two candidate medical data sets. Figure 7 ​The interface also displays the images before anonymization. For example, the user can view the medical images corresponding to the data in the list by clicking on a row of data. Similarly, the terminal device 130 can anonymize the medical images and the information in the patient list together after detecting that the "one-click anonymization" button 620 is triggered. After the anonymization is completed, the relevant private information displayed on the medical images is replaced.

[0081] Figure 8 is another example of a user interface for anonymization. As shown in Figure 8 , the user can select the specific textual description, specific value, or specific range of a feature label to select the medical data set to be anonymized. For example, the user can select the examination time range, examination type, and organization name (equivalent to the body part of interest described above). In some embodiments, the patient list displayed on the terminal device 130 can be automatically updated to show the records that meet the user's selection each time the user completes a selection. After all selections are completed, the user can click the "one-click anonymization" button 620. By way of example only, the processing device 110 can retrieve the medical images in the target medical data set selected by the user and anonymize the medical images and image labels.

[0082] In some embodiments, the user can also select a specific feature label type through the terminal device 130 and then select one or more contents (text or numerical value, etc.) corresponding to the specific feature label. For example, the user can select "body part corresponding to medical image" as the feature label of interest, select "liver" as the content, and further select "information list, medical image, and image label" as the data types to be included in the target medical data set. For another example, the user can select "type of medical image" and "body part corresponding to medical image" as the feature labels of interest, select "ultrasound image" as the content of "type of medical image" and "abdomen" as the content of "body part corresponding to medical image", and further select "medical image and image label" as the data types to be included in the target medical data set.

[0083] In general, the beneficial effects that can be brought by the embodiments of the present specification include but are not limited to: (1) the medical data set can be anonymized in batches according to the user's instruction, which improves the efficiency of anonymization and saves the user's time and effort; (2) uploading the medical data set to the server after completing the anonymization can improve the security of the patient's privacy information and prevent the patient's privacy information from being leaked from the server side; (3) the user can select the medical data set according to one or more characteristic labels (such as the body part corresponding to the medical image), which facilitates the quick selection of the medical data set that needs to be anonymized, and also facilitates the automatic subsequent archiving management of the anonymized medical data set and the user grouping for viewing. It should be noted that different embodiments can have different beneficial effects, and in different embodiments, the beneficial effects that can be produced can be any one or a combination of the above, or any other beneficial effects that can be obtained.

[0084] The above has described the basic concept, and it is obvious that the above detailed disclosure is only used as an example and does not limit the present specification. Although it is not explicitly stated here, those skilled in the art can make various modifications, improvements and corrections to the present specification. Such modifications, improvements and corrections are suggested in the present specification, so such modifications, improvements and corrections still belong to the spirit and scope of the exemplary embodiments of the present specification.

[0085] At the same time, specific words are used in the present specification to describe the embodiments of the present specification. As "one embodiment", "an embodiment", and / or "some embodiments" means a certain feature, structure or characteristic related to at least one embodiment of the present specification. Therefore, it should be emphasized and noted that the "an embodiment" or "one embodiment" or "one alternative embodiment" mentioned in different places in the present specification does not necessarily refer to the same embodiment. In addition, certain features, structures or characteristics in one or more embodiments of the present specification can be properly combined.

[0086] In addition, unless the claim explicitly states otherwise, the order of the processing elements and sequences described in the present specification, the use of numerals and letters, or the use of other names, is not intended to limit the order of the processes and methods of the present specification. Although some currently considered useful embodiments are discussed in the above disclosure through various examples, it should be understood that such details are only for the purpose of illustration, and the additional claims are not limited to the disclosed embodiments, on the contrary, the claims are intended to cover all modifications and equivalent combinations that meet the spirit and scope of the embodiments of the present specification. For example, although the system components described above can be realized by hardware devices, they can also be realized by software solutions only, such as installing the described system on existing servers or mobile devices.

[0087] For simplicity and to facilitate understanding of one or more embodiments, a description of an embodiment sometimes refers to a plurality of features in a single embodiment, drawing, or description of an embodiment. However, this method of disclosure is not to be interpreted as meaning that the claimed embodiment requires more features than are explicitly recited in the claims. In fact, claims that do not specifically claim a combination of features are intended to cover the various possible combinations of features as would be understood by a person of ordinary skill in the art.

[0088] Some embodiments use numerical values to describe components, quantities of attributes. It should be understood that such numerical values used in the description of embodiments are, in some examples, modified by the adjectives "about," "approximately," or "substantially." Unless otherwise stated, "about," "approximately," or "substantially" indicate that the described numerical value allows for a variation of ±20%. Accordingly, numerical values used in the specification and claims are approximations that vary depending on the requirements of the particular embodiment. In some embodiments, numerical values should be considered in the context of the number of significant figures used in the description and the general number of significant figures used in the art. Although the numerical ranges and parameters setting forth the broadest scope of the embodiments described in this specification are approximations, the numerical values set forth in the specific examples are reported as precisely as practicable. The numerical values set forth in the specific examples are provided to be as precise as practicable.

[0089] Each patent, patent application, patent publication, and other material, such as articles, books, specifications, publications, documents, and the like, referenced herein are hereby incorporated by reference in their entirety for the teachings relevant to the sentence and / or paragraph in which the reference is made. Discrepancies between applications history documents and the present specification, other than limitations on the scope of the claims, are excepted. It is specifically intended that the description, definitions, and / or terminology used in the incorporated material be governed by the disclosures in the present specification, which are only meant to be methods of illustration and not limitation. In the event of a discrepancy between the incorporated material and the present disclosure, the present disclosure will control.

[0090] Finally, it should be understood that the embodiments described herein are merely exemplary of the principles of the embodiments described herein. Other variations having essentially the same structure and function but different values for components, and / or different arrangements of the components are intended to be within the scope of the embodiments described herein. Accordingly, the embodiments described herein are not limited to that precisely as shown and described.

Claims

1. An anonymization method, characterized in that, The method includes: At least two candidate medical datasets are obtained, each of which corresponds to an object. Each candidate medical dataset includes at least one candidate medical image of the object, an image label corresponding to the at least one candidate medical image, and an information list of the object. Each candidate medical dataset includes multiple feature labels, at least some of which exist in the information list. The feature labels are used to identify the type of data in the candidate medical datasets. Based on the multiple feature labels, the at least two candidate medical datasets are grouped at multiple levels. The terminal displays a list of information about the at least two candidate medical datasets and options for selection from multiple feature labels corresponding to the at least two candidate medical datasets. Obtain instructions input from the terminal regarding the selection of multiple target medical data sets; Based on the received instructions, the plurality of target medical data sets are determined according to the at least two candidate medical data sets; In response to the triggering of the one-click anonymization button displayed on the terminal, batch anonymization processing is automatically performed on the multiple target medical data sets and the medical images, image tags, and information lists in each target medical data set to obtain multiple anonymized medical data sets, wherein... For each of the target medical datasets, text recognition is performed on the medical images to locate the privacy information text displayed on the medical images; and An anonymization algorithm is used to remove, hide, or replace the privacy information text displayed on the medical image, and after the anonymization process is completed, the privacy information displayed on the medical image is anonymized; After anonymizing the multiple target medical datasets, the information list is updated. The updated information list contains anonymized privacy information text under multiple feature tags corresponding to the multiple target medical datasets; and The updated information list is sent to the terminal device for display.

2. The method as described in claim 1, characterized in that, The step of determining the plurality of target medical data sets based on the received instructions and the at least two candidate medical data sets includes: Based on the instructions, multiple candidate medical images are selected from the at least two candidate medical datasets as a group of target medical images; and The multiple candidate medical data sets corresponding to the set of target medical images are designated as the multiple target medical data sets.

3. The method as described in claim 2, characterized in that, The instructions include information about the body part of interest, and determining a set of target medical images based on the at least two candidate medical datasets according to the instructions includes: Based on the instructions, determine the medical image corresponding to the body part of interest from the at least two candidate medical datasets; and The medical images corresponding to the body parts of interest are designated as the set of target medical images.

4. The method as described in claim 3, characterized in that, The step of determining the medical image corresponding to the body part of interest from the at least two candidate medical datasets according to the instruction includes: Based on the instructions, multiple candidate medical images from the at least two candidate medical datasets are identified in real time to determine the body part corresponding to each candidate medical image; and Based on the body part corresponding to each of the candidate medical images, a medical image corresponding to the body part of interest is determined from the at least two candidate medical data sets.

5. The method as described in claim 3, characterized in that, The method further includes: Based on the body parts corresponding to multiple candidate medical images in the at least two candidate medical datasets, the multiple candidate medical images are grouped.

6. The method as described in claim 1, characterized in that: The instruction includes information about at least one feature label of interest from the plurality of feature labels; The selection of multiple target medical datasets from the at least two candidate medical datasets based on the received instructions includes: Based on the instructions, a subset of medical data under the at least one feature label of interest is determined from the at least two candidate medical data sets; and The subset of medical data under the at least one feature label of interest is designated as the plurality of target medical data sets.

7. The method as described in claim 6, characterized in that, The multiple feature tags are selected from the following combinations: type of medical image, body part corresponding to the medical image, object identification number, examination time, examination type, examination parameters, object name, object gender, object age, object weight, whether the object is pregnant, and whether the object suffers from a specific disease.

8. The method as described in claim 1, characterized in that, The batch anonymization process for the multiple target medical data sets includes: Anonymization algorithms are used to remove, hide, or replace privacy information text under multiple feature labels corresponding to the at least two target medical data sets.

9. The method as described in claim 1, characterized in that, The use of anonymization algorithms to remove, hide, or replace the privacy information text displayed on the medical image includes: The privacy information text on the medical image is non-editable. Use a layer to cover the privacy information text; and Insert text onto the layer.

10. The method as described in claim 1, characterized in that, The selection of multiple target medical datasets from the at least two candidate medical datasets based on the received instructions includes: In response to the one-click anonymity button displayed on the terminal being triggered, the terminal displays an option to select between full anonymity function and partial anonymity function; In response to the partial anonymity function being selected, the terminal displays an option to select from the at least two candidate medical datasets; Obtain the instruction input from the terminal regarding the selection of the plurality of target medical data sets; Based on the instructions, multiple target medical datasets are selected from the at least two candidate medical datasets.

11. The method as described in claim 1, characterized in that, Also includes: The multiple anonymized medical datasets are sent to the server.

12. A system for anonymization processing, characterized in that, The system includes: At least one storage medium storing at least one set of instructions; and At least one processor is configured to communicate with the at least one storage medium, wherein, when executing the at least one set of instructions, the at least one processor is instructed to cause the system to: At least two candidate medical data sets are obtained, each candidate medical data set corresponding to an object. Each candidate medical data set includes at least one candidate medical image of the object, an image label corresponding to the at least one candidate medical image, and an information list of the object. Each candidate medical data set includes multiple feature labels, at least some of which exist in the information list. The feature labels are used to identify the type of data in the candidate medical data sets. Based on the multiple feature labels, the at least two candidate medical datasets are grouped at multiple levels. The terminal displays a list of information about the at least two candidate medical datasets and options for selection from multiple feature labels corresponding to the at least two candidate medical datasets. Obtain instructions input from the terminal regarding the selection of multiple target medical data sets; Based on the received instructions, the plurality of target medical data sets are determined according to the at least two candidate medical data sets; In response to the triggering of the one-click anonymization button displayed on the terminal, batch anonymization processing is automatically performed on the multiple target medical data sets and the medical images, image tags, and information lists in each target medical data set to obtain multiple anonymized medical data sets, wherein... For each of the target medical datasets, text recognition is performed on the medical images to locate the privacy information text displayed on the medical images; and An anonymization algorithm is used to remove, hide, or replace the privacy information text displayed on the medical image, and after the anonymization process is completed, the privacy information displayed on the medical image is anonymized; After anonymizing the multiple target medical datasets, the information list is updated. The updated information list contains anonymized privacy information text under multiple feature tags corresponding to the multiple target medical datasets; and The updated information list is sent to the terminal device for display.

13. The system as described in claim 12, characterized in that, In order to determine the plurality of target medical data sets based on the at least two candidate medical data sets according to the received instructions, the at least one processor is instructed to cause the system to: Based on the instructions, multiple medical images are selected from the at least two candidate medical datasets as a group of target medical images; as well as The multiple candidate medical data sets corresponding to the set of target medical images are designated as the multiple target medical data sets.

14. The system as described in claim 13, characterized in that, The instructions include information about the body part of interest, and in order to determine the set of target medical images based on the at least two candidate medical datasets according to the instructions, the at least one processor is instructed to cause the system to: Based on the instructions, determine the medical image corresponding to the body part of interest from the at least two candidate medical datasets; and The medical images corresponding to the body parts of interest are designated as the set of target medical images.

15. The system as described in claim 14, characterized in that, In order to determine, according to the instructions, a medical image corresponding to the body part of interest from the at least two candidate medical datasets, the at least one processor is instructed to cause the system to: Based on the instructions, multiple candidate medical images in the at least two candidate medical data sets are identified in real time to determine the body part corresponding to each candidate medical image; as well as Based on the body part corresponding to each of the candidate medical images, a medical image corresponding to the body part of interest is determined from the at least two candidate medical data sets.

16. The system as described in claim 15, characterized in that, The at least one processor is also instructed to cause the system to: Based on the body parts corresponding to multiple candidate medical images in the at least two candidate medical datasets, the multiple candidate medical images are grouped.

17. The system as claimed in claim 12, characterized in that: In order to select the plurality of target medical data sets from the at least two candidate medical data sets based on the received instructions, the at least one processor is instructed to cause the system to: Based on the instructions, a subset of medical data under the at least one feature label of interest is determined from the at least two candidate medical data sets; as well as The subset of medical data under the at least one feature label of interest is designated as the plurality of target medical data sets.

18. The system as claimed in claim 17, characterized in that, The multiple feature tags are selected from the following combinations: type of medical image, body part corresponding to the medical image, object identification number, examination time, examination type, examination parameters, object name, object gender, object age, object weight, whether the object is pregnant, and whether the object suffers from a specific disease.

19. The system as claimed in claim 12, characterized in that, In order to perform batch anonymization processing on the multiple target medical datasets, the at least one processor is instructed to make the system: Anonymization algorithms are used to remove, hide, or replace privacy information text under multiple feature labels corresponding to the at least two target medical data sets.

20. The system as claimed in claim 12, characterized in that, In order to use an anonymization algorithm to remove, hide, or replace the privacy information text displayed on the medical image, the at least one processor is instructed to cause the system to: The privacy information text on the medical image is non-editable. Use a layer to cover the privacy information text; and Insert text onto the layer.

21. The system as claimed in claim 12, characterized in that, In order to select a plurality of target medical datasets from the at least two candidate medical datasets based on the received instructions, the at least one processor is instructed to cause the system to: In response to the one-click anonymity button displayed on the terminal being triggered, the terminal displays an option to select between full anonymity function and partial anonymity function; In response to the partial anonymity function being selected, the terminal displays an option to select from the at least two candidate medical datasets; Obtain the instruction input from the terminal regarding the selection of the plurality of target medical data sets.

22. The system as claimed in claim 21, characterized in that, The at least one processor is also instructed to cause the system to: The multiple anonymized medical datasets are sent to the server.

23. A system for anonymization processing, characterized in that, The system includes: The acquisition module is used to acquire at least two candidate medical data sets, each candidate medical data set corresponding to an object. Each candidate medical data set includes at least one candidate medical image of the object, an image label corresponding to the at least one candidate medical image, and an information list of the object. Each candidate medical data set includes multiple feature labels, at least some of which exist in the information list. The feature labels are used to identify the type of data in the candidate medical data sets. The acquisition module is further configured to perform multi-level grouping of the at least two candidate medical data sets according to the multiple feature tags; display an information list of the at least two candidate medical data sets and options for selection from the multiple feature tags corresponding to the at least two candidate medical data sets through the terminal; and acquire instructions input from the terminal regarding the selection of multiple target medical data sets. A selection module, configured to determine the plurality of target medical data sets based on the received instructions and the at least two candidate medical data sets; and An anonymization module, in response to the triggering of a one-click anonymization button displayed on the terminal, automatically performs batch anonymization processing on the multiple target medical data sets and the medical images, image tags, and information lists in each target medical data set to obtain multiple anonymized medical data sets, wherein... For each of the target medical datasets, text recognition is performed on the medical images to locate the privacy information text displayed on the medical images; and An anonymization algorithm is used to remove, hide, or replace the privacy information text displayed on the medical image, and after the anonymization process is completed, the privacy information displayed on the medical image is anonymized; The anonymization module is further configured to perform the anonymization processing on the multiple target medical data sets, update the information list, wherein the updated information list contains anonymized privacy information text under multiple feature tags corresponding to the multiple target medical data sets; and send the updated information list to the terminal device for display.

24. A non-transitory computer-readable storage medium comprising at least one set of instructions, wherein, When executed by at least one processor of a computer device, the at least one set of instructions instructs the at least one processor to: At least two candidate medical data sets are obtained, each candidate medical data set corresponding to an object. Each candidate medical data set includes at least one candidate medical image of the object, an image label corresponding to the at least one candidate medical image, and an information list of the object. Each candidate medical data set includes multiple feature labels, at least some of which exist in the information list. The feature labels are used to identify the type of data in the candidate medical data sets. Based on the multiple feature labels, the at least two candidate medical datasets are grouped at multiple levels. The terminal displays a list of information about the at least two candidate medical datasets and options for selection from multiple feature labels corresponding to the at least two candidate medical datasets. Obtain instructions input from the terminal regarding the selection of multiple target medical data sets; Based on the received instructions, the plurality of target medical data sets are determined according to the at least two candidate medical data sets; as well as In response to the triggering of the one-click anonymization button displayed on the terminal, batch anonymization processing is automatically performed on the multiple target medical data sets and the medical images, image tags, and information lists in each target medical data set to obtain multiple anonymized medical data sets, wherein... For each of the target medical datasets, text recognition is performed on the medical images to locate the privacy information text displayed on the medical images; and An anonymization algorithm is used to remove, hide, or replace the privacy information text displayed on the medical image, and after the anonymization process is completed, the privacy information displayed on the medical image is anonymized; After anonymizing the multiple target medical datasets, the information list is updated. The updated information list contains anonymized privacy information text under multiple feature tags corresponding to the multiple target medical datasets; and The updated information list is sent to the terminal device for display.

Images