Methods and systems for providing anonymous patient datasets

Abstract

The present invention relates to a computer-implemented method and system (1) for providing anonymized patient datasets, the method comprising the steps of: analyzing (S1) statistical demographic data to determine a blurring parameter OP, and anonymizing a patient dataset P-DS containing a quasi-identifier Q-ID as an attribute by means of the determined blurring parameter OP to blur the quasi-identifier Q-ID of the patient dataset P-DS to generate an anonymized patient dataset P-DS'.

Description

Technical Field

[0001] The present invention relates to a computer-implemented method and a corresponding system for providing patient datasets in digital form, the method and system being, for example, capable of setting parameters of medical devices and / or for training artificial intelligence modules of medical devices. Background Technology

[0002] Structured datasets are used in multiple clinical applications and systems. These datasets involve patients or individuals about whom case studies exist. Projects can, for example, include different medical studies concerning specific topics or medical conditions. These medical studies can be conducted by different medical institutions, such as hospitals, research institutions, or laboratories. Medical studies typically involve a large number of patient case studies. Correspondingly, projects can include a large number of case studies with corresponding patient datasets. Projects here often involve specific medical conditions, such as myocardial infarction or benign prostatic hyperplasia. Multiple structured datasets for a project can be stored in a central or distributed database for further evaluation. Patient data contains sensitive personal data, especially health data, which must be anonymized for further evaluation to ensure the anonymity of the relevant patients. This prevents the isolation of individual datasets, allowing for the identification of the corresponding patients or individuals. Furthermore, it ensures that two different datasets involving the same data can be linked or joined.

[0003] Furthermore, it prevents the values ​​of sensitive attributes from being derived from the values ​​of other attributes. It enables the evaluation of anonymized data across multiple medical applications and devices without obtaining conclusions about the identity of the patient or person, whose anonymized data content is based on the patient's or person's personal data.

[0004] Traditional methods for anonymizing patient data are based on so-called k-anonymity. k-anonymity is a formal criterion for evaluating the anonymity of aggregated data. Here, different attributes of the dataset are first divided into non-sensitive and sensitive attributes. Sensitive attributes include personal data about the corresponding patient, such as information about the disease. Sensitive attributes represent information about the person that deserves protection. Non-sensitive attributes include general personal characteristics of the person, such as the corresponding person's age and / or gender. Non-sensitive attributes can be further divided into identifiers and quasi-identifiers. Identifiers are suitable for explicitly identifying a specific person or a specific patient. In contrast, quasi-identifiers, combined with other data within the dataset, and using other datasets as needed, are suitable for identifying the patients involved. The goal of k-anonymization is to alter multiple datasets so that they become indistinguishable. To this end, direct identifiers are removed or hidden (e.g., names or patient IDs are replaced with pseudonyms), while quasi-identifiers are altered or hidden so that the dataset is not emphasized (e.g., very young or very old persons are associated with intervals rather than mentioning a specific age). If each data point is indistinguishable from at least k-1 other data points, the resulting dataset is called k-anonymous. Data anonymity is achieved as follows: it is possible to have no explicit correlation between sensitive attribute values ​​and individual data points within a group. To perform anonymization of database content, which comprises multiple patient datasets belonging to a project, it is typically necessary to perform costly data preprocessing on the entire database content to be anonymized before anonymization to obtain appropriate generalization constraints for the quasi-identifiers of the patient datasets. However, such data preprocessing of the database content is not feasible if data is generated continuously, such as a continuous data stream based on generated sensor data. Preprocessing is often difficult to perform in practice if the database content is too large. In many applications, the database content of project data sources for a specific project can reach several terabytes (TB). Adding to the difficulty, most systems used by healthcare institutions only allow relatively slow data exchange. Many healthcare institutions, such as hospitals, use so-called PACS (Picture Archiving and Communication System) systems. These systems, in particular, include image archiving and communication systems that are also suitable for detecting and exchanging digital image data.

[0005] Due to the enormous amount of existing data and the limited data transfer speed of traditional database systems, data preprocessing for obtaining anonymization and obfuscation parameters is very time-consuming or difficult to perform in practice, and is even infeasible in many applications. Summary of the Invention

[0006] Therefore, one object of the present invention is to provide a method and system that allows for the efficient anonymization of existing patient datasets.

[0007] According to the present invention, the objective is achieved by a method implemented by a computer according to the present invention and by a system according to the present invention.

[0008] Therefore, the present invention provides a computer-implemented method for providing anonymized patient datasets, the method comprising the following steps:

[0009] Analyze statistical demographic data to determine fuzzification parameters, and

[0010] Anonymizing patient datasets containing quasi-identifiers as attributes involves obfuscating the quasi-identifiers of the patient dataset using determined obfuscation parameters to generate anonymized patient datasets.

[0011] One advantage of the computer-implemented method according to the present invention is that, in order to determine the obfuscation parameters, data preprocessing of the database content of the project data source is not required; instead, an available statistical database can be used for this purpose. Therefore, the obfuscation parameters can be determined efficiently without being hindered by the technical limitations of conventional PACS systems. In this way, anonymization of patient datasets can be performed at a higher speed even with fewer computational resources. Therefore, the computer-implemented method is significantly faster than traditional anonymization methods and requires fewer resources, especially fewer computational and storage resources. It also benefits network security and data protection due to less exposure and less processing of patient data.

[0012] In one feasible embodiment of the computer-implemented method according to the present invention, the quasi-identifiers of the patient dataset are obfuscated by generalizing the values ​​of the quasi-identifiers to a generalization range that includes them.

[0013] In another feasible embodiment of the computer-implemented method according to the invention, the quasi-identifiers of the patient dataset are obfuscated by at least partially deleting or masking one or more characters of the value of the quasi-identifier.

[0014] In another feasible embodiment of the computer-implemented method according to the invention, the quasi-identifiers of the patient dataset are obfuscated by changing the value of the quasi-identifiers in an arithmetic or logical operation. In one feasible implementation, the changing value can be formed by a random value.

[0015] In another feasible embodiment of the computer-implemented method according to the invention, the fuzziness parameter determined by analyzing statistical demographic data provides the regional range of the generalization interval for generalizing the quasi-identifier.

[0016] In another feasible embodiment of the computer-implemented method according to the invention, the number and / or position of characters to be deleted or masked are given by the obfuscation parameters determined by analyzing statistical demographic data.

[0017] In another feasible embodiment of the computer-implemented method according to the invention, a change value for altering the value of the quasi-identifier is given by a fuzzification parameter determined by analyzing statistical demographic data.

[0018] In one feasible embodiment of the computer-implemented method according to the invention, the patient dataset has different types of attributes. In one feasible embodiment, the attributes include identifiers, quasi-identifiers, and sensitive attributes. Here, the identifiers themselves are suitable for explicitly identifying the corresponding patient. Conversely, the quasi-identifiers are only suitable for explicitly identifying the corresponding patient in combination with other data. Sensitive attributes include the personal data of the corresponding patient that needs to be protected.

[0019] In another feasible embodiment of the computer-implemented method according to the invention, when anonymizing the patient dataset, the identifiers contained in the patient dataset are automatically deleted or masked.

[0020] Therefore, a certain level of data security can be ensured.

[0021] In another feasible embodiment of the computer-implemented method according to the invention, a patient dataset is read from a project data source. The project data source can have a central database or a distributed database.

[0022] In another feasible embodiment of the computer-implemented method according to the invention, a patient dataset is automatically generated in real time based on sensor data.

[0023] In another feasible embodiment of the computer-implemented method according to the invention, patient datasets read from a project data source and / or patient datasets generated based on sensor data are continuously obfuscated as a data stream using determined obfuscation parameters to generate an anonymized patient dataset. The anonymized patient dataset generated herein is preferably stored in an anonymized database for further evaluation.

[0024] In another feasible embodiment of the computer-implemented method according to the invention, the anonymized patient dataset forms a cluster of cluster size, wherein all obfuscated quasi-identifiers are identical.

[0025] In another feasible embodiment of the computer-implemented method according to the invention, a population expectation is calculated based on statistical population data read from one or more statistical databases, the population expectation giving a number of people in a population within a project-affiliated area who conform to a quasi-identifier of an anonymized patient dataset, which is obfuscated according to an obfuscation option.

[0026] In another feasible embodiment of the computer-implemented method according to the invention, the quasi-identifiers of the patient dataset are obfuscated by means of obfuscation parameters, such that the calculated population expectation is greater than the optional cluster size of the clusters within the anonymized patient dataset.

[0027] In another feasible embodiment of the computer-implemented method according to the invention, an anonymized patient dataset stored in an anonymous database is used as training data for training an artificial intelligence module, particularly for training an artificial neural network.

[0028] In another feasible embodiment of the computer-implemented method according to the invention, the device parameters of the medical device used to examine the patient are automatically set based on an anonymized patient dataset stored in an anonymous database.

[0029] In another feasible embodiment of the computer-implemented method according to the invention, the attributes of the patient's patient dataset are detected at least in part by sensors.

[0030] In another feasible embodiment of the computer-implemented method according to the invention, the attributes of the patient dataset include text data, audio data, and / or image data.

[0031] The computer-implemented method according to the present invention can be executed by a corresponding program, which is stored in a computer program product or a computer-readable storage medium or transmitted and read by a data carrier signal for execution by a processor of a data processing unit.

[0032] According to another aspect, the present invention provides a system for providing anonymized patient data.

[0033] Therefore, the present invention provides a system for providing anonymized patient data, the system having a data processing unit adapted to analyze population data to determine obfuscation parameters and to anonymize patient datasets read from a project data source to generate anonymized patient datasets by obfuscating the quasi-identifiers of the read patient datasets using the determined obfuscation parameters. Attached Figure Description

[0034] The invention is set forth in greater detail below with reference to exemplary embodiments illustrated in the accompanying drawings.

[0035] The accompanying drawings are provided to better understand the invention and are part of this disclosure. The drawings illustrate embodiments of the invention and should be described in detail along with the specification. Other embodiments of the invention and many of its intended advantages will become apparent from the description taken with reference to the drawings. Furthermore, the same reference numerals denote the same or similar parts.

[0036] The numbering of method steps should be easy to understand and should not be construed as implying that the identified steps must be performed according to the numbering of their accompanying figure labels, unless explicitly stated or clearly implied otherwise. Similarly, some or even all method steps can be performed simultaneously, in an overlapping manner, or sequentially.

[0037] Figure 1 A block diagram is shown illustrating a feasible embodiment of a system for providing anonymized patient data according to the present invention;

[0038] Figure 2 A feasible application example is illustrated, which uses patient data anonymized by the system according to the present invention;

[0039] Figure 3 A flowchart illustrating one embodiment of a method for providing anonymized patient datasets according to the present invention is shown;

[0040] Figure 4 A table with a patient dataset is schematically shown to illustrate the computer-implemented method according to the invention and the operating mode of the system according to the invention for providing anonymized patient data. Detailed Implementation

[0041] Figure 1 A block diagram illustrating a feasible embodiment of a system 1 for providing anonymized patient data P-DS according to the present invention is shown. System 1 has a data processing unit 2 with one or more processors, as in... Figure 1 The diagram illustrates the data processing unit 2. The data processing unit 2 has a first data processing stage 2A, designed to analyze population data to determine a blurring parameter OP. Furthermore, the data processing unit 2 has a second data processing stage 2B, which anonymizes the patient dataset P-DS to generate an anonymized patient dataset P-DS'. For this purpose, the second data processing stage 2B of the data processing unit 2 uses the blurring parameter OP, which is generated by the first data processing stage 2A through analysis of population data. Figure 1 In the embodiment shown, a patient dataset P-DS to be anonymized can be read from a project data source 3 of system 1. Project data source 3 can store multiple different patient datasets P-DS belonging to a project, such as a project about a specific medical condition, such as myocardial infarction or benign prostatic hyperplasia. The patient dataset P-DS is fed as a data stream DS to a second data processing level 2B of data processing unit 2. The second data processing level 2B anonymizes the fed patient dataset P-DS by automatically obfuscating the quasi-identifier Q-ID of the patient dataset P-DS using a determined obfuscation parameter OP. In a feasible implementation, the patient dataset P-DS' anonymized in this way can be stored in an anonymization database 4 for further evaluation. For example, the anonymized patient dataset P-DS' can be fed to another data processing unit 5 for further analysis and evaluation. Data processing unit 5 can, for example, analyze the anonymized patient dataset P-DS' during another medical research process. To anonymize the patient dataset P-DS read from project data source 3, a fuzzification parameter OP determined based on statistical demographic data is used by the first data processing level 2A of data processing unit 2. For this purpose, the first data processing level 2A accesses at least one statistical database 6, such as... Figure 1 As shown in the illustration. This can involve a publicly accessible statistical database 6. To determine the fuzzification parameter OP, data preprocessing of the patient dataset P-DS, which is located, for example, in the project data source 3, is therefore unnecessary. The system 1 according to the invention eliminates the expensive data preprocessing required in conventional methods, as is the case in… Figure 1 As shown, the second data processing level 2B processes the data stream DS, which performs the actual analysis of the patient dataset P-DS. This data stream is generated by reading the patient dataset P-DS from the project data source 3, or alternatively, also based on sensor data. Figure 1 In the embodiment shown, different sensors 7-1, 7-2, ..., 7-n can generate sensor data about feasible attributes of the patient. Based on the sensor data, the data processing unit 8 generates a patient dataset P-DS in real time, which is transmitted as a data stream DS to the second data processing stage 2B of the data processing unit 2 of system 1, as shown in... Figure 1 It is shown schematically in the middle.

[0042] Figure 4Multiple patient datasets P-DS are schematically illustrated in a table format, stored, for example, in project data source 3. Project data source 3 can be a central database of a medical institution or can be formed through a distributed database. The project includes a very large number of different patient datasets P-DS. The project here preferably relates to a specific medical topic or a specific medical condition. Patient datasets P-DS can be generated by different medical organizational units, such as hospitals, research laboratories, or research institutions. Each patient dataset P-DS includes different types of attributes. (See below for details.) Figure 4 As shown, the patient dataset P-DS includes identifiers IDs, which are suitable for explicitly identifying the corresponding patient. Examples of identifier IDs include, for instance, the patient's name or a specific patient number. Furthermore, each patient dataset P-DS includes one or more quasi-identifiers Q-IDs, which are used in combination with other data to identify the corresponding patient. Quasi-identifiers Q-IDs are attributes that are not allowed to identify a patient on their own, but can achieve explicit associations when combined with generally accessible data. (See also...) Figure 4 As shown, the patient dataset P-DS includes m quasi-identifiers Q-IDs. Examples of quasi-identifiers Q-IDs are the patient's gender (male / female) and age, as well as, for example, the postal code PLZ of the patient's address. In addition to the quasi-identifiers Q-IDs, each patient dataset P-DS also contains sensitive attributes, which include the corresponding patient's personal data. Sensitive attributes include personal information that is particularly worthy of protection, such as the patient's illness, such as influenza or cancer.

[0043] Data processing unit 2's data processing level 2B anonymizes the patient dataset P-DS by blurring or hiding its quasi-identifier Q-ID using a determined blurring parameter OP to generate a corresponding anonymized patient dataset P-DS'. Blurring can be performed in different ways depending on the type of quasi-identifier Q-ID. For example, in one feasible implementation, the quasi-identifier Q-ID of the patient dataset P-DS can be blurred by generalizing its value to a generalization interval that includes it. If, for example, the patient's age is 35 years old, the value of the quasi-identifier Q-ID can be generalized to a range between 30 and 40 years old. Therefore, the range of this generalization interval is ten years. The regional range or value range of the generalization interval used to generalize the quasi-identifier "age" forms the feasible blurring parameter OP. For example, the age of a target person or patient who is 35 years old can also be generalized to a generalization interval between 30 and 35 years old, including the boundary value. In this case, the blurring parameter OP used to generalize the age information is only five years. The quasi-identifier "age" in the patient dataset is therefore obfuscated by generalizing the value (age information) of the quasi-identifier "age" to include it according to the obfuscation parameter OP. In this case, the obfuscation parameter OP gives the range or value range of the generalization interval used to generalize the quasi-identifier "age". Using the system 1 according to the invention, the obfuscation parameter OP is determined by analyzing statistical demographic data through the first data processing stage 2A of the data processing unit 2. The statistical demographic data can be read from a publicly accessible statistical database 6.

[0044] In another feasible implementation, the quasi-identifier Q-ID of the patient dataset P-DS is obfuscated by at least partially deleting or masking one or more characters of the quasi-identifier Q-ID value. If the quasi-identifier Q-ID consists, for example, a five-digit postal code PLZ, the first, second, third, or fourth character of the postal code PLZ can be deleted or masked to partially conceal or obfuscate it. For example, the postal code PLZ "80333" for patient "Charles" can be obfuscated as "8033*" or "803**" or "80***" or "8****". Furthermore, the obfuscation parameter OP can also specify which position or character part is obfuscated. Generally, obfuscating lower character parts results in less obfuscation than obfuscating higher character parts. If, for example, only the last character of the postal code PLZ is obfuscated, the degree of concealment is less than, for example, deleting or masking the first character of the postal code PLZ.

[0045] In another feasible implementation, the quasi-identifier Q-ID of the patient dataset P-DS is obfuscated by changing the value of the quasi-identifier Q-ID. This changing value can also be a random value.

[0046] Different types of techniques can be used to blur the image. In aggregation-based methods, individual data points or fields from the original patient dataset can be grouped together, making it difficult to re-identify and determine or reliably estimate the attribute values ​​of individual individuals or patients.

[0047] In randomized fuzzing methods, the attributes of a patient dataset can be changed randomly, making it more difficult to re-identify and reliably estimate the attribute values ​​of each patient.

[0048] Furthermore, a synthesis-based fuzzification method can be used. Here, a statistical model of the original data is first formed. New synthetic data is then generated based on this model, which reproduces the original data as closely as possible, but no longer includes personal references regarding the corresponding patients.

[0049] Anonymizing the patient dataset via the second level 2B of data processing unit 2 can include both static and dynamic anonymization. In the case of dynamic anonymization, the continuous data stream DS is anonymized according to specific criteria. In the case of static anonymization, a completely known dataset can be anonymized according to predetermined criteria. Interactive anonymization is also possible. For example, noise-based anonymization can be achieved through user-defined queries on existing database tables.

[0050] To anonymize the patient dataset P-DS via the second data processing level 2B of the data processing unit 2, preferably, all explicit identifiers IDs contained in the delivered patient dataset P-DS are automatically deleted or masked. Additional quasi-identifiers Q-IDs are automatically obfuscated or masked by determining the relevant obfuscation parameter OP. This can be done in different ways depending on the type of quasi-identifier Q-ID and the determined relevant obfuscation parameter OP. The patient dataset P-DS read from the project data source 3 and / or the patient dataset P-DS generated based on sensor data, as data volume DS, are continuously obfuscated by means of the determined obfuscation parameter OP for anonymization, to generate an anonymized patient dataset P-DS', as shown in... Figure 1 As illustrated schematically. The anonymized patient dataset P-DS' is preferably stored in the anonymized database 4 for further evaluation and analysis.

[0051] The analyzed patient dataset P-DS forms a cluster C with a cluster size K, where all obfuscated quasi-identifiers Q-IDs are identical. In a feasible implementation, the population expectation E can be calculated by data processing level 2A based on static population data read from a statistical database 6. For the population within the project's project-affiliated area, this population expectation E gives the number of individuals whose quasi-identifiers Q-IDs, obfuscated according to the obfuscation option, conform to the anonymized patient dataset P-DS'. The quasi-identifiers Q-IDs of the patient dataset are preferably obfuscated using the obfuscation parameter OP, such that the calculated population expectation E is greater than the optional cluster size K of cluster C within the anonymized patient dataset P-DS'.

[0052] The anonymized patient dataset P-DS' stored in the anonymized database 4 can be used for various applications. For example, the anonymized patient dataset can be used for medical research via another data processing unit 5. To this end, the stored anonymized patient dataset P-DS' can be further evaluated using additional anonymized data.

[0053] Figure 2 The illustration schematically demonstrates a feasible application of the anonymized patient dataset P-DS' stored in the anonymized database 4. In one feasible implementation, the anonymized patient dataset P-DS' can be used as training data for training the artificial intelligence module (KIM) 9. Subsequently, the artificial intelligence module 9 can be used for medical diagnosis based on another anonymized patient dataset. Furthermore, the anonymized patient dataset P-DS' can also be used to set the device parameters of a medical device 10 used to examine patients or samples. In addition, the anonymized patient dataset P-DS' can also be used to determine medical diagnoses, particularly enabling diagnoses outside of a hospital's information technology infrastructure using the anonymized patient dataset P-DS'.

[0054] In a feasible embodiment of system 1 according to the invention, the attributes of the patient dataset, such as their... Figure 4 As shown in tabular form, the data is detected at least partially by sensors. For example, the patient's identifier ID can be read from a patient-worn identification device using the reading unit of System 1. The patient can also wear a wearable device that directly measures and monitors bodily functions and transmits patient data, if necessary. Furthermore, the identifier ID can be read from, for example, RFID tags.

[0055] The patient's quasi-identifier Q-ID can also be detected by sensors or by means of a reading unit and stored as the quasi-identifier Q-ID in the patient's corresponding patient dataset P-DS. The attributes of the patient dataset P-DS, i.e., in addition to text data, include identifier ID, quasi-identifier Q-ID, and sensitive attributes, and can also include audio data and / or image data. Audio and image data are, for example, sensor data important for a specific medical condition being examined in the project. For example, heart sounds can be examined to check for myocardial infarction. Other examples include EKG data, etc. In addition to audio data, image data can also form attributes generated during radiological examinations. The image data includes, for example, the patient's CT data or X-ray data. Furthermore, the patient's biometric data can also be evaluated as identifier IDs for identifying the patient. For example, fingerprint data forms image data that can be used as a distinct identifier ID for the patient. Data detected by sensors, such as image data, can also be evaluated during data processing to automatically determine the quasi-identifier Q-ID of the relevant person. For example, the gender of a patient can be determined from a facial image. Typical examples of quasi-identifiers (Q-IDs) include a patient's age, weight, sex, blood type, type of examination, or date of examination. The Q-ID is obfuscated using an obfuscation parameter OP to prevent reverse identification or re-identification of the patient. This is achieved using an obfuscation parameter OP determined based on statistical demographic data.

[0056] Figure 3 A flowchart illustrating a feasible embodiment of a computer-implemented method for providing anonymized patient datasets P-DS' according to the present invention is shown. In the schematic flowchart, the computer-implemented method essentially comprises two main steps, S1 and S2.

[0057] In the first step S1, statistical demographic data is analyzed to determine the fuzzification parameter OP. For example, statistical demographic data is read from statistical database 6 and analyzed to obtain the fuzzification parameter OP. For example, the fuzzification parameter OP can provide a range or region for the generalization interval used to generalize the quasi-identifier "age". The fuzzification parameter OP may, for example, provide a region that includes 10 years, 5 years, or only 3 years.

[0058] In another step S2, the patient dataset P-DS' containing the quasi-identifier Q-ID as an attribute is anonymized by blurring or masking the quasi-identifier Q-ID of the patient dataset P-DS using the blurring parameter OP determined in step S1, to generate the anonymized patient dataset P-DS'. For example, the age information of patients in their patient dataset P-DS can be generalized by giving only the corresponding age range instead of the exact age information. To anonymize the patient dataset P-DS in step S2, the quasi-identifier Q-ID is blurred, and preferably the identifier ID is automatically deleted or completely masked.

[0059] The anonymized patient dataset P-DS' generated in step S2 is preferably stored in the corresponding anonymized database 4 for further evaluation and use. For example, the stored anonymized patient dataset P-DS' can be used to train an artificial neural network KNN (as an example of artificial intelligence module 9) or to set device parameters for medical devices, such as in combination with... Figure 2 As described. A computer-implemented method according to the present invention, such as in... Figure 3 The flowchart illustrates, schematically, how the K-anonymization process can be performed: specific characteristics of the database, such as the database content itself included in project data source 3, are not important; what matters is only the parameter distribution of data values ​​within the total population within the corresponding project's sub-region. This parameter distribution can be evaluated to determine the cluster size K of cluster C within the anonymized patient dataset P-DS'. For this purpose, statistical population data within the project's sub-region is read from statistical database 6 and evaluated through data processing level 2A to obtain the corresponding fuzzification parameter OP. For example, the age distribution of people within the sub-region can be read from statistical database 6. The age distribution of people within the population is then used to determine the regional range of the generalization interval.

[0060] In one feasible implementation, the population expectation value E can be calculated based on statistical population data read from a statistical database 6. This population expectation value gives the number of people in the project's affiliated area who actually conform to the abbreviated quasi-identifier Q-ID of the anonymized patient dataset P-DS' according to a fuzzification option. The fuzzification option includes combinations of fuzzifications for different quasi-identifiers Q-ID.

[0061] This will be further explained below with the help of a simple example. For example, the affiliated area of ​​a specific medical institution, such as a hospital, is known. Furthermore, for example, the affiliated area for a specific project can include, for example, an area inhabited by 5 million people. In a specific medical condition or situation, for example, the incidence rate among men (half the population) within a predetermined age range is 5 in 100,000. The age range, for example, includes 5% of the population residing in the relevant area. In this simple example, the expected value E (generalized age of males) for patients in the corresponding cluster C is:

[0062]

[0063] In this simple example, the population A in the project's adjacent area is 5 million, half of whom are male, and the incidence rate is... The relevant age range is 5% of the population.

[0064] Generally speaking, the expected value of the total population E can be calculated by multiplying the number of people in the subordinate area by the product of the different expected values ​​E of the different attributes of the patient dataset P-DS.

[0065] The population expectation value E calculated in this way is preferably compared with the cluster size K of cluster C in the anonymized patient dataset P-DS. This is done by blurring or masking using the blurring parameter OP, so that the calculated population expectation value E... gesamt The selectable cluster size K is always greater than the cluster C within the anonymized table or database.

[0066] Therefore, the quasi-identifier is preferably obfuscated in the following manner, which is applicable:

[0067] E gesamt >ρ*K, where ρ is a preset constant (system parameter), and ρ≥1.

[0068] Where E gesamt It is the total expected value, while K is the cluster size or the range of equivalence classes.

[0069] Different fuzzification techniques with suitable fuzzification parameters OP can be used in the method according to the invention, wherein the fuzzification parameters OP are always derived by analyzing statistical demographic data, which is available in the statistical database 6. The size of cluster C in the anonymized patient dataset P-DS' is here determined according to the calculated statistical expectation value E. gesamt To set it.

[0070] The computer-implemented method allows for k-anonymization to be performed without the need for data preprocessing of the data content from the project data source 3. This significantly simplifies and accelerates the anonymization process. Furthermore, anonymization can also be performed on the continuous data stream DS of the patient dataset P-DS. Anonymization is efficiently and resource-efficiently based on publicly available statistical demographic data, which can be retrieved from at least one statistical database 6 via the cloud or the internet with minimal access time. The statistical demographic data specifically includes the static distribution of one or more attributes within the population.

[0071] In one feasible implementation, the obfuscation parameter OP is determined for use in analyzing statistical demographic data before the actual anonymization in step S2 of the patient dataset P-DS. In another feasible implementation, the obfuscation parameter OP can also be dynamically adjusted in the background during the anonymization process in step S2, should the statistical distribution of the relevant parameters in the statistical database 6 change. Depending on the application, reverse coupling of the medical device in which the anonymized patient dataset P-DS' is set accordingly can also be used to adjust the obfuscation parameter OP.

[0072] With the system according to the invention, anonymized patient datasets P-DS' can be publicly accessed without requiring data from all examination studies within a project to already be available. The system according to the invention is also capable of processing continuous data streams DS of patient datasets P-DS, which are generated in real time, for example, based on sensor data or readout data, or retrieved from a database. The method and system 1 according to the invention are suitable for effectively anonymizing any patient dataset P-DS having any number of different attributes, thereby providing a basis for further evaluation of research. Furthermore, the anonymized patient dataset P-DS' can be used as training data or for setting device parameters. The determination of the obfuscation parameter OP can be performed before anonymization, or it can be performed in parallel in the background during ongoing anonymization. An advantage of the method according to the invention is therefore that the obfuscation parameter OP can be determined or updated in the background in parallel with the anonymization of the patient dataset P-DS. Therefore, in a feasible embodiment, system 1 according to the invention is also capable of real-time processing, meaning that a real-time generated patient dataset P-DS, also containing sensor data as an attribute, can be obfuscated in real time to generate anonymized patient dataset P-DS'.

[0073] The method according to the invention can be used in a variety of different ways for various applications. The embodiments shown in the different figures include features that can be combined with each other in other embodiments. The computer implementation method for providing anonymized patient datasets P-DS' according to the invention and the system 1 according to the invention are not limited to... Figures 1 to 4The embodiment shown is illustrated. Other applications and implementations are possible. For example, the anonymized patient dataset P-DS' can also be written back to the project data source 3 in a manner correspondingly marked as anonymized.

[0074] The anonymized patient dataset P-DS' can also be displayed to users via a user interface, such as a graphical user interface (GUI), for example, to the project manager of the relevant medical research project. In a feasible implementation, the obfuscation parameter OP used here is also displayed on the display unit via such a user interface, and can be further adjusted interactively if necessary.

[0075] In another feasible implementation, the blurring parameter OP is additionally adjusted according to a preset or input security level SK. Here, highly sensitive data is blurred or obscured over a larger scope compared to the less sensitive patient dataset P-DS. In this implementation, the blurring parameter OP, determined by analyzing statistical demographic data, is additionally adjusted or readjusted according to the security level SK.

Claims

1. A computer-implemented method for providing anonymized patient datasets, the method comprising the steps of: -Analyze (S1) statistical demographic data to determine the fuzzification parameter OP, and - Anonymizing (S2) a patient dataset P-DS containing a quasi-identifier Q-ID as an attribute is performed by obfuscating the quasi-identifier Q-ID of the patient dataset P-DS using a determined obfuscation parameter OP, in order to generate an anonymized patient dataset P-DS'. The patient dataset P-DS was read from the project data source (3). Statistical population data are read from at least one statistical database (6). Each patient dataset in the patient dataset P-DS corresponds to a project, and the statistical demographic data for the project pertains to the project's associated region. The quasi-identifier Q-ID of the patient dataset P-DS is obfuscated by: generalizing the value of the quasi-identifier Q-ID to a generalization range that includes it, or by at least partially deleting or masking one or more characters of the value of the quasi-identifier Q-ID, or by changing the value of the quasi-identifier Q-ID in an arithmetic or logical operation.

2. The computer-implemented method according to claim 1, wherein the fuzziness parameter OP, determined by analyzing statistical demographic data, provides a range for generalizing the quasi-identifier Q-ID, the number and / or position of characters to be deleted from the value of the quasi-identifier Q-ID, or a change value for changing the value of the quasi-identifier Q-ID.

3. The computer-implemented method according to claim 1 or 2, wherein the patient dataset P-DS includes different types of attributes, wherein the attributes have: Identifiers ID, each of which is individually applicable and can clearly identify the corresponding patient; Quasi-identifiers Q-IDs, which are applied in conjunction with other available data to definitively identify the corresponding patients; and Sensitive attributes, including the patient's personal data.

4. The computer-implemented method of claim 3, wherein when anonymizing (S2) the patient dataset P-DS, the identifier ID contained in the patient dataset P-DS is automatically deleted or masked.

5. The computer-implemented method according to claim 1 or 2, wherein the patient dataset P-DS is generated in real time based on sensor data determined by sensors.

6. The computer-implemented method according to claim 5, wherein the patient dataset P-DS read from the project data source (3) and / or the patient dataset P-DS generated based on sensor data is continuously anonymized as a data stream (DSTROM) by means of a determined anonymization parameter OP to generate an anonymized patient dataset P-DS', wherein the anonymized patient dataset P-DS' is stored in an anonymized database (4).

7. The computer-implemented method according to claim 1 or 2, wherein the anonymized patient dataset P-DS' forms a cluster C with a cluster size K, wherein all obfuscated quasi-identifiers Q-ID are identical.

8. The computer-implemented method according to claim 1 or 2 above, wherein a population expectation value E is calculated based on statistical population data read from at least one statistical database (6), the population expectation value giving a number of people in the project-affiliated area of ​​the project that conform to the quasi-identifier Q-ID of the anonymized patient dataset P-DS' according to the fuzzification option.

9. The computer-implemented method of claim 8, wherein the quasi-identifier Q-ID of the patient dataset P-DS is obfuscated by means of the obfuscation parameter OP, such that the calculated population expectation value E is greater than the optional cluster size K of cluster C within the anonymized patient dataset P-DS'.

10. The computer-implemented method according to claim 6, wherein the anonymized patient dataset P-DS' stored in the anonymized database (4) is used as training data for training the artificial intelligence module (9).

11. The computer-implemented method of claim 10, wherein the anonymized patient dataset P-DS' stored in the anonymized database (4) is used as training data for training an artificial neural network KNN.

12. The computer-implemented method according to claim 6, wherein device parameters for examining a medical device (10) are automatically set based on the anonymized patient dataset P-DS' stored in the anonymized database (4), and / or at least one medical diagnosis relating to the patient is automatically created based on the anonymized patient dataset P-DS' stored in the anonymized database (4).

13. The computer-implemented method according to claim 1 or 2, wherein the attributes of the patient dataset P-DS are detected at least in part by sensors or read from an identification mechanism.

14. The computer-implemented method according to claim 1 or 2, wherein the attributes of the patient dataset P-DS include text data, audio data, and / or image data.

15. A computer program product comprising instructions that, when executed by a computer, arrange for the computer to perform the method according to any one of claims 1 to 14.

16. A computer-readable storage medium comprising instructions that, when executed by a computer, arrange the computer to perform the method according to any one of claims 1 to 14.

17. A data carrier signal, said data carrier signal transmitting a computer program product according to claim 15.

18. A system (1) for providing anonymized patient datasets, the system having a data processing unit (2) adapted to analyze population data to determine abbreviation parameters OP and to anonymize patient datasets P-DS read from an item data source (3) to generate an anonymized patient dataset P-DS' by means of: a quasi-identifier Q-ID of the read patient dataset P-DS by means of the determined abbreviation parameters OP, wherein the patient dataset P-DS is read from an item data source (3), wherein statistical population data is read from at least one statistical database (6), wherein each patient dataset in the patient dataset P-DS corresponds to an item and the statistical population data for the item relates to an item-related region of the item, and wherein the quasi-identifier Q-ID of the patient dataset P-DS is abbreviated by: generalizing the value of the quasi-identifier Q-ID to a generalization range that includes it, or by: at least partially deleting or masking one or more characters of the value of the quasi-identifier Q-ID, or by: changing the value of the quasi-identifier Q-ID in an arithmetic or logical operation.

Images