Selective deidentification of data

Abstract

A computer-implemented method, computing device, laboratory instrument, computer program product, and computer-readable storage medium for selectively de-identifying protected health information (PHI) are provided. The method includes accessing a first data file, the first data file including at least a first data item, the first data item including a PHI and first PHI category information, the first PHI category information indicating a first PHI category of a plurality of PHI categories, the PHI in the first data item belonging to the first PHI category. The method also includes accessing the first PHI category information. The method further includes evaluating whether the PHI in the first data item is to be de-identified based on the first PHI category information. If the PHI in the first data item is to be de-identified, the method further includes generating a second data item by modifying the first data item such that the protected health information is de-identified.

Description

Technical Field

[0001] The present invention relates to processing health information that can be associated with a specific individual, ie, protected health information. Background Art

[0002] A laboratory instrument (e.g., a chemical analyzer) may analyze a biological sample (or samples) such as serum, urine, plasma, or perform a clinical test. Analytical data may be generated based on the analysis. The analytical data may include information that may be associated with a specific individual. Such information may be referred to as protected health information.

[0003] It may be desirable to transmit analytical data including protected health information over a computer network, possibly by transmitting the analytical data from an internal network to an external entity. Given the sensitivity of the protected health information, operations may be performed on the protected health information prior to transmission. Summary of the invention

[0004] The object of the present invention is to improve the availability of analytical data for troubleshooting, testing or performance analysis. In particular, the object of the present invention is to improve the availability of analytical data for troubleshooting, testing (eg, laboratory instruments) or performance analysis in a laboratory environment.

[0005] This object is achieved by what is stated in the independent claim. Further implementations are the subject matter of the dependent claims.

[0006] According to a first aspect, a computer-implemented method for selectively de-identifying protected health information (PHI) is provided. The method includes accessing a first data file, the first data file including at least a first data item, wherein the first data item includes PHI and first PHI category information, wherein the first PHI category information indicates a first PHI category among multiple PHI categories, and the PHI in the first data item belongs to the first PHI category. The method also includes accessing the first PHI category information. The method also includes evaluating whether the PHI in the first data item is to be de-identified based on the first PHI category information. If the PHI in the first data item is to be de-identified, the method also includes generating a second data item by modifying the first data item so that the protected health information is de-identified.

[0007] The method may be performed by one or more computing devices. The computing device may include at least one memory and at least one processor. The computing device may also include one or more input / output units.

[0008] Accessing the first data file may include retrieving the first data file from at least one memory of the computing device or from a remote data storage (e.g., a database, secondary storage, cloud storage, etc.). Thus, in some cases, accessing the first data file may include downloading data. For example, the computing device may retrieve the data file in response to a user command.

[0009] Additionally or alternatively, accessing the first data file may include, for example, receiving the first data file from a user or another computing device. For example, the computing device may receive the first data file from another computing device via a computer network. Specifically, the first data file may be received from a laboratory instrument. The laboratory instrument may be an analyzer, i.e., a device configured to perform one or more clinical tests on a biological sample. More specifically, the laboratory instrument may be a chemical analyzer or a hematology analyzer. The two options for accessing the first data file are not mutually exclusive. For example, accessing the first data file may include receiving the first data file, storing the first data file in a memory of the computing device during this period, and retrieving the first data file by accessing the memory.

[0010] The first data file includes at least a first data item. The first data file may include multiple entries. Each entry may include one or more data fields (hereinafter also referred to as "fields") or components. Each field may include one or more data items. Each entry in the first data file may have a corresponding structure (e.g., the same number of fields, fields with the same data type). Unless otherwise indicated, the information provided below about the first data item may also apply to other data items in the first data file.

[0011] The first data file can be a text file, that is, a computer file structured as a sequence of lines of electronic text. The text file can be substantially human-readable. The text file can be distinguished from a binary file by the operating system of the computing device (e.g., Microsoft Windows or Linux). The first data file can be formatted. The first data file can include plain text data items or data items in log formats such as JavaScript Object Notation (JSON), Windows Event Log, Common Event Format (CEF), etc. The first data item can include a descriptive markup language (such as LaTeX, HTML, XML, etc.).

[0012] The data items in the first data file can be structured and / or encoded. For example, the first data file can use multiple delimiters to separate data. A first delimiter (e.g., a comma or a vertical bar) can be used to separate fields, and a second delimiter (e.g., a line break) can be used to separate entries within the first data file. The data items in the first data file can be part of a field that includes other data items, or can cover an entire field.

[0013] Protected health information (PHI) may be information that has been identified as sensitive and in need of protection. For example, a subset of information output by a laboratory instrument may be identified as PHI. In the context of PHI, the term "protected" indicates that the health information is sensitive and should be protected, and does not necessarily indicate that the health information has been protected.

[0014] PHI may refer to information that can be used to identify a specific individual. Such identification information may include direct identifiers (such as name or government identification number), or indirect identifiers (such as birthday, city of birth, age, gender, etc.). Direct identifiers can be used to uniquely identify individuals. Indirect identifiers may not be unique to an individual, but can be used in combination with other indirect identifiers to uniquely identify an individual. Another indirect identifier is, for example, the name of the physician who performed the test or the name of the attending physician. Therefore, PHI may include one or more direct identifiers and / or one or more indirect identifiers.

[0015] A PHI category (e.g., a first PHI category) may be a class or division of PHI having shared characteristics. More specifically, a PHI category may group fields corresponding to a single direct identifier or fields corresponding to a single indirect identifier. For example, a sample ID category may group PHI that identifies a biological sample; the PHI in the sample ID category may begin with a specified text or prefix (e.g., sample ID:) and / or appear in a specified position of an entry in the first data file (e.g., appearing in the fifth field together with descriptive text). The sample ID may be an indirect identifier. Other PHI categories may include a patient ID category, a doctor ID category, and the like. There may be any number of PHI categories. For example, there are two PHI categories, such as a sample ID category and a default category, and the default category is a PHI category that does not belong to the sample ID category. For example, there are three PHI categories, such as a sample ID category, a patient ID category, and a default category, and the default category is a PHI category that does not belong to the sample ID category and the patient ID category. In particular, there are four PHI categories, such as a sample ID category, a patient ID category, a doctor ID category, and a default category, which is a PHI category that does not belong to the sample ID category, the patient ID category, and the doctor ID category. The PHI category can also correspond to a subset of the PHI group (e.g., a selected sample ID that is tested).

[0016] Each PHI category may be unique. The PHI category information (e.g., first PHI category information) may indicate a PHI category (e.g., first PHI category). For example, the PHI category information may distinguish PHI of data items belonging to the PHI category from PHI of other data items that do not belong to the PHI category. The PHI category information (e.g., first PHI category information) of a data item (e.g., first data item) may be included in a string that is detectable by a parser (e.g., via one or more regular expressions (i.e., pattern matching). The PHI category information may be provided by a prefix and / or suffix of the data item. For example, the aforementioned prefix and suffix may appear at the beginning and end of the data item such that the PHI of the first data item is included in the category information. The prefix and suffix may be the same. Alternatively, the prefix may be different from the suffix. The prefix and suffix may include alphanumeric characters (a, b, c, 1, 2, 3, etc.) and / or non-alphanumeric characters (*, >, >, $, &, %, |, etc.). Alternatively, the PHI category information may be included in a string that is added before or appended to the string that includes the PHI.

[0017] The PHI category information may include a combination of characters that do not appear elsewhere in the first data file (i.e., do not exist elsewhere). For example, the prefix and / or suffix may each include a combination of characters. The combination of characters may include alphanumeric and / or non-alphanumeric characters. Alternatively, the combination of characters may be limited to non-alphanumeric characters or word characters (alphanumeric characters and the underscore character).

[0018] The PHI category information (eg, first PHI category information) of a data item (eg, first data item) may be included in an XML element marked by a PHI category-related tag. Specifically, the PHI may be the content of the XML element.

[0019] The PHI category information (e.g., first PHI category information) of a data item (e.g., first data item) may be included in a PHI category-related LaTex command. The PHI may be a parameter of a command. For example, each of a plurality of PHI categories may be associated with a corresponding color. If this is the case, the PHI category-related LaTex command may be a command that specifies the color of its parameter text. If this is the case, then in the first data item, the PHI belonging to the PHI category is a parameter of a command that specifies the color associated with the PHI category as the text color.

[0020] In addition to the PHI, the entries in the first data file may include unprotected analytical data (i.e., unprotected data). The unprotected analytical data may include one or more timestamps (i.e., a sequence of characters or encoded information that identifies when an event occurred, which may include a date and time of day or a number of seconds relative to an elapsed time). For example, the timestamp may include the start and end of an event corresponding to the first data item (e.g., the first data item may include information about the event).

[0021] In addition, the unprotected data may include an entry identifier, a severity level, and a description of the event, which may include a rack location and / or a rack identifier in addition to the descriptive text. The rack location and the rack identifier may refer to a laboratory instrument, which may include one or more racks. The rack may be suitable for holding a sample cup or a test tube. The rack may be placed on a rack input tray. For example, there may be two rack input trays, each tray accommodating up to 20 racks for up to 200 samples. The unprotected analytical data may also include error messages and / or additional information for the analytical event.

[0022] The PHI in the first data item belongs to the first PHI category. The first data item may be limited to PHI in the first PHI category and may not include PHI in any other PHI category.

[0023] Accessing the first PHI category information may include scanning the first data item and / or the first data file using one or more specified regular expressions. Accessing the first PHI category information may be implemented together with accessing the first data file (e.g., as part of the same program or function call), or may be implemented separately. A regular expression may include a sequence of characters (e.g., metacharacters and regular characters) for specifying a search pattern to describe and / or parse text. Thus, the specified regular expression may be used to separate or determine the first PHI category information in the first data item.

[0024] Evaluating whether the PHI in the first data item is to be de-identified based on the first PHI category information may include using the first PHI category information to determine whether the PHI in the first data item is to be de-identified. Thus, a category setting may be associated with the first PHI category information. If the category setting is turned off (i.e., set to false), then the first data item may be de-identified. Similarly, if no category setting is associated with the first PHI category information, then the first data item may be de-identified. Alternatively, if the category setting is turned on (i.e., set to true), then the first data item may be processed differently (i.e., significantly different) from other PHI. For example, when the category setting is turned on, the first data item may not be de-identified. Alternatively, when the category setting is turned on, the first data item may be de-identified so that the original data can be reconstructed after de-identification. For example, when the category setting is turned on, the first data item may be encrypted.

[0025] An advantage of including the PHI category information in the data item (and thus in the data file) rather than in other external files outside the configuration file or data file is that the PHI category information can be more easily identified, for example, using regular expressions. If the PHI category information is not in the data item, then the external file will need to include detailed instructions on where to find the PHI information, such as a designated field number in a log file entry and the location and format within the field (e.g., the character classes included in the PHI, such as alphanumeric or printable characters or space characters). By including the PHI category information in the data item, such detailed instructions do not need to be provided in the external file, and the PHI information can be located more efficiently.

[0026] De-identification of information (e.g., PHI) may prevent or hinder the identity of an individual associated with the PHI from being revealed, i.e., hinder or prevent re-identification. Thus, after de-identifying the PHI, it may be impossible or very difficult to identify the individual from the de-identified PHI. De-identifying a first data item may include generating a second data item in which the PHI may be replaced or obfuscated.

[0027] For example, the PHI of the first data item can be replaced by a specified (e.g., predefined) string in the second data item, such that the specified string cannot be used to reconstruct the original PHI. Thus, the PHI with the patient name category in the first data item can be replaced by a specified string including four asterisks (i.e., the string "****" in the second data item). In the example, since all data items in the category are replaced with the same specified string, the second data item cannot be used as a basis for deriving the first data item, and therefore, the replacement is irreversible. The specified string can include alphanumeric and / or non-alphanumeric characters. Alternatively, the specified string can be limited to non-alphanumeric characters.

[0028] Alternatively, generating the second data item may include modifying the first data item by encrypting the PHI of the first data item. As yet another alternative, the PHI in the first data item may be replaced by a code that can be decoded by a third party (e.g., a doctor) that possesses a key. For example, the patient's name may be replaced with a corresponding coded name that can be decoded by a third party using a table that matches the patient's name to the corresponding coded name. In the first two examples, the replacement is reversible, i.e., the second data item may be used as a basis for deriving the first data item.

[0029] De-identification may be handled differently depending on the destination of the second data item. For example, the second data item may be exported to a GUI or a second data file. When exported to a GUI, if the user does not have permission to view the PHI, the PHI may be de-identified (e.g., obfuscated) by using a series of symbols (e.g., asterisks). If the user does have permission to view the PHI, the PHI may be displayed as readable text in the GUI. When exported to a second data file, the PHI may be de-identified by replacing the PHI with a specified series of characters.

[0030] Typically, all PHI in the data file is de-identified (e.g., irreversibly obfuscated) before exporting the data in the data file to, for example, a GUI or another data file (where the other data file can be transmitted to an external entity). De-identification may be useful to protect sensitive data.

[0031] Prior to displaying or recording the PHI information, de-identification may be implemented at compile time by encapsulating the PHI information within a specified class. The PHI processing framework may use a code analyzer (e.g., the .NET compiler platform, also known as Roslyn) to implement de-identification. If it is determined that the PHI has not been encapsulated for de-identification, a compile-time error may be thrown. Encapsulation may include mapping and marking the PHI in a class of the PHI framework. However, it may be desirable to prevent de-identification or irreversible de-identification of selected PHI.

[0032] Thus, the protected health information is selectively de-identified by generating a second data item. The selective de-identification is performed with the aid of the first PHI category information, which is a basis for determining whether the PHI in the first data item is to be de-identified. De-identification can be performed based on the risk of whether the first data item can be used to derive the identity of an individual associated with the PHI. Additionally, de-identification can be performed based on whether the first data item can be used for troubleshooting or testing (e.g., troubleshooting or testing of a laboratory instrument).

[0033] Selective de-identification ensures that the risk that a data item can be used to derive the identity of an individual associated with the PHI is low, while also being helpful for troubleshooting or testing. For example, if a first data item has a relatively low risk that it can be used to derive the identity of an individual associated with the PHI, and the first data item appears to be useful for troubleshooting, then a category setting may be associated with the first data item (e.g., the first data item may not be modified) and the second data item may not be generated. A relatively low risk of re-identification may be associated with sample or laboratory equipment information, such as a sample ID or a TubeID associated with a sample ID. The sample or laboratory equipment information may also be relatively useful for troubleshooting or testing. Conversely, a relatively high risk of re-identification may be associated with patient information, such as patient gender and date of birth. Patient information is also unlikely to be useful for troubleshooting or testing.

[0034] Troubleshooting can refer to determining the cause of an event (e.g., an error or problem), and can also include determining how to prevent the event from happening again. For example, troubleshooting a laboratory instrument can include determining what happened (or what went wrong) with an order from a physician or a result from a test. Troubleshooting can include traceability (e.g., determining all relevant entities that caused the event) and / or tracking (e.g., tracking the movement of an object associated with the event).

[0035] Traceability can refer to determining the destination of entities (e.g., laboratory instruments) involved in an event. For example, laboratory instruments A and B may cause an error at laboratory instrument C. Data items such as sample IDs can be used to trace the error at laboratory instrument C back to laboratory instruments A and B.

[0036] Tracking can refer to the movement of an object (e.g., a sample) to different locations (e.g., two different laboratory instruments). For example, a sample may be analyzed by multiple laboratory instruments during a diagnostic process. Tracking may be useful during troubleshooting, for example, to determine where something went wrong during an analysis, or during performance analysis (e.g., to determine whether a sample is optimally routed through laboratory instruments such as an automated laboratory instrument).

[0037] Testing can refer to determining whether a laboratory instrument is functioning properly.

[0038] Information that is not selectively de-identified can also be used for performance analysis, for example, to develop statistics about laboratory instruments (e.g., minutes of idle time per day / week, number of samples processed, number of samples processed by each physician). For example, a sample ID can be used in conjunction with one or more log entry timestamps to track whether a sample has been processed in a timely manner, for example, whether each sample has been processed within its stable period. In particular, the stable period of a sample is the amount of time that a sample can be reliably analyzed by a laboratory instrument after the sample is drawn. Alternatively, a sample ID can be used to determine the number of samples processed by each patient. For example, such a metric can be used to determine whether aliquoting of a primary sample is performed as expected.

[0039] The following is an example of using selective de-identification in a testing context. The first PHI category may correspond to a test category. The first PHI category may be used when an automated laboratory system or a laboratory instrument of an automated laboratory system is tested. Specifically, the automated laboratory system may include a flow cytometer for virus detection (i.e., a flow cytometer for virus determination). The flow cytometer may be able to process 32 sample tubes. When testing, two of the sample tubes may contain known control samples, such as samples known to contain viruses and samples known to be free of viruses. Whether the other 30 samples (i.e., experimental samples) contain viruses may be unknown. In this example, the PHI information of the sample ID of the control sample is not de-identified so that the control sample can be tracked during the test. On the contrary, the PHI information of the sample ID of the experimental sample can be de-identified.

[0040] In this way, with the aid of the first PHI category, the sample ID of the control sample is not de-identified; therefore, the control sample can be used to test the function of the flow cytometer and can be discarded from subsequent analysis assuming that the test results show that the flow cytometer is functioning properly. In contrast, the sample ID of the experimental sample is de-identified along with other PHI information because the experimental sample is not used to test the flow cytometer.

[0041] The method may also include accessing PHI presence information in the first data file, the PHI presence information indicating whether the first data item includes protected health information, and evaluating whether the first data item includes protected health information based on the PHI presence information.

[0042] For example, accessing the PHI presence information in the first data file may include accessing the PHI presence information in the first data item. Thus, the PHI presence information of the first data item may be completely contained within the first data item.

[0043] The PHI presence information may be included in a string detectable by a parser, for example, via one or more regular expressions (i.e., pattern matching). The PHI presence information may be provided by a prefix and / or suffix of the first data item. The prefix and suffix may be the same. For example, when the first data item contains PHI, the aforementioned prefix and suffix may appear at the beginning and end of the first data item, so that the PHI information of the first data item is included in the PHI presence information. Alternatively, the prefix may be different from the suffix. The PHI presence information may be included in the following string, which is added before the string including the PHI or appended to the string including the PHI. The string may include alphanumeric characters and / or non-alphanumeric characters. In addition, the same one or more strings (possibly including alphanumeric and non-alphanumeric characters) may provide both the PHI presence information and the first PHI category information.

[0044] Similar to accessing the first PHI category information, accessing the PHI presence information may include scanning the first data item and / or the first data file using one or more specified regular expressions. The regular expression used to access the PHI presence information may be different from the regular expression used to access the first PHI category information. Access to the first PHI presence information may be implemented together with accessing the first data file and accessing the first PHI category information (e.g., as part of the same program or function call), or may be implemented separately. Therefore, the specified regular expression may be used to separate or determine the PHI presence information in the first data item.

[0045] The PHI presence information may appear after the first PHI category information. For example, the PHI category information may appear at the beginning and end of the data in the first data item, and the PHI presence information may appear at the beginning and end of the PHI category information.

[0046] The entry in the first data file including the first data item may also include additional data items. Each of the additional data items of the entry may include corresponding PHI presence information.

[0047] Using the PHI presence information can enable efficient determination of whether a given data item includes PHI. For example, a pattern corresponding to (i.e., describing) a prefix of the PHI presence information can be searched within the first data file. When the pattern is found and subsequently a pattern corresponding to a suffix of the PHI presence information is found, the information contained within the prefix and suffix can be determined to be PHI.

[0048] In some cases, if the protected health information in the first data item is not de-identified, the method also includes modifying the first data item by removing the PHI category information to generate a third data item.

[0049] Modifying the first data item may include deleting the PHI presence information in addition to deleting the PHI category information. In this manner, the third data item may display the PHI information in plain text. Thus, the PHI information may be used in the context of troubleshooting or testing (e.g., troubleshooting or testing of a laboratory instrument).

[0050] The third data item may be stored in a data file (eg, along with the other data items) for export (eg, transmission to a remote computing device over a computer network).

[0051] Removing PHI category information may reduce the amount of information exported for troubleshooting, testing, or analysis. This may be particularly beneficial when the export includes sending information over a network because the impact on other network users may be reduced. For example, removing PHI category information in the context of troubleshooting may reduce the size of files sent over a network by removing information that is not relevant to troubleshooting, thereby simplifying the handling and processing of data used for troubleshooting and speeding up the transmission of data.

[0052] In some cases, the first data item includes one or more tags. The one or more tags may include first PHI category information. Additionally, the one or more tags may include PHI presence information.

[0053] For example, if the first data file includes XML text, the entries of the first data file may be XML elements marked by XML entry tags, and the fields of the log file entries that include PHI may be XML elements marked by PHI category-related XML tags. Alternatively or additionally, if the first data file includes LaTeX text, the entries of the first data file may have been marked in a LaTeX environment, and the fields of the log file entries that include PHI may be marked using PHI category-related LaTeX commands.

[0054] Each tag may include metadata that enables efficient finding of the first data item via a search.In addition, the tags may enable efficient determination of whether the data item includes PHI, and if so, enables efficient determination of the first PHI category.

[0055] Evaluating whether the protected health information in the first data item is to be de-identified may include evaluating whether one or more de-identification requirements are satisfied. The one or more de-identification requirements may include a category requirement, wherein the category requirement is a requirement that the first PHI category is different from one or more given PHI categories in the plurality of PHI categories.

[0056] For example, if one or more de-identification requirements are met, the first data item is to be de-identified. Additionally or alternatively, if at least one de-identification requirement is not met, the first data item is not de-identified. When the first data item is not to be de-identified, the PHI category information may be deleted.

[0057] Using multiple de-identification requirements rather than a single de-identification requirement may increase the flexibility and scalability of methods for selectively de-identifying protected health information.

[0058] One of the de-identification requirements may be that the user attempting to access the first data item via the GUI does not have permission to access the first data item. In particular, this requirement exists in the context of a GUI.

[0059] A given PHI category may be a suitable subset of multiple PHI categories, i.e., a given PHI category may not include all of the multiple PHI categories. For example, a given PHI category may include PHI categories related to samples, tubes, or laboratory instruments. In addition, a given PHI category may exclude PHI categories related to patient information.

[0060] For each given PHI category, the category setting may be turned on (i.e., set to true). Thus, as discussed above, PHI in a data item that includes PHI category information that indicates one of the given PHI categories may be processed differently than other PHI. Similarly, for each of a plurality of PHI categories that is not one of the given PHI categories, the category setting may be turned off (i.e., set to false). Thus, PHI in a data item that includes PHI category information that does not indicate one of the given PHI categories may be processed according to a standard or default method applicable to PHI, i.e., the PHI may be de-identified. The category setting may be configurable; for example, after turning off the category setting, PHI in a PHI category that was previously subject to different processing may be subject to default processing.

[0061] In the following example (points 1 to 8 below), the given PHI categories are limited to the sample ID category and do not include the default PHI category (the default PHI category is the category to which all PHI that does not belong to the sample ID category belongs). The example shows PHI category information and PHI presence information for the default and sample ID categories in a first data file (e.g., a data file for a laboratory instrument) and a second data file (e.g., a data file to be exported to an external entity):

[0062] 1. Patient Name (Default Category)

[0063] Data items in the first data file: <<<Jane Austen> >>.

[0064] 2. Tube barcode (sample ID category)

[0065] Data item in the first data file: <<<_SID_TubeBarCode_1_SID_>>>.

[0066] Point 1 above shows a data item in the first data file that includes PHI "Jane Austen", which is preceded and followed by designated strings that provide PHI presence information and PHI category information (prefix "<<<" and suffix ">>>"). Therefore, as indicated, the data item includes PHI belonging to the default category. Point 2 above shows a data item in the first data file that includes PHI "TubeBarcode_1", which is preceded and followed by designated strings that provide PHI presence information and PHI category information (strings "<<<_SID_" and "_SID_>>>"). Specifically, the PHI category information included in the data item at point 2 specifies that the PHI of the data item belongs to the sample ID category.

[0067] When the category setting for the sample ID is set to true, the category requirement requires that the PHI category of the data item be different from the default category, and therefore, the "_SID_" string can be used to provide different treatment of the corresponding PHI. Therefore, in the second data file generated for export (e.g., as a log file to be exported), the above data item will appear as follows:

[0068] 3. Patient Name (Default Category)

[0069] Data items in the second data file: *****.

[0070] 4. Tube barcode (sample ID category)

[0071] Data item in the second data file: Tube Barcode_1.

[0072] Point 3 above shows the data item from point 1 after de-identification. Specifically, "<<<Jane Austen> >>" has been replaced with "*****" because the data item from point 1 belongs to the default PHI category. Point 4 above shows the data item from point 2; in this case, de-identification is not performed, for example, because one or more de-identification requirements are not met. The data item from point 2 has been modified by removing the PHI presence information and the first PHI category information (i.e., the character strings "<<<_SID_" and "_SID_>>>".

[0073] Alternatively, the category setting for the sample ID category may be set to false. In this case, the PHI category information and PHI presence information for the default and sample ID categories in the first data file will be as follows:

[0074] 5. Patient Name (Default Category)

[0075] Data items in the first data file: <<<Jane Austen> >>.

[0076] 6. Tube barcode (sample ID category)

[0077] Data item in the first data file: <<<_SID_TubeBarCode_1_SID_>>>.

[0078] Points 5 and 6 above correspond to points 1 and 2. When the category setting of the sample ID category is set to false, then no different processing is applied; instead, the default method is applied. In this case, the PHI category information is ignored, and all data marked by the PHI presence information, i.e., "<<<" and ">>>", is de-identified.

[0079] Therefore, when a second data file (e.g., an export log file) is generated, the above data items will be displayed in the second data file as follows;

[0080] 7. Patient Name (Default Category)

[0081] Data items in the second data file: *****.

[0082] 8. Tube barcode (sample ID category)

[0083] Data items in the second data file: *****.

[0084] As indicated in points 7 and 8 above, if the category setting for a sample ID category is set to false, then PHI corresponding to the sample ID category is treated in the same manner as other PHI, i.e., no different treatment is applied to the sample ID category, and the data items are de-identified in the same manner as data items in the default category are de-identified.

[0085] The method may also include accessing de-identification data; the de-identification data may include information indicating one or more de-identification requirements.

[0086] If one or more de-identification requirements are limited to category requirements, the de-identification data may specify whether PHI belonging to a category of PHI (eg, whether the PHI in the first data item belongs to a first PHI category) is to be de-identified.

[0087] Accessing the de-identified data may include retrieving a file including the de-identified data from at least one memory of the computing device or from a remote data store. Thus, in some cases, accessing the de-identified data includes downloading the data. For example, the computing device may retrieve a file including the de-identified data in response to a user command.

[0088] Additionally or alternatively, accessing the de-identified data may include receiving a file including the de-identified data from a user or another computing device. For example, the computing device may receive the file including the de-identified data from another computing device via a computer network. Specifically, the file including the de-identified data may be received from a laboratory instrument.

[0089] Accessing the de-identified data may include accessing a profile that includes the de-identified data.

[0090] Storing the de-identified data in a configuration file may enable the de-identified data to be stored together with other configuration data. For example, the configuration file may correspond to a recording facility of a laboratory instrument. Thus, in addition to the de-identified data, the configuration file may also describe fields that may appear in an entry in the first data file. Combining the de-identified data with other configuration data may be more efficient than storing the de-identified data separately.

[0091] In some examples, the method may also include generating a second data file. In particular, if the protected health information in the first data item is to be de-identified, the second data file includes the second data item. Additionally or alternatively, if the protected health information in the first data item is not to be de-identified, the second data file may include a third data item.

[0092] In addition to the second data item, the second data file may include unprotected analytical data, for example, a data item included in the first data file and not including PHI. Exemplarily, the data item not including PHI is a message specifying a failure of a component of a laboratory instrument. For example, the string "BuIkQ request exceeded maximum retry window. Failed request" may be a field of an entry in the first data file that (i) does not include PHI and (ii) specifies that the software component BulkQ failed due to too many retries to send data to the cloud.

[0093] The second data file may be a data file for export. Thus, the second data file may be sent to a remote computing device via a computer network. In this manner, unprotected analysis data in the second data file may be analyzed without providing access to the PHI.

[0094] The method may also include accessing file information indicating a file category. Evaluating whether the PHI of the first data item is to be de-identified may be based on the file information. Specifically, the file category is a category to which the second data item belongs or a category to which a file including the second data item (e.g., a second data file) belongs. Alternatively, the file category is a category to which the third data item belongs.

[0095] The one or more de-identification requirements may include a file category requirement. The file category requirement may correspond to a destination of the second data file (e.g., a destination of the second data item). For example, a first file category may correspond to a relatively secure closed network for analysis and troubleshooting, and a second file category may correspond to a relatively unsecure public network. Thus, when exporting the second data file, the second data file may be sent to the destination via a computer network.

[0096] Thus, the file class requirement may make it easy to reveal selected PHI for analysis (eg, troubleshooting or testing) in a relatively secure destination, while ensuring that the same PHI is de-identified when a second data file is to be sent to an unsecure destination.

[0097] Similar to the destination, the file category may correspond to the target user of the second data item. For example, if the target user is a field engineer or other person related to troubleshooting, sample ID information may be required (i.e., the sample ID may not be de-identified), while if the target user is a typical user not related to troubleshooting, the PHI does not need to be readable and can be de-identified.

[0098] Thus, the file category information can make it easy to reveal the selected PHI to the target user when the target user at the destination needs to know the selected PHI. In the case where the target user at the destination does not need to know, the same PHI can be de-identified.

[0099] Alternatively or additionally, the file category requirement may correspond to a type of file.For example, the third file category may correspond to a file for troubleshooting a workflow of biological samples processed by an automated laboratory system.

[0100] Exemplarily, in files belonging to the third file category, PHI belonging to the sample ID should not be de-identified, for example, so that the path of the sample in an automated laboratory system can be reconstructed.

[0101] Compared to the third file category, the fourth file category may instead correspond to a file for evaluating downtime or idle time of a laboratory instrument of an automated laboratory system. In files belonging to the fourth category, PHI belonging to a sample ID is not relevant to the evaluation of instrument idle time and may be de-identified. Thus, the file category increases the flexibility of de-identification of PHI, such that the same PHI can be handled differently in different files if the file category has a corresponding indication.

[0102] According to a second aspect, a computer-implemented method for generating a first data item is provided. The method includes obtaining protected health information that belongs to a first PHI category among a plurality of PHI categories. The method also includes determining the first PHI category. The method also includes generating a first data item based on the first PHI category, the first data item including the protected health information and category information, the category information indicating the first PHI category, wherein the first data item is part of a first data file. In particular, the PHI included in the first data item is not in a de-identified form.

[0103] Similar to the first aspect, the method can be performed by one or more computing devices. The computing device can include at least one memory and at least one processor. The computing device can also include one or more input / output units. The computing device can be a laboratory instrument or a part of a laboratory instrument.

[0104] Obtaining protected health information may include retrieving protected health information from at least one memory of a computing device. Additionally or alternatively, obtaining protected health information may include receiving protected health information from a user. For example, a laboratory instrument may retrieve protected health information from a memory (e.g., for protected health information corresponding to the laboratory instrument itself, such as a tube ID or barcode) or receive protected health information via user input (e.g., for patient or physician related information, such as patient gender or date of birth). Obtaining protected health information may include, for example, receiving protected health information from a laboratory instrument.

[0105] The first PHI category can be determined based on a risk that the protected health information can be used to derive the identity of an individual associated with the protected health information. Additionally, the first PHI category can be determined based on whether the protected health information can be used for troubleshooting. Exemplarily, determining the first PHI category can be performed by executing computer instructions that specify a PHI category to which the protected health information belongs. In this example, determining the first PHI category can include providing the first PHI category.

[0106] For example, if the risk that the protected health information can be used to derive the identity of the individual associated with the protected health information is relatively low (i.e., low re-identification risk) and the protected health information appears to be useful for troubleshooting, then the first PHI category may indicate that the protected health information is to be processed differently than other protected health information. Conversely, if the risk of re-identification is relatively high and the protected health information does not appear to be useful for troubleshooting, then the first PHI category may indicate that the protected health information is to be processed according to a default method for processing protected health information.

[0107] Thus, the default approach may include, for example, irreversibly de-identifying the protected health information. Additionally, different treatments may include not performing de-identification of the protected health information or performing reversible de-identification of the protected health information (e.g., via the codes or encryption discussed above).

[0108] Exemplarily, within a PHI processing framework including the method of the present invention, any field, attribute, or function parameter identified as sensitive and requiring protection is marked as PHI, for example by using a PHI attribute, particularly a C# attribute. The PHI processing framework can record (e.g., at runtime) and display information marked as PHI in a first data file so that sensitive data can be hidden as needed. For example, a marked PHI attribute can be written to the first data file as "<<<{phi_value}>>>", where PHI is shown as "{phi_value}", and PHI presence information is shown as three "<" symbols before PHI and three ">" symbols after PHI. For example, any PHI attribute marked as PHI can be anonymized and displayed as a series of asterisks as needed.

[0109] In particular, the PHI processing framework is configured to perform the method according to the second aspect of the present invention. More specifically, the PHI processing framework is a computer program product comprising instructions, which, when the PHI processing framework is executed by a computer, cause the computer to perform the steps of the method according to the second aspect of the present invention. The PHI processing framework may include one or more classes and may be integrated into a more general logging framework.

[0110] The PHI processing framework can obtain PHI from a laboratory instrument by receiving information specifying an event that occurred in the laboratory instrument. For example, the laboratory instrument can send information to the PHI processing framework specifying a query for a tube order for a given tube (e.g., a tube with identification number "Tube001") for a given patient (e.g., Ms. Muholland).

[0111] This information about the event can be processed by the PHI processing framework by using the following code:

[0112] Log.lnfo("Query the tube order of tube id {0} for patient {1})", PHILogValue.Log(tubeID,new

[0113] DefaultPHIValueFormatter(PHICategory.SampleID)),

[0114] PHILogValue.Log(patientName)).

[0115] Therefore, the PHI processing framework uses the information received from the laboratory instrument to determine a template for the text of the log entry, i.e., the string "query for tube order of tube id {0} for patient {1}" and the information that should replace the placeholders {0} and {1} in the first data file. Specifically, the data item including the information identifying the sample tube should replace the placeholder {0}, and the data item including the patient name information should replace the placeholder {1}. Therefore, as in the code above, {0} is processed according to the following first code snippet:

[0116] PHILogValue.Log(order.SampleID,new

[0117] DefaultPHIValueFormatter(PHICategory.SampleID)).

[0118] In the first code snippet, the field identifier "tubeID" from the above code has been replaced by a variable "order.SampleID", which has a value corresponding to "tubeID". The PHI category to which the PHI included in the string "Tube001" belongs is determined by executing the first code snippet (i.e., the PHILogValue.Log function). In particular, the first code snippet specifies that the PHI included in the string "Tube001" belongs to the sample ID category (see the parameters of the DefaultPHIValueFormatter method). In the first code snippet, the PHI category of the sample ID is simply provided. However, the PHI category can also be determined according to more complex instructions (e.g., based on the value of the sample ID in the data item). For example, if the sample ID corresponds to a sample ID belonging to a set of test samples, the sample ID can be assigned to the test category, while other sample IDs that do not belong to the set of test samples can be assigned to the sample ID category.

[0119] As in the code above, {1} is processed according to the following second code snippet:

[0120] PHILogValue.Log(order.Patient.PatientDisplayName).

[0121] In the second code snippet, the PHI category patientName has been replaced by the variable order.Patient.PatientDisplayName, which corresponds to the PHI category. The PHI category to which the PHI included in the string "Muholland" belongs is determined by executing the second code snippet. The second code snippet specifies that the string "Muholland" includes information related to the patient's identity (see Order.Patient.PatientDisplayName) and belongs to the default category, for example.

[0122] The PHILogValue.Log method is configured to generate data items including protected health information and PHI category information based on the PHI category of the detected PHI. In particular, the following entries are generated for a data file (e.g., a first data file):

[0123] Patient management <muiholland>>>Query the tube order with tube id <<<_SID_Tube001_SID_>>>.

[0124] Thus, a data item including sample ID "Tube001" now also includes PHI category information corresponding to the sample ID PHI category, while a data item including patient "Mulholland" includes PHI category information corresponding to the default PHI category.

[0125] Immediately after generating the first data item based on the first PHI category, the protected health information in the first data item may not be in de-identified form. More specifically, de-identification of the first data item may occur upon export of the first data item (e.g., export of a first data file including the first data item).

[0126] Generating the first data item based on the first PHI category ensures the efficiency of selective de-identification of protected health information of the first data item. Specifically, since the first data item includes category information, a regular expression can be effectively used to access the category information; the category information can then be used to determine whether the PHI in the first data item is to be de-identified.

[0127] The method may also include evaluating whether the protected health information satisfies at least one criterion for protected health information.The first criterion for protected health information may specify that the protected health information includes at least one direct identifier.

[0128] The second standard for protected health information may specify that the protected health information includes at least one indirect identifier. Alternatively, the second standard for protected health information may specify that the protected health information includes at least two direct identifiers, and the third standard for protected health information may specify that the protected health information includes at least one indirect identifier from a list of high-risk indirect identifiers.

[0129] According to the present invention, the first data file may be a log file of a laboratory instrument (e.g., an automated laboratory system). Thus, the first data item may be generated by the laboratory instrument as part of an entry in the log file. For example, the protected health information may be a sample ID, and the laboratory instrument may obtain the sample ID from the memory and insert the sample ID into the end of the log file entry indicating that an aliquot has been created.

[0130] Entries in the log file may be created on the laboratory instrument, but selective de-identification may not occur immediately. Instead, PHI in the log file data items may be selectively de-identified prior to exporting to a remote computer (e.g., a third party or external entity), for example, via a network. PHI in the data items may be tagged, for example, using the tags described above, so that the PHI may be identified prior to exporting the data items (e.g., via regular expressions).

[0131] Typically, an automated laboratory system (also referred to as an "ALS") is an assembly comprising a plurality of components and a computing device operably connected to the components and configured to control each component. The components may be analytical instruments, pre-analytical instruments, post-analytical instruments, input / output modules, transport components (e.g., tracks, belts, tube carriers) configured to move samples.

[0132] An analytical instrument (e.g., an analyzer) is an instrument configured to perform one or more analytical steps, such as measuring one or more characteristics of a sample (e.g., the concentration of a given analyte). A pre-analytical instrument is an instrument configured to perform one or more pre-analytical steps on a biological sample to prepare the sample for the analytical instrument. For example, a centrifuge, aliquoter, and decapper are pre-analytical instruments. A post-analytical instrument is an instrument configured to perform one or more post-analytical steps on a biological sample after the sample has been processed by one or more analytical instruments. For example, a recapper and a sample storage unit are post-analytical instruments. The terms "instrument" and "laboratory instrument" are generally used to refer to an analytical instrument, a pre-analytical instrument, or a post-analytical instrument.

[0133] Thus, a laboratory instrument may create a log file in which protected health information is categorized so that selective de-identification of the protected health information may be performed in an efficient manner.

[0134] According to the present invention, a first PHI category may specify that protected health information refers to biological samples, patient data, physician data, or laboratory test data.

[0135] More specifically, the first PHI category may specify that the protected health information refers to one of the following categories: sample ID, patient ID, physician ID, test. For example, PHI that uniquely identifies a sample, PHI that uniquely identifies the tube in which the sample was collected, and / or PHI that uniquely identifies a secondary sample obtained by aliquoting the sample belongs to the sample ID category. For example, PHI that specifies a patient's first name, PHI that specifies a patient's middle name, PHI that specifies a patient's last name, PHI that specifies a patient's salutation, PHI that specifies a patient's gender, PHI that specifies a patient's date of birth, and / or PHI that specifies a patient's address belongs to the patient ID category. Exemplarily, PHI that specifies the identity of a physician who performed the test and / or PHI that specifies the identity of a physician who treated the patient belongs to the physician ID category. As another example, a set of identifiers (e.g., sample ID, tube ID, specimen ID) designated for testing laboratory instruments may belong to the test category.

[0136] According to a third aspect, a computing device is provided. The computing device comprises a processor configured to execute the method according to the first aspect of the invention and / or the method according to the second aspect of the invention. According to a fourth aspect, a laboratory instrument is provided. The laboratory instrument comprises the computing device provided above.

[0137] According to a fifth aspect, a computer program product is provided. The computer program product comprises instructions which, when executed by a computer, cause the computer to perform the steps of the method according to the first aspect of the invention and / or the steps of the method according to the second aspect of the invention.

[0138] According to a sixth aspect, a computer-readable storage medium is provided. The computer-readable storage medium comprises instructions which, when executed by a computer, cause the computer to perform the steps of the method according to the first aspect of the invention and / or the steps of the method according to the second aspect of the invention. The computer-readable storage medium may be non-transitory, i.e., tangible.

[0139] The subject matter described in the present disclosure may be implemented as a method or on a device, possibly in the form of one or more computer programs (eg, computer program products). Such a computer program may enable a data processing device to perform one or more operations described in the present disclosure.

[0140] The subject matter described in the present disclosure can be realized in a data signal or on a machine-readable medium, wherein the medium is embodied in one or more information carriers such as a CD-ROM, a DVD-ROM, a semiconductor memory or a hard disk. In particular, the disclosed subject matter can be tangibly embodied in a machine (computer) readable medium.

[0141] In addition, the subject matter described in this disclosure can be implemented as a system including a processor and a memory coupled to the processor. The memory can encode one or more programs so that the processor performs one or more of the methods described in this application. The other subject matter described in this disclosure can be implemented using various machines.

[0142] The details of one or more implementations are set forth in the exemplary drawings and the description that follow.Other features will be apparent from the description, drawings, and claims. BRIEF DESCRIPTION OF THE DRAWINGS

[0143] Figure 1 A schematic representation of a portion of a first data item is shown.

[0144] Figure 2 A further schematic representation of a portion of the first data item is shown.

[0145] Figure 3 A first method for selectively de-identifying protected health information is shown.

[0146] Figure 4A Steps of a second method for selectively de-identifying protected health information are shown.

[0147] Figure 4B

[00136] Proceed to a second method for selectively de-identifying protected health information.

[0148] Figure 5 A method for generating a first data item is shown. DETAILED DESCRIPTION

[0149] Hereinafter, a detailed description of the examples will be given with reference to the accompanying drawings. Various modifications may be made to the examples. In particular, one or more elements of one example may be combined and used in other examples to form new examples.

[0150] Figure 1 A schematic representation of a portion of a first data file 101 including analytical data is shown; in particular, the first data file 101 includes a first data item 103. The first data item 103 may be a string of characters. The first data item 103 includes a string of digits 109 having protected health information (PHI). In this example, the PHI specifies the ID of a sample processed by a laboratory instrument (not shown).

[0151] The first data item 103 includes protected health information (PHI) presence information. As shown in string 109, the PHI presence information may indicate whether the first data item 103 includes protected health information. Thus, string 109 includes protected health information "123456". The PHI presence information may include one or more symbols, for example, at least two symbols. The symbol may be a non-alphanumeric character.

[0152] exist Figure 1 In the example of , the string "<<<_SID_" 107a at the beginning of the first data item 103 and the string "_SID_>>>" 107b at the end of the first data item 103 provide both PHI presence information and first PHI category information. In this example, the presence of PHI and the category to which the PHI belongs are specified by the prefix of the first data item 103 - string "<<<_SID_" 107a and the suffix (i.e., ending) - string "_SID_>>>" 107b. In addition, the prefix and the suffix are different because three "<" characters appear in the prefix and three ">" characters appear in the suffix.

[0153] In some cases, the suffix 107b and the prefix 107a may include one or more alphanumeric characters and one or more non-alphanumeric characters (e.g., at least two alphanumeric characters and at least two non-alphanumeric characters). Figure 1 In the example of , both the suffix 107b and the prefix 107a include three alphanumeric characters (which constitute the string "SID") and two underscores. The suffix 107b and the prefix 107a also include three characters ">" and three characters "<", respectively.

[0154] exist Figure 1 In the example of , the PHI presence information specifies that the first data item 103 includes PHI; the first PHI category information included in the prefix 107a and the suffix 107b indicates that the protected health information belongs to the sample ID category. The sample ID category can be one of one or more given PHI categories. For example, a given PHI category can be limited to the sample ID category. Protected health information in the sample ID category can be handled differently from other protected health information. All protected health information that does not belong to the sample ID category can be in the default category. Specifically, protected health information that does not correspond to one of the other PHI categories can belong to the default category. Protected health information in the default category can be de-identified, for example, via irreversible replacement. Therefore, such protected health information can be displayed as a series of symbols (e.g., asterisks, such as "*****") in a graphical user interface, or marked with symbols (e.g., characters ">" and "<") in a log file.

[0155] exist Figure 1 In the example of , the first data file 101 includes an additional data item 111. Data item 111 includes protected health information, which is specified by an alphanumeric string 112 including the name "Jane Austen"; the alphanumeric string 112 represents the name of the patient. Data item 111 includes a prefix, i.e., the string "<<<" 105a, and a suffix, i.e., the string ">>>" 105b, which provides PHI presence information and specifically specifies that data item 111 includes PHI. The prefix and suffix also specify that the PHI in data item 111 belongs to a default PHI category, which is the category to which all PHI that does not belong to the sample ID category belongs.

[0156] Alternatively, a given PHI category may include multiple PHI categories. For example, an additional patient name category may be one of the given PHI categories. In particular, PHI identifying a patient's first name, PHI identifying a patient's last name, and / or PHI identifying a patient's middle name belongs to the patient name category.

[0157] In this example, each of the patient name and sample ID categories may enable different processing of the protected health information corresponding to those categories.

[0158] Figure 2 A further schematic representation of a portion of the first data file 101 ' is shown. Figure 2 The portion of the first data file 101 ′ shown includes a first entry 120 , a second entry 130 and a third entry 140 .

[0159] The first entry 120 and the second entry 130 each include the following fields: an end timestamp 121, 131 (e.g., 2022-03-15T20:02:26.9204727Z), a start timestamp 122, 132 (e.g., 2022-03-15 20:02:26.289), an identifier 123, 133 (e.g., 12116 / 41 / 19), a severity level 124, 134 (e.g., information), descriptive text 125a, 125b, 135a, 135b (e.g., a tube carrying an information barcode), and data items including PHI category information and PHI presence information 126, 136 (e.g., <<<Master Batch 123-T0>>>). Based on the PHI category information and the PHI presence information provided by the data items 126 and 136 (ie, the character strings ">>>" and "<<<" provided thereby), the data items 126, 136 include PHI belonging to a default category.

[0160] The third entry 140 includes a timestamp 141, an identifier 143, a severity level 144, descriptive text 145a, 145b, and a data item including PHI category information and PHI presence information 146 (i.e., the string "<<<_SID_Tube001_SID_>>>"). In particular, the alphanumeric string "f99c62a0-1dc0-4128-82b4-ea2b70c711a9" included in the string 145a is an identifier that uniquely identifies the operation of the laboratory instrument. Based on the PHI category information and PHI presence information provided by the data item 146 (i.e., the strings "_SID_>>>" and "<<<_SID_" provided thereby), the data item 146 includes PHI belonging to the sample ID category.

[0161] The first data file 101' may be stored on the laboratory instrument, or may be stored in storage controlled by the laboratory instrument. Thus, the PHI in data items 126 and 136 remains readable and has not been replaced or obfuscated. Data items 126 and 136 may be de-identified, for example, replaced by symbols such as asterisks, before the first data file 101' is exported (e.g., to a remote computer via a computer network).

[0162] The entries of the first data file 101' may have Figure 2 The data of the entries 120, 130, 140 not marked with PHI presence information may be unprotected analytical data.

[0163] Figure 3 A first method for selectively de-identifying protected health information is shown. At step S301, a first data file 101 is accessed. The first data file 101 includes at least a first data item 103. The first data item 103 includes PHI and first PHI category information. The first PHI category information indicates a first PHI category among a plurality of PHI categories. The PHI in the first data item 103 belongs to the first PHI category.

[0164] Accessing the first data file 101 may include retrieving the first data file 101 from at least one memory of the computing device or from a remote data storage (e.g., a database, secondary storage, cloud storage, etc.). Thus, in some cases, accessing the first data file 101 may include downloading data. For example, the computing device may retrieve the data file in response to a user command.

[0165] Additionally or alternatively, accessing the first data file 101 may include, for example, receiving the first data file 101 from a user or another computing device. For example, the computing device may receive the first data file 101 from another computing device via a computer network. Specifically, the first data file 101 may be received from a laboratory instrument. The laboratory instrument may be an analyzer, i.e., a device configured to perform one or more clinical tests on a biological sample. More specifically, the laboratory instrument may be a chemistry or hematology analyzer. The two options for accessing the first data file 101 are not mutually exclusive. For example, accessing the first data file 101 may include: receiving the first data file 101, storing the first data file 101 in a memory of the computing device during this period, and retrieving the first data file 101 by accessing the memory.

[0166] At step S303, the first PHI category information is accessed. Accessing the first PHI category information may include scanning the first data item 103 and / or the first data file 101 using one or more specified regular expressions. Accessing the first PHI category information may be implemented together with accessing the first data file 101 (e.g., as part of the same program or function call) or may be implemented separately. A regular expression may include a sequence of characters (e.g., metacharacters and regular characters) that specifies a search pattern for describing and / or parsing text. Thus, the specified regular expression may be used to separate or determine the first PHI category information in the first data item 103.

[0167] At step S305, the method includes evaluating whether the PHI in the first data item 103 is to be de-identified based on the first PHI category information; the evaluating may include using the first PHI category information to determine whether the PHI in the first data item 103 is to be de-identified. Thus, a category setting may be associated with the first PHI category information. If the category setting is turned off (i.e., set to false), then the first data item 103 may be de-identified. Similarly, if no category setting is associated with the first PHI category information, then the first data item 103 may be de-identified. Alternatively, if the category setting is turned on (i.e., set to true), then the first data item 103 may be treated differently (i.e., significantly different) from other PHI. For example, when the category setting is turned on, the first data item 103 may not be de-identified. Alternatively, when the category setting is turned on, the first data item 103 may be de-identified so that the original data can be reconstructed after de-identification. For example, when the category setting is turned on, the first data item 103 may be encrypted.

[0168] At step S307, if the PHI in the first data item 103 is to be de-identified, the method further comprises generating a second data item (not shown) by modifying the first data item 103 so that the protected health information is de-identified. Thus, step S307 may comprise de-identifying the first data item 103 by generating a second data item, wherein the second data item corresponds to the first data item 103, except that: in the second data item, the PHI of the first data item 103 has been replaced or obfuscated.

[0169] For example, the PHI of the first data item 103 may be replaced by a specified (e.g., predefined) string in the second data item, such that the specified string cannot be used to reconstruct the original PHI. Thus, the PHI in the first data item 103 having the patient name category may be replaced by a specified string including four asterisks (i.e., the string "****" in the second data item). In the example, since all data items in the category are replaced with the same specified string, the second data item cannot be used as a basis for deriving the first data item 103; therefore, the replacement is irreversible.

[0170] Alternatively, generating the second data item may include modifying the first data item 103 by encrypting the PHI of the first data item 103. As yet another alternative, the first data item 103 may be replaced with a code that can be decoded by a third party (e.g., a doctor) that possesses a key. For example, the patient's name may be replaced with a corresponding coded name that can be decoded by a third party using a table that matches the patient's name with the corresponding coded name. In the first two examples, the replacement is reversible, i.e., the second data item may be used as a basis for deriving the first data item 103.

[0171] Depending on the destination of the second data item, de-identification may be handled differently. For example, the second data item may be exported to a GUI or a second data file. When exported to a GUI, the PHI may be de-identified (e.g., obfuscated) by using a series of symbols (e.g., asterisks). When exported to a second data file, the PHI may be de-identified by replacing the PHI with a specified series of characters.

[0172] Figure 4A Steps of a second method for selectively de-identifying protected health information are shown.

[0173] At step S401, the second method includes accessing a first data file 101, 101'. Accessing the first data file 101, 101' may include retrieving the first data file 101, 101' from at least one memory of the computing device or from a remote data storage (e.g., a database, an auxiliary memory, a cloud storage, etc.). Thus, in some cases, accessing the first data file 101, 101' may include downloading data. For example, the computing device may retrieve the data file in response to a user command.

[0174] Additionally or alternatively, accessing the first data file 101, 101' may include, for example, receiving the first data file 101, 101' from a user or another computing device. For example, the computing device may receive the first data file 101, 101' from another computing device via a computer network. Specifically, the first data file 101, 101' may be received from a laboratory instrument.

[0175] The first data file 101, 101' includes multiple data items. The first data file 101, 101' may include multiple entries. Each entry may include one or more data fields or components. Each field may include one or more data items. Each entry in the first data file 101, 101' may have a corresponding structure (e.g., the same number of fields, fields with the same data type). Unless otherwise indicated, the information provided below about the first data item 103 may also be applicable to other data items in the first data file 101, 101'. After step S401, the counter i may be set to 1.

[0176] At step S402 , the second method comprises accessing the ith data item. Since the counter i is set to 1, the first time step S402 is performed, accessing the ith data item corresponds to accessing the first data item 103 .

[0177] At step S403, the second method includes determining whether the i-th data item includes PHI. Determining whether the i-th data item includes PHI may include accessing PHI presence information in the first data file 101, 101' (e.g., PHI presence information of the first data item 103), the PHI presence information indicating whether the i-th data item includes protected health information, and evaluating whether the i-th data item includes protected health information based on the PHI presence information.

[0178] When the i-th data item does not include PHI, step S404 is performed. Therefore, the i-th data item is stored in the second data file. In this case, the i-th data item may include or consist of unprotected analysis data. After step S404, the counter i is incremented, and step S402 is performed for the (i+1)-th data item.

[0179] When the i-th data item includes PHI, as discussed in more detail below, execution begins at step 5405. Figure 4B steps.

[0180] Figure 4B

[00136] Proceed to a second method for selectively de-identifying protected health information.

[0181] At step S405, the second method may further include accessing PHI category information included in the i-th data item (hereinafter also referred to as "i-th PHI category information"). The i-th PHI category information included in the i-th data item indicates the PHI category to which the PHI included in the i-th data item belongs, that is, the PHI category of the i-th data item. For example, the i-th PHI category information may distinguish the PHI of a data item belonging to the PHI category of the i-th data item from the PHI of other data items that do not belong to the PHI category of the i-th data item. The i-th PHI category information may be included in a string detectable by a parser, for example, via one or more regular expressions (i.e., pattern matching). As described above and in the above Figure 1 and Figure 2 As shown in , the PHI category information of the i-th data item may be provided by a prefix and / or suffix of the data item. Alternatively, the PHI category information of the i-th data item may be included in a string that is added before or appended to the string including the PHI.

[0182] At step S406, the second method may further include evaluating whether the PHI of the i-th data item is to be de-identified based on the PHI category information of the i-th data item. In particular, the PHI category information of the i-th data item is used to determine whether the PHI in the i-th data item is to be de-identified. Therefore, a category setting may be associated with the PHI category information of the i-th data item. If the category setting is turned off (i.e., set to false), then the i-th data item may be de-identified. Similarly, if no category setting is associated with the PHI category information, then the i-th data item may be de-identified.

[0183] Alternatively, if the category setting is turned on (ie, set to true), then the i-th data item may be treated differently (ie, significantly different) from other PHI. For example, when the category setting is turned on, the i-th data item may not be de-identified.

[0184] Alternatively, when the category setting is turned on, the i-th data item may be de-identified such that the original data may be reconstructed after de-identification. For example, when the category setting is turned on, the i-th data item may be encrypted. For example, step S406 may be performed by evaluating whether one or more de-identification requirements are met. The one or more de-identification requirements include a category requirement, i.e., a requirement that the first PHI category is different from one or more given PHI categories in the plurality of PHI categories.

[0185] Illustratively, the given PHI category is limited to the sample ID category and does not include the default PHI category, i.e., the category to which all PHI that does not belong to the sample ID category belongs. Thus, if the PHI included in the i-th data item belongs to the default PHI category, the PHI is de-identified, and if the PHI included in the i-th data item belongs to the sample ID, the PHI is not de-identified. For example, if the first data item is Figure 2 If data item 101' is depicted in FIG. 1 , data items 126 and 136 will be de-identified, while data item 146 will not be de-identified.

[0186] At step S407, based on the evaluation of step S406, a determination is made regarding further steps to be performed for the second method.

[0187] If the PHI is not de-identified, for example, if the PHI belongs to the sample ID category, the second method may also include deleting the i-th PHI category information at step S408, and thereby creating a modified i-th data item. Figure 2 , then in step S407, data item 146 is modified by deleting the prefix "<<<_SID_" and the suffix "_SID_>>>" so that the modified data item is the string "Tube001". The creation of the modified i-th data item may include deleting the PHI presence information in addition to deleting the PHI category information. Thus, the PHI may be used in the context of troubleshooting or testing (e.g., laboratory instrument troubleshooting or testing).

[0188] The modified ith data item may be in a second data file for export (eg, transmission to a remote computing device via a computer network).

[0189] If step S407 results in a determination that the PHI is to be de-identified, then the PHI may be de-identified to create a modified i-th data item at step S409. De-identifying the PHI may include modifying or obfuscating the PHI.

[0190] For example, the PHI and the i-th PHI category information may be replaced with a specified (eg, predefined) string (ie, string "****") so that the specified string cannot be used to reconstruct the original PHI. For example, if the first data item is Figure 2 , then in step S407, data items 126 and 136 are de-identified by replacing them with the string "****". In particular, if the i-th data item includes PHI related to the patient's identity, i.e., belongs to the default PHI category, then the PHI of the i-th data item is replaced in the i-th data item with a specified string including four asterisks (i.e., the string "****"), so that the modified i-th data item is the string "****". In the example, since all data items in the default PHI category are replaced by the same specified string, the i-th data item cannot be used as a basis for deriving the first data item 103; therefore, the replacement is irreversible. The specified string may include alphanumeric and / or non-alphanumeric characters. Alternatively, the specified string may be limited to non-alphanumeric characters.

[0191] Alternatively, de-identifying the i-th data item may include encrypting the PHI of the i-th data item. As yet another alternative, the PHI of the i-th data item may be replaced with a code that may be decoded by a third party (e.g., a physician) that possesses a key. For example, a patient's name may be replaced with a corresponding coded name that may be decoded by a third party using a table that matches patient names to corresponding coded names. In the previous two examples, the replacement is reversible, i.e., the modified i-th data item may be used as a basis for deriving the data item.

[0192] At step S410, the second method includes storing the modified data item in the second data file. Step S410 may be after step S408 or step S409. Thus, the second data file may include data items with de-identified PHI and data items with PHI that has not been de-identified.

[0193] After step S410, the second method returns to Figure 4A , and the counter i is incremented before returning to step S402.

[0194] Figure 5 A method for generating a first data item is shown. At step S501, the method includes obtaining protected health information that belongs to a first PHI category among a plurality of PHI categories. Obtaining the protected health information may include retrieving the protected health information from at least one memory of a computing device. At step S503, a first PHI category is determined. At step S505, the method also includes generating a first data item based on the first PHI category, the first data item including the protected health information and category information. The category information indicates the first PHI category, wherein the first data item is part of a first data file.

[0195] Immediately after generating the first data item based on the first PHI category, the protected health information in the first data item is not in de-identified form. More specifically, de-identification of the first data item occurs upon export of the first data item (e.g., export of a first data file that includes the first data item).

[0196] Specifically, Figure 5 The method for generating a first data item shown in can be performed by the PHI processing framework discussed above. The PHI processing framework can obtain PHI from a laboratory instrument by receiving information specifying an event that occurred in the laboratory instrument (step S501). For example, the laboratory instrument can send information to the PHI processing framework that specifies a query for a tube order for a given tube (e.g., a tube with an identification number "Tube001") for a given patient (e.g., Ms. Muholland).

[0197] This information about the event can be processed by the PHI-processing framework by using the following code:

[0198] Log.Info("Query the tube order of tube id {0} for patient {1}"

[0199] PHILogValue.Log(tubelD,new

[0200] DefaultPHIValueFormatter(PHICategory.SampleID)),

[0201] PHILogValue.Log(patientName)).

[0202] Therefore, the PHI processing framework uses the information received from the laboratory instrument to determine a template for the text of the log entry, namely the string "query tube order for tube id {0} for patient {1}" and the information that should replace the placeholders {0} and {1} in the first data file. Specifically, the data item including the information identifying the sample tube should replace the placeholder {0}, and the data item including the patient name information should replace the placeholder {1}. Therefore, as in the code above, {0} is processed according to the following first code snippet:

[0203] PHILogValue.Log(order.SampleID,new

[0204] DefaultPHIValueFormatter(PHICategory.SampleD)).

[0205] In the first code snippet, the field identifier "tubeID" from the above code has been replaced by a variable "order.SampleID", which has a value corresponding to "tubeID". The PHI category to which the PHI included in the string "Tube001" belongs is determined by executing the first code snippet (i.e., the PHILogValue.Log function). In particular, the first code snippet specifies that the PHI included in the string "Tube001" belongs to the sample ID category (see the parameters of the DefaultPHIValueFormatter method). In the first code snippet, the PHI category of the sample ID is simply provided. However, the PHI category can also be determined according to more complex instructions (e.g., based on the value of the sample ID in the data item). For example, if the sample ID corresponds to a sample ID belonging to a set of test samples, the sample ID can be assigned to the test category, while other samples that do not belong to the set of test samples can be assigned to the sample ID category.

[0206] As in the above code, {1} is processed according to the following second code snippet:

[0207] PHILogValue.Log(order.Patient.PatientDisplayName).

[0208] In the second code snippet, the PHI category patient name has been replaced by the variable order.Patient.PatientDisplayName corresponding to the PHI category. The PHI category to which the PHI included in the string "Muholland" belongs is determined by executing the second code snippet. The second code snippet specifies that the string "Muholland" includes information related to the patient identity (see orderPatient.PatientDisplayName) and belongs to the default category, for example.

[0209] The PHILogValue.Log method is configured to generate data items including protected health information and PHI category information based on the PHI category of the detected PHI. In particular, the following entries are generated for a data file (e.g., a first data file):

[0210] For patients<< <mulholland> >>Query the tube order for tube id <<<_SID_Tube001_SID_>>>. Therefore, the data item including the sample ID "Tube001" now also includes the PHI category information corresponding to the sample ID PHI category, and the data item including the patient "Mulholland" includes the PHI category information corresponding to the default PHI category.< / mulholland> < / muiholland>

Claims

1. A computer-implemented method for selectively de-identifying protected health information (PHI), the method comprising: Accessing (S301) a first data file (101, 101'), the first data file (101, 101') comprising at least a first data item (103), wherein the first data item (103) comprises PHI and first PHI category information, wherein the first PHI category information indicates a first PHI category among a plurality of PHI categories, and the PHI in the first data item belongs to the first PHI category; Access (S303) the first PHI category information; evaluating (S305) whether the PHI in the first data item (103) is to be de-identified based on the first PHI category information; and If the PHI in the first data item (103) is to be de-identified, then • Generating (S307) a second data item by modifying the first data item (103) such that the protected health information is de-identified.

2. The method according to claim 1, further comprising: accessing PHI presence information in the first data file (101, 101'), the PHI presence information indicating whether the first data item (103) includes protected health information; and • Evaluating whether the first data item (103) includes protected health information based on the PHI presence information.

3. The method according to claim 1 or 2, wherein: If the protected health information in the first data item (103) is not to be de-identified, the method further comprises: · Modifying the first data item (103) by deleting the PHI category information to generate a third data item.

4. A method according to any one of the preceding claims, wherein: The first data item (103) includes one or more tags, and the one or more tags include the first PHI category information.

5. A method according to any one of the preceding claims, wherein: Evaluating whether the protected health information in the first data item (103) is to be de-identified includes evaluating whether one or more de-identification requirements are satisfied, the one or more de-identification requirements including a category requirement, wherein the category requirement is a requirement that the first PHI category is different from one or more given PHI categories among the plurality of PHI categories.

6. The method according to the preceding claim further comprising: • accessing de-identified data, the de-identified data comprising information indicative of the one or more de-identification requirements.

7. A method according to the preceding claim, wherein: Accessing the de-identified data includes accessing a configuration file, the configuration file including the de-identified data.

8. The method according to any one of the preceding claims, further comprising: Generate a second data file, Wherein, if the protected health information in the first data item (103) is to be de-identified, the second data file includes the second data item.

9. The method according to any one of the preceding claims, further comprising: · Access file information indicating the file category, Wherein, whether the PHI in the first data item (103) is to be de-identified is evaluated based on the file information.

10. A computer-implemented method for generating a first data item (103), wherein: The method comprises: Obtaining (S501) protected health information, the protected health information belonging to a first PHI category among a plurality of PHI categories; Determining (S503) the first PHI category; and Generating (S505) the first data item (103) based on the first PHI category, the first data item (103) comprising the protected health information and category information indicating the first PHI category, wherein the first data item (103) is part of a first data file (101, 101').

11. The method according to the preceding claim, further comprising: • Assessing whether the protected health information satisfies at least one criterion for protected health information.

12. A method according to any one of the preceding claims, wherein: The first data file (101, 101') is a log file of a laboratory instrument.

13. A method according to any one of the preceding claims, wherein: The first PHI category specifies that the protected health information refers to biological specimens, patient data, physician data, or laboratory test data.

14. A computing device comprising a processor configured to perform a method according to any preceding claim.

15. A laboratory instrument comprising a computing device according to claim 14.

16. A computer program product comprising instructions which, when executed by a computer, cause the computer to perform the steps of the method according to any one of claims 1 to 13.

17. A computer-readable storage medium comprising instructions which, when executed by a computer, cause the computer to perform the steps of the method according to any one of claims 1 to 13.

Images