Assessing structured data for privacy risks

Abstract

Structured data for privacy risk assessment. Provide multiple text documents related to the application domain; automatically identify multiple text fragments based on these documents; automatically assign tags (words representing text fragments) to each of the multiple text fragments; provide multiple primary objects in the application domain; automatically cluster the multiple text fragments and tags based on these primary objects to obtain multiple clusters; within each cluster, automatically cluster multiple text fragments with relevant information into sub-clusters, and assign the tags of the clustered text fragments to the corresponding sub-clusters; for each attribute, automatically assign it to one of the multiple sub-clusters based on the similarity between at least one of the attribute name and attribute description and the multiple text fragments and tags of the sub-cluster; for each of the multiple sub-clusters, assess the corresponding re-identification risk based on the value type assigned to the attribute and the attribute description assigned to the sub-cluster.

Description

Technical Field

[0001] Various examples typically involve assessing privacy risks. Specifically, various examples involve computer-implemented methods for assessing the risk of individual re-identification. Background Technology

[0002] Information privacy is the relationship between the collection, processing, and dissemination of data, technology, public expectations of privacy, and the legal and political issues surrounding them. It is also known as data privacy or personal data protection. Personal data protection is challenging because it involves attempting to protect individual privacy preferences and personally identifiable information while using data.

[0003] Data minimization and purpose limitation are two key principles of personal data protection. Whenever personal data is needed for a specific, explicit purpose, the amount of data collected or processed may be limited to the amount necessary for that purpose. This is especially true for personal health information, which is subject to very strict privacy and data protection regulations, including the European Union's General Data Protection Regulation (GDPR) or the US Health Insurance Portability and Accountability Act (HIPAA).

[0004] Two techniques that contribute to the principle of data minimization are pseudonymization and anonymization, in which the data controller or processor does not need to access the real identity of the data or the real value of the data attributes, but the minimized data is still useful for the intended purpose.

[0005] Typically, personal data relating to an individual (also known as a "data subject") can be viewed as consisting of records. Each record includes a set of fields or attributes. Each field or attribute is a pair of attribute names or labels (e.g., the individual's age or his name) and attribute values ​​(e.g., 33 years old or Peter Smith).

[0006] Pseudonymization is a data management and de-identification procedure in which personally identifiable information fields within a data record are replaced with one or more artificial identifiers or pseudonyms. The individual pseudonym used for each replaced field or set of replaced fields makes the data record less identifiable while still being suitable for data analysis and processing. Data anonymization is the process of removing personally identifiable information from a dataset, thus keeping the person described in the data anonymous.

[0007] In other words, much of the process of pseudonymization or anonymization (or any more general form of minimization) involves removing some fields or replacing the exact values ​​with more "abstract" versions of them. For example, attribute values ​​might contain a range like 30 to 35 years old or pseudonyms like PS2235, instead of age in years. These two procedures are also known as deletion (or suppression) and abstraction, respectively.

[0008] Fields or attributes have different meanings for identifying individuals. A person's name does not fully identify them, but neither does age. However, combinations of attributes can be problematic: given an individual's age, postal code address, and weight, the probability of identifying that person may be very high.

[0009] For example, as defined in Episode 26 of the GDPR, data protection principles should apply to any information relating to an identified or identifiable natural person. On the other hand, data protection principles should therefore not apply to anonymized information, i.e., information unrelated to an identified or identifiable natural person, or information unrelated to personal data anonymized in a manner in which the data subject is not identifiable or is no longer identifiable. In the case of anonymization, the minimized data should not involve an identified or identifiable natural person, nor should it involve any other personal data anonymized, even if the data subject is not identifiable or is no longer identifiable. In other words, anonymized data should not be directly or indirectly linked to the subject from which it originates. The concept is that the resulting “anonymized data” does not require further privacy protections, and in particular, does not require any specific mechanisms involving information and context management (after publication). Inferring information should be impossible; that is, it should be impossible to infer the value of an attribute with a high probability from the values ​​of a set of other attributes.

[0010] In various contexts, much personal data is collected and stored using structured formats, such as, as mentioned above, records of a set of attribute-value pairs. Important examples in the medical data field are structured formats such as the DICOM (Digital Imaging and Communications in Medicine), HL7 (Health Level 7), and FHIR (Rapid Healthcare Interoperability Resource) standards. These are used to store vital sign readings, results of medical examinations, and especially information obtained from imaging devices such as CT (Computed Tomography), MRI (Magnetic Resonance Imaging), and ultrasound imaging. Within the DICOM standard, thousands of different attributes exist, and the list of defined attributes continues to expand.

[0011] In assessing and identifying individual risk, an attribute may be considered critical if its values ​​might contain too much information valuable for identifying the data subject. For data minimization, a rejection list (also known as a "blacklist") can be used to specify which critical attributes should be eliminated during minimization. This approach can be very dangerous because many pieces of information may still remain among the remaining attributes that have not yet been identified as critical, either individually or in combination with other attributes.

[0012] Furthermore, given the large number of attributes, identifying how to handle different attributes can be difficult, error-prone, and cumbersome, especially in scenarios with hundreds or thousands of attributes, and when attributes change or other attributes are added.

[0013] Therefore, advanced technologies are needed to assess the risk of individual re-identification. Summary of the Invention

[0014] Various examples of this disclosure typically involve assessing individual re-identification. According to various examples, a computer-implemented method for assessing the risk of individual re-identification in an application domain is provided. In the application domain, for each of a plurality of individuals, a corresponding personal record is stored in a database. Each record includes a set of attributes. Each attribute includes a corresponding attribute name and a corresponding attribute value. According to the method, multiple text documents related to the application domain are provided. The application domain can be any domain in which personal data is collected, such as consumer behavior, travel and driving habits, employment, and particularly medical and health care. For example, descriptions of relevant standards (e.g., DICOM standards in the medical and health fields) or professional literature (e.g., corresponding entries in encyclopedias such as Wikipedia) can be edited by experts and provided in electronic form as input in a computer-based system. Based on the multiple text documents, multiple text fragments are identified. A text fragment in one or more text fragments is a text phrase or word contained in the multiple text documents that may be relevant in the application domain. A text fragment can include, for example, an entire sentence, a portion of a sentence, or a single word. For example, word and phrase embedding techniques can be used to identify text fragments, or text markers emphasizing specific words or phrases (e.g., hyperlinks, italics, or bold letters) can be used to identify text fragments. Tags are assigned to each of the multiple text fragments. Tags are words that represent text fragments. For example, multiple tags can be identified based on clustering tagging techniques applied to multiple text fragments or based on emphasized words in multiple text documents. Furthermore, multiple primary objects in the application domain are provided. For example, primary objects can be provided electronically as a list by experts for input in a computer-based system. For example, in the medical and health field, primary objects may include patient information, visit and examination information, institution information, equipment information, and / or analysis and results information. Multiple text fragments and multiple tags are clustered based on multiple primary objects. For example, clustering can be performed using clustering tagging techniques. Clustering is performed, resulting in multiple clusters. Each cluster is associated with one of the multiple primary objects; that is, the text fragments of a particular cluster are associated with one of the multiple primary objects. Within each cluster, multiple text fragments with relevant information are clustered into sub-clusters, and the tags of the clustered text fragments are assigned to the corresponding sub-clusters. For example, text fragments within a specific subcluster can have spatial or contextual relationships, or they can have similar types of information. Two text fragments can have a spatial relationship when they appear in the same sentence or are closely arranged together (e.g., separated by no more than a few words (e.g., no more than ten or fifteen words)). The number of words separating related text fragments can be an adjustable parameter of this method. Thus, a subcluster can include multiple tags. Each attribute is assigned to one of the subclusters based on similarity among the following:

[0015] (i) at least one of the attribute name and attribute description, and

[0016] (ii) Multiple text fragments and multiple tags in a sub-cluster.

[0017] For each sub-cluster, the corresponding re-identification risk is assessed based on the value type assigned to the attribute and the attribute description assigned to the sub-cluster.

[0018] For example, based on the re-identification risk assigned to a sub-cluster, the attributes of the sub-cluster can be processed in the same way, such as applying pseudonymization. Therefore, attributes that may not seem critical in isolation, but may be critical in combination with other attributes, can also be grouped into a sub-cluster and processed accordingly to avoid re-identification, given the re-identification risk. Furthermore, new attributes can be easily and automatically included in the method, enabling the assessment of re-identification risk to be performed with low effort and at least partially automated.

[0019] In various examples, the method also includes adjusting the value type assigned to the attribute and reassessing the corresponding re-identification risk for each sub-cluster based on the adjusted value type and the attribute description of the attribute assigned to the sub-cluster.

[0020] The value type of an attribute can be defined in different ways. For example, the value type of the attribute "Individual's Age" can be defined as age in years, i.e., an integer value, or as age groups, i.e., defining an enumeration of multiple age groups, such as 0-4 years, 5-10 years, 11-15 years, 16-20 years, 21-25 years, etc. Another value type can define multiple age groups with a different granularity, or age groups covering different ranges, such as 0 to 20 years, 21 to 30 years, 31 to 40 years, 41 to 50 years, 51 to 60 years, and 60 years and older. Similarly, the value type of the attribute "Individual's Address" can be defined as an exact address including the country, city (e.g., via postal code), street, and house number. Another value type of the attribute "Individual's Address" can include only the country and city. Yet another value type of the attribute "Individual's Address" can include a range of latitude and / or longitude. By adjusting the value type of the attribute, the re-identification of risk can vary. For example, by changing the granularity of age grouping, the number of people assigned to an age group, and therefore the number assigned to sub-clusters that include the "age" attribute, can vary, thus changing the risk of re-identification. The purpose of adjusting the value type of the attribute may be to ensure that the number of people in each cluster is within a reasonable range, i.e., that the cluster contains enough individuals to have a low risk of re-identification, but with a granularity that allows for meaningful data associations.

[0021] In various examples, the steps of assigning attributes to sub-clusters include: For each sub-cluster, determining a semantic similarity measure between the following:

[0022] (i) at least one of the attribute name and attribute description; and

[0023] (ii) Multiple text fragments and multiple tags in a sub-cluster.

[0024] Attributes are assigned to the sub-cluster that determined the maximum semantic similarity metric. Semantic similarity is a metric defined on a set of documents or terms, where the concept of distance between items is based on the similarity of their meanings or semantic content, rather than dictionary similarity. Mathematical tools can be used to estimate the strength of semantic relationships between linguistic units, ideas, or instances by means of numerical descriptions obtained from comparisons of information supporting their meanings or describing their properties.

[0025] In particular, in the context of medical and health data, identifying text fragments may include identifying text fragments that are associated with at least one of the following:

[0026] - Clinical field;

[0027] -Target audience in the clinical field;

[0028] - Activities in the clinical field; and

[0029] - Types of information collected in the clinical field.

[0030] A clinical domain can refer to a category of various types of healthcare services provided to patients. A clinical domain can encompass specific topics such as musculoskeletal disorders, trauma, cancer, stroke, mental health, diabetes, etc. For example, text snippets can be identified such that they relate to a specific clinical domain, such as an MRI scan of a specific area like the knee, pancreas, breast, or brain. Objects within a clinical domain can relate to specific organs or bones within that domain. Activities within a clinical domain can define actions performed in conjunction with the clinical domain, such as physician consultations, hospitalizations, and examinations performed. The types of information to be collected within a clinical domain can include, for example, examination results, data from laboratories, and images from ultrasound, X-ray, or MRI scans. Text snippets can be identified such that they include text fragments of provided text documents related to each of the above aspects.

[0031] To achieve this, determining text fragments and assigning labels can be performed using machine learning techniques with multiple text documents as input, thereby obtaining clusters for each major object.

[0032] This method may include the step of removing a specific sub-cluster when no attributes are assigned to it. In other examples, a specific sub-cluster may be removed when the number of attributes assigned to it is less than a target, i.e., when the sub-cluster is too small. The predefined target number of sub-clusters can range from 1 to a maximum of 100. However, if a sub-cluster is smaller than the target and is significantly separated from all other sub-clusters (with a large distance), it may still be retained. Clearly, attributes assigned to a sub-cluster to be removed can be assigned to another sub-cluster. The target can be sub-cluster-specific, meaning some sub-clusters may not be allowed to be removed, even if they contain very few attributes.

[0033] In various examples, the two sub-clusters may include attributes with high semantic similarity. Therefore, the method may include a step of merging the first and second sub-clusters when the semantic similarity measure between the attributes assigned to the first sub-cluster and the attributes assigned to the second sub-cluster is greater than a predefined threshold. For example, the semantic similarity measure may be defined in a range from 0 to 1, where 0 represents very low similarity and 1 represents very high similarity. The predefined threshold may be in the range of 0.9 to 1; for example, the predefined threshold may have a value of 0.98.

[0034] Based on various examples, within each cluster, multiple text fragments and multiple tags are clustered such that each sub-cluster includes text fragments and tags with a semantic similarity metric above a threshold. The threshold is chosen to ensure that the number of sub-clusters is within a predefined range. For example, the predefined maximum number of sub-clusters is between 20 and 100. In other examples, the desired number of sub-clusters can be the target value of the clustering algorithm used. For example, clustering multiple text fragments with relevant information into sub-clusters could consider a predefined target number of sub-clusters. A cost function can indicate the higher cost of clustering, causing the number of sub-clusters to deviate from the target number. Therefore, the desired number of sub-clusters can be achieved at least approximately.

[0035] In various examples, the method includes a step of evaluating attribute assignment to a sub-cluster by verifying whether the same data minimization algorithm is applicable to attributes assigned to a sub-cluster. The goal of this evaluation is to address the risk of re-identification. For all attributes in the sub-cluster, the same or similar data minimization algorithm should be available. Similar data minimization algorithms may differ only in different parameters for different value types. If this cannot be achieved with a defined sub-cluster, it is a clear indication that the attribute should be in different sub-clusters, and the steps of assigning the attribute to the sub-cluster can be repeated using different measures or parameterizations of semantic similarity to obtain different sub-clusters.

[0036] Based on various examples, assigning attributes to sub-clusters is performed using machine learning techniques with at least one of the attribute name and attribute description of the attribute and (ii) multiple text fragments and multiple labels of the sub-clusters as input. Machine learning techniques may include supervised machine learning methods, which involve manual inspection to examine the actual content of at least some sub-clusters.

[0037] Various examples of this application relate to an apparatus for assessing the risk of individual re-identification of "items" in an application domain, where, for each of a plurality of individuals, a corresponding individual record is stored in a database. Each record includes a set of attributes. Each attribute includes a corresponding attribute name and a corresponding attribute value. The apparatus may be a computer, workstation, or server, and includes at least one interface and a computing device. The computing device is configured to: receive a plurality of text documents related to the application domain via at least one interface; and, based on the plurality of text documents, determine a plurality of text fragments. One or more text fragments are text phrases or words contained in the plurality of text documents that may be relevant in the application domain. The computing device is also configured to assign each of a plurality of tags to each of the plurality of text fragments. Tags are words that represent relevant text fragments. The computing device receives a plurality of primary objects in the application domain via at least one input unit. The plurality of primary objects may be provided by an input file.

[0038] The computing device is also configured to cluster multiple text fragments and multiple tags based on multiple primary objects to obtain multiple clusters. Each cluster can be assigned to one of the multiple primary objects. Within each cluster, the computing device can cluster multiple text fragments into sub-clusters and assign the tags of the clustered text fragments to the corresponding sub-clusters. Text fragments can be clustered based on the information they contain; that is, text fragments with relevant information are in one sub-cluster. For each attribute, the computing device assigns the attribute to one of the multiple sub-clusters based on the similarity between the following:

[0039] (i) at least one of the attribute name and attribute description; and

[0040] (ii) Multiple text fragments and multiple tags in the cluster.

[0041] The computing device is also configured to assess the corresponding re-identification risk for each sub-cluster based on the value type assigned to the attribute and the attribute description assigned to the attribute.

[0042] Other examples relate to a computer program product that includes computer-readable program code configured to cause a computing device to perform the steps of the methods described above.

[0043] A computer-readable recording medium is configured to store a computer program product therein, the computer program product including computer-readable program code configured to cause a computing device to perform the steps of the method described above.

[0044] The various examples in this disclosure relate to machine learning techniques. Machine learning techniques can include supervised learning and / or unsupervised learning. Unsupervised learning can include data mining and clustering techniques. Specifically, given the examples above, machine learning techniques can be optimized by repeating steps such as clustering attributes and assigning them to sub-clusters using modified parameters (e.g., parameters related to semantic similarity). Manually provided quality parameters regarding the results of, for example, clustering, attribute assignment, or re-identification risk assessment can also be fed back into supervised machine learning techniques.

[0045] It should be understood that, without departing from the scope of the invention, the features mentioned above and those to be described below can be used not only in the indicated combinations, but also in other combinations or individually. Attached Figure Description

[0046] Figure 1 The devices are illustrated schematically according to various examples.

[0047] Figure 2 It is a flowchart based on various examples of methods. Detailed Implementation

[0048] Some examples of this disclosure typically provide multiple circuits or other electrical devices. All references to circuits and other electrical devices, and the functions provided by each of these circuits and other electrical devices, are not intended to be limited to what is shown and described herein. While specific labels may be assigned to the various circuits or other electrical devices disclosed, such labels are not intended to limit the scope of operations for the circuits and other electrical devices. Such circuits and other electrical devices may be combined and / or separated from each other in any way based on a desired particular type of electrical implementation. It should be understood that any circuit or other electrical device disclosed herein may include any number of microcontrollers, graphics processing units (GPUs), integrated circuits, storage devices (e.g., flash memory, random access memory (RAM), read-only memory (ROM), electrically programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or other suitable variations thereof), and software that cooperates with each other to perform the operations disclosed herein. Additionally, any one or more of the electrical devices may be configured to execute program code embodied in a non-transitory computer-readable medium, which is programmed to perform any number of functions as disclosed.

[0049] It has been found that analyzing the risk of project re-identification can benefit from structuring project data into clusters and sub-clusters in such a way that:

[0050] - Re-identification can be easily estimated and analyzed.

[0051] -It can decide which sub-clusters can be retained, and

[0052] - How to abstract (generalize or suppress) data values ​​of clusters and sub-clusters to obtain acceptable re-identification risks and target k-anonymity levels, as described in the following paragraphs.

[0053] From an anonymization perspective, data can be categorized into direct identifiers, quasi-identifiers, and other information. Direct identifiers typically uniquely identify patients in the absence of further information. Quasi-identifiers alone cannot identify patients, but when combined with other information, they can help in patient selection. Therefore, it is important to identify which fields or information represent quasi-identifiers and carefully assess their risk of re-identification.

[0054] A general method for achieving relative anonymization is as follows:

[0055] -Do not retain direct patient identifiers.

[0056] - Information about organizations is not stored in plain text in DICOM files.

[0057] The amount of information needed to evaluate the data should be kept to a minimum.

[0058] Additional information, such as relevant laboratory results, can be added if needed, but no identifiers are provided.

[0059] Typically, personal data relating to an individual or patient can be viewed as consisting of records. Each record includes a set of fields or attributes. Each field or attribute is a pair of attribute name or label and attribute value.

[0060] The risk of re-identification can be measured using k-anonymity. k-anonymity is a property of anonymized data. For example, a data publication is said to have k-anonymity if the information of each individual included in the publication cannot be distinguished from that of at least k-1 other individuals whose information also appears in the publication.

[0061] To achieve k-anonymity for a reasonable value of parameter k, not only are quasi-identifiers generalized or obfuscated to obtain subclusters of a selected size, but the possibility of using sensitive information (such as pixel data) is also considered. Other factors analyzed and affecting the risk of re-identification are: the hospital's coverage (the population size of potential patients), the number of studies conducted at that hospital (the lower the number, the easier it is to re-identify patients), and the completeness of the number of studies in collaborations (the proportion of studies used for collaborations to the total number of available studies; the lower the completeness, the more difficult it is to re-identify patients).

[0062] The following will first provide an overview of some relevant aspects of the re-identification risk analysis associated with this invention, and then describe embodiments of the invention in detail with reference to the accompanying drawings. It should be understood that the following description of the embodiments should not be considered limiting. The scope of the invention is not intended to be limited by the embodiments or drawings described below, which are merely illustrative.

[0063] Data is fundamental to all digital activities and is the basis for developing new and improved products. Particularly in the healthcare field, digitalization is creating tremendous opportunities, for example, through the development of artificial intelligence (AI) to assist physicians in decision-making processes or automate the safe operation of medical devices. Therefore, many projects in this field acquire and process such data, such as storing, analyzing, estimating, or correlating it. However, such data may include personal health information, which is subject to very strict privacy and data protection regulations. It is necessary to avoid re-identifying individuals / patients based on this data.

[0064] It has been found that different types of examinations (e.g., head scans versus internal organ scans) have significantly different risks of re-identification. Furthermore, contextual information (such as the hospital cluster or the number and completeness of studies) has an additional impact on the risk of re-identification.

[0065] The techniques described in this paper organize the inspection information in different "key objects" of re-identification risk and provide guidance for data minimization operations. Whether data can be considered anonymized can be estimated based on the criteria of selection, linkability, and inference as defined in Article 29 of the Working Group on Data Protection, Opinion 05 / 2014 on Anonymization Techniques. It may also take into account elements set forth in Preamble 26 of the GDPR, such as cost, time commitment, and the reasonable likelihood of a re-identification attempt.

[0066] Clinical data can be obtained from DICOM studies generated during clinical workflows, with the aim of developing and improving medical products and procedures for diagnosis and / or treatment. DICOM studies used should be k-anonymized to reduce the risk of re-identification.

[0067] In the following text, reference will be made primarily to data stored according to the DICOM standard, i.e., data from DICOM studies. However, it is clear that the techniques described are not limited to DICOM studies but can be applied to any other type of structured data, including the aforementioned personal data.

[0068] Data minimization can be based on an allowable list. The allowable list specifies which labels from the DICOM study to retain and what minimization operations to perform on them. These operations describe whether the label remains unchanged or undergoes some modification, such as reducing the precision of the value or replacing it with a random value. During data minimization, not all labels not included in the allowable list may be retained.

[0069] The DICOM standard itself currently defines approximately 5,000 different tags. New versions of the standard (including new tags supporting new modalities and use cases) are released several times a year. In addition, vendors can define their own proprietary tags.

[0070] Typically, a so-called rejection list method is used to remove tags that contain identifiable information. Any tags not listed in the rejection list will not be modified.

[0071] The DICOM standard itself includes the following list (“Confidentiality Profile”), which currently defines approximately 450 tags that are considered to contain identifiable information.

[0072] The technique described in this paper proposes a more secure approach that uses a defined list of allowed operations for the content of each DICOM tag. This means that during data minimization, using defined data reduction operations, only tags included in the allowed list are retained. Tags not listed in the allowed list are not retained. This is similar to the security approach used for declarative access control: only those explicitly specified operations are allowed.

[0073] Furthermore, from a privacy perspective, this approach is more robust. Allowing the list ensures that only relevant and expected data is available after minimization.

[0074] However, such an approach could require significant effort to edit and maintain an allowed list of thousands of defined tags. It would be much more convenient to simply remove known tags that may contain personal data, as defined in the DICOM standard.

[0075] DICOM tags can include thousands of commonly used DICOM tags defined by the DICOM standard, plus an equal number of proprietary DICOM tags. DICOM tags can be grouped according to a primary object within a cluster and each cluster within a sub-cluster. The primary object groups different kinds of information in DICOM studies (e.g., information about the institution, the equipment used, the patient themselves, and the parameters and measurements in the examination). Within each of these clusters, sub-clusters are defined, which group tags with similar re-identification risks.

[0076] The description and value representation (VR) of label content specified in the DICOM standard should be considered, such as integer values, predefined code strings, and text. DICOM labels with VR text (whose content can be defined by the device operator) may require particular care. Typically, these labels do not contain patient-related information, but there is a residual risk that these labels may hold quasi-identifiers. Therefore, only free text elements known to be used for a specific purpose and necessary, as they are typically used for that purpose, should be retained. The recommendations of the DICOM standard in the confidentiality profile may also be considered.

[0077] Private labels are defined by the modal vendor (i.e., manufacturer). Each vendor publishes a DICOM Declaration of Conformity (DCS) which contains a list of its private labels, including label names and value representations. Not all private labels are published by the vendor. The DICOM standard lists several private labels as "secure" attributes in its confidentiality profile. This means that these private labels are considered technical information only.

[0078] For estimations of proprietary tags, DICOM conformance statements can serve as a basis for information. Recommendations from the DICOM standard can be considered, but are not the only source of information. Estimations can particularly consider VRs, which provide hints about tag values ​​and their potential contribution to re-identification risks. Additional information may be required for tags containing strings and tags containing binary objects.

[0079] For risk re-identification analysis, tags in DICOM studies can be clustered based on the primary objects to which they belong.

[0080] The following clusters can be defined:

[0081]

[0082]

[0083] For each cluster, sub-clusters can be identified, which will be grouped with DICOM tags that have similar information and are relevant to re-identification. For all tags within a sub-cluster, the same type of data minimization operation can be applied. The applied data minimization can always remove direct patient identifiers. However, the resulting information may still be quasi-identifiers. In this case, the re-identification risk based on that sub-cluster can be estimated, and the rationale can be given.

[0084] The following sections will discuss the identified sub-clusters in terms of their content, the applied data minimization, and the risks of re-identification. For each sub-cluster, the following information may be considered:

[0085] - DICOM tag groups with similar information related to re-identification;

[0086] - A brief description of the cluster;

[0087] - Data minimization: Based on project requirements, each project will define a set of data minimization operations, which ensures that only the appropriate minimum amount of data is retained;

[0088] - Re-identify risk: Re-identify risk estimation after applying data minimization operations;

[0089] - Quasi-identifier: Indicates whether the information of this sub-cluster can be regarded as a quasi-identifier or non-personally identifiable information.

[0090] The "Patient" cluster contains all information directly related to the patient. This cluster is divided into sub-clusters that distinguish different types of fields (labels). The criteria used to construct these sub-clusters may seem somewhat arbitrary, but the criteria can be as follows: if two different types of data (labels / fields) pose different risks of re-identification (given the remaining data that should be collected), they are placed in different sub-clusters. More precisely, two types of labels can only be kept together in the same sub-cluster if:

[0091] -They have similar origins.

[0092] -They pose similar risks to the re-identification of research, and

[0093] - If labels are collected at the same frequency for the same type of research: labels in the same cluster are either frequently or infrequently retained, or they should be retained for a specific type of research.

[0094] The following sub-clusters can be identified about a cluster “patient”: identifier, information, and characteristics.

[0095] Patient identifiers such as patientID (the patient identifier used by hospitals) or patient names can be replaced with null values, the same constant value, or random values. Not retaining these labels may be unacceptable, for example, because these labels are required to comply with DICOM standards.

[0096] For example, some projects may need to differentiate between different patients. An example is a project developing AI algorithms. Other examples are projects analyzing the progression of health conditions over time.

[0097] Regarding patient information, DICOM studies can include more information about the patient, such as address, phone number, date of birth, and names of relatives.

[0098] DICOM tags containing this type of information have been assigned to this sub-cluster.

[0099] Regarding patient characteristics, DICOM studies can include many different patient characteristics, such as sex, age, weight, and body type. All of these characteristics serve as quasi-identifiers for the patient.

[0100] Another aspect to consider is the dataset. If the project has several or all of the DICOM studies from hospitals targeting a specific disease, then selection and inference could become a threat to re-identification. If someone knows that their neighbor had a fracture at a specific hospital (institution), is 86 years old, and there is only one 86-year-old patient in the dataset of fracture patients from the past 3 years, then selection is highly likely.

[0101] If all DICOM studies in a subgroup are part of a project, then the selection and inference of factors need to be taken into account for project-specific evaluation.

[0102] Regarding patient characteristics, it has been found that projects may require additional patient characteristics on their own. An example is:

[0103] Research on lung diseases often requires information about smoking status;

[0104] Studies involving the application of drugs (such as contrast agents) may require the patient's weight;

[0105] For some medical products, testing and certification for different ethnic groups may be required.

[0106] The primary object, "Institution," contains all information about the institution (hospital) that performed the examination (e.g., the imaging procedure for the DICOM study).

[0107] The following sub-clusters can be identified regarding the main object "organization": identifiers, regions, information, and personnel.

[0108] Information about the institution is an important quasi-identifier because it helps to narrow down a group of potential individuals who are already subjects of the imaging procedure by their location.

[0109] Therefore, the DICOM label can be carefully analyzed to avoid any implications for the organization.

[0110] Information such as the name of an organization, such as an organization identifier, may not typically need to be in plain text.

[0111] For several reasons, it may be necessary to be able to distinguish between different institutions. Some projects involve different institutions. Being able to distinguish the sources of data makes it possible to calculate the amount of data provided by different institutions. For example, for the release of medical devices, there are legal requirements regarding the testing and validation data used; if the data can be linked to a specific institution, these requirements can be met more easily.

[0112] For example, random values ​​can be used to represent specific institutions across all studies. For different projects, new random values ​​can be generated (these random values ​​are random and not too short, and can be confidently assumed to be different for all institutions and all projects).

[0113] Random values ​​from individual institutions do not provide useful information for selecting patients. However, within a project, information about the institutions can be obtained even if the DICOM file itself does not contain any information.

[0114] If the institution is known, the cluster provides a hint about a group of potential patients. The size of this group depends on the institution. A small hospital in a rural area might only serve 100,000 people. A small rural hospital specializing in certain diseases will handle more patients. These patients may also come from other areas (e.g., in the case of specialist services). If the institution is a chain of hospitals or a group of clinics, its cluster will be much larger, covering millions of people.

[0115] The number of potential patients from institutional clusters can be estimated for each project, as this number is an important factor in estimating the risk of selection.

[0116] DICOM studies include additional institutional information that can help identify an institution. Examples include the institution's address, department name, and site name. This information may not be required in the study project. Because it increases the risk of the institution being identified, this data may not be retained.

[0117] The region that can support the organization. The calculated region can be large enough (e.g., the EU, Asia, etc.) that it does not increase the risk of re-identification. Therefore, this value is not considered a quasi-identifier.

[0118] DICOM studies may include the names or identifiers of institutional or other personnel involved in image acquisition or patient treatment. This is personal data that is not typically required. It also increases the risk of identifying the institution. Therefore, this data may not be retained.

[0119] DICOM studies may include additional tags, which may contain information about the institution. Examples are the tags below, whose content is a text field that can be specified by the institution. In case of doubt, these tags are assigned to the cluster and are not retained to ensure that the minimized DICOM study does not contain any unintended content.

[0120] The cluster “devices” contains all the information about the devices that generate DICOM studies.

[0121] The following sub-clusters can be identified about a cluster “device”: identifier, general information, specific information, and free text.

[0122] For medical devices, manufacturers know which device is located at which customer site. This mapping can be stored in various databases. Although this information is not accessible to everyone, it is assumed that a link between the device and the institution is possible. Therefore, detailed information about the device is considered a quasi-identifier.

[0123] Regarding device identifiers, DICOM studies include unique identifiers for devices (e.g., devices used for imaging acquisition). An example is a serial number or identifier for a device component. This information allows the device to be attributed to an organization and is therefore not retained.

[0124] Several tags containing device identifiers are so-called "Type 1" tags, meaning they should exist in DICOM-compliant DICOM studies. Therefore, these values ​​can be replaced with random numbers.

[0125] If required by the project, it can support assigning consistent values ​​to device identifiers (either via a mapping table or using a keyed hash, where the key is generated within the client scope for the research project).

[0126] From a risk analysis perspective, maintaining consistent random values ​​allows us to know that the same equipment has been used for imaging acquisition. This does not generate useful information for re-identification.

[0127] The serial number itself is considered a quasi-identifier because the manufacturer knows which device is installed where. Knowing the location reduces potential clusters, and therefore the number of potential patients will be much smaller. Therefore, device identifiers are not retained.

[0128] For all types of analysis, general information about the equipment and its sub-components (e.g., detectors, coils) may be required, such as manufacturer information and model name.

[0129] Many projects must ensure that test data is based on devices from different vendors. An example is the development of AI-based pixel data analysis for automated annotation. Regulatory agencies require testing on many different devices to approve medical products.

[0130] The information assigned to this sub-cluster is so generic that many devices of each model are typically in use. There are two exceptions. For new device models, there will be only a small number of customers when they are introduced to the market. Furthermore, some high-end devices are not widely used.

[0131] There is no publicly available list showing which hospitals are operating which equipment models. Some hospitals publish information about the equipment models they use, especially in the case of high-end equipment. Equipment manufacturers have complete lists of equipment deployed at their clients' sites.

[0132] Equipment information is generally considered a quasi-identifier because, in some cases, it can be used to restrict a group of hospitals to operating that particular model of equipment.

[0133] Therefore, device model information does not directly help in selecting patients, but it can help narrow down the range of hospitals that use the device.

[0134] In projects that do not focus on specialized equipment, data from new equipment models will be rare, and efforts to use such data to select patients can be considered highly correlated with success rates.

[0135] This sub-cluster, "Device-Specific Information," covers more detailed information about the device, such as software or application versions. Many different versions may exist in use. The current version is available in the manufacturer's installation database and can be accessed by many different employees. Therefore, knowing this information allows for a significant narrowing of the organization's scope. This more specific information is considered a quasi-identifier compared to general device information.

[0136] Some projects will require this information. An example is a research project testing a new software component. In this case, the manufacturer can be aware of the device and therefore needs to consider the clustering of that device in the project-specific risk assessment.

[0137] Regarding device dates, DICOM studies include datestamps that are related to the device itself and independent of the image acquisition date. These are dates of device maintenance, specifically device configuration and calibration dates.

[0138] Maintenance and calibration dates can be obtained from the monitoring equipment's database. Individual date stamps are for technical information only. Therefore, these date stamps are not retained or replaced with fixed or random values.

[0139] Regarding the "free text" of the device sub-clusters, DICOM studies can contain various information about the device, which can be defined by the device operator. An example is the device's organization-specific name. These free text DICOM fields can contain information about the organization. To avoid this risk, free text values ​​or opinions are not retained.

[0140] The cluster "inspection" contains information about the inspection itself, such as image acquisition and post-processing steps as annotations.

[0141] The following sub-clusters can be identified regarding cluster "inspection": identifiers, dates, programs, text, pixel data, technical data, free text, etc.

[0142] The DICOM UID (Unique Identifier Used for Inspection) describes the relationship between different parts of the imaging procedure. Each DICOM UID consists of two parts (<org root> and <suffix>Composition: UID =<org root> . <suffix>UID<org root> Partially uniquely identifies an organization, such as a device manufacturer. UID <suffix>The part also consists of several digital components, and<org root> It should be unique within the range.

[0143] The "Research Instance UID" is a globally unique identifier for the DICOM research itself. The "Series Instance UID" identifies a series (usually a single scan), and the "SOP Instance UID" is unique for a single file (e.g., a slice).

[0144] These DICOM UIDs are quasi-identifiers because they allow identification of DICOM studies rather than directly identifying patients. To provide uniqueness, the suffix typically includes detailed device information and a date or timestamp.

[0145] Therefore, the DICOM UID can be modified to reduce the risk of re-identification. This modification should be consistent, preserving the relationships found in DICOM studies and ensuring the results conform to DICOM standards.

[0146] Therefore, all UIDs can be modified as follows: For data-minimizing use cases, the root is replaced with a vendor-specific root, and a suffix is ​​generated using a keyed hash of the original UID. This key is generated for research projects within the institution. This approach preserves the uniqueness required for UIDs in DICOM research.

[0147] The results are not considered quasi-identifiers because they are no longer likely to be relevant to the patient.

[0148] Regarding inspections, DICOM studies contain many different dates / timestamps. The included tags depend on various factors, such as the imaging equipment used, and also on the configuration of the entire imaging procedure within the institution, such as the date / timestamp associated with image acquisition.

[0149] Other datestamps in the DICOM study were associated with hospitalization time or the device itself. These datestamps were assigned to different sub-clusters and processed differently.

[0150] The inspection date is a quasi-identifier because the actual inspection date can be known. The timeframe between different steps is important for all analyses in the DICOM study. Therefore, the date stamp can be modified in a way that preserves the time distances within the study.

[0151] Modifying (transferring) timestamps does not significantly reduce the risk of re-identification. The exact timestamp during the inspection is usually unknown.

[0152] One approach is to transfer the dates of all studies to the same random value, or to allow users to choose the time frame to use for the transfer. Both approaches carry risks for various reasons:

[0153] - If a study can be identified in some way, then the transition value of that study is known, and therefore the transition values ​​for all other studies are also known.

[0154] - Days of the week and some public holidays can be derived from the frequency of the study.

[0155] User input is usually not a reliable source of the random values ​​needed here.

[0156] A more appropriate approach to minimizing the data could be to completely discard the date distribution pattern. This can be achieved by setting all dates to a fixed value (e.g., the first day of the year) or by randomly shifting each individual study using a sufficiently large random value. The downside is that longitudinal information will be lost.

[0157] Some research projects analyze different examinations of the same patient, such as to analyze the progression of a disease like cancer. For these projects, longitudinal information, i.e., the distance between different examinations, may be required. Longitudinal information can only be preserved if the patient ID is consistently modified (i.e., different patients can be distinguished). In this case, all studies belonging to the same patient are transferred for the same number of days.

[0158] As the timeframe shifts, for example from one year to three years, the risk of re-identification based on individual study dates decreases significantly. All patients within the 3-year timeframe need to be considered as a group of potential patients.

[0159] The risks associated with retaining longitudinal information depend on the type of program. If all patients are examined at the same date interval, the examination pattern is not unique for a single patient. The effectiveness of retaining longitudinal information can be estimated on a program-by-program basis.

[0160] Use case analysis shows that R&D projects use similar longitudinal information for each patient, such as performing several tests over a short period (hours or days) to analyze the effects of applied contrast agents, or performing tests over a roughly fixed period (e.g., all 6 months) to monitor disease progression. In these cases, all patients follow the same testing pattern. Therefore, this pattern helps narrow down the patient pool because it indicates that several tests have been performed, but the pattern is identical. Thus, in these cases, the potential risk of selection is considered negligible.

[0161] If longitudinal information is retained, project-specific assessments may be required.

[0162] The sub-cluster "Check-Procedure" can contain procedural information, protocols used, and notes for checks performed as applied drugs (contrast agents / pills).

[0163] The application of medication (contrast agent / pill) affects pixel data, thus requiring accurate pixel estimation. The protocol used describes and is necessary for the configuration employed in this imaging acquisition. Annotations, i.e., the automatic or manual interpretation of the pixel data, are fundamental to subsequent analysis.

[0164] None of this information is specific to the patient.

[0165] Using medical expertise, information about a patient's health status can be gleaned from procedural information, as some procedures are specific to (suspected) disease types.

[0166] Using medical expertise, one can deduce the medical conditions depicted in the pixel data. Annotations aid in understanding the findings within the pixel data, even for non-experts.

[0167] This information is considered a quasi-identifier because it can provide some information about the patient's health condition and thus indirectly help narrow down a group of patients.

[0168] The sub-cluster "Inspect-Text" contains standardized text elements that include information about the application's procedures (e.g., study or series descriptions, labels) or as post-processing objects segmented from radiotherapy (RT) structures. This may be necessary for many analyses.

[0169] The information contained herein is similar to that of the sub-cluster "program". It does not contain information about the patient.

[0170] All free text elements always carry the residual risk of containing unexpected values. Therefore, each tag in this sub-cluster should be thoroughly examined.

[0171] The information in this sub-cluster contains standardized values. Since the examination is also conducted to rule out certain medical conditions, this information is not considered a quasi-identifier.

[0172] The sub-cluster "pixel data" refers to the "image" data itself. In the modality, pixel data is calculated by the device itself based on physical measurements.

[0173] For some projects, it may be necessary to retain the physical measurements themselves (e.g., the "raw data" of an image), for example, to test new algorithms used for image computation.

[0174] DICOM studies can contain different "slices" of an image. Using specialized software, these slices can be rendered and displayed as 3D images.

[0175] Preserving pixel data is a core requirement for all these research projects. These projects primarily focus on improving image quality or image analysis, and therefore blurring content to reduce the risk of re-identification contradicts the project's objectives.

[0176] Pixel data can contain burned-in text information about the patient. This is done, for example, to improve human readability through a post-processing system. The collection of this type of pixel data can be optimized, for example, by obscuring or masking the information before minimization; this can be implemented through manual inspection or semi-automated testing.

[0177] There may be some very specific clinical conditions, such as very specific stents, implants, fractures, or anatomical structures. These very specific conditions can help narrow down the pool of potential patients for selection. DICOM studies may exclude patients with these types of conditions from the program.

[0178] Pixel data provides information about the patient, depending on the body region and disease shown, which can help identify the patient or link the data to other data of the same patient.

[0179] For all projects, an overall assessment of the risk of re-identification of the indicated body areas may be necessary. The frequency of disease may be considered for this purpose.

[0180] Head scans may require special attention. A specific project-specific risk assessment may be necessary for head scans.

[0181] Furthermore, DICOM studies can avoid including pixel data containing direct patient identifiers, as burned-in text, or very specific clinical conditions, which would allow for high-probability patient identification.

[0182] For the display of many analyses and pixel data, information from the "Technical Data" sub-cluster may be required. This can cover the acquisition parameters and measurements used. Furthermore, DICOM tags used for structured DICOM studies are included in this sub-cluster as Sequences (SQs) (i.e., DICOM tags where VR = SQ).

[0183] Technical data is not relevant to patients and therefore is not considered a quasi-identifier.

[0184] In the sub-cluster "Check-Free Text", DICOM studies can contain opinions or other free text information related to the DICOM study, or post-processing of the study, or accompanying objects of the study specified by the operator.

[0185] The possibility of indirect information about patients or other quasi-identifiers cannot be ruled out. All examined free-text DICOM elements are assigned to this sub-cluster. To avoid any risk, these free-text values ​​or opinions may not be retained.

[0186] The "Inspect - Other" sub-cluster contains all data that is irrelevant or unnecessary to the use case, such as data used to display the system or storage device, or data whose content is unclear and unnecessary. This data may not be retained.

[0187] The "Other" cluster can contain all other information, i.e., DICOM tags that have been analyzed and do not fall into any of the aforementioned clusters and sub-clusters.

[0188] Typically, research projects may require additional clinical data about patients, such as biopsy results in cancer-related projects or laboratory information as PCR values ​​during prostate examinations. This information may not be stored in a DICOM file. It may need to be linked by the institution to a modified patientID. Therefore, for these projects, it may be necessary to store an institution-wide mapping table between the original patientID and the minimized patientID.

[0189] Each item may require checking whether this additional information is a quasi-identifier, and therefore requires estimation on a item-by-item basis. For example, items related to prostate exams require PCR values. These PCR values ​​are laboratory results at the time of the exam, and they will change over time. Therefore, they are not helpful in identifying patients and are not considered quasi-identifiers.

[0190] Article 29 of the Data Protection Working Group's "Comment 05 / 2014 on Anonymization Techniques" describes the criteria for estimating anonymization techniques. These criteria can be used to derive specific threats from analyses regarding the risk of re-identifying patients.

[0191] According to Article 29 of the WP, the main threats to anonymization are:

[0192] -Selection corresponds to the possibility of isolating some or all of the records in the dataset to identify an individual;

[0193] Linkability is the ability to link at least two records about the same data subject or a group of data subjects (in the same database or in two different databases). This technique provides resistance to "selection" if an attacker can determine (e.g., through correlation analysis) that two records are assigned to the same group of individuals, but cannot select individuals from that group; however, it does not provide resistance to linkability.

[0194] - Inference is the probability of inferring the value of an attribute from a set of other attribute values ​​with a high probability.

[0195] Based on the method described herein, a risk analysis framework for estimating the re-identification risk of quasi-identifiers for projects is provided, which are identified by grouping them into DICOM tag clusters as described above. It examines combinations of quasi-identifiers, links that information to additional knowledge that the threat source may possess, and analyzes the re-identification risk by considering the means and external information that the threat source may use, as well as objective factors determining the risk value (e.g., cost, time commitment, and the reasonable likelihood of a re-identification attempt).

[0196] The techniques used to analyze the probability of selecting patients are described below.

[0197] It can be distinguished whether the individuals ("threats") attempting to identify patients know about the hospital.

[0198] In principle, pixel data can be used to identify patients. It can contain patient identification structures as text or identification structures (outliers). Some devices generate text information within pixel data. In this case, it can contain the patient ID or even the patient's name. In this case, the patient can be directly identified. Furthermore, pixel data can contain identification structures (outliers), such as unusual implants. This information will allow for patient selection.

[0199] Therefore, to process pixel data in the project, only pixel data without identification information can be provided. Thus, after minimization, the pixel data may not contain patient identification structures.

[0200] Assuming the threat source is unaware of the hospital that generated the DICOM study, and the DICOM study does not contain information that allows the threat source to directly or indirectly identify the hospital, the only available information about the hospital is its geographic region. This region can be a predefined value covering several countries. Therefore, the potential patient pool is very large, potentially encompassing millions of people.

[0201] DICOM studies can include general information about the equipment used. Manufacturer staff can use this information to narrow down a group of potential hospitals. Even if only a few hospitals use a particular type of equipment, the potential patient pool can still be large.

[0202] In cases where equipment models are uncommon in the market (e.g., new models, very expensive models, etc.), the hospitals using them may be well-known. In such cases, clustering for risk analysis can take this into account.

[0203] Patient-related quasi-identifiers can be used to limit a group of potential patients.

[0204] The examination parameters, clinical condition, and pixel data indicating disease are themselves other quasi-identifiers. The information obtained is a disease or suspected disease. To account for the impact of this information, the frequency (incidence rate) of the disease can be derived or estimated from available statistics.

[0205] Using this information (population, patient characteristics, incidence rate), k-anonymization checks can be performed. The following example illustrates the use of patient quasi-identifiers in a sub-cluster of basic patient characteristics. The estimation can be adjusted when more or fewer patient characteristics are configured.

[0206] The number of people in each age category can be calculated using available statistics for the region. The incidence rate can then be used to calculate the distribution within each category. If a category contains fewer than a fixed number of individuals (e.g., k = 5), the chosen data minimization can be reconsidered. An example of a k-anonymization check is shown below:

[0207]

[0208]

[0209] If the k-anonymization analysis shows enough values ​​in each category, it is impossible to pick out patients.

[0210] Assume the threat source does indeed know the hospital that generated the DICOM study. Even if the DICOM study itself doesn't contain information about the hospital, individuals involved in the project could still be aware of it. In this case, a cluster of hospitals can be estimated as a basis for further estimations.

[0211] Furthermore, for DICOM studies generated by a specific device manufacturer, employees with access to the list of installed libraries can identify devices of that model. Therefore, employees can even further narrow down the geographical range from which patients might originate. In this case, the cluster to be considered is even smaller. Due to the significantly smaller number of participants, k-anonymization may be difficult to achieve.

[0212] It is impossible to select patients with a high probability. To demonstrate this, the following qualitative examination can be performed. The probability of a potential threat agent performing the following actions can be estimated:

[0213] -Has access to minimal DICOM research,

[0214] -Know the hospital,

[0215] - Patients who have visited the hospital and undergone matching tests, and

[0216] - The DICOM study can be assigned to this patient.

[0217] To achieve anonymity, the probability of generation should be low, and the information obtained through successful links should be low or negligible.

[0218] Another aspect to consider is "inference." Inference is the probability of inferring an individual's characteristics with significant probability from information about the distribution of quasi-identifiers and their values. In the context of k-anonymization, this means that the knowledge that a patient's study likely belongs to that sub-cluster allows for estimating the sensitive data with a higher probability than the statistical baseline. However, if the deviation from the prior probability is systematic because there is a relationship between the values ​​of sensitive data in the population and the primary subject, then this increase in knowledge is not "inference." For example, the suggestion that a patient might have a complication that is typical of a primary subject is not a privacy threat.

[0219] In research projects, hospitals can choose from multiple DICOM studies.

[0220] Within the project, DICOM studies with similar clinical conditions can be analyzed, such as COVID-19 lung conditions or lesions used for AI algorithm development. Through this pre-selection, the clinical conditions of DICOM studies may be identical.

[0221] If not all DICOM studies with defined clinical conditions are part of the project, there is no evidence that a particular patient's DICOM study is part of the dataset. Therefore, inference carries a very low probability / risk.

[0222] If all DICOM studies for a particular subgroup are collected, this can be considered in risk assessment. In this case, it can be analyzed to infer additional information about the patient.

[0223] Suppose a specific individual is known to be part of the dataset. By filtering based on given criteria (e.g., an individual's age and weight range), the number of potentially matching DICOM studies can be reduced. This results in a subgroup of DICOM studies that includes studies on a given individual. Continuing with the COVID-19 example, suppose the dataset contains both positive and negative studies. The subgroup of DICOM studies provides more information about the probability that this person tested positive or negative for COVID-19. Assuming that 90% of the COVID-19 tests in this subgroup are positive, we can assume that the probability of a specific individual testing positive is 90%. The inferred risk can be kept very low.

[0224] Another aspect to consider is "linkability." Linkability involves the ability of a minimized DICOM study in different scenarios to be linked to other information to allow for the identification of patients.

[0225] Assume that other DICOM studies for the same patient are available.

[0226] The data minimization tool removes all direct patient identifiers and ensures that new random values ​​are generated for patientID and hospital for each new project. Therefore, if DICOM studies for specific patients are collected for different projects, the random identifiers generated for patients and hospitals will be different. Consequently, it is not possible to link different DICOM studies using these identifiers.

[0227] Using the same DICOM study in different projects is highly improbable (because a study is about a specific medical condition and may only be suitable for one research question) and should be avoided unless the two minimized studies are identical. In other words, the same minimized procedure should be used in both projects.

[0228] If this is not done, these DICOM studies can be matched by comparing, for example, pixel data and technical values ​​(e.g., decimal values ​​as KVP (peak kilovolt output of the X-ray generator)). All of these technical and pixel data from the DICOM studies are preserved.

[0229] Similarly, this information can be used to match a minimized DICOM study with the original DICOM study. Searching the large database of DICOM studies using technical or pixel data is theoretically possible, but not easy, and the sheer volume of processing required for the DICOM database is obvious and cannot be ignored. It would require parsing the files to obtain combinations of technical data values, or comparing the pixel data. Pixel data comparison could be accelerated by first calculating hash values ​​and then comparing those hash values. However, this would only succeed if the two images were completely identical. Furthermore, the effort expended by these types of attacks is disproportionate to the expected information gain (since the original DICOM study already contains all the information).

[0230] Therefore, formal linkability is possible, but no additional information is obtained, and thus this is not considered an attack on privacy.

[0231] Suppose the patient published the DICOM study. It can be assumed that the patient knew that if the study was published, it would be accessible and used to link to other information.

[0232] All unique identifiers in DICOM studies are replaced with data-minimized replacements. Therefore, they cannot be used to match a specific study with publicly available studies on the internet. As mentioned above, technical or pixel data can be used to link studies, but no additional information is obtained, and therefore this is not considered a privacy attack.

[0233] For some body regions, pixel data has been found to be identifiable. The most prominent example is 3D head scans, which allow for the reconstruction and comparison of photographs. Standard facial recognition algorithms can use the reconstruction from a head scan to match photographs. Several publications have shown good results when compared to a limited set of photographs with high recognition rates. This means that if a limited set of possible patients already exists, the patient may be identifiable by linking these two different data sources. Therefore, a head scan may be identifiable and therefore may not be part of a project.

[0234] Given the above, a common question might be how to identify and handle different attributes, especially when there are hundreds or thousands of attributes defined in DICOM, for example, and when the number of attributes changes, such as when new attributes are included.

[0235] It has been found that each attribute can be handled in a specific way (suppressed / abstracted), but many "similar" attributes can be handled in a similar way. In order to establish a data minimization method for structured data with thousands of different fields (attributes), and in order to be able to assess the risk of residual re-identification after minimization, it is convenient to cluster the fields that should be handled in a similar way (i.e., suppress or abstract them in a similar way).

[0236] The corresponding methods can be executed at least partially or largely automatically, for example, through devices such as computer systems.

[0237] Figure 1 Aspects of device 100 are shown. Device 100 includes computing devices, such as processor 102 and memory 104. Device 100 also includes interface 106. For example, it is possible to receive text documents in digital form, such as from database 150, via interface 106. Processor 102 can load program code from memory 104 and execute the program code. When loading and executing program code, processor 102 may perform one or more of the following: receiving multiple text documents related to an application domain via at least one interface; determining multiple text fragments based on the multiple text documents, wherein one or more text fragments are text phrases or words contained in the multiple text documents that may be relevant in the application domain; assigning tags from a plurality of labels to each of the multiple text fragments, the tags being words representing the text fragments; receiving multiple main objects in the application domain via at least one input unit; clustering the multiple text fragments and multiple tags based on the multiple main objects to obtain multiple clusters; within each cluster, clustering multiple text fragments with relevant information in a sub-cluster, and assigning the tags of the clustered text fragments to the corresponding sub-cluster; for each attribute, assigning the attribute to one of the multiple sub-clusters based on the similarity between (i) at least one of the attribute name and attribute description of the attribute and (ii) the multiple text fragments and multiple tags of the sub-cluster, and for each of the multiple sub-clusters, assessing the corresponding re-identification risk based on the value type assigned to the attribute and the attribute description assigned to the sub-cluster.

[0238] Figure 2 This is a flowchart of method 200 based on various examples. For example, when program code is loaded from memory 104, processor 102 can execute... Figure 2 Method 200. Method 200 includes method steps 202 to 218. Method steps 202 to 218 may be performed sequentially or in parallel. The (preliminary) result of each step may lead to revisions to preceding (or subsequent) steps.

[0239] An application domain, such as the medical and healthcare domain, can be described using a set of tags and text snippets. For example, in step 202, multiple text documents related to the application domain can be provided. Text snippets can be small documents, text sentences, text phrases, or even words. More precisely, it may be necessary to find (primarily short) text snippets and tags describing different aspects:

[0240] -Application areas;

[0241] - Objects in the application domain;

[0242] -Main activities;

[0243] - The type of information to be collected.

[0244] Many sources that can directly use both tags and text include, for example, Wikipedia, DICOM manuals, etc. Therefore, many readily available sources containing large amounts of tagged or untagged data can be used for this purpose. For example, Wikipedia or descriptions of relevant standards (in the case of DICOM, ... http: / / medical.nema.org / standard.html The pages in the document can be used for these purposes. Based on multiple text documents, multiple text fragments are identified, wherein each text fragment is a text phrase or word contained in the multiple text documents that may be relevant in the application domain (step 204).

[0245] In step 206, a tag from the multiple tags is assigned to each of the multiple text segments. Each tag is a word representing the assigned text segment. Since the standard already has a structure, it is convenient to use information from the standard for initial tagging and to initially assign attributes to the cluster, as described below in conjunction with step 214. Even untagged text (such as Wikipedia) uses text tags (e.g., utilizing hyperlinks, italics, or bold) to emphasize specific words, which is likely to provide good tagging for the text. Even without tags, there are well-known algorithms for separating text segments and tags, such as cluster tagging techniques.

[0246] In step 208, for example based on expert knowledge, key objects available in the application domain are identified. Key objects can be physical objects (e.g., technical objects, buildings or parts of buildings), institutions (hospitals, museums, etc.), individuals (identifiable or unidentifiable, groups or roles of individuals, such as doctors, patients, etc.), or events (such as examinations). This step can be entirely manual, fully automated, or machine-assisted.

[0247] In the medical and healthcare field, especially considering the DICOM standard, the main objects can include those mentioned above (but are not limited to these examples):

[0248] -The patient, including all information about the patient, such as the patient himself, demographics, his family, physical condition, etc.;

[0249] - Medical visits and examinations, such as the type and condition of medical visits and hospitalizations, admission date, discharge date, and medical comments;

[0250] - Institutions, such as hospitals, departments, laboratories, etc.;

[0251] - Devices, such as device type, identifiers, software, etc.;

[0252] -Analysis and results, such as vital signs, diagnoses, medical information, or comments.

[0253] In step 210, the text and tags are organized into clusters, that is, into groups directly related to the same primary object. Multiple clusters are obtained, where each cluster may include spatially and / or context-dependent text fragments from a single document of multiple text documents.

[0254] Clusters can be characterized by a set of representative labels. The task of assigning a set of labels to each individual cluster in a document organization is called cluster labeling. See, for example, "Hanieh Poostchi and Massimo Piccardi. 2018. Cluster Labeling by Word Embeddings and WordNet's Hypernymy. In Proceedings of Australasian Language Technology Association Workshop, pages 66-70". A related set of algorithms that can be used is word embedding, for example, see "Wang, Yanshan, et al. A comparison of word embeddings for the biomedical natural language processing." Journal of biomedical informatics 87(2018):12-20".

[0255] Therefore, text fragments and labels are grouped into clusters, and each cluster is described by a number of labels and a number of text fragments.

[0256] In steps 208 and 210, labels and text fragments can be compressed and clustered to identify the primary objects available in the application domain. Therefore, a hierarchical approach is applied to a set of labels to divide them into a hierarchy of clusters (based on primary objects) and sub-clusters. This can be done using standard clustering algorithms, as discussed in "Hanieh Poostchi and Massimo Piccardi. 2018. Cluster Labeling by Word Embeddings and WordNet's Hypernymy. In Proceedings of Australasian Language Technology Association Workshop, pages 66-70". The primary criteria can end with approximately 5 to 12 primary objects, and correspondingly represent 5 to 12 clusters of the primary labels for the objects, meaning one primary label per object, but there can be more labels. Manually revising this step or manually including objects may be helpful, but is not required.

[0257] Attributes with similar category information are grouped into sub-clusters. For example, in step 214, each attribute is assigned to a sub-cluster based on the similarity between at least one of the attribute name and attribute description of the attribute and multiple text fragments and multiple tags of the (ii) cluster.

[0258] For example, for DICOM, the following are the specific sub-clusters that can be identified:

[0259] -Regarding the primary target group, "patients":

[0260] -Identifier

[0261] - Demographic data (including age, sex, race, weight, and height)

[0262] - Family members, relatives, friends, tutors, etc.

[0263] - Address, phone number

[0264] -Regarding the primary target group "medical visits and examinations":

[0265] -Type of medical visit

[0266] - Medical visits and / or hospitalization

[0267] - Admission and discharge dates

[0268] -Medical Visit Reviews

[0269] -Regarding the primary target "institutions":

[0270] -Hospitals, departments, laboratories, etc.

[0271] -City

[0272] -Institutional personnel

[0273] -Regarding the main object "device":

[0274] -manufacturer

[0275] -Equipment model and type

[0276] -Identifier

[0277] -SW and HW configuration

[0278] - Regarding the main object "Analysis and Results":

[0279] - Vital signs

[0280] -Captured information and images

[0281] -diagnosis

[0282] - Medical information or comments generated during analysis within the institution.

[0283] Steps 212 to 214 may include two related tasks:

[0284] - For each primary object, determine the sub-clusters and their corresponding labels.

[0285] - Assign standard attributes to sub-clusters.

[0286] To this end, steps 202 to 208 can be repeated again within each main object: grouping text fragments with similar type information into sub-clusters and labeling these sub-clusters.

[0287] Different attributes of the standard can be assigned based on the labels of clusters and sub-clusters. Supervised machine learning methods can be used to find the optimal label for a given input sequence; this problem is known as the sequence labeling problem. Well-known procedures used for this step are Conditional Random Fields (CRF), Maximum Entropy (ME), and Structured Support Vector Machines (SSVM). A guiding principle may be that attributes of the same type (identifier, date, free text) should be classified into the same sub-clusters whenever possible. Information on value types and attribute content in the DICOM standard can be found in the DICOM data feature registry (see, for example, DICOM PS3.6 2022b - Data Dictionary; DICOM Standards Committee; Copyright). (2022 NEMA). "VR" (Value Representation) is the value type of an attribute, which explicitly indicates whether the attribute is a date or free text, etc. The word "ID" or "identifier" in keywords or descriptions usually distinguishes the identifier.

[0288] Besides DICOM, other health information standards are handled in a very similar way: FHIR and HL7 (and to a lesser extent, CCD, ICD-9, and ICD-10).

[0289] In step 216, for each sub-cluster, the corresponding re-identification risk is assessed based on the value type assigned to the attribute and the attribute description assigned to the sub-cluster.

[0290] Optionally, in step 218, the value type assigned to the attribute can be adjusted, and for each sub-cluster, the corresponding re-identification risk can be reassessed based on the adjusted value type and the attribute description of the attribute assigned to the sub-cluster. The goal of this adjustment of the value type could be to achieve an appropriate number of patients for each sub-cluster.

[0291] Although the invention has been shown and described with respect to certain preferred embodiments, equivalents and modifications will occur to those skilled in the art upon reading and understanding the specification. The invention includes all such equivalents and modifications and is limited only by the scope of the appended claims.

[0292] Therefore, the above method enables the grouping of attributes of all objects in the application domain, allowing them to be processed together in a way that makes it easy to assess the risk of re-identification during the data minimization step. This method can be performed fully automatically or entirely manually, but an automated method with subsequent expert estimation is highly convenient. The procedure comprises several interrelated steps:

[0293] - Identify text that describes the application domain.

[0294] - Identify objects relevant to the application domain.

[0295] - Text and labels are grouped into clusters associated with the identified objects.

[0296] - Attributes are assigned to clusters, and each cluster is subdivided into sub-clusters, making it easier to re-identify risk assessments.

[0297] The analysis for re-identifying risks is based on sub-clusters. Therefore, risk assessment is manageable because the number of sub-clusters is much smaller than the number of attributes, thus eliminating the need to estimate thousands of individual attributes.

[0298] Structured approaches help make risk assessments more transparent. The reasoning in the assessment can be easily understood, thus enabling early detection of weaknesses and preventing data breaches.

[0299] Clusters and sub-clusters can be described, allowing new attributes to be easily assigned to sub-clusters; automated initial assignment is possible. Furthermore, assignment can be performed by individuals not skilled in anonymization. If existing sub-clusters are available, there is no need to adjust the re-identification risk assessment. This provides an efficient and robust mechanism for adapting new attributes for the purposes of data minimization and assessing appropriate re-identification risk.< / suffix> < / suffix> < / suffix>

Claims

1. A computer-implemented method for assessing the risk of individual re-identification in an application domain, wherein for each of a plurality of individuals, a corresponding individual record is stored in a database, each record including a set of attributes, each attribute including a corresponding attribute name and a corresponding attribute value, the method comprising: Provide (202) multiple text documents related to the application domain; Based on the multiple text documents, multiple text fragments are automatically determined (204), wherein one or more text fragments are text phrases or words contained in the multiple text documents that may be relevant in the application domain; Automatically assign (206) a tag from a plurality of tags to each of the plurality of text segments, wherein the tag is a word representing the text segment; Provides (208) several main objects in the application domain, Based on the multiple main objects, the multiple text fragments and the multiple tags are automatically clustered (210) to obtain multiple clusters; Within each cluster, the multiple text fragments with relevant information are automatically clustered (212) in a sub-cluster, and the labels of the clustered text fragments are assigned to the corresponding sub-clusters. For each attribute, based on the similarity between at least one of the attribute name and attribute description of the attribute and (ii) multiple text fragments and multiple tags of the sub-cluster, the attribute is automatically assigned (214) to one of the sub-clusters; and For each sub-cluster, the corresponding re-identification risk is assessed (216) based on the value type assigned to the attribute and the attribute description assigned to the attribute of the sub-cluster.

2. The method according to claim 1, wherein, The method further includes: Adjust (218) the value type assigned to the attribute, and for each sub-cluster, reassess the corresponding re-identification risk based on the adjusted value type and the attribute description of the attribute assigned to the sub-cluster.

3. The method according to claim 1 or 2, wherein, The step of automatically assigning (214) the attribute to one of the sub-clusters includes: For each sub-cluster, determine a semantic similarity measure between (i) at least one of the attribute name and attribute description of the attribute and (ii) multiple text fragments and multiple tags of the sub-cluster; and The attribute is assigned to the sub-cluster that has determined the maximum semantic similarity metric.

4. The method according to claim 1 or 2, wherein, Automatically determining (204) the text fragment includes determining a text fragment associated with at least one of the following: The clinical areas covered in the multiple text documents; The clinical domain objects covered in the multiple text documents; Activities in the clinical fields covered in the multiple text documents; as well as The types of information to be collected in the clinical areas covered by the multiple text documents.

5. The method according to claim 1 or 2, wherein, The automatic determination (204) of the text fragment and the automatic assignment (206) of the tag are performed using machine learning techniques with the multiple text documents as input.

6. The method according to claim 1 or 2, wherein, The plurality of primary objects includes at least one of the following: Patient information; Medical records and examination information; Institutional information; Equipment information; as well as Analysis and results information.

7. The method according to claim 1 or 2, wherein, The method further includes: When fewer than a predefined number of attributes are assigned to a specific sub-cluster, remove that specific sub-cluster.

8. The method according to claim 1 or 2, wherein, The method further includes: When the semantic similarity metric between the attributes of the first sub-cluster assigned to the sub-cluster and the attributes of the second sub-cluster assigned to the sub-cluster is greater than a predefined threshold, the first sub-cluster and the second sub-cluster are merged.

9. The method according to claim 1 or 2, wherein, Within each cluster, in the step of automatically clustering (212) the multiple text fragments with relevant information into sub-clusters, each sub-cluster includes text fragments and tags with a semantic similarity metric above a threshold, wherein the threshold is selected such that the number of sub-clusters is within a predefined target range.

10. The method according to claim 9, wherein, The predefined target range is 20 to 100 sub-clusters.

11. The method according to claim 1 or 2, further comprising: The allocation of the attribute to the sub-cluster is evaluated by verifying whether a similar data minimization algorithm is applicable to the attribute assigned to the sub-cluster.

12. The method according to claim 1 or 2, wherein, The automatic assignment (214) of the attribute to the sub-cluster is performed using machine learning techniques with inputs of at least (i) the attribute name and attribute description of the attribute and (ii) multiple text fragments and multiple tags of the sub-cluster.

13. An apparatus for assessing the risk of individual re-identification in an application domain, wherein for each of a plurality of individuals, a corresponding individual record is stored in a database, each record including a set of attributes, each attribute including a corresponding attribute name and a corresponding attribute value, the apparatus comprising: At least one interface (106); as well as Computing device (102), said computing device (102) being configured to: Receive multiple text documents related to the application domain via the at least one interface (106); Based on the plurality of text documents, a plurality of text fragments are identified, wherein one or more text fragments are text phrases or words contained in the plurality of text documents that may be relevant in the application domain; Assign a tag from a plurality of tags to each of the plurality of text segments, wherein the tag is a word representing the text segment; Receives multiple main objects in the application domain via at least one input unit; The multiple text fragments and the multiple tags are clustered based on the multiple main objects to obtain multiple clusters; Within each cluster, the multiple text fragments with relevant information are clustered into sub-clusters, and the labels of the clustered text fragments are assigned to the corresponding sub-clusters. For each attribute, based on the similarity between (i) at least one of the attribute name and attribute description of the attribute and (ii) the multiple text fragments and multiple tags of the sub-cluster, the attribute is assigned to one of the multiple sub-clusters, and For each of the plurality of sub-clusters, the corresponding re-identification risk is assessed based on the value type assigned to the attribute and the attribute description assigned to the attribute of the sub-cluster.

14. A computer program product comprising computer-readable program code configured to cause a computing device (102) to perform the steps of the method according to any one of claims 1 to 12.

15. A computer-readable recording medium configured to store a computer program product therein, the computer program product including computer-readable program code configured to cause a computing device (102) to perform the steps of the method according to any one of claims 1 to 12.

Images