Minimum evidence access control method and system for clinical psychological counseling data

Abstract

The present application discloses a minimum evidence access control method and system for clinical psychological interview data, relates to the technical field of medical data security, and comprises the following steps: differentiating desensitization of layered original psychological interview data based on a hierarchical desensitization strategy to obtain desensitized interview data; a binding relationship between analysis conclusions and the minimum time interval supporting the analysis conclusions in the desensitized interview data is established; in response to a user evidence verification request, an access condition judgment is performed, and if the access condition is met, data directly corresponding to the target conclusion to be verified is extracted from the desensitized interview data according to the binding relationship to generate a minimum necessary evidence segment; the minimum necessary evidence segment is locally desensitized, and the desensitized minimum necessary evidence segment is displayed under control. When the access condition is met, the minimum segment directly corresponding to the target conclusion is accessed, and the data security and access efficiency in the access process are considered.

Description

Technical Field

[0001] This application relates to the field of medical data security technology, specifically to a method and system for minimum evidence access control of clinical psychological interview data. Background Technology

[0002] Compared to ordinary meetings and customer service calls, clinical psychological consultations have a stronger need for process, interactivity, and clinical interpretation. Conversation recordings, structured segments, and analytical conclusions typically contain highly sensitive content such as patient personal information, traumatic experiences, symptom expressions, and risk cues. The secure protection and compliant use of this data directly impacts the privacy rights of visitors and the legal responsibilities of institutions. Current technologies primarily rely on encrypted storage, standardized anonymization, and role-based access control to protect consultation data. However, they do not consider the binding relationship between analytical conclusions and supporting evidence. Reviewers often need to examine a large amount of irrelevant original content when verifying a conclusion. Audio playback is usually done in whole sessions or in long segments, which is inefficient and easily exceeds the minimum necessary informed consent. Although role-based access control allows different roles to access different consultation records, this control is limited to the file or consultation level. In the specific context of clinical consultation data, it is difficult to dynamically adjust based on conclusion type, risk status, evidence sensitivity, and user role, and it cannot achieve fine-grained control over the visibility of different conclusions within the same consultation to different roles. Furthermore, in practical applications, the protection of clinical interview data also faces the challenge of balancing privacy protection and conclusion verification: while uniform desensitization reduces the exposure of sensitive information, excessive desensitization weakens verification capabilities, while full disclosure increases privacy risks.

[0003] The patent "A Role-Based Access Control System and Method for Hierarchical Classification and De-identification of Medical Data" (publication number CN121808821A) proposes to perform differentiated de-identification based on the mapping relationship between sensitivity level and de-identification strategy, construct an attribute encryption strategy space according to sensitivity level, and implement access control through ABE encryption, allowing only authorized users to access the corresponding data. However, this solution only performs hierarchical classification, de-identification, and access control on the original medical data itself. It cannot achieve direct jump from a single analysis conclusion to the corresponding original evidence fragment. Reviewers still need to manually search and match in a large amount of original content, and it cannot achieve the fine-grained control of granting access to only the evidence fragment corresponding to a certain conclusion while maintaining a high level of protection for the rest of the content. Summary of the Invention

[0004] This application addresses the problem that existing data security processing technologies suffer from overly coarse-grained access control and a lack of mapping between conclusions and evidence fragments, resulting in an inability to balance data security and access efficiency in access control of clinical psychological interview data. It proposes a minimum evidence access control method and system for clinical psychological interview data. By establishing a binding relationship between conclusions and evidence, combined with a minimum necessary evidence fragment generation mechanism and secondary desensitization of the minimum evidence fragments, the method effectively controls the exposure scope of sensitive information, preserving the verifiability of analytical conclusions while protecting privacy, thus balancing data security and access efficiency.

[0005] To achieve the above objectives, the technical solutions adopted in the embodiments of this application are as follows: In a first aspect, embodiments of this application provide a minimal evidence access control method for clinical psychological interview data, the method comprising: Based on a tiered anonymization strategy, differentiated anonymization is performed on the original psychological interview data in layers to obtain anonymized interview data; a binding relationship is established between the analysis conclusions and the minimum time intervals supporting the analysis conclusions in the anonymized interview data; in response to user evidence verification requests, access condition judgment is performed, and if the access conditions are met, data directly corresponding to the target conclusion to be verified is extracted from the anonymized interview data according to the binding relationship to generate minimum necessary evidence fragments; the minimum necessary evidence fragments are partially anonymized, and the anonymized minimum necessary evidence fragments are displayed in a controlled manner.

[0006] Optionally, the step of differentially desensitizing the layered original psychological interview data based on a hierarchical desensitization strategy to obtain desensitized interview data includes: dividing the original psychological interview data into an audio layer, a text layer, a structured layer, a conclusion layer, and an evidence layer; configuring corresponding basic visibility permissions and sensitivity levels for each layer of data; and performing data desensitization on each layer of data based on a hierarchical desensitization strategy corresponding to the basic visibility permissions and sensitivity levels to obtain desensitized interview data. Specifically, key data entities and entity relationships in the text layer are masked and blurred; pseudo-identifiers are generated for role entities in the structured layer; entity recognition and template rewriting are performed on the conclusion text in the conclusion layer, and personal identity information is removed; and sensitive content is identified and partially desensitized in the evidence layer.

[0007] Optionally, establishing the binding relationship between the analytical conclusions and the minimum time intervals supporting the analytical conclusions in the desensitized interview data includes: determining key conclusions based on the criticality score of each analytical conclusion in the conclusion layer; retrieving and matching corresponding discourse units based on the key conclusion ID, and using them as candidate evidence units; calculating the correlation between candidate evidence units and key conclusions, and using candidate evidence units with a correlation exceeding a preset threshold as directly supporting evidence units; merging the time intervals of all directly supporting evidence units, verifying the transcribed text of the merged intervals through the text content of the text layer, and if the transcribed text corresponds one-to-one with the text content of the text layer, then using the merged interval as the minimum time interval supporting the analytical conclusions; and establishing an index table of key conclusions and the minimum time intervals supporting the analytical conclusions to obtain the binding relationship.

[0008] Optionally, determining key conclusions based on the criticality score of each analytical conclusion in the conclusion layer includes: obtaining a criticality score for each analytical conclusion in the conclusion layer based on the sum of the conclusion type feature value, risk level feature value, evidence sensitivity level feature value, and decision impact degree feature value; and taking analytical conclusions with criticality scores greater than or equal to the scoring threshold as key conclusions.

[0009] Optionally, the step of merging the time intervals of all directly supporting evidence units and verifying the transcribed text of the merged intervals through the text content of the text layer includes: arranging the timestamps of all directly supporting evidence units in ascending order of audio start time; if the audio start time of the current directly supporting evidence unit is less than or equal to the sum of the audio end time of the previous merged interval and the preset allowed merge interval, then merging the timestamps of the two directly supporting evidence units into a continuous time interval; if the audio start time of the current directly supporting evidence unit is greater than the sum of the audio end time of the previous merged interval and the preset allowed merge interval, then stopping the current merging; for the continuous time blocks after merging, adding preset forward and backward time windows within the time constraints of the session unit to complete the contextual semantics of the merged interval; comparing the transcribed text of the semantically completed merged interval with the corresponding full-text transcript in the text layer word by word, and if the texts correspond one-to-one, then the verification is passed.

[0010] Optionally, the step of responding to a user evidence verification request and performing access condition judgment includes: parsing the user evidence verification request data and encapsulating it into an access judgment object package, wherein the access judgment object package includes at least the user role, role permissions, target conclusion field and request purpose; performing access condition judgments on basic conditions, blocking conditions, permission upgrade requirement conditions and additional access obligations in sequence according to the access judgment object package; when each access condition is met, access is allowed and an access judgment decision result is generated.

[0011] Optionally, the step of extracting data directly corresponding to the target conclusion to be verified from the anonymized interview data according to the binding relationship and generating the minimum necessary evidence fragment includes: extracting the ID of the target conclusion to be verified and the ID of the evidence fragment authorized to be viewed by the user based on the access decision result; retrieving all corresponding index records from the index table of the analysis conclusion and the minimum time interval supporting the analysis conclusion according to the ID of the target conclusion to be verified and the ID of the evidence fragment, each index record including at least the ID of the evidence fragment, the discourse unit, and the start and end times of the audio; retrieving the target text segment corresponding to the evidence fragment from the full text transcript of the anonymized interview data based on the index records; sorting the audio segments corresponding to all the index records by time, merging the time intervals that overlap or are adjacent, and normalizing the start and end times of each merged audio to the boundary of the discourse unit with the nearest time to obtain the target audio segment; performing semantic integrity verification on the target text segment and the target audio segment to construct the minimum necessary evidence fragment.

[0012] Optionally, the step of performing semantic integrity verification on the target text segment and the target audio segment to construct the minimum necessary evidence fragment includes: performing sentence boundary integrity check and boundary expansion on the target text segment; if the expanded text segment does not match the target audio segment, adjusting the boundary of the target audio segment based on the expanded boundary of the text segment; detecting speaker role continuity based on the arrangement order of each discourse unit within the target audio segment; if speaker conversation is detected to be truncated, retrieving and completing the data from the structured layer of the desensitized meeting data in chronological order, and synchronously updating the boundary of the target text segment; querying and determining whether the evidence fragment after boundary adjustment of the target text segment and the target audio segment is completely within the topic range based on the topic segment ID to which the current evidence fragment belongs; if the evidence fragment exceeds the topic range, truncating the excess part to obtain the minimum necessary evidence fragment.

[0013] Optionally, the step of partially anonymizing the minimum necessary evidence fragments and then displaying the anonymized minimum necessary evidence fragments in a controlled manner includes: identifying sensitive fields in the minimum necessary evidence fragments that are not directly related to the target conclusion to be verified, and partially anonymizing them; and then displaying the anonymized minimum necessary evidence fragments in a controlled manner, wherein, for text evidence, it is displayed to the user and copying and full-text export are restricted; for audio evidence, a fragment-level playback token is generated that includes at least the number of playbacks, the visible time interval, the audio validity period, and download permissions, and the user's audio listening behavior is constrained based on the fragment-level playback token.

[0014] Secondly, embodiments of this application provide a minimal evidence access control system for clinical psychological interview data, including: The data anonymization module is used to perform differentiated anonymization on the stratified original psychological interview data based on a hierarchical anonymization strategy to obtain anonymized interview data; the conversation unit module is used to establish the binding relationship between the analysis conclusion and the minimum time interval supporting the analysis conclusion in the anonymized interview data; the conclusion evidence module is used to respond to user evidence verification requests, perform access condition judgment, and if the access conditions are met, extract data directly corresponding to the target conclusion to be verified from the anonymized interview data according to the binding relationship to generate the minimum necessary evidence fragment; the evidence display module is used to perform partial anonymization on the minimum necessary evidence fragment and display the anonymized minimum necessary evidence fragment in a controlled manner.

[0015] The beneficial effects of this application are: 1. By constructing a minimum time interval binding index for conclusions and supporting evidence, reviewers only need to examine evidence fragments directly related to specific analytical conclusions, improving verification efficiency. Because the binding index ensures the dual integrity of evidence fragments in both the temporal and semantic dimensions through minimum time interval merging and boundary regularization during its creation, the extracted evidence fragments neither lose the necessary contextual information due to truncation nor introduce irrelevant content due to excessively wide boundaries. This achieves precise control over the scope of evidence exposure while improving review efficiency. Furthermore, the synergy between the binding index and differentiated desensitization strategies minimizes the exposure of sensitive data while ensuring the integrity of clinical verification functions, providing a data foundation that balances security and usability for subsequent access control and minimum fragment extraction. 2. By further identifying sensitive fields that are not directly related to the verification of the target conclusion after the minimum necessary evidence fragment is generated, and performing local secondary desensitization, the final displayed content retains the key information required for verification while removing unnecessary personal identification, contact information, or third-party information. This avoids the problem of coarse granularity in unified desensitization schemes, which can mask sensitive entities at the full text level but cannot retain the necessary context as needed for specific verification scenarios. Furthermore, controlled display is performed on the minimum evidence fragment, ensuring that sensitive evidence remains under control throughout the entire chain from data extraction to user presentation, thus guaranteeing data security throughout the entire access process. 3. By constructing a progressive, multi-layered access control architecture that includes basic condition verification, blocking condition adjudication, permission escalation requirement determination, and additional access obligation execution, we have solved the problem that conventional access control remains at the file or meeting level and cannot be dynamically adjusted in fine granularity according to the type of conclusion, risk status, and sensitivity of evidence. This results in a disconnect between access control and data extraction, which weakens the security policy during the execution phase. We have achieved full-cycle security protection from permission determination to data presentation. Attached Figure Description

[0016] Other features, objects, and advantages of this application will become more apparent from the following detailed description of non-limiting embodiments with reference to the accompanying drawings. The drawings are for illustrative purposes only and are not intended to limit the scope of this application. Furthermore, the same reference numerals denote the same parts throughout the drawings.

[0017] Figure 1 This is a flowchart of the minimum evidence access control method for clinical psychological interview data according to an embodiment of this application; Figure 2 This is a schematic diagram of an access condition judgment process according to an embodiment of this application; Figure 3 This is a schematic diagram illustrating a process for generating the minimum necessary evidence fragment according to an embodiment of this application. Detailed Implementation

[0018] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description of this application is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely one preferred embodiment of this application and are only used to explain this application. They do not limit the scope of protection of this application. All other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0019] Example 1: As Figure 1 As shown, a minimal evidence access control method for clinical psychological interview data includes steps S1-S4, wherein: S1. Based on a graded desensitization strategy, differentiated desensitization is performed on the original psychological interview data in layers to obtain desensitized interview data.

[0020] Specifically, step S1 includes: S11. Divide the raw psychological interview data into audio layer, text layer, structured layer, conclusion layer and evidence layer, and configure the corresponding basic visibility permissions and sensitivity levels for each layer of data; S12. Based on the hierarchical desensitization strategy corresponding to the basic visibility permissions and sensitivity level configuration, perform data desensitization on data at each level to obtain desensitized meeting data; Specifically, key data entities and entity relationships in the text layer are masked and obscured; pseudo-identifiers are generated for role entities in the structured layer; entity recognition and template rewriting are performed on the conclusion text in the conclusion layer, and personal identity information is removed; and sensitive content is identified and partially desensitized in the evidence layer.

[0021] In some embodiments, psychological interview data is divided into the following five levels, with each level configured with different basic visibility permissions and anonymization levels, as shown in Table 1. Table 1 Data Layer and Basic Visibility Permission Settings ; It should be noted that a discourse unit refers to a discourse unit with a speaker, text content, and audio timestamp; a topic segment consists of multiple consecutive discourse units, encompassing both the text segment range and the corresponding audio start and end time interval. The structured layer mainly includes structured data processed from the original audio and transcripts, which is easy to calculate and index. The structured layer includes: discourse unit data, topic segment data, role and pseudo-identifier data, timeline data, risk or sentiment label data, and intermediate results of system analysis. Timeline data includes discourse order, pauses, overlapping speech, and periods of high sentiment. Intermediate results of system analysis include classification labels, confidence levels, evidence candidate labels, model version numbers, etc. The conclusion layer refers to the judgment or analysis results output by the system. The evidence layer refers to the minimum evidence bound to a conclusion and used to verify that conclusion, including summary conclusions, risk warnings, clinical conceptualizations, supervisory questions, ethical boundary warnings, intervention recommendations, etc. The evidence layer is determined by the minimum evidence object that forms a binding relationship with a conclusion; only conversation units, topic segments, text ranges, or audio time intervals cited by a specific conclusion are included in the evidence layer. Different levels are not all visible by default. Instead, sensitivity levels are assigned based on the default level of the level, the identified sensitive entities, the type of conclusion, the risk status, and the differences in manual annotation results. When multiple factors correspond to different sensitivity levels, the higher level is taken as the final sensitivity level.

[0022] Furthermore, the sensitivity levels of each data layer are as follows: the audio layer and text layer are highly sensitive, the conclusion layer is moderately sensitive, and the sensitivity level of the conclusion layer depends on the type of conclusion. For example, ordinary desensitized conclusions can be displayed according to roles, with a sensitivity level of low sensitivity. Conclusions related to risks, trauma, ethics, etc., need to be strictly controlled, with a sensitivity level of moderate or high sensitivity. The evidence layer is not directly visible by default and must be displayed after conclusion binding and permission judgment. The sensitivity level depends on the actual situation.

[0023] Furthermore, different data anonymization strategies are employed across different data layers. Entity masking, relation masking, temporal blurring, and geographic information blurring are applied to the text layer. Pseudo-identifiers are used for the structured layer; the conclusion layer displays anonymized conclusions by default; and the evidence layer preserves local anonymization rules and access levels.

[0024] In some examples, when using pseudo-identifiers on the structured layer, entity recognition is performed on the original verbatim transcript and structured data. The identified entities include visitors, counselors, family members, schools, workplaces, locations, contact information, and third-party personnel. An entity mapping record is established for each entity, and stable pseudo-identifiers are generated based on entity type, meeting identifier, case identifier, and key parameters. Alternatively, role-based pseudo-identifiers are generated based on the order in which entities appear within the same meeting. The mapping relationship between real entities and pseudo-identifiers is encrypted and stored separately, and only the pseudo-identifiers are displayed on the regular verification interface. For example, the visitor identifier is Visitor P001, the father identifier is Family Member A, and the school name identifier is School S001.

[0025] In some examples, when desensitizing the conclusion layer, the conclusion text undergoes template rewriting, entity masking, relation generalization, and time and location obfuscation. Specifically, named entity recognition is performed on the conclusion text, replacing names, schools, organizations, addresses, and contact information with pseudo-identifiers or generalized descriptions; specific dates are changed to relative times; precise locations are changed to regional or scene-level descriptions; psychological judgments or risk assessments directly related to conclusion verification are retained; and for high-risk conclusions, only a summary of the conclusion is displayed first, without directly showing the original evidence.

[0026] In some examples, when anonymizing evidence, sensitive segments in the evidence text are identified during the creation of evidence objects. It is determined whether each sensitive segment is necessary to verify the target conclusion, and corresponding anonymization rules are generated. The anonymized object corresponding to each rule includes at least the location of the sensitive segment, entity type, processing action, replacement value, necessity identifier, and required access level. Processing actions include masking, pseudo-identification, generalization, retention, and denial of display. The access level is determined based on the sensitivity level of the evidence, the type of conclusion, the risk status, and the purpose of the request. For example, for ordinary summary evidence, counselors can view the anonymized segments; for trauma-related evidence, only counselors and supervisors can view it; for audio evidence of self-injury risk, only supervisors or risk management personnel can play back the segments, and downloading is prohibited.

[0027] In this embodiment, by dividing the data into layers and configuring differentiated basic visibility permissions and sensitivity levels for each layer, the data at different levels can obtain protection granularity that matches their risk level, avoiding the loss of key information or the overprotection of low-sensitivity data due to uniform desensitization, which affects the efficiency of use. On this basis, targeted desensitization strategies are implemented for the data at each layer, so that the data at each layer can complete the desensitization processing that is appropriate to its own function and purpose, providing a data foundation that balances security and usability for subsequent conclusion-evidence binding and generation of minimum evidence fragments.

[0028] S2. Establish a binding relationship between the analysis conclusions and the minimum time interval in the desensitization interview data that supports the analysis conclusions.

[0029] It should be noted that when establishing binding relationships, the entire meeting or recording is not bound by default. Instead, the minimum time interval is selected based on the scope of the evidence text, the boundaries of discourse units, the boundaries of the topic paragraph, and the audio timestamp. If the conclusion is supported by a single discourse unit, the start and end times of that discourse unit are bound; if the conclusion is supported by multiple discourse units, multiple time intervals are bound separately; if the conclusion depends on the topic paragraph, the topic paragraph is used as the higher-level container, and the list of discourse units and text scopes that directly support the conclusion within the topic paragraph are recorded. To further ensure semantic integrity, preset context windows can be added before and after the minimum time interval.

[0030] Specifically, step S2 includes: S21. Determine key conclusions based on the criticality score of each analytical conclusion in the conclusion layer, retrieve and match the corresponding discourse units based on the key conclusion ID, and use them as candidate evidence units. S22. Calculate the correlation between candidate evidence units and key conclusions, and take candidate evidence units with a correlation exceeding a preset threshold as directly supporting evidence units. S23. Merge the time intervals of all directly supporting evidence units, and verify the transcribed text of the merged interval through the text content of the text layer. If the transcribed text corresponds one-to-one with the text content of the text layer, then the merged interval shall be used as the minimum time interval supporting the analysis conclusion. S24. Establish an index table of the minimum time intervals for key conclusions and supporting analysis conclusions to obtain the binding relationship.

[0031] Specifically, when calculating the relevance between candidate evidence units and key conclusions, a set of keywords is extracted from the key conclusion text. These keywords include, but are not limited to, core noun phrases, risk type terms, emotional state terms, and relational terms from the conclusion text. The extraction method combines word segmentation and part-of-speech tagging, retaining nouns, verbs, and adjectives as keywords. The extracted keywords are then matched with the transcribed text of the candidate evidence units. The matching method is as follows: for each keyword, a full-text search is performed across all transcribed texts of the candidate evidence units. Based on the initially matched candidate evidence units, short phrases composed of consecutive keywords are used to calculate text similarity with the transcribed texts of the candidate evidence units, thus obtaining the relevance between the candidate evidence units and the key conclusions.

[0032] In some embodiments, the index table stores index records for each key conclusion and its corresponding minimum time interval of evidence. Each index record includes at least the key conclusion ID, conclusion type, list of discourse units contained in the evidence, topic segment to which the evidence belongs, start time of the evidence audio, end time of the evidence audio, start character position of the evidence text, end character position of the evidence text, sensitivity level of the evidence, access level, list of local anonymization rules, and current meeting risk status. If a key conclusion is bound to multiple evidence fragments, the system generates an independent index record for each evidence fragment.

[0033] Furthermore, after the index records are stored, a bidirectional mapping is established. The first direction points from key conclusions to evidence. After the system updates the conclusion object, it adds an evidence identifier to its fields. This evidence identifier refers to the list of allowed evidence identifiers, i.e., the set of evidence fragment IDs that a user can be authorized to view. The system achieves a forward query from conclusion to evidence by recording the evidence list of all evidence objects bound to this conclusion. The second direction points from evidence to key conclusions. After the system updates the evidence object, it adds a key conclusion identifier to its fields. Subsequent retrieval records the list of key conclusion IDs of all conclusions referencing this evidence, achieving a reverse tracing from evidence to conclusion.

[0034] It's important to note that in the data storage structure, the index table doesn't store the anonymized text itself, nor the original text. Instead, it stores the coordinates pointing to the original structured layer. Specifically, the fields in the index table point to the specific discourse unit ID, topic segment ID, precise millisecond timestamps in the original audio stream, and absolute character start and end positions in the original transcript within the original structured layer. Because IDs and timestamps themselves don't carry privacy information, the coordinates are stored instead of the original text. Furthermore, only with precise original coordinates can the correct waveform range be segmented when generating audio playback tokens, and boundaries be accurately located during full-text search. If only the anonymized text were stored, the anonymization operation would alter the text length, causing character coordinates to become completely disordered and unable to align with the original audio. When the index table runs, the actual object extracted is the anonymized meeting data read using the pointed-to position coordinates, ensuring memory safety. For example, after a user passes access verification, the system uses the absolute character start and end positions in the original transcript in the index table to extract the corresponding text substring from the full-text transcript of the anonymized meeting data.

[0035] In this embodiment, key conclusions are selected using criticality scores, avoiding unnecessary computational and storage overhead from building a full index. For key conclusions, corresponding discourse units are retrieved and matched as candidate evidence, and relevance is further calculated to select directly supporting evidence, ensuring the accuracy of the binding relationship. By merging the time intervals of directly supporting evidence and performing text verification, the data integrity of directly supporting evidence is further guaranteed, ensuring the accuracy and effectiveness of the index table. Simultaneously, through the binding relationship between conclusions and supporting evidence, the verification of relevant conclusions can be completed without reviewing all original meeting content, significantly improving the efficiency of conclusion verification while also addressing data security issues.

[0036] Specifically, in step S21, key conclusions are determined based on the criticality score of each analytical conclusion in the conclusion layer, including: For each analytical conclusion in the conclusion layer, a key score is obtained based on the sum of the conclusion type characteristic value, risk level characteristic value, evidence sensitivity level characteristic value, and decision impact degree characteristic value. The analytical conclusions where the critical scores are greater than or equal to the scoring threshold are considered critical conclusions.

[0037] Specifically, key conclusions refer to analytical conclusions that will affect subsequent manual review, risk management, clinical judgment, supervision and quality control, ethical judgment, or case management. Key conclusions include, but are not limited to, risk warning conclusions, conclusions related to trauma or highly sensitive experiences, conclusions affecting clinical conceptualization or intervention plans, conclusions requiring review by supervisors or quality control personnel, conclusions with low confidence but high risk, conclusions related to ethical boundaries, complaints, and accountability, and conclusions manually marked as requiring verification. Non-key conclusions typically include general topic summaries, descriptions of non-sensitive interview procedures, auxiliary labels that do not affect risk assessment or intervention decisions, and low-risk statistical information that does not require evidence verification.

[0038] In some embodiments, the conclusion type feature value is determined based on the conclusion type of each analytical conclusion in the conclusion layer. The conclusion types include at least risk warning conclusions, clinical conceptualization conclusions, supervision problem conclusions, intervention establishment conclusions, and summary conclusions. Each conclusion type corresponds to a feature value to reflect the inherent importance of that type of conclusion in the psychointerview analysis. If a conclusion belongs to multiple types, such as a conclusion that is both a risk warning and a clinical conceptualization, the highest type feature value is taken. Risk level characteristic values ​​are determined based on the risk status of the analysis conclusions. Risk levels include extremely high risk, high risk, medium-high risk, medium risk, low risk, and no risk. Each risk level corresponds to a characteristic value, and the value of the characteristic value decreases from high to low according to the risk level. The sensitivity level of evidence is determined based on the sensitivity level of the analysis conclusions. The sensitivity levels include high sensitivity, medium sensitivity, and low sensitivity. Each sensitivity level corresponds to a characteristic value, and the characteristic value decreases from high to low. The criteria for determining the sensitivity level of evidence include: whether the evidence contains personal identification information, details of traumatic experiences, information that can be identified by a third party, and specific descriptions of risky behaviors. The decision impact level characteristic value is determined based on the type and content of the analysis conclusion to assess its influence on clinical decision-making, and the corresponding characteristic value is obtained. The decision impact level is divided into three levels, with the specific judgment rules as follows: High decision impact: The conclusion involves safety risk management decisions, such as whether emergency intervention is needed, whether hospitalization referral is needed, whether crisis contingency plans need to be activated, ethical violation judgments, major adjustments to treatment direction, etc.; Medium decision impact: The conclusion involves adjustments to treatment plans, judgments of supervision needs, changes to follow-up plans, etc.; Low decision impact: The conclusion involves summaries of interview content, general observation descriptions, non-critical information records, etc. Each decision impact level corresponds to a characteristic value. For example, risk warning conclusions are defaulted to high decision impact with a characteristic value of 0.9; clinical conceptualization conclusions are defaulted to medium decision impact with a characteristic value of 0.6; and summary conclusions are defaulted to low decision impact with a characteristic value of 0.3. All of the above feature values ​​are preset based on expert experience, and the feature values ​​of each dimension are adjusted according to the application scenarios of different key conclusions, such as clinical scenarios, scientific research scenarios, and quality control scenarios.

[0039] In some possible embodiments, the feature values ​​affecting the criticality score also include conclusion confidence feature values ​​and manually labeled feature values. The conclusion confidence feature value is the confidence score of the conclusion generated by the AI ​​model; for example, if the model confidence score of a conclusion is 0.92, the corresponding feature value is 0.92. For manually entered conclusions not generated by the model, the feature value is set to a default medium confidence value. Manual labeling refers to the markings added to the conclusion by consultants, supervisors, or quality control personnel during the review process, including but not limited to markings such as "requires verification," "questionable," "conclusion of key concern," and "reviewed and approved," each marking corresponding to a feature value. The AI ​​model is an intelligent agent trained using historical meeting data to intelligently analyze and manage meeting data.

[0040] Furthermore, the above feature values ​​are summed to obtain a criticality score. When the criticality score exceeds a threshold, it is marked as a critical conclusion, and a conclusion-evidence binding index is forcibly established to generate an index table.

[0041] In this embodiment, key scores are obtained by considering multi-dimensional feature values. This ensures that the judgment results of key conclusions reflect both the inherent importance of the conclusions themselves and their urgency and sensitivity, avoiding misjudgments caused by single-dimensional judgments. It also ensures that the system can prioritize the allocation of limited index storage and retrieval computing resources to key conclusions that truly need verification, avoiding the waste of resources and decreased retrieval efficiency caused by creating a full index. Specifically, evidence sensitivity level feature values ​​are introduced, so that highly sensitive evidence is proactively included in the controlled access system before any access requests are triggered. By forcibly creating a binding index, it is bound to an auditable access control link, achieving proactive control of sensitive data security. This overcomes the waste of storage and retrieval resources in the full index mode and the security deficiencies caused by highly sensitive evidence remaining in a default visible state in non-essential scenarios under the full-access mode.

[0042] Specifically, in step S22, the discourse units corresponding to the key conclusion IDs are retrieved and matched, and these units are used as candidate evidence units, including: The system determines whether the key conclusion contains a supporting evidence citation field output by the model when generating the conclusion. This field is recorded by the model during the reasoning process and includes the discourse unit ID or topic segment ID on which the model based its conclusion. If the field exists and is not empty, the discourse units or topic segments corresponding to these IDs are used as candidate evidence sources, i.e., candidate evidence units. If the key conclusion does not contain a supporting evidence citation field or the field is empty, a keyword localization and matching method is used to extract a set of keywords from the conclusion text. Keywords include: core noun phrases, risk type words, emotional state words, and interpersonal relationship words in the conclusion text. The extraction method combines word segmentation and part-of-speech tagging, retaining nouns, verbs, and adjectives as candidate keywords. The extracted keywords are matched with the transcribed text of all discourse units in the current conversation. The search results are sorted according to the number of keywords matched in each discourse unit from high to low, and the discourse units with the top N number of matched keywords are selected as candidate evidence units.

[0043] Specifically, in step S23, the time intervals of all directly supporting evidence units are merged, and the transcribed text of the merged intervals is verified through the text content of the text layer, including: Arrange all timestamps of directly supporting evidence units in ascending order of audio start time; If the audio start time of the current directly supporting evidence unit is less than or equal to the sum of the audio end time of the previous merged interval and the preset merge allowable interval, then the timestamps of the two directly supporting evidence units will be merged into a continuous time interval. If the audio start time of the current directly supporting evidence unit is greater than the sum of the audio end time of the previous merged interval and the preset merge allowable interval, then the current merge is stopped. For consecutive time blocks after merging, a preset forward time window and a backward time window are added within the session unit time constraint to complete the contextual semantics of the merged interval. The transcribed text of the semantically completed merged interval is compared word by word with the corresponding full-text transcript at the text layer. If the texts correspond one-to-one, the verification is successful.

[0044] Specifically, the forward time window shall not be earlier than the start time of the thematic segment to which the continuous time block belongs, nor earlier than the start time of the entire meeting; the backward time window shall not be later than the end time of the thematic segment to which the continuous time block belongs, nor later than the total duration of the entire meeting.

[0045] In this embodiment, by sorting the timestamps of the directly supporting evidence units according to the audio start time and merging intervals based on a preset merging tolerance interval, the problem of low verification efficiency caused by fragmentation when the same conclusion corresponds to multiple discrete time segments is avoided. After merging, preset forward and backward context windows are added within the time constraints of the session unit, so that the extracted evidence segments have semantic integrity on the time axis, avoiding the impact of context loss due to boundary truncation on verification accuracy. By comparing the transcribed text of the merged interval with the full text word-by-word, the audio and text cross-modal content are accurately aligned, providing a reliable time boundary for subsequent accurate trimming of evidence segments.

[0046] S3. In response to the user's evidence verification request, perform access condition judgment. If the access condition is met, extract the data directly corresponding to the target conclusion to be verified from the de-identified meeting data according to the binding relationship, and generate the minimum necessary evidence fragment.

[0047] Specifically, in step S3, in response to the user evidence verification request, an access condition judgment is performed, including: S31. Parse the user evidence verification request data and encapsulate it into an access determination object package. The access determination object package shall include at least the user role, role permissions, target conclusion field and request purpose. S32. Based on the access determination object package, perform access condition judgments sequentially on basic conditions, blocking conditions, permission escalation requirement conditions, and additional access obligations, and combine them with... Figure 2 As shown, when each access condition is met, access is allowed, and an access decision result is generated.

[0048] In some embodiments, the basic conditions include user authentication, the role possessing the minimum permissions to access the meeting data, a legitimate relationship between the user and the meeting, and the request purpose conforming to the minimum necessity principle and the access method not exceeding the evidence access level. The minimum necessity principle means that the request purpose and the access method must match. For example, a request for clinical review allows access to text viewing and audio playback, while research only allows text viewing. If a research-type request requests audio playback, the request purpose does not conform to the minimum necessity principle, and the condition is not met. Evidence access levels include public, restricted, and strictly controlled levels. The allowed access methods for each level are as follows: public level allows text viewing and copying; restricted level allows text viewing but not copying and audio playback; strictly controlled level allows text viewing but not copying or exporting, and audio playback requires an approval permission token. If the requested access method exceeds the evidence access level, such as a strictly controlled level request to export and download evidence, the condition is not met. After all the above basic conditions are verified, the blocking condition check phase begins.

[0049] Furthermore, the blocking conditions include: access or export is prohibited due to a high-risk status; the user is unrelated to the case; the sensitivity level of the evidence exceeds the user's permissions; the purpose of the request does not match; or the permission upgrade fails. Specifically, prohibiting access or export due to a high-risk status means that if the current meeting is in a high-risk state, all access is prohibited, and no further checks are needed; the verification request is directly rejected. The condition that the user is unrelated to the case means that if the basic conditions are met, but there are additional access restrictions between the current user's role and the specific evidence object to which the target conclusion belongs, the sensitivity level of the target evidence is further assessed. If the target evidence is highly sensitive or moderately sensitive, and the user's relationship with the current meeting is one of indirect jurisdiction rather than direct service (e.g., the supervisory office has jurisdiction over the case but not a direct service relationship), then the depth of the relationship between the user and the evidence is insufficient, and the access requirements for highly sensitive evidence are not met. However, if the user initiates a permission upgrade request and it is approved, then this condition is met. The "Evidence Sensitivity Level Exceeds Permission" condition is as follows: If the evidence sensitivity level is "Highly Sensitive" and the user's default access level is lower than the "Strictly Controlled" level, blocking is triggered, and the condition is not met. If the evidence sensitivity level is "Mediumly Sensitive" and the user's default access level is lower than the "Restricted" level, blocking is triggered, and the condition is not met. If the user has already obtained approval for an upgrade to access permissions for that specific evidence, the blocking is invalid, and the condition is met. The "Request Purpose Mismatch" condition is as follows: The access type of the current request purpose is used to determine if the corresponding conditions are met. For example, if the access type is "Export / Download," but the risk level of the current meeting data includes a "Prohibit Export" flag, blocking is triggered, and the condition is not met. The "Permission Upgrade Failure" condition is as follows: If all basic conditions are met and no blocking conditions are triggered, it is determined whether the current request triggers a permission upgrade process. Permission upgrade refers to the process of obtaining temporary authorization by applying when the user's default permissions are insufficient to satisfy the current access request. If the permission upgrade process is triggered and the permission upgrade is successful, the condition is met.

[0050] The detection conditions that trigger the permission upgrade process include, but are not limited to: the sensitivity level of the target evidence is high sensitivity, the access method of the current request exceeds the evidence access level of the target evidence, the relationship between the user and the meeting is not direct service and the sensitivity level of the target evidence is not lower than medium sensitivity.

[0051] Furthermore, the requirement for permission upgrades is to determine whether the user's permission upgrade application process has been approved. The permission upgrade status is determined by the permission approval process, including statuses such as not applied for, pending approval, approved, rejected, expired, and revoked. After an upgrade is approved, access is only granted within the approved conclusion, evidence fragments, access methods, and validity period. Additional access obligations are checked and executed under the premise that the basic conditions are met, no blocking conditions are triggered, and the permission upgrade status is legal or does not require an upgrade. Additional obligations refer to operations that must be completed before access is granted; each obligation is checked independently, and access is denied if any is not completed. Additional obligations include, but are not limited to, informed confirmation status, secondary approval status, and reconfirmation within a minimum time interval.

[0052] In this embodiment, by parsing and encapsulating user evidence verification requests into access decision object packages, all subsequent decisions are executed based on a unified data context, avoiding consistency issues caused by repeated searches. Simultaneously, access conditions are judged sequentially, forming a multi-level funnel-shaped access control mechanism. This avoids the one-sidedness of single-dimensional judgments and prevents inconsistencies in decisions caused by logical conflicts when multiple conditions are judged in parallel. This solves the problem of insufficient granularity in conventional access control, which remains at the file or meeting level and cannot dynamically adjust access permissions based on conclusion type, risk status, and evidence sensitivity. It ensures that access decisions strictly adhere to the minimum necessary principle while meeting clinical verification requirements.

[0053] In some possible implementations, access condition determination can employ an access strategy matrix that combines basic conditions, blocking conditions, and additional obligations, rather than mechanically requiring all conditions to be met simultaneously, in order to adapt to different data access needs.

[0054] Specifically, in combination Figure 3 As shown, step S3, which involves extracting data directly corresponding to the conclusion of the target to be verified from the anonymized interview data based on the binding relationship, and generating the minimum necessary evidence fragment, includes: S33. Based on the access determination decision result, extract the target conclusion ID to be verified and the evidence fragment ID authorized for the user to view; S34. Based on the ID of the target conclusion to be verified and the ID of the evidence fragment, retrieve all corresponding index records from the index table of the analysis conclusion and the minimum time interval supporting the analysis conclusion. Each index record shall include at least the ID of the evidence fragment, the discourse unit, and the start and end times of the audio. S35. Based on the index record, retrieve the target text segment corresponding to the evidence fragment from the full verbatim transcript of the anonymized interview data; S36. Sort the audio segments corresponding to all the index records by time, merge the time intervals that overlap or are adjacent, and normalize the start and end times of each merged audio segment to the boundary of the nearest speech unit to obtain the target audio segment. S37. Perform semantic integrity verification on the target text segment and the target audio segment, and construct the minimum necessary evidence fragment.

[0055] Specifically, the start and end times of each merged audio segment are normalized to the boundary of the nearest discourse unit. This ensures that the speaker's complete semantic expression is not truncated during audio playback. Specifically, all discourse unit IDs contained in the evidence are extracted from the index records. For the start time of the merged audio, the discourse units containing that time point are searched backwards. If the start time of the target discourse unit is less than the start time of the merged audio, the start time of the merged audio is adjusted to match the start time of the target discourse unit. Similarly, for the end time of the merged audio, the discourse units containing that time point are searched backwards. If the end time of the target discourse unit is greater than the end time of the merged audio, the end time of the merged audio is adjusted to match the end time of the target discourse unit. If the merged audio spans multiple discourse units, to ensure that the normalized start time is no later than the start time of the first discourse unit within the merged audio time block, and the normalized end time is no earlier than the end time of the last discourse unit within the time block.

[0056] In this embodiment, by converting the access determination result into specific extraction instructions, the audio coordinates and text coordinates of the evidence fragments are retrieved from the binding index table, thus achieving a logical connection from determining that access is permitted to accurately obtaining data. By sorting all index records by time and merging overlapping or adjacent time intervals, the problem of fragmented verification efficiency caused by having to open and play each discrete segment one by one when the same conclusion corresponds to multiple discrete segments is solved. Furthermore, the start and end times of the merged audio are regularized to the nearest speech unit boundary, ensuring that the audio truncation point does not truncate the speaker's complete expression.

[0057] Furthermore, by combining coordinate-driven bimodal precise positioning with a runtime de-identified data reading mechanism, the evidence extraction process, while strictly adhering to access control decision results, achieves precise trimming from conclusions to text fragments and audio fragments with triple alignment. This avoids the inefficiency caused by reviewers having to manually locate and search after the verification request has been approved, as well as the problem of security defenses shifting backward due to direct reading of raw data during the evidence extraction stage. This ensures that the minimum necessary evidence is precisely achieved simultaneously in both temporal and semantic boundaries.

[0058] Specifically, step S37 includes: The target text segment is subjected to sentence boundary integrity check and boundary expansion. If the expanded text segment does not match the target audio segment, the boundary of the target audio segment is adjusted based on the boundary of the expanded text segment. Based on the arrangement order of each utterance unit within the target audio segment, the continuity of the speaker's role is detected. If the speaker's conversation is detected to be truncated, the structured layer of the desensitized conversation data is retrieved and completed in chronological order, and the boundary of the target text segment is updated synchronously. Based on the topic segment ID to which the current evidence fragment belongs, query and determine whether the evidence fragment after the boundary adjustment between the target text segment and the target audio segment is completely within the topic range. If the evidence fragment exceeds the topic range, the excess part is truncated to obtain the minimum necessary evidence fragment.

[0059] Specifically, the steps for performing sentence boundary integrity checks and boundary expansion on the target text segment include: Perform segment beginning and end checks on the target text segment to determine if there are any truncations at the beginning and end of the segment. If the starting character of the target text segment is not the beginning of a paragraph and the preceding character is not a period, question mark, exclamation mark, or newline character, it is determined to be a beginning truncation; if the ending character of the target text segment is not a sentence end character and the following character is not a whitespace character or sentence end character, it is determined to be an end truncation. When a beginning truncation exists, extend the text truncation position forward to the character after the nearest previous sentence end character, update the starting character position of the evidence fragment in the basic anonymized full-text transcript to that position, and adjust the start time of the corresponding target audio segment to the start time of the discourse unit corresponding to the newly extended position. When there is an end truncation, extend the text truncation position backward to the character after the nearest sentence end character, update the end character position of the evidence fragment in the basic desensitized full text transcript to that position, and adjust the end time of the corresponding target audio segment to the end time of the discourse unit corresponding to the new extended position. If the expansion results in a mismatch between the time intervals of the target text segment and the target audio segment, then the boundary of the target audio segment will be resynchronized using the expanded boundary of the target text segment. Sentence ending marks include periods, question marks, exclamation marks, and line breaks.

[0060] In some possible embodiments, after obtaining the minimum necessary evidence fragment for the first time, deduplication and merging of the minimum necessary evidence fragments are performed to obtain the final minimum necessary evidence fragment, specifically as follows: Detect whether there is content overlap in the initial minimum necessary evidence fragments, including text content overlap and audio time interval overlap; If overlap is detected, the two or more overlapping segments are merged into a new segment, and the merged speech units are arranged in ascending order of time, while duplicate segments are deleted. The start time of the merged segments is the minimum value among all segments, and the end time is the maximum value among all segments.

[0061] The overlap detection rule is as follows: if the start time of segment A is less than the start time of segment B, and the end time of segment A is greater than the end time of segment B, then segment B is determined to overlap with segment A.

[0062] In this embodiment, the three verification steps of sentence boundary regularization, speaker continuity completion, and topic scope constraint work together to ensure that the final output minimum necessary evidence fragment has a complete semantic unit, does not fragment the speaker's expression, and does not exceed the target topic scope. Performing deduplication and merging of the minimum evidence fragment further improves the accuracy of the minimum evidence fragment and avoids the occasional errors of the previous three verification steps.

[0063] S4. Perform local desensitization on the minimum necessary evidence fragments, and then display the desensitized minimum necessary evidence fragments in a controlled manner.

[0064] Specifically, step S4 includes: S41. Identify sensitive fields in the minimum necessary evidence fragment that are not directly related to the conclusion to be verified, and perform local desensitization on them; S42. The de-identified minimum necessary evidence fragments are displayed in a controlled manner. For text evidence, it is displayed to the user and copying and full-text export are restricted. For audio evidence, a fragment-level playback token is generated that includes at least the number of playbacks, the visible time interval, the audio validity period, and the download permission. The user's audio listening behavior is constrained based on the fragment-level playback token.

[0065] It should be noted that after generating the minimum necessary evidence fragment, further identifying sensitive fields that are not directly related to the verification of the target conclusion and performing local secondary anonymization is to ensure that the final displayed content retains the key information required for verification while removing unnecessary personal identification, contact information, or third-party information, thus avoiding the problem of redundant sensitive information exposure in the minimum necessary evidence fragment. Different controlled display mechanisms are adopted based on the attribute characteristics of text evidence and audio evidence to jointly ensure that the minimum necessary evidence fragment maintains a minimum level of sensitive information exposure during the actual presentation stage, achieving an end-to-end controlled access closed loop from data extraction to user presentation.

[0066] Example 2, based on the same inventive concept, also provides a minimum evidence access control system for clinical psychological interview data, corresponding to the minimum evidence access control method for clinical psychological interview data. This system includes: The data anonymization module is used to perform differentiated anonymization on the original psychological interview data in layers based on a hierarchical anonymization strategy, and to obtain anonymized interview data. The conversation unit module is used to establish a binding relationship between the analysis conclusions and the minimum time interval in the desensitized interview data that supports the analysis conclusions; The conclusion evidence module is used to respond to user evidence verification requests, perform access condition judgment, and if the access conditions are met, extract data directly corresponding to the target conclusion to be verified from the de-identified meeting data according to the binding relationship, and generate the minimum necessary evidence fragment. The evidence display module is used to locally desensitize the minimum necessary evidence fragments and to display the desensitized minimum necessary evidence fragments in a controlled manner.

[0067] In this embodiment, a tiered anonymization strategy is used to differentiate the anonymization of layered raw data, reducing the risk of sensitive information exposure from the data source. Based on this, a binding relationship is established between the analytical conclusions and the minimum time intervals supporting them, so that evidence verification no longer depends on the full release of data. When a user initiates a verification request, the system extracts the smallest fragment directly corresponding to the target conclusion from the anonymized data only when the access conditions are met, and further limits the exposure scope through partial anonymization and controlled display. The collaborative modules transform the traditional full-data access mode into a precise access mode at the conclusion level, fragment level, and purpose-defined level, solving the technical problem of data security and access efficiency being mutually exclusive due to overly coarse-grained access control, and minimizing the exposure of sensitive data while ensuring clinical verification functionality.

[0068] The above-described embodiments are preferred embodiments of this application and are not intended to limit the specific scope of this application. The scope of this application includes but is not limited to the specific embodiments described above. All equivalent changes made in accordance with the shape, structure, and method of this application are within the protection scope of this application.

Claims

1. A minimum evidence access control method for clinical psychological interview data, characterized by: Includes the following steps: Based on a tiered desensitization strategy, differentiated desensitization is performed on the original psychological interview data in layers to obtain desensitized interview data; Establish a binding relationship between the analytical conclusions and the minimum time interval in the desensitized interview data that supports the analytical conclusions; In response to a user's evidence verification request, an access condition judgment is performed. If the access condition is met, data directly corresponding to the conclusion of the target to be verified is extracted from the anonymized meeting data according to the binding relationship, and the minimum necessary evidence fragment is generated. The minimum necessary evidence fragments are locally desensitized, and the desensitized minimum necessary evidence fragments are then displayed in a controlled manner.

2. The minimum evidence access control method for clinical psychological interview data according to claim 1, characterized in that: The method of differentially desensitizing the stratified original psychological interview data based on a hierarchical desensitization strategy to obtain desensitized interview data includes: The raw psychological interview data is divided into audio layer, text layer, structured layer, conclusion layer and evidence layer, and corresponding basic visibility permissions and sensitivity levels are configured for each layer of data; Based on the hierarchical desensitization strategy corresponding to the basic visibility permissions and sensitivity level configuration, data desensitization is performed on data at each level to obtain desensitized meeting data; Specifically, key data entities and entity relationships in the text layer are masked and obscured; pseudo-identifiers are generated for role entities in the structured layer; entity recognition and template rewriting are performed on the conclusion text in the conclusion layer, and personal identity information is removed; and sensitive content is identified and partially desensitized in the evidence layer.

3. The minimum evidence access control method for clinical psychological interview data according to claim 2, characterized in that: The process of establishing a binding relationship between the analytical conclusions and the minimum time interval supporting the analytical conclusions in the anonymized interview data includes: Key conclusions are determined based on the criticality score of each analytical conclusion in the conclusion layer. The corresponding discourse units are retrieved and matched based on the key conclusion ID and used as candidate evidence units. Calculate the correlation between candidate evidence units and key conclusions, and take candidate evidence units whose correlation exceeds a preset threshold as directly supporting evidence units. The time intervals of all directly supporting evidence units are merged, and the transcribed text of the merged interval is verified by the text content of the text layer. If the transcribed text corresponds one-to-one with the text content of the text layer, the merged interval is taken as the smallest time interval supporting the analysis conclusion. An index table is established to determine the minimum time intervals between key conclusions and supporting analytical conclusions, thus obtaining the binding relationship.

4. The minimum evidence access control method for clinical psychological interview data according to claim 3, characterized in that: The determination of key conclusions based on the criticality score of each analytical conclusion in the conclusion layer includes: For each analytical conclusion in the conclusion layer, a key score is obtained based on the sum of the conclusion type characteristic value, risk level characteristic value, evidence sensitivity level characteristic value, and decision impact degree characteristic value. The analytical conclusions where the critical scores are greater than or equal to the scoring threshold are considered critical conclusions.

5. The minimum evidence access control method for clinical psychological interview data according to claim 3, characterized in that: The process of merging the time intervals of all directly supporting evidence units and verifying the transcribed text of the merged intervals through the text content of the text layer includes: Arrange all timestamps of directly supporting evidence units in ascending order of audio start time; If the audio start time of the current directly supporting evidence unit is less than or equal to the sum of the audio end time of the previous merged interval and the preset merge allowable interval, then the timestamps of the two directly supporting evidence units will be merged into a continuous time interval. If the audio start time of the current directly supporting evidence unit is greater than the sum of the audio end time of the previous merged interval and the preset merge allowable interval, then the current merge is stopped. For consecutive time blocks after merging, a preset forward time window and a backward time window are added within the session unit time constraint to complete the contextual semantics of the merged interval. The transcribed text of the semantically completed merged interval is compared word by word with the corresponding full-text transcript at the text layer. If the texts correspond one-to-one, the verification is successful.

6. The minimum evidence access control method for clinical psychological interview data according to claim 1, characterized in that: The step of responding to a user evidence verification request and performing access condition judgment includes: Parse the user evidence verification request data and encapsulate it into an access determination object package. The access determination object package includes at least the user role, role permissions, target conclusion field and request purpose. Based on the access determination object package, the access conditions are judged sequentially: basic conditions, blocking conditions, permission upgrade requirements, and additional access obligations. When each access condition is met, access is allowed, and an access determination decision result is generated.

7. The minimum evidence access control method for clinical psychological interview data according to claim 6, characterized in that: The steps for extracting data directly corresponding to the target conclusion to be verified from anonymized interview data based on the binding relationship, and generating the minimum necessary evidence fragments, include: Based on the access determination decision result, extract the target conclusion ID to be verified and the evidence fragment ID authorized for the user to view; Based on the ID of the target conclusion to be verified and the ID of the evidence fragment, retrieve all corresponding index records from the index table of the analysis conclusion and the minimum time interval supporting the analysis conclusion. Each index record includes at least the ID of the evidence fragment, the discourse unit, and the start and end times of the audio. Based on the index record, retrieve the target text segment corresponding to the evidence fragment from the full verbatim transcript of the anonymized interview data; Sort all the audio segments corresponding to the index records by time, merge the time intervals that overlap or are adjacent, and normalize the start and end times of each merged audio segment to the boundary of the nearest speech unit to obtain the target audio segment. Semantic integrity checks are performed on the target text segment and the target audio segment to construct the minimum necessary evidence fragment.

8. The minimum evidence access control method for clinical psychological interview data according to claim 7, characterized in that: The step of performing semantic integrity verification on the target text segment and the target audio segment, and constructing the minimum necessary evidence fragment, includes: The target text segment is subjected to sentence boundary integrity check and boundary expansion. If the expanded text segment does not match the target audio segment, the boundary of the target audio segment is adjusted based on the boundary of the expanded text segment. Based on the arrangement order of each utterance unit within the target audio segment, the continuity of the speaker's role is detected. If the speaker's conversation is detected to be truncated, the structured layer of the desensitized conversation data is retrieved and completed in chronological order, and the boundary of the target text segment is updated synchronously. Based on the topic segment ID to which the current evidence fragment belongs, query and determine whether the evidence fragment after the boundary adjustment between the target text segment and the target audio segment is completely within the topic range. If the evidence fragment exceeds the topic range, the excess part is truncated to obtain the minimum necessary evidence fragment.

9. The minimum evidence access control method for clinical psychological interview data according to claim 1, characterized in that: The process of locally desensitizing the minimum necessary evidence fragments and then displaying the desensitized minimum necessary evidence fragments in a controlled manner includes: Identify sensitive fields in the minimum necessary evidence fragment that are not directly related to the conclusion to be verified, and perform local anonymization on them; The anonymized minimum necessary evidence fragments are displayed in a controlled manner. For text evidence, it is displayed to the user and copying and full-text export are restricted. For audio evidence, a fragment-level playback token is generated that includes at least the number of playbacks, the visible time interval, the audio validity period, and download permissions. The user's audio listening behavior is constrained based on the fragment-level playback token.

10. A minimal evidence access control system for clinical psychological interview data, characterized in that: The minimum evidence access control method applicable to clinical psychological interview data as described in any one of claims 1-9 includes: The data anonymization module is used to perform differentiated anonymization on the original psychological interview data in layers based on a hierarchical anonymization strategy, and to obtain anonymized interview data. The conversation unit module is used to establish a binding relationship between the analysis conclusions and the minimum time interval in the desensitized interview data that supports the analysis conclusions; The conclusion evidence module is used to respond to user evidence verification requests, perform access condition judgment, and if the access conditions are met, extract data directly corresponding to the target conclusion to be verified from the de-identified meeting data according to the binding relationship, and generate the minimum necessary evidence fragment. The evidence display module is used to locally anonymize the minimum necessary evidence fragments and then display the anonymized minimum necessary evidence fragments in a controlled manner.

Images