End-to-end-based medical record privacy data elimination method and system

Abstract

The invention relates to the technical field of medical data privacy protection, and discloses an end-to-end based medical record privacy data elimination method and system. The method comprises the following steps: acquiring an original medical record stream at a medical data generation end, identifying a privacy field type and extracting field boundary features; calling the dynamic desensitization rule base according to the field type, and generating a matched anonymization processing strategy; negotiating the session parameter by using an asymmetric encryption algorithm to obtain a real-time encryption channel parameter; inputting the original medical record stream into a corresponding encryption assembly line, and outputting an intermediate medical record with a dynamic desensitization identifier; analyzing the identifier at a receiving end, and reconstructing a data access range based on the role permission matrix; selecting parameters from the differential privacy noise pool according to the access range, and performing statistical characteristic disturbance on the intermediate record; and verifying the data integrity after disturbance through a secure multi-party computing protocol, and generating an available anonymous medical data set. The method covers the privacy protection of the whole process of the medical record, and balances the data security and practical value.

Description

Technical Field

[0001] This invention relates to the field of medical data privacy protection technology, specifically to an end-to-end method and system for eliminating privacy data in medical records. Background Technology

[0002] With the deepening of medical informatization, the scale of medical data, including electronic medical records, test results, treatment plans, and medication records, continues to expand. This type of data not only contains basic identity information such as patient names, ID numbers, and contact information, but also highly sensitive content such as medical history, genetic data, and diagnostic conclusions. It has irreplaceable value in scenarios such as clinical treatment optimization, medical scientific research innovation, and public health monitoring. However, in the process of sharing and utilizing medical data, the risk of privacy leakage remains a prominent issue hindering the realization of its value. If there are vulnerabilities in the data processing stage, sensitive patient information may be illegally crawled, sold, or misused, which not only infringes on patients' privacy and right to know, but may also trigger a crisis of trust in the medical industry and even negatively impact patients' daily lives.

[0003] Currently, various technical solutions exist in the field of medical data privacy protection, such as static desensitization technology, which replaces, deletes, or masks specific privacy fields through preset fixed rules. However, this type of technology has significant drawbacks: medical records contain diverse types of privacy fields, and the sensitivity and format characteristics of different fields vary significantly. For example, ID numbers have a fixed format but are highly sensitive, while medical history descriptions have variable lengths and contain semantically sensitive information. Static rules cannot adapt to these differences, easily leading to "over-desensitization" that renders the data worthless for analysis, or "under-desensitization" that leaves potential privacy leaks. Static desensitization is mostly completed during the data storage stage and cannot cope with scenarios where medical records are generated and transmitted in real time. It is difficult to cover the entire process of data protection from generation to receipt, and data still faces the risk of leakage during transmission.

[0004] In the data transmission stage, some solutions use symmetric encryption algorithms to construct transmission channels. However, symmetric encryption requires the transmission of keys between participants, and the key distribution process has security vulnerabilities. Once the key is stolen, the encrypted channel will be completely invalidated, and the anonymization strategy and original medical data may be illegally obtained. Furthermore, existing solutions often employ simple role-based access control at the medical data receiving end, failing to integrate with the front-end anonymization process and unable to dynamically adjust access scope based on the data anonymization status. For example, researchers may only need de-identified diagnostic and treatment statistics, while attending physicians may need to view complete patient records. However, current solutions struggle to achieve such refined access control that matches the data anonymization status, easily leading to unauthorized access issues.

[0005] While differential privacy technology is used to protect statistical features of data through noise injection, current applications often treat noise injection as an independent step, failing to dynamically select parameters based on the data access scope. Different access scenarios have varying requirements for privacy protection strength and data availability. Fixed noise parameters may lead to excessive noise causing data distortion, or insufficient noise to defend against privacy inference attacks. Furthermore, most solutions lack mechanisms to verify the integrity of data after perturbation, making it impossible to confirm whether data has been tampered with during transmission or processing, further impacting the reliability of subsequent data utilization. Summary of the Invention

[0006] The purpose of this invention is to provide an end-to-end method and system for eliminating privacy data in medical records, so as to solve the problems mentioned in the background art.

[0007] To achieve the above objectives, the present invention provides an end-to-end method for eliminating privacy data in medical records, the method comprising: At the point where medical data is generated, the raw medical record stream is acquired, the types of privacy fields in the raw medical record stream are identified, and the field boundary features are extracted. Based on the privacy field type, a pre-set dynamic desensitization rule library is invoked to generate an anonymization processing strategy that matches the field boundary features; Asymmetric encryption algorithm is used to negotiate the key for the session parameters in the anonymization strategy to obtain the real-time encrypted channel parameters. The original medical record stream is input into the encryption pipeline corresponding to the parameters of the real-time encryption channel, and the intermediate medical record carrying a dynamic desensitization identifier is output. At the medical data receiving end, the dynamic de-identification identifier in the intermediate medical records is parsed, and the data access scope is reconstructed based on the role and permission matrix. Based on the data access range, noise injection parameters are selected from the differential privacy noise pool to perform statistical feature perturbation on intermediate medical records; The integrity of the disturbed medical records is verified through a secure multi-party computation protocol, generating a final, usable anonymized medical dataset.

[0008] Preferably, identifying the types of privacy fields in the original medical record stream and extracting field boundary features includes: Multimodal feature scanning is performed on the raw medical record stream to separate structured data blocks from unstructured text streams; Locate the patient identifier field and treatment code field in the structured data block, and record the starting offset and length attributes of the fields; Match preset sensitive keyword patterns in unstructured text streams to capture the position information of triples in the keyword context; The starting offset, length attribute, and triplet position information of the field are merged into a set of field boundary features.

[0009] Preferably, the anonymization strategy that generates anonymization matching field boundary features includes: Based on the field type index in the field boundary feature set, load the corresponding hash replacement rule and mask generation template from the dynamic desensitization rule library; A segmented hash operation is used on the patient identifier field to generate a pseudonym identifier that retains the original format; Apply bit substitution operations in the mask generation template to the diagnosis code field to generate a de-identified diagnosis code; Input the positional information of the triplet in the context of sensitive keywords into the semantic confusion model to generate context-preserving alternative text fragments.

[0010] Preferably, an asymmetric encryption algorithm is used to perform key negotiation on the session parameters in the anonymization strategy, including: Extract the encryption policy identifier and key lifecycle parameters of the current session from the dynamic de-identification rule base; Temporary public key pairs are generated using an elliptic curve key exchange protocol, and the public key pairs are encoded as encrypted pipeline configuration parameters. The session key rotation interval is set according to the key lifecycle parameter, and a key update transaction is triggered when the rotation interval is reached.

[0011] Preferably, the output of intermediate medical records carrying dynamic desensitization markers includes: Field-level anonymization and streaming encryption are performed in parallel within the encryption pipeline to generate binary data blocks that undergo dual processing. Append a metadata header containing the de-identification rule version number to each binary data block and assemble them into an intermediate medical record data packet; The integrity signature of the data packet is verified using a lightweight digest algorithm, and abnormal data packets that fail to verify the signature are discarded.

[0012] Preferably, the data access scope is reconstructed based on the role-based permission matrix, including: Parse the metadata header in the intermediate medical record data packet to extract the de-identification rule version number and field processing type marker; The permission matrix is ​​queried based on the role identifier of the receiving user to obtain the whitelist of accessible fields and the aggregation granularity level. Map the whitelist field and the aggregation granularity level to the query conditions of the differential privacy noise pool.

[0013] Preferably, the intermediate medical records are subjected to statistical feature perturbation, including: Based on the query criteria, load the noise generator parameters conforming to the Laplace distribution from the differential privacy noise pool; Apply a noise offset that matches the aggregation granularity to the numeric data of the whitelist fields; Perform a k-anonymity-based generalization operation on non-numerical data to generate a perturbation result set that satisfies privacy budget constraints.

[0014] Preferably, the data integrity of the disturbed medical records is verified through a secure multi-party computation protocol, including: The perturbation result set is split into multiple secret shares and distributed to the verification nodes participating in the computation; Each verification node performs a consistency comparison operation on the secret share based on the obfuscated circuit protocol; When the verification nodes that exceed the threshold return consistent confirmation, the secret shares are reassembled to generate the final anonymized medical dataset.

[0015] Preferably, the method further includes: Embed a traceable watermark in the final anonymized medical dataset. The watermark contains the data recipient's identifier and usage period information. When a watermark identifier is detected to have exceeded its expiration date, a data destruction command is automatically triggered and an audit log is generated.

[0016] Preferably, the present invention also includes an end-to-end medical record privacy data erasure system, the system including a memory, a processor, and a computer program stored in the memory and running on the processor, wherein the processor, when executing the computer program, implements the steps of the end-to-end medical record privacy data erasure method described above.

[0017] Compared with the prior art, the beneficial effects of the present invention are: At the data generation stage of medical data, by identifying the types of privacy fields in the original medical record stream and extracting field boundary features, different categories of sensitive information can be accurately identified, avoiding desensitization vulnerabilities or misprocessing problems caused by ambiguous identification of privacy fields. This precise identification method ensures that desensitization operations only apply to truly privacy fields, preventing non-privacy fields from being mistakenly desensitized and losing their practical value, and also preventing privacy fields from facing leakage risks due to oversight in identification, providing a clear target for subsequent privacy protection processing.

[0018] The system invokes a pre-defined dynamic anonymization rule library based on the privacy field type to generate an anonymization strategy that matches the field's boundary features, overcoming the limitations of traditional static anonymization rules. Different privacy fields have varying sensitivity attributes and application scenario requirements. The dynamic anonymization rule library can flexibly adjust the processing method for specific field types. For example, it can use partial masking for standardized bank card numbers, synonym substitution for diagnostic conclusions containing semantic information, and data generalization for highly sensitive genetic data. This ensures a high degree of adaptation between the anonymization strategy and field features, thoroughly protecting privacy while preserving the data's structure and semantic information to the greatest extent possible. It avoids excessive data distortion caused by uniform anonymization rules, guaranteeing the data's usability in subsequent analysis and reference scenarios.

[0019] Asymmetric encryption algorithms are employed to negotiate key parameters for session parameters in the anonymization strategy, resulting in real-time encrypted channel parameters. This significantly improves security compared to traditional symmetric encryption. Asymmetric encryption, through its public-key encryption and private-key decryption mechanism, eliminates the need to directly transmit keys during transmission, fundamentally avoiding the security vulnerabilities of key distribution in symmetric encryption. This ensures that session parameters are not illegally stolen or tampered with during the negotiation phase. The real-time encrypted channel built upon these secure parameters provides a secure environment for the transmission and processing of raw medical records, preventing data leakage and tampering after entering the encryption pipeline due to channel insecurity, thus building a robust security defense for intermediate data processing stages.

[0020] The raw medical record stream is input into an encryption pipeline corresponding to the parameters of the real-time encryption channel, and the output is an intermediate medical record carrying a dynamic de-identification tag. This gives the intermediate data the dual attributes of encryption protection and de-identification information labeling. The dynamic de-identification tag clearly records key information such as the type and scope of the front-end de-identification processing. After parsing this tag, the medical data receiving end can quickly grasp the privacy protection status of the data without having to re-perform comprehensive privacy field identification and de-identification analysis, significantly improving the data processing efficiency of the receiving end and avoiding resource waste and data loss caused by repeated processing at the receiving end.

[0021] At the medical data receiving end, a role-based access control matrix is ​​used to reconstruct the data access scope, enabling fine-grained access management. Different user roles have different needs in utilizing medical data. For example, nurses need to view patients' basic vital signs data, while medical researchers need to obtain batches of de-identified diagnostic and treatment statistics. The role-based access control matrix can set precise access boundaries based on user roles and, combined with dynamic de-identification markers reflecting the data de-identification status, reconstruct the specific data range that each role can access. This control method ensures that users with different permissions can only access data that matches their roles and meets privacy requirements, preventing privacy leaks caused by unauthorized access while protecting the normal data usage needs of legitimate users.

[0022] Based on the data access scope, noise injection parameters are selected from a differential privacy noise pool to statistically perturb intermediate medical records, making the noise injection more targeted and reasonable. Different access scopes correspond to different application scenarios, with varying requirements for privacy protection strength and data accuracy. For example, data used for regional public health analysis can appropriately increase noise intensity to enhance privacy protection; while data used for clinical case reference needs to control the amount of noise to ensure data accuracy. Selecting appropriate parameters from the noise pool can precisely balance privacy protection and data usability, ensuring that the injected noise is sufficient to resist privacy inference attacks based on statistical features, preventing attackers from inferring patient privacy information through data analysis, while also preventing excessive noise from severely distorting the statistical features of the data and affecting its practical value.

[0023] Verifying the integrity of disturbed medical records through a secure multi-party computation protocol enables reliable verification without relying on a single trusted center. Secure multi-party computation allows multiple participants to collaboratively complete computations without disclosing private data. Using this protocol to verify data integrity avoids verification failures caused by attacks or malfunctions of a single trusted center, accurately confirming whether data remains intact and untampered during transmission and disturbance. Verified medical data ensures that the resulting anonymized medical dataset meets both privacy requirements and possesses reliable integrity, allowing for secure application in various scenarios such as clinical research, treatment optimization, and public health decision-making, thus enabling medical data to fully realize its value within a secure framework. Attached Figure Description

[0024] Figure 1 This is a schematic diagram illustrating the working principle of the end-to-end medical record privacy data elimination method described in this invention. Figure 2 A flowchart for identifying privacy field types and extracting field boundary features; Figure 3 A flowchart for outputting intermediate medical records; Figure 4 This is a graph showing the system performance and error monitoring analysis. Detailed Implementation

[0025] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0026] Please see Figure 1This invention provides an end-to-end method for eliminating privacy data in medical records. The method includes: at the data generation end, the system first acquires the original medical record stream, which may contain medical information in various formats, such as electronic health records, diagnostic reports, or real-time monitoring data. The system performs preliminary analysis on the original medical record stream to identify the types of privacy fields, such as sensitive information like patient names, ID numbers, and treatment codes, while extracting field boundary features, including the field's starting position, length, and contextual relationship. This identification process relies on multimodal feature scanning technology, capable of processing both structured and unstructured data simultaneously. Based on the identified privacy field types, the system calls a pre-set dynamic de-identification rule base, which stores various de-identification strategies, such as hash replacement, mask generation, or semantic obfuscation. The system generates a matching anonymization strategy based on the field boundary features, ensuring that the de-identification operation is precisely targeted at each privacy field. Next, an asymmetric encryption algorithm, such as elliptic curve cryptography, is used to negotiate the session parameters in the anonymization strategy to generate real-time encrypted channel parameters. This step ensures the security and temporality of the data transmission channel through a key exchange protocol.

[0027] The raw medical record stream is then fed into an encryption pipeline corresponding to the real-time encryption channel parameters. This pipeline performs field-level anonymization and streaming encryption in parallel, outputting intermediate medical records carrying dynamic de-identification identifiers. These identifiers contain metadata information, such as the de-identification rule version number and field processing type flags, for subsequent tracking. At the medical data receiving end, the system parses the dynamic de-identification identifiers in the intermediate medical records and reconstructs the data access scope based on a role-permission matrix. The role-permission matrix defines the data fields and aggregation levels accessible to different user roles (such as doctors, researchers, or administrators). Based on the data access scope, the system selects noise injection parameters from a differential privacy noise pool to statistically perturb the intermediate medical records. This process adds Laplace-distributed noise to numerical data and performs k-anonymization generalization on non-numerical data to balance data availability and privacy protection. Finally, the data integrity of the perturbed medical records is verified through a secure multi-party computation protocol. Multiple verification nodes participate in consistency comparisons to ensure the data has not been tampered with. Once verification is successful, the system generates a final, usable anonymous medical dataset and embeds a traceable watermark containing the data recipient's identifier and usage period information, facilitating auditing and lifecycle management.

[0028] Example 1: See Figure 2After system startup, the system first establishes a connection with medical data sources, which may include hospital information systems, electronic health record databases, or real-time vital sign monitoring devices. The resulting raw medical record streams exhibit high heterogeneity and dynamism. Data streams are input into the system buffer in a continuous or batch processing manner. The system initializes a multimodal feature scanning engine, configured with a parsing rule base tailored to the characteristics of medical data, capable of processing completely different data formats simultaneously. Structured data blocks typically follow international standards such as HL7, FHIR, or DICOM. The system loads the corresponding message structure definition or database schema to quickly locate tabular data areas containing basic patient information, test results, and medical operation records. Regarding unstructured text streams, the system deals with free text such as doctors' handwritten notes, radiology reports, and discharge summaries. These texts contain rich clinical descriptions but are loosely formatted, requiring more complex linguistic analysis.

[0029] The core of multimodal feature scanning lies in the design of a parallel processing pipeline. The system performs preliminary classification of the input data stream and routes it to different parsing channels based on the header information or content features of the data packets. For structured data blocks, the parser scans the data content field by field according to predefined templates or pattern files. Patient identifier fields such as name, medical record number, and social security number are prioritized for identification because these fields are directly associated with personal identity. The system uses rule-based pattern matching algorithms, such as verifying the number of digits and check digits for ID card numbers and identifying the country code and area code pattern for phone numbers. Once a match is successful, the parser immediately records the starting offset of the field in the data block, which is a byte or character count relative to the beginning of the data block. At the same time, the system calculates the length attribute of the field, i.e., the storage space occupied by the field. This metadata is temporarily stored in a memory-mapped table for later use. The identification of diagnostic code fields relies on medical terminology dictionaries and coding systems, such as the International Classification of Diseases (ICD) and contemporary operational terminology codes. The system quickly locates the position of these standardized codes in the data stream and records their boundary information by searching a pre-loaded code library.

[0030] When processing unstructured text streams, the system employs a natural language processing module that integrates a word segmenter, part-of-speech tagger, and named entity recognizer. The text stream is segmented into continuous sentences or paragraphs, and the scanning engine loads a pre-defined sensitive keyword pattern library. This library not only contains a simple list of keywords but also defines complex contextual grammar rules. For example, when the system scans the word "diagnosis," it checks whether an entity representing a disease name appears in the subsequent text. This contextual association is achieved through dependency parsing. The keyword contextual information captured during the matching process is stored in the form of triples, typically consisting of a subject, predicate, and object. For instance, in the sentence "CT scan suggests lung nodules," the system identifies "CT scan" as the subject, "suggests" as the predicate, and "lung nodules" as the object, fully recording the starting and ending character positions of this semantic unit in the text, as well as the logical relationship between the three. This deep contextual analysis effectively distinguishes sensitive information in clinical descriptions from common medical terminology, avoiding over-identification or omission.

[0031] The field boundary feature extraction process emphasizes accuracy and efficiency. The system generates a feature descriptor for each identified privacy field. This descriptor uses a structured data format, including field type encoding, starting offset, length value, data format description, and confidence score. For features extracted from structured data, the system also records information about the parent container, such as table name or message type, to maintain the hierarchical structure of the data. For triple position information extracted from unstructured text, the system additionally stores the vector representation of the words. This representation is generated by a pre-trained language model and captures the semantic features of the words. All these feature information are merged into a unified field boundary feature set, which is organized in memory using an indexed data structure to support fast querying and updating. The entire scanning and extraction process implements a multi-layered quality control mechanism. The system monitors the accuracy of the identification results in real time, and when the confidence score falls below a threshold, a manual review process or auxiliary verification algorithm is triggered. Fluctuations in data flow speed and volume are smoothed by a dynamic buffering mechanism to ensure processing stability even under high load. The extracted set of field boundary features is encapsulated into transaction units, appended with timestamps and data source fingerprints, and then transmitted to the next processing stage. Simultaneously, the system retains a backup of the original data for audit trail purposes. This implementation ensures the comprehensiveness and accuracy of privacy field identification, laying a reliable foundation for subsequent anonymization processing.

[0032] The diversity and complexity of medical data demand that scanning systems possess strong adaptability. The system regularly updates medical terminology and pattern rules from a knowledge base that remains synchronized with standard medical terminology systems. For emerging medical data formats or non-standard expressions, the system provides machine learning interfaces, allowing fine-tuning of the recognition model through training data. In a distributed deployment environment, multiple scanning nodes can collaborate, each responsible for processing a segment of the data stream. A central coordinator integrates the recognition results from each node and resolves field boundaries across nodes. This architecture ensures both processing efficiency and enhances the system's scalability and fault tolerance. The generation of field boundary feature sets is not a one-time process; the system continuously monitors changes in field boundaries during data stream processing. For example, in a real-time stream, a long text field may be transmitted in multiple data packets; the system can recognize this and correctly concatenate the complete boundary information of the field. For encrypted or compressed medical records, the system performs decryption or decompression operations before scanning, but the entire process maintains zero knowledge of the original data; that is, the system does not store decryption keys or compression algorithm parameters, operating only on plaintext data in memory. All processing operations are performed within a strictly secure sandbox to prevent accidental leakage of private data during the recognition phase. The final generated set of field boundary features serves as the core metadata of the entire privacy elimination process, and its completeness and accuracy directly affect the effectiveness of subsequent de-identification operations. The system generates a digital signature for each feature set to ensure it is not tampered with during transmission to the next stage. Simultaneously, the system maintains detailed operation logs, recording the identification time, processing node, and operator information for each privacy field. These logs are used for compliance audits and system optimization.

[0033] Example 2: After receiving the set of field boundary features from upstream processing, the system first parses and verifies them to confirm the completeness and consistency of the feature descriptions. Then, based on the type index of each field in the feature set, it initiates a query request to the dynamic desensitization rule base. The dynamic desensitization rule base is a scalable rule management system that stores processing rule templates for different types of medical privacy data. These templates are organized according to the medical data classification system, and the rule base maintains high availability and fast response capabilities through distributed caching technology. The query process employs multi-level index optimization. The system first matches the major categories of fields, such as patient identifiers, diagnostic codes, or free text, and then subdivides each major category into subtypes. For example, the patient identifier category is further divided into direct identifiers and indirect identifiers, with each subtype corresponding to different desensitization strengths and processing methods. For the patient identifier field, the system loads the corresponding hash replacement rules from the rule base. These rules specify in detail the selection of the hash algorithm, the usage of the salt value, and the control parameters of the output format. The hash replacement process employs a segmented processing strategy. For example, for long identifiers like ID card numbers, the system divides them into semantic segments. The first six digits, representing the region code, may retain their original value or undergo weak hashing; the middle eight digits, representing the birth date, undergo strong hashing; and the last four digits, representing the sequence code, may be completely replaced with random values. This segmented processing method can preserve some statistical characteristics for legitimate use while compromising the direct recognizability of the identifier. The hash operation uses a one-way hash function with a salt value. The salt value is dynamically generated by the system's security module and bound to each processing session to prevent reverse derivation via rainbow tables. The output format of the hash result is strictly limited. The system ensures that the generated pseudonyms are highly similar to the original data in terms of data length, character set, and appearance format. For example, the name "Zhang San" is replaced with a pseudonym with the same structure, such as "Li Si," instead of being displayed as a meaningless hash string. This format-preserving desensitization technique minimizes interference with downstream business systems.

[0034] The processing of diagnostic code fields relies on mask generation templates loaded from a rule base. These templates define the sensitivity levels and maskable ranges for different parts of the code. The system analyzes the structural characteristics of the diagnostic codes; for example, ICD-10 codes have a clear hierarchical structure, with the first three digits representing the disease category and the last few providing more specific clinical information. The mask templates determine the level of granularity to retain based on the data usage scenario. Bit substitution operations are performed at the binary or character level of the code. The system identifies sensitive bits in the code that may contain information that can be associated with rare diseases or specific treatments, and then overwrites the original values ​​with predefined replacement characters or random values. The de-identification process ensures that the generated code remains medically meaningful but cannot be traced back to an individual patient. For example, the specific "E11.92 type diabetes" is replaced with the more generalized "E11.x diabetes category." This processing satisfies privacy requirements while maintaining the code's utility in epidemiological studies.

[0035] Handling sensitive information in unstructured text is the most complex. The system inputs the captured keyword context triple position information into a semantic obfuscation model. This model is built on a deep learning architecture and has been trained on a large corpus of medical texts. The model first analyzes the semantic roles of each component in the triple and the logical relationships between them. Then, based on the sensitivity level assessment results, it generates alternative text fragments. The substitution strategies include synonym replacement, concept generalization, and sentence reconstruction. Context preservation is the core requirement of semantic obfuscation. The system not only replaces sensitive words but also adjusts the grammatical structure of the surrounding text to make the entire paragraph read naturally and fluently. For example, "the patient exhibited typical symptoms of myocardial infarction" is rewritten as "the individual presented with clinical manifestations related to acute coronary syndrome." This processing eliminates personal identification information while preserving the educational and research value of the clinical description.

[0036] Maintaining the dynamic data masking rule base is an ongoing process. The system provides rule version management functionality, allowing administrators to adjust data masking rules based on changes in laws and regulations or business needs. Rule updates are rolled out gradually through a canary release mechanism. New rules are validated in the test environment before being deployed to the production system. Detailed audit logs are recorded for each rule change, including the modification time, the operator, and the reason for the change. The rule base supports a multi-tenant architecture, allowing large medical groups to configure different data masking strategies for different hospital campuses while maintaining consistency in core rules.

[0037] The generation process of anonymization strategies includes multiple quality checkpoints. The system performs logical consistency and security assessments on each generated strategy, and strategy execution parameters undergo compliance verification to ensure compliance with medical data protection regulations. Strategy description files use a standardized format and include metadata such as strategy identifiers, applicable field types, processing algorithm parameters, and expected output formats. These files are encrypted and stored before being transmitted to the execution engine. The strategy generator also implements a fallback mechanism. When a field cannot find a completely matching processing rule, the system initiates a tiered matching process, first attempting to match similar rules, and then considering using a stricter default rule to avoid data processing interruptions due to missing rules. The entire anonymization strategy generation emphasizes configurability and adaptability. Medical institutions can adjust the strength of anonymization rules through the management interface to balance privacy protection and data utility. The system provides a strategy simulation function, allowing administrators to preview the anonymization effect before formal deployment to ensure that strategy adjustments meet expectations. All generated strategies are digitally signed and timestamped to prevent tampering during transmission. The strategy version strictly corresponds to the data processing result, supporting complete data traceability. The policy generation stage is closely integrated with subsequent encryption processing. The system binds anonymization policy parameters with session security parameters, forming a complete processing pipeline configuration. This design ensures that anonymization not only considers the transformation of the data content itself but also takes into account the security and auditability of the processing procedure. Through this refined policy generation mechanism, medical privacy data can be appropriately protected in different use cases, meeting strict compliance requirements while supporting the legitimate sharing and secondary use of medical data.

[0038] Example 3: See Figure 3 After generating the anonymization policy, the system immediately initiates a secure session establishment process. It extracts an encryption policy identifier bound to the current data processing task from the dynamic de-identification rule base. This identifier points to a predefined set of encryption parameters, including recommended elliptic curve type, key length, and hash algorithm. The key lifetime parameter is dynamically calculated by the system's policy engine. Its value is based on a comprehensive assessment of the data processing task's sensitivity level, data volume, and network environment risk index. A typical lifetime might be set as the time window required to process a single medical record stream, ranging from a few minutes to a few hours. After this period expires, the session will automatically become invalid.

[0039] The key negotiation process is implemented using elliptic curve cryptography. The system first initializes a temporary key pair generator at the medical data generation end. This generator uses an elliptic curve, such as secp256r1 or curve25519, and obtains an initial seed value from a cryptographically secure random number source. The generator calculates the multiplication operation of a base point G on the elliptic curve, mathematically expressed as: in: It is a private index generated by the data producer; it is an extremely large random integer. It is a recognized generating point on an elliptic curve. This is the calculated public key point. The data generator will use the public key... Along with the encryption policy identifier and suggested key lifespan, this information is sent to the medical data recipient through an initial authentication channel. The recipient then independently generates its own private key using the same elliptic curve parameters. and public key And perform the same dot product operation. Then The result is returned to the generating end. Both parties then use their own private keys and the public key sent by the other party to calculate the shared key: the generating end calculates... Receiver calculation According to the properties of elliptic curve cryptography, because ,therefore This shared secret It is used as the root key for subsequent symmetric encryption. The entire negotiation process takes place in a secure, isolated area in memory, and all intermediate key materials are erased immediately after use to prevent them from being stolen by malware.

[0040] The construction of real-time encrypted channel parameters is based on a shared key. Based on this, the system will The input key derivation function, such as an HMAC-based key derivation function, derives a set of subkeys for the actual encryption pipeline. These subkeys include a symmetric key for data encryption. An authentication key used for integrity verification. , and a generation key for initialization vectors. The encryption pipeline configuration parameters are ultimately encapsulated into a structure containing the symmetric encryption algorithm identifier, operating mode, authentication tag length, and key rotation trigger conditions. The key rotation interval is determined by the previously acquired key lifespan parameter. The system internally maintains a high-precision timer; when the duration of an active session reaches the rotation interval threshold, a key update transaction is automatically triggered. The update transaction does not involve a complete elliptic curve key exchange again; instead, it utilizes the current shared secret. As a foundation, new session key material is generated through a one-way function. This method significantly reduces computational overhead and communication latency while ensuring forward security. In the specific operation of the encryption pipeline, the original medical record stream is divided into appropriately sized data blocks. Each data block undergoes field-level anonymization and streaming encryption operations in parallel. The field-level anonymization operations are strictly performed according to the aforementioned anonymization processing strategy, such as hashing identifier fields and masking diagnostic codes. These operations are performed in the plaintext state of the data block. Subsequently, the processed data blocks are sent to the encryption module, which uses a derived symmetric key. and by The generated unique initialization vector uses an authenticated encryption mode to encrypt the data block and calculate the authentication tag. This dual processing mechanism ensures that the data is both de-identified in terms of content and protected in terms of confidentiality and integrity of the transmission channel when it leaves the generating end.

[0041] The generated dual-processed binary data blocks are then appended with metadata headers and assembled into complete intermediate medical record data packets. The metadata header design includes several key fields: an anonymization rule version number indicates the version of the anonymization strategy applied to the data block, facilitating correct parsing at the receiving end; a data sequence number ensures packet order and prevents replay attacks; a timestamp records the packet's generation time; and a cryptographic hash value is used for quick verification of packet integrity. The assembly process follows a network transmission protocol format to ensure compatibility with various medical information systems. Finally, the system applies a lightweight digest algorithm, such as BLAKE2s or truncatedSHA-256, to the entire data packet to generate a short integrity signature, which is transmitted along with the data packet. Before packet transmission, the generating end performs a local signature verification, simulating the receiving end's verification behavior. Any abnormal data packets with failed signature verification are immediately discarded, and an error log is generated, triggering a possible reprocessing process, thereby minimizing the entry of defective data into the transmission stage.

[0042] Example 4: After receiving the intermediate medical record data packet from the transmission channel, the system first decapsulates and performs preliminary verification. After confirming the data packet structure is complete and the signature is valid, it begins parsing the metadata header carried within. The metadata header is typically located at the beginning of the data packet and is encoded in TLV format. The parser first reads the de-identification rule version number, which is a hash value or sequence number used to precisely match a specific snapshot of the dynamic de-identification rule library used by the generating end. The system maintains a version number mapping table; querying this table allows locating the specific content of the rule, including which fields were processed and what de-identification algorithm was used. Next, the parser extracts field processing type tags. These tags record the de-identification operation category each field underwent in the form of a bitmap or list, such as "full pseudonymization," "partial masking," or "semantic generalization." The parsed metadata information is passed to the access control engine, which parses the role identifier based on the user's identity credentials (such as a digital certificate or security token) of the currently requesting data. The role identifier is matched against a centralized role permission matrix, which is a dynamically updated access policy library. For example, in a clinical research scenario, there might be different roles such as "principal investigator," "statistical analyst," and "auditor." The matrix precisely defines the whitelist of fields that each role is allowed to access, as well as the corresponding data aggregation granularity level. The determination of whitelisted fields is based not only on field names but also on the clinical sensitivity of the data and the necessity for the research objective. For example, a "principal investigator" might be allowed to access precise age and laboratory indicators, while a "statistical analyst" might only be allowed to access age groups and the average values ​​of indicators. The aggregation granularity level defines the level of detail in the data aggregation, such as "individual level," "department level," or "institutional level."

[0043] The system combines the parsed whitelist fields with the aggregation granularity level to generate a set of differential privacy noise pool query conditions for this data access request. The query conditions are a structured request object containing the data field type, the desired aggregation level, and the privacy protection parameter ε value allocated by the privacy budget management module for this query. The differential privacy noise pool is a pre-configured noise parameter library, in which noise generator parameters conforming to a Laplace or Gaussian distribution are pre-calculated for different types of numerical fields and aggregation levels. Based on the field type and aggregation level in the query conditions, the noise pool returns the corresponding noise scale parameter b. This parameter directly determines the amount of noise added to the data; the coarser the aggregation level (e.g., institutional level), the larger the corresponding b value, and the greater the added noise to provide stronger privacy protection. Refer to Table 1, a simplified role-permission mapping table, to show the differences in access permissions for different roles to fields in the same intermediate medical record.

[0044] Table 1: Role Permission Mapping Table Based on parameters obtained from the noise pool, the system begins to statistically perturb the whitelist fields in intermediate medical records. For numerical data, such as laboratory test results and vital sign measurements, the system applies a noise offset that matches its aggregation granularity. Specifically, for each value to be published, a random noise following a Laplace distribution is generated, with the noise scale determined by parameter b. For example, a patient's blood glucose level is 6.2 mmol / L. At the individual level, a smaller noise (such as sampling a value of -0.1 from the Laplace distribution) might be added, resulting in a published value of 6.1 mmol / L; while at the department level, a larger noise (such as +0.3) might be added, resulting in a published value of 6.5 mmol / L. This process ensures the privacy of individual records while maintaining the statistical utility of the data at different aggregation levels. For non-numerical data, such as diagnostic descriptions and surgical names, the system performs a k-anonymity-based generalization operation. The generalization process relies on a predefined medical knowledge ontology tree structure, elevating specific diagnostic codes or descriptions to a more general level. For example, a specific diagnostic code "I21.0 Acute anterior wall myocardial infarction" might be generalized to "I21 Acute Myocardial Infarction," or further generalized to "I20-I25 Ischemic Heart Disease." The system checks whether the generalized category contains at least k records in the current dataset (k is usually set to 5, 10, etc.). If the k-anonymity requirement is not met, the system continues to generalize upwards until the condition is satisfied. This process ensures that no single record can be associated with a small number of specific individuals.

[0045] See Figure 4 This chart is a key performance monitoring visualization in the medical data privacy protection system. It employs a dual-chart composite structure to comprehensively reflect the system's operational status. The upper sub-chart uses a dual Y-axis design to display core system performance indicators. The left vertical axis represents throughput, monitoring the system's data processing capacity per unit time; the right vertical axis corresponds to processing time, tracking the processing efficiency of a single record. Simultaneous analysis of the two trend lines allows for timely identification of performance bottlenecks. When throughput decreases while processing time increases, it indicates potential resource strain or abnormal processing logic. The lower sub-chart uses a bar chart to detail the frequency of various errors. The horizontal axis indicates the specific error type, and the vertical axis displays the number of errors. The chart clearly shows the percentage occurrence rate of each error type, providing a precise quantitative display and clear direction for system optimization. By comparing the frequency of different error types, the operations team can prioritize handling high-frequency errors, improving system stability. This monitoring mechanism provides crucial data support for the continuous optimization and stable operation of the medical data privacy protection system.

[0046] Example 5: After completing the statistical feature perturbation, the system generates a temporary perturbation result set. This result set must undergo independent data integrity verification before being officially released to end users to ensure that the data has not been accidentally tampered with or damaged during the perturbation process. The verification process employs a secure multi-party computation protocol, which allows multiple untrusted verification nodes to collaborate and jointly determine the correctness of the data processing results without exposing the original data content. The system first treats the perturbation result set as a secret to be verified and uses a secret-sharing algorithm to split it into multiple secret shares. The splitting process typically employs the Shamir secret-sharing scheme, which uses polynomial interpolation to divide the data into multiple fragments. Each fragment itself does not contain complete information; only by collecting a sufficient number of fragments can the original data be recovered. The secret share distribution strategy is based on a predefined verification node network topology. Verification nodes can be different security servers within the organization or computation nodes from certified external partners. Each node is assigned a unique secret share and a computational circuit description file required to perform the verification task. The system ensures that multiple shares of the same dataset are distributed to different physically or logically isolated nodes to prevent collusion attacks. Upon receiving the secret share, each verification node initiates local computation based on the obfuscated circuit protocol. Obfuscated circuits are a technique that transforms verification logic into encrypted Boolean circuits. In the encrypted state, the node performs a predefined consistency comparison operation on the share. The core of the comparison operation is to verify whether the perturbed data still retains the necessary statistical properties and logical consistency with the original dataset. For example, it checks whether the age field is still within a reasonable range, whether the diagnostic code conforms to the coding rules, and whether the statistical distribution of the numerical field matches the added noise model.

[0047] Communication between verification nodes is conducted through a secure channel. All interactive messages are encrypted and authenticated. During computation, nodes cannot infer the share content of other nodes from their own shares, nor can they obtain the complete dataset. After completing local computation, each node outputs a partial judgment result regarding data integrity, which is itself an encrypted commitment. When more than a preset threshold of verification nodes return consistent confirmation signals, the coordinator node determines that the data integrity verification has passed. This threshold is typically set to two-thirds or higher of the total number of nodes to tolerate the failure or malicious behavior of a minority of nodes. Once verification is successful, the system triggers a secret share reorganization process. Authorized nodes send their respective shares to a designated reorganization server, which uses a Lagrange interpolation algorithm to recover the complete, verified final anonymized medical dataset. If verification fails, the system discards the perturbation results of the current batch, records a security event log, and may retrospectively examine previous processing steps. Simultaneously with the generation of the final anonymized medical dataset, the system initiates a traceable watermark embedding process. The watermark information includes a unique identifier for the data recipient and the dataset's usage period information. The recipient identifier can be the hash value of its digital certificate or the organization code, while the usage period defines the start and end points of the time when data access is permitted. The watermark embedding algorithm employs robust techniques. For structured data, the watermark information may be converted into a binary bitstream and embedded by slightly adjusting the least significant bit of numerical data or making minor perturbations to the encoding of categorical data. For unstructured text reports, it may be implemented using steganography techniques such as adjusting word spacing and synonym substitution. The embedding process strictly controls the watermark strength to ensure it is imperceptible and does not affect the analytical and usability value of the data.

[0048] The watermark detection module is integrated into the data access interface. When any user or system attempts to access the final anonymized medical dataset, the backend first attempts to extract the embedded watermark information. The extracted recipient identifier is compared with the current visitor's identity. If the identifiers do not match, the access request is immediately rejected and a security alert is generated. The system continuously monitors the relationship between the current time and the usage period information of the watermark. When the clock exceeds the end of the usage period, a data destruction command is automatically triggered. The specific execution method of the destruction command depends on the storage location and format of the data. For records stored in a database, a secure erase command may be executed, using random data to overwrite the original storage area multiple times. For datasets in file format, a secure deletion is executed, and the link pointers in the operating system are cleared. In a cloud storage environment, the storage service provider is also notified to revoke the corresponding access token. Each watermark verification, data access, or destruction event triggers the audit log recording function. The log entries record the event type, timestamp, operation subject, data identifier, and event result in detail. The audit log is sent to a secure log management server in real time, using an append-only storage format and calculating a cryptographic hash chain to prevent subsequent tampering. System administrators can periodically review these logs, monitor data usage compliance, and conduct retrospective analysis in the event of security incidents. Through the tight integration of watermarking and integrity verification, medical data remains under control at the end of its lifecycle, achieving end-to-end privacy protection and security management from generation to destruction. This design ensures that data sharing meets research and application needs while strictly adhering to the principles of data minimization and purpose limitation.

[0049] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus.

[0050] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. An end-to-end based medical record privacy data elimination method, characterized in that, Comprise: Obtaining an original medical record stream at a medical data generation end, identifying a privacy field type in the original medical record stream and extracting field boundary features; Calling a preset dynamic de-identification rule library according to the privacy field type to generate an anonymization processing strategy matched with the field boundary features; Performing key negotiation on session parameters in the anonymization processing strategy by using an asymmetric encryption algorithm to obtain real-time encryption channel parameters; Inputting the original medical record stream into an encryption pipeline corresponding to the real-time encryption channel parameters to output an intermediate medical record carrying a dynamic de-identification identifier; Analyzing the dynamic de-identification identifier in the intermediate medical record at a medical data receiving end, and reconstructing a data access range based on a role permission matrix; Selecting noise injection parameters from a differential privacy noise pool according to the data access range to perform statistical feature perturbation on the intermediate medical record; Verifying the data integrity of the perturbed medical record through a secure multi-party computation protocol to generate a final available anonymized medical data set.

2. The end-to-end based medical record privacy data elimination method of claim 1, wherein, Identifying the privacy field type in the original medical record stream and extracting the field boundary features, comprising: Performing multi-modal feature scanning on the original medical record stream to separate structured data blocks and unstructured text streams; Locating patient identifier fields and diagnosis and treatment code fields in the structured data blocks, and recording the starting offset and length attributes of the fields; Matching preset sensitive keyword patterns in the unstructured text stream to capture triad position information of the keyword context; Combining the starting offset, length attribute and triad position information of the fields into a field boundary feature set.

3. The end-to-end based medical record privacy data elimination method of claim 2, wherein, Generating an anonymization processing strategy matched with the field boundary features, comprising: According to the field type index in the field boundary feature set, loading corresponding hash replacement rules and mask generation templates from the dynamic de-identification rule library; Performing segmented hash operation on the patient identifier field to generate a pseudonym identifier in a reserved format; Applying bit replacement operation in the mask generation template to the diagnosis and treatment code field to generate a de-identified diagnosis and treatment code; Inputting the triad position information of the sensitive keyword context into a semantic confusion model to generate a context-preserved replacement text segment.

4. The end-to-end based medical record privacy data elimination method of claim 3, wherein, Performing key negotiation on session parameters in the anonymization processing strategy by using an asymmetric encryption algorithm, comprising: Extracting the encryption strategy identifier and key lifetime parameters of the current session from the dynamic de-identification rule library; Generating a temporary public key pair through an elliptic curve key exchange protocol, and encoding the public key pair into encryption pipeline configuration parameters; Setting a session key rotation interval according to the key lifetime parameters, and triggering a key update transaction when the rotation interval is reached.

5. The end-to-end based medical record privacy data elimination method of claim 4, wherein, Outputting an intermediate medical record carrying a dynamic de-identification identifier, comprising: Performing field-level anonymization operations and stream encryption operations in parallel in the encryption pipeline to generate double-processed binary data blocks; Appending a metadata header containing a de-identification rule version number to each binary data block to assemble into an intermediate medical record data packet; Verifying the integrity signature of the data packet through a lightweight digest algorithm, and discarding abnormal data packets that fail the signature verification.

6. The end-to-end based medical record privacy data elimination method of claim 5, wherein, Reconstructing a data access range based on a role permission matrix, comprising: Analyzing the metadata header in the intermediate medical record data packet to extract the de-identification rule version number and field processing type marker; According to the role identifier of the receiving end user, the permission matrix is queried to obtain a whitelist of accessible fields and an aggregation granularity level; The whitelist field and the aggregation granularity level are mapped into a query condition of a differential privacy noise pool.

7. The end-to-end based medical record privacy data elimination method of claim 6, wherein, Statistical feature perturbation is performed on the intermediate medical record, including: According to the query condition, a noise generator parameter conforming to a Laplace distribution is loaded from the differential privacy noise pool; A noise offset amount conforming to the aggregation granularity level is applied to the numerical data of the whitelist field; A k-anonymity-based generalization operation is performed on the non-numerical data to generate a perturbed result set satisfying a privacy budget constraint.

8. The end-to-end based medical record privacy data elimination method of claim 7, wherein, The data integrity of the perturbed medical record is verified through a secure multi-party computation protocol, including: The perturbed result set is split into multiple secret shares and distributed to verification nodes participating in the computation; Each verification node performs a consistency comparison operation on the secret shares based on a garbled circuit protocol; When more than a threshold number of verification nodes return a consistent confirmation, the secret shares are recombined to generate a final anonymous medical data set.

9. The end-to-end medical record privacy data elimination method of claim 8, wherein, Further comprising: A traceable watermark is embedded in the final anonymous medical data set, and the watermark contains data receiver identification and use period information; When it is detected that the watermark identifier exceeds the use period, a data destruction instruction is automatically triggered and an audit log record is generated.

10. An end-to-end based medical record privacy data elimination system comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that, The processor, when executing the computer program, implements the steps of the end-to-end medical record privacy data elimination method according to any one of claims 1 to 9.

Images