A health information data management method and system

Abstract

This invention discloses a health information data management method and system, relating to the field of data management technology. The method includes acquiring multi-source health information data streams, determining target health user objects based on user association identifiers and a health user master index, and generating attributed health information data; standardizing and quality-verifying the attributed health information data to generate a set of quality-marked health information fields and determining the sensitivity levels of the fields; generating field-level access control instances based on the authorization configuration of the target health user objects and organizing them into health information data management objects; and upon receiving a health information access request, matching and generating an accessible field set, an authorization intent token, and an access risk score, determining the field output status, and generating a dynamic health information data view. This method enables refined management and dynamic secure output of health information data based on field quality, sensitivity levels, and authorization intent, improving the security and adaptability of health information data management.

Description

Technical Field

[0001] This invention relates to the field of data management technology, and in particular to a method and system for managing health information data. Background Technology

[0002] With the development of mobile terminals, wearable devices, internet healthcare platforms, and information systems in testing institutions, the sources of health information data have gradually expanded from records within a single medical institution to data sets generated by multiple terminals and platforms. Existing health information data management methods typically use user accounts, device identifiers, institutional user numbers, or identity identifiers to assign data ownership. They also perform field mapping, unit standardization, format conversion, and time normalization on data such as vital sign monitoring, exercise and sleep data, health questionnaires, test summaries, and medication records to create health information data resources that are easy to store, query, and access. Based on this, related systems typically combine technologies such as master indexes, field directories, time indexes, access permission tables, and log recording to centrally manage health information data, meeting the application needs of health record maintenance, health consultation, institutional follow-up, and statistical analysis.

[0003] However, in health information management scenarios involving multiple sources, fields, and access purposes, existing methods still have shortcomings: On the one hand, field quality marking and field sensitivity are usually not stably correlated with subsequent field-level management processes, and low-trust, abnormal, conflicting, or highly sensitive fields are easily treated as ordinary fields in the retrieval and output stages; on the other hand, existing access controls mostly rely on user roles or system permissions, making it difficult to dynamically determine whether a field should be output in its original form, desensitized, summarized, or masked, by simultaneously combining the access purpose, the scope of the requested fields, the time range of the request, the type of access operation, and field output constraints. This results in deficiencies in the refined management and differentiated secure output of health information data. Summary of the Invention

[0004] In view of the aforementioned existing problems, the present invention is proposed.

[0005] Therefore, the present invention provides a health information data management method and system that solves the problem of how to construct field-level management objects based on field quality tags, field sensitivity levels and authorization configurations, and generate dynamic health information data views according to authorization intent and access risks.

[0006] To solve the above-mentioned technical problems, the present invention provides the following technical solution: In a first aspect, the present invention provides a health information data management method, comprising, Acquire multi-source health information data streams, and determine the target health user object based on the user association identifier and the health user master index in the multi-source health information data streams, and generate attributed health information data; Perform field standardization and quality verification on the attributed health information data, generate a set of quality-marked health information fields and determine the corresponding field sensitivity levels; Based on the set of health information fields marked with quality tags, the sensitivity level of the corresponding fields, and the authorization configuration of the target health user object, a field-level access control instance is generated. The target health user object is used as the primary key, and the field-level access control instance is organized into a health information data management object. Receive health information access requests, match the health information access requests with field-level access control instances in the health information data management object, determine the set of accessible fields, generate an authorization intent token based on the set of accessible fields, and generate an access risk score after determining the set of accessible fields. Based on the authorization intent token, field-level access control instance, and access risk score corresponding to the access request, determine the output status of each field in the set of accessible fields, and generate a dynamic health information data view according to the output status.

[0007] As a preferred embodiment of the health information data management method of the present invention, the generation of attributed health information data includes: performing access verification on the received multi-source health information data; generating a real-time access event after successful verification; extracting a user association identifier set from the real-time access event and the corresponding original data content; binding the real-time access event, the original data content, and the user association identifier set to form a health information data stream to be attributed; matching the user association identifier set with the health user master index to determine the target health user object; and binding the health information data stream to be attributed with the target health user object to generate attributed health information data.

[0008] As a preferred embodiment of the health information data management method of the present invention, the step of generating a quality-marked health information field set and determining the corresponding field sensitivity level includes: parsing and standardizing the attributed health information data according to the source channel number and data type identifier of the attributed health information data to generate a standardized health information field set; performing quality verification on the standardized health information field set to determine the field quality mark, and determining the field sensitivity level according to the field code and field content category; writing the field quality mark and field sensitivity level into the corresponding field to generate a quality-marked health information field set.

[0009] As a preferred embodiment of the health information data management method of the present invention, the generation of a field-level access control instance includes: determining the allowed access destination set, allowed operation type set, and output control flag for a corresponding field based on the field code, field quality mark, and field sensitivity level in the health information field set with quality marks, and the authorization configuration of the target health user object; generating a field resource address based on the target health user object identifier, access event number, field code, and collection time, and generating a field digest value based on the field value, field quality mark, field sensitivity level, and output control flag; binding the allowed access destination set, allowed operation type set, output control flag, field resource address, and field digest value to the corresponding field to generate a field-level access control instance.

[0010] As a preferred embodiment of the health information data management method of the present invention, the step of organizing field-level access control instances into health information data management objects with the target health user object as the primary key includes: aggregating field-level access control instances with the target health user object as the primary key, and establishing field indexes according to field codes and collection times; binding field indexes, field resource addresses, and field summary values ​​with corresponding field-level access control instances to generate health information data management objects.

[0011] As a preferred embodiment of the health information data management method of the present invention, the step of determining the set of accessible fields includes: receiving a health information access request, and standardizing the requested access field set, requested access time range, access purpose, and access operation type to obtain standardized access request parameters; retrieving the corresponding field index in the health information data management object according to the target health user object identifier, and matching the standardized access request parameters with the field code, collection time, allowed access purpose set, allowed operation type set, field quality mark, and output control mark in the field-level access control instance to determine the set of accessible fields.

[0012] As a preferred embodiment of the health information data management method of the present invention, the authorization intent token is generated based on the access subject identifier, the target health user object identifier, the access purpose, the access operation type, the requested access time range, the set of accessible fields, and the token validity period.

[0013] As a preferred embodiment of the health information data management method of the present invention, the access risk scoring is as follows: after determining the set of accessible fields, the sensitivity level of each field in the set of accessible fields is read, the highest sensitivity level of the field is determined, and the corresponding risk is determined according to the access subject's permission level, the highest sensitivity level of the field and the access operation type, and an access risk score for the current health information access request is generated based on the corresponding risk.

[0014] As a preferred embodiment of the health information data management method of the present invention, the step of determining the output status of each field in the set of accessible fields and generating a dynamic health information data view according to the output status includes: validating the authorization intent token, and after successful verification, limiting the fields to be output to the set of accessible fields bound to the authorization intent token; determining the output status of each field in the set of accessible fields based on the access risk score, access operation type, and output control flag in the corresponding field-level access control instance; reading the corresponding field content through the field resource address and performing consistency verification based on the field summary value according to the output status of each field; and organizing the fields that have passed the verification into a dynamic health information data view according to the methods of original output, desensitized or summary output, and masking processing.

[0015] Secondly, the present invention provides a health information data management system, comprising, The data access and attribution module is used to acquire multi-source health information data streams, determine the target health user object based on the user association identifier and the health user master index, and generate attributed health information data. The field standardization and grading module is used to standardize and quality-verify the fields of the classified health information data, generate a set of quality-marked health information fields and determine the corresponding field sensitivity levels. The field access control management module is used to generate field-level access control instances based on field encoding, field quality tags, field sensitivity levels, and authorization configurations of target health user objects, and organize them into health information data management objects. The authorization intent and risk assessment module is used to receive health information access requests, match and determine the set of accessible fields, generate an authorization intent token, and generate an access risk score based on the access subject's permissions, the sensitivity level of the fields in the set of accessible fields, and the type of access operation. The dynamic view generation module is used to determine the output status of each field based on the authorization intent token, field-level access control instance, and access risk score, and generate a dynamic health information data view according to the output status.

[0016] The beneficial effects of this invention are as follows: By standardizing and quality-verifying the fields of attributed health information data, a set of health information fields with field quality tags and sensitivity levels is formed. Combined with the authorization configuration of the target health user object, field-level access control instances are generated. This allows health information data to be managed more finely, not just by user or data table, but by field quality, sensitivity, and authorization scope. By organizing field-level access control instances into health information data management objects and determining field output status based on authorization intent tokens and access risk scores, health information data views can be dynamically generated for different access purposes, field ranges, time ranges, and operation types. This enables differentiated control over field output (original text, anonymized output, summary output, or masking), thereby improving the security, controllability, and applicability of health information data management. Attached Figure Description

[0017] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the following description of the embodiments will be briefly introduced. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0018] Figure 1 A flowchart for health information data management methods.

[0019] Figure 2 A schematic diagram illustrating the construction of health information data management objects.

[0020] Figure 3 A schematic diagram illustrating authorized access and the generation of dynamic health information data views.

[0021] Figure 4 This is a structural diagram of a health information data management system. Detailed Implementation

[0022] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

[0023] Many specific details are set forth in the following description in order to provide a full understanding of the invention. However, the invention may also be practiced in other ways different from those described herein, and those skilled in the art can make similar extensions without departing from the spirit of the invention. Therefore, the invention is not limited to the specific embodiments disclosed below.

[0024] Secondly, the term "one embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The phrase "in one embodiment" appearing in different places in this specification does not necessarily refer to the same embodiment, nor is it a single or selective embodiment that is mutually exclusive with other embodiments.

[0025] Example 1, referring to Figures 1-3 This is the first embodiment of the present invention, which provides a health information data management method, including the following steps: S1. Obtain multi-source health information data streams, and determine the target health user object based on the user association identifier and the health user master index in the multi-source health information data streams, and generate attributed health information data; S1.1 Acquire multi-source health information data streams and generate real-time access events; Specifically, the system receives health information data uploaded from user terminals, wearable devices, health management platforms, testing institution interfaces, health questionnaire systems, or third-party health data interfaces. It reads the source channel number, upload entity identifier, device identifier, collection time, upload time, data type identifier, and original data content of the health information data. It then performs access verification on the source channel number, data type identifier, collection time, and original data content. Upon successful verification, a real-time access event is generated. Furthermore, it extracts user association identifiers from the data packet header information and original data content of the real-time access event. The extracted user association identifiers are then formatted and duplicates are merged to generate a user association identifier set. Finally, the real-time access event, the original data content, and the user association identifier set are bound together to form a health information data stream to be assigned.

[0026] It should be noted that the access verification includes: determining whether the source channel number exists in the preset access channel list, determining whether the data type identifier has the corresponding data parsing rules, determining whether the collection time and upload time meet the preset time order, determining whether the original data content is empty or lacks the necessary fields of the corresponding data type, and determining whether the upload subject identifier or device identifier meets the access requirements of the source channel.

[0027] Health information data includes at least one of the following: basic user information, vital sign monitoring data, exercise and sleep data, health questionnaire data, test summary data, medication record data, and health device reported data; real-time access events include access event number, source channel number, uploading entity identifier, device identifier, collection time, upload time, data type identifier, and original data content; user association identifiers include at least one of the following: user account identifier, device binding identifier, mobile phone number hash value, ID card number hash value, platform unique user identifier, and internal institution user identifier.

[0028] S1.2 Determine the target healthy user object based on the user association identifier set and the healthy user master index; Specifically, the set of user-associated identifiers in the health information data stream to be assigned is input into the health user master index for retrieval. The health user master index uses the health user object as the primary key and stores the user account identifier, device binding identifier, mobile phone number hash value, ID card number hash value, platform unique user identifier, internal institution user identifier, historical device records, historical source records, and historical collection time records corresponding to the health user object. Precise matching is prioritized using the platform unique user identifier, ID card number hash value, or authenticated user account identifier. When a precise match uniquely matches a health user object, and there are no account freezes, device unbindings, or identifier conflicts... If a precise match fails or multiple healthy user objects are matched, a combination match is performed based on the device binding identifier, mobile phone number hash value, internal user identifier of the organization, and upload subject identifier. The attribution is confirmed in the order of consistent device binding relationship, consistent upload subject record, consistent historical source record, and continuous collection time. If the healthy user object can be uniquely identified after confirmation, it is identified as the target healthy user object. If it still cannot be uniquely identified, the corresponding health information data stream to be attributed is marked as data to be confirmed, and the subsequent field standardization processing is suspended.

[0029] It should be noted that the combined matching involves sequentially verifying the device binding relationship, upload subject record, historical source record, and collection time continuity in the main index of healthy users, and identifying the healthy user objects that can simultaneously meet the higher priority verification conditions and have no conflicts as the target healthy user objects.

[0030] S1.3 Bind the health information data stream to be assigned to the target health user object to generate assigned health information data.

[0031] Specifically, once the target healthy user object is determined, the real-time access events, raw data content, and user association identifier set in the health information data stream to be assigned are bound to the target healthy user object identifier to generate assigned health information data.

[0032] It should be noted that the attributed health information data includes the target health user object identifier, access event number, source channel number, uploading entity identifier, device identifier, collection time, upload time, data type identifier, user association identifier set, original data content, attribution confirmation basis, and attribution status marker. Among them, the attribution confirmation basis is used to record the user association identifier or matching basis used in this attribution process, and the attribution status marker is used to indicate that the health information data has completed user attribution and can enter the subsequent field standardization processing flow.

[0033] S2. Perform field standardization and quality verification on the attributed health information data, generate a set of quality-marked health information fields and determine the corresponding field sensitivity levels; S2.1 Read the attributed health information data and determine the basis for field parsing; Specifically, when the attribution status indicates that user attribution has been completed, field standardization processing continues; when the attribution status indicates that confirmation is pending, field standardization processing for the data is paused to prevent data with unclear attribution from entering the subsequent health information field management process.

[0034] The corresponding data parsing template is invoked based on the source channel number and data type identifier, and the preset standard field directory is read (including at least the standard field code, standard field name, field type, standard unit of measurement, field value format, reasonable value range, necessary field markers and field content category).

[0035] S2.2, Perform field decomposition and field mapping on the original data content; Specifically, the raw data content is decomposed into multiple raw field items according to the data parsing template. Each raw field item includes at least the raw field name, raw field value, raw unit of measurement, raw collection time, and raw source location. The raw field items are matched with the standard field directory, and raw fields with the same meaning but different names from different sources are uniformly mapped to the same standard field code and standard field name. For raw field items that can be matched with the standard field code, the field format, unit of measurement, and collection time conversion are performed. For raw field items that cannot be matched with the standard field code, they are kept in the access event log and are not written into the formal standardized health information field set.

[0036] S2.3. Standardize the format, unit, and time of the mapped fields to generate a standardized set of health information fields; Specifically, the mapped field values ​​are formatted according to the field types and field value formats in the standard field catalog. Numeric fields are converted to a unified numeric format, date fields are converted to a unified time format, enumeration fields are converted to standard enumeration values, and text fields have invalid characters removed while retaining their original semantic content. For fields with different units of measurement, the original units of measurement are converted to standard units of measurement according to a preset unit conversion relationship. For fields with different collection time formats, the original collection time is converted to the standard collection time.

[0037] After completing field mapping, format conversion, unit conversion, and time unification, the fields are written into the standardized health information field set. Each field in the standardized health information field set includes at least the target health user object identifier, access event number, field code, field name, field value, unit of measurement, collection time, data source, field type, field content category, and data status.

[0038] Among them, the target healthy user object identifier follows the user attribution result from the previous step, the access event number is used to trace the field source, and the field content category is used to determine the field sensitivity level later. For necessary fields whose standard field codes can be determined but whose field values ​​are missing, their data status is marked as pending completion.

[0039] S2.4 Perform quality verification on the standardized health information field set and determine the field quality markers; Specifically, each field in the standardized health information field set undergoes quality verification, including integrity verification, format consistency verification, numerical rationality verification, time continuity verification, and duplication verification.

[0040] Based on the verification results, the field quality is marked as follows: fields with complete information, correct format, reasonable values, and no time conflicts or duplicate records are marked as normal fields; fields lacking necessary values ​​are marked as fields to be completed; fields whose values ​​can be parsed but exceed the reasonable range are marked as fields with abnormal range values; fields whose collection time has an inexplicable conflict with historical records of the same type of field for the same target healthy user are marked as fields with time conflicts; fields that are duplicates of existing records are marked as candidate duplicate fields; fields that can be parsed but have non-critical missing information or incomplete source information are marked as low-confidence fields; fields that cannot be parsed or lack the information necessary to form a formal field record are marked as invalid fields.

[0041] S2.5 Determine the sensitivity level of a field based on its content category and quality tag, and generate a set of health information fields with quality tags.

[0042] Specifically, a field sensitivity level rule table is pre-established. The field sensitivity level rule table uses standard field codes and field content categories as matching conditions, and configures corresponding field sensitivity levels for different fields. Field sensitivity levels include low-sensitivity fields, generally sensitive fields, high-sensitivity fields, and restricted access fields.

[0043] When determining the sensitivity level of a field, first perform an exact match in the field sensitivity level rule table based on the field code of the standardized health information field; when the field code can match the corresponding rule, directly determine the field sensitivity level according to that rule; when the field code does not match the corresponding rule, then perform category matching based on the field content category.

[0044] Among them, fields whose content categories do not directly represent an individual's health status, such as device model, device operating status, data source identifier, collection time, and data synchronization status, are identified as low-sensitivity fields; fields whose content categories reflect daily health activities or general health status, such as steps, exercise duration, sleep duration, general health questionnaire options, and non-abnormal physical sign records, are identified as generally sensitive fields; fields whose content categories reflect changes in the user's health status or health management results, such as test summaries, medication records, abnormal physical sign records, health risk warnings, and continuous physical sign change results, are identified as high-sensitivity fields; and fields whose content categories include ID number hash value, mobile phone number hash value, platform unique user identifier, diagnostic summaries, specific test results, long-term health trend analysis results, and fields designated as restricted access by management rules are identified as restricted access fields.

[0045] When the same field meets multiple sensitivity level rules at the same time, the final sensitivity level of the field is determined according to the priority of restricted access field, high sensitivity field, general sensitivity field, and low sensitivity field. That is to say, if a field has both identity association attribute and general health status attribute, it is given priority to be identified as a restricted access field to avoid the sensitivity level being underestimated due to category overlap.

[0046] For fields marked as invalid, no formal field sensitivity level is configured; only the quality mark and access event record are retained. For fields marked as low-trust fields, abnormal range fields, or time conflict fields, the field sensitivity level is still determined according to the field sensitivity level rule table, so that subsequent field-level access control instances can determine the output control mark of the field in combination with the field quality mark. The field quality mark and field sensitivity level are written back to the corresponding standardized health information field to generate a set of quality-marked health information fields.

[0047] S3. Based on the set of health information fields marked with quality tags, the sensitivity level of the corresponding fields, and the authorization configuration of the target health user object, generate field-level access control instances, and organize the field-level access control instances into health information data management objects with the target health user object as the primary key. S3.1 Read the set of quality marker health information fields and the authorization configuration of the target healthy user object; Specifically, read the set of quality-marked health information fields generated in the previous step, and sequentially obtain the target health user object identifier, access event number, field code, field value, collection time, field quality mark, field sensitivity level, field content category and data source for each health information field; The corresponding authorization configuration is read based on the target healthy user object identifier. The authorization configuration includes at least the scope of the authorized subject, the scope of authorized fields, the permitted access purpose, the permitted operation type, and the authorization validity period. Among them, the scope of authorized fields is used to limit the field codes or field content categories to which the authorization configuration applies; the permitted access purpose is used to limit the business purpose for which the corresponding field can be accessed; the permitted operation type includes at least one of the following: viewing the original text, viewing the anonymized text, viewing the summary, exporting, and calling the API.

[0048] S3.2 Determine the set of allowed access destinations and the set of allowed operation types based on field codes and authorization configurations; Specifically, using the field code of each health information field as the matching object, the corresponding authorization rule is searched in the authorization configuration currently in effect for the target health user object; when there is an authorization rule that directly corresponds to the field code, the set of allowed access purposes and the set of allowed operation types for that field are determined according to the authorization rule.

[0049] When there is no authorization rule directly corresponding to the field encoding, the category authorization rule is searched based on the field content category and the field sensitivity level; when both the field encoding rule and the category authorization rule exist, the field encoding rule is used first; when there is no applicable authorization rule, the default protection rule is followed, restricting the field to be viewed only by the target healthy user object and disallowing export and API calls.

[0050] S3.3 Determine the output control flags based on the field quality flags, field sensitivity levels, and the set of allowed operation types; Specifically, output control flags for corresponding fields are determined based on field quality flags, field sensitivity levels, allowed access destination sets, and allowed operation type sets.

[0051] When a field is marked as invalid, or if the field has not been granted any permitted access purpose or permitted operation type, the output control flag for that field is set to prohibit output. When a field is marked as a field to be completed, a low-confidence field, an abnormal range field, or a time conflict field, the output control flag for that field is set to allow only anonymized or summary output. When a field is marked as a high-sensitivity field or a restricted access field, and the permitted operation type set does not include viewing the original text, the output control flag for that field is set to allow only anonymized or summary output. When a field is marked as a normal field, a low-sensitivity field, or a generally sensitive field, and the permitted operation type set includes viewing the original text, the output control flag for that field is set to allow original text output.

[0052] S3.4 Generate field resource addresses, field summary values, and field-level access control instances.

[0053] Specifically, the original text of the k-th health information field is stored in the health information data storage area, and a field resource address is generated based on the target health user object identifier, access event number, field code, and collection time. The field resource address is used to locate the storage location of the health information field in the health information data storage area, and does not directly contain the original content of the field.

[0054] Further, a field summary value is generated for the k-th health information field, which is used for subsequent consistency verification of the field content and field control attributes. Field summary value Generate as follows:

[0055] In the formula, This represents a hash operation. Indicates the target healthy user object identifier, Indicates field encoding. Indicates the field value. Indicates the system is the first Random salt values ​​generated for each field Indicates the data collection time. Indicates the quality tag of the field. Indicates the sensitivity level of the field. Show the set of allowed access destinations The set encoding obtained after sorting and encoding, Represents the set of allowed operation types The set encoding obtained after sorting and encoding, Indicates output control flags; The purpose of using set encoding is to ensure that the allowed access destination set and the allowed operation type set can generate consistent digest values ​​even if they are in different orders but have the same content. Field digest values ​​are not stored in place of the original field text, nor are they directly disclosed to the accessing entity.

[0056] Encapsulate the field encoding, field quality flag, field sensitivity level, allowed access destination set, allowed operation type set, output control flag, field resource address, and field digest value to generate a field-level access control instance.

[0057] It should be noted that before generating the field summary value, the field value, unit of measurement, collection time, field quality mark, field sensitivity level, set of allowed access purposes, set of allowed operation types, and output control mark are all converted into a preset normalized encoding format before hashing is performed; the random salt value or salt value identifier used to generate the field summary value is used as a summary parameter and associated with the field summary value.

[0058] S3.5. Collect field-level access control instances according to the target healthy user objects; Specifically, the set of field-level access control instances generated in the previous step is used as the processing object. The instances are grouped according to the target healthy user object identifier in the field-level access control instances, and field-level access control instances belonging to the same target healthy user object are grouped into the same user field instance set.

[0059] Each user field instance set uses the target healthy user object identifier as the primary key and retains the field code, field quality tag, field sensitivity level, allowed access destination set, allowed operation type set, output control tag, field resource address, and field summary value from the field-level access control instance. The access event number, collection time, and field content category associated with the field-level access control instance are synchronously written to the user field instance set as the basis for index construction.

[0060] S3.6. Establish field time indexes and field filtering indexes according to field codes and collection times, and generate health information data management objects; Specifically, using the field codes and collection times in the user field instance set as the basic index terms, field-level access control instances under the same target healthy user object are written into the corresponding time index structure according to their collection times, forming a health information timeline. This health information timeline is used to record the correspondence between field-level access control instances and collection times, and supports subsequent retrieval of corresponding field-level access control instances by target healthy user object, field code, and time range.

[0061] For continuously collected fields, according to the preset time window corresponding to the field code, field-level access control instances whose collection time falls within the same time window are grouped into the same time segment index; for event-type fields, event node indexes are generated according to the collection time; for document-type or report-type fields, document node indexes are generated according to the collection time, and the corresponding field-level access control instances are bound to the document node.

[0062] When multiple field-level access control instances exist for the same target healthy user object, the same field code, and the same collection time, index records are created separately based on the access event number and field resource address to avoid merging different source fields at the same point in time into the same field record.

[0063] Furthermore, based on the field time index, a field filtering index is established according to the field quality marker, field sensitivity level, set of allowed access purposes, set of allowed operation types, and output control marker. The target healthy user object identifier, user field instance set, health information timeline, field time index, field filtering index, set of field resource addresses, and set of field summary values ​​are bound to generate a health information data management object. The health information data management object uses the target healthy user object identifier as the primary key and is used to manage the field-level access control instances and their index relationships corresponding to the target healthy user object.

[0064] It should be noted that the allowed access purpose set is used to match the access purpose in subsequent access requests; the allowed operation type set is used to match the operation type in subsequent access requests; and the output control flag is used to limit the highest output form of the field in the subsequent dynamic health information data view.

[0065] S4. Receive health information access request, match the health information access request with the field-level access control instance in the health information data management object, determine the set of accessible fields, generate an authorization intent token based on the set of accessible fields, and generate an access risk score after determining the set of accessible fields. Specifically, the system receives health information access requests initiated by the accessing entity, including the accessing entity identifier, the target health user object identifier, the requested access field set, the requested access time range, the access purpose, and the access operation type. The system first performs standardization processing on the health information access request, converting the field names or external field identifiers in the requested access field set into standard field codes, converting the requested access time range into a unified time format, and converting the access purpose and access operation type into preset enumeration values. Based on the target health user object identifier, locate the field index corresponding to the target health user object in the health information data management object generated in the previous step, and perform preliminary filtering according to the requested access field set and the requested access time range to obtain field-level access control instances whose field codes match the requested access field set and whose collection time falls within the requested access time range; For the field-level access control instances obtained from the initial screening, the authorization conditions are further matched: it is determined whether the purpose of this access belongs to the set of allowed access purposes in the field-level access control instance, whether the type of this access operation belongs to the set of allowed operation types in the field-level access control instance, whether the field quality flag of the field is not an invalid field, and whether the output control flag of the field is not prohibited from output; when a field-level access control instance simultaneously satisfies the following conditions, the field corresponding to the field-level access control instance is determined as the accessible field of this access request; all fields that meet the above conditions constitute the set of accessible fields corresponding to this access request; if no field-level access control instance meets the conditions, an access failure result is generated, and the access subject identifier, target healthy user object identifier, access purpose, access operation type, and failure reason are recorded; if a field-level access control instance meets the conditions, the corresponding set of accessible fields is passed to the subsequent authorization intent token generation step.

[0066] Furthermore, the access subject identifier, target healthy user object identifier, access purpose, access operation type, requested access time range, and token validity period are first standardized and encoded; then, the set of accessible fields is set-encoded. The standardized access subject identifier, target healthy user object identifier, access purpose, access operation type, requested access time range, set of accessible fields encoding, token validity period, and random number are combined to form the token to be signed content, and the token to be signed content is signed using the system signing key to generate an authorization intent token.

[0067] It should be noted that the set encoding includes: sorting each field-level access control instance in the accessible field set according to a fixed order of field code, collection time, and field resource address identifier; and then extracting the field code, collection time, field resource address identifier, and output control flag corresponding to each field-level access control instance to form the accessible field set encoding.

[0068] The authorization intent token does not carry health information field values; it is only used to limit the access subject, target healthy user object, access purpose, access operation type, access time range, set of accessible fields, and token validity period corresponding to this access request.

[0069] Furthermore, after determining the set of accessible fields, the sensitivity level of each field in the set of accessible fields is read, and the highest sensitivity level is determined. Based on the access subject's permissions, the sensitivity levels of the fields in the set of accessible fields, and the access operation type, the access subject's permission level risk, the field sensitivity level risk, and the access operation type risk are determined respectively. It should be noted that the access subject's permission level risk is determined based on the preset subject permission risk table; the higher the access subject's permission level, the lower the corresponding risk value, and the lower the access subject's permission level, the higher the corresponding risk value; for example, the target health user, authorized health management personnel, cooperative institution accounts, and temporary access accounts can be configured with corresponding risk values ​​in order of increasing risk. The sensitivity level risk of a field is determined based on the highest sensitivity level of the field in the set of accessible fields. The system iterates through the field-level access control instances in the set of accessible fields and reads the sensitivity level of each field. If the set of accessible fields contains restricted access fields, the sensitivity level risk is determined to be the highest level. If it does not contain restricted access fields but contains highly sensitive fields, the sensitivity level risk is determined to be high risk. If it only contains generally sensitive fields, the sensitivity level risk is determined to be medium risk. If it only contains low-sensitivity fields, the sensitivity level risk is determined to be low risk. The risk of access operation type is determined based on a preset operation risk table; summary viewing and anonymized viewing correspond to lower risk, original text viewing corresponds to medium risk, and export and API call correspond to higher risk. If a single health information access request contains multiple access operation types, the access operation type with the highest risk level is used to determine the access operation type risk. Based on preset risk weights, the access subject permission level risk, field sensitivity level risk, and access operation type risk are weighted and synthesized to obtain the access risk score for this health information access request. It should also be noted that the preset risk weights include subject permission risk weights, field sensitivity level risk weights, and operation type risk weights. These preset risk weights are pre-stored in the system security policy, and each risk weight is a value greater than or equal to 0 and less than or equal to 1, with the sum of the three being one. In the default configuration, the field sensitivity level risk weight is set to the highest, the subject permission risk weight to the second highest, and the operation type risk weight to the lowest; for example, the field sensitivity level risk weight can be set to 0.5, the subject permission risk weight to 0.3, and the operation type risk weight to 0.2. This default configuration ensures that the access risk score primarily reflects the sensitivity of the accessed health information fields themselves, while also considering the access subject's permissions and the access operation type. When the system security policy needs to adjust the weights according to the business scenario, it is configured according to the access scenario type: for low-risk access scenarios such as self-viewing and health record organization, the field sensitivity level risk weight is reduced and the subject permission risk weight is increased; for external access scenarios such as institutional follow-ups, insurance verification, data statistics, or regulatory audits, the field sensitivity level risk weight is increased; for export and API call scenarios, the operation type risk weight is increased. After adjustment, the three weights are normalized so that the sum of the three weights is 1. Specifically, the access subject permission level risk, field sensitivity level risk, and access operation type risk are all represented using the same value range, for example, all normalized to between 0 and 1. The access risk score is obtained by multiplying the access subject permission level risk, field sensitivity level risk, and access operation type risk by their respective weights and then summing them.

[0070] S5. Based on the authorization intent token, field-level access control instance, and access risk score corresponding to the access request, determine the output status of each field in the set of accessible fields, and generate a dynamic health information data view according to the output status.

[0071] S5.1 Verify the authorization intent token and the set of accessible fields; Specifically, taking the authorized intent access result generated in the previous step as input, the following are obtained: authorized intent token, access subject identifier, target healthy user object identifier, access purpose, access operation type, requested access time range, accessible field set, and access risk score. The authorized intent token is verified, including: whether the signature of the authorized intent token is valid; whether the authorized intent token is within its validity period; whether the current access subject identifier, target healthy user object identifier, access purpose, access operation type, and requested access time range are consistent with the content recorded in the authorized intent token; and whether the current field to be output belongs to the accessible field set bound to the authorized intent token. If any verification content is not satisfied, the access request is rejected, and no dynamic health information data view is generated. When the authorized intent token is verified, the accessible field set bound to the authorized intent token is used as the processing object, and the field output status determination process begins.

[0072] S5.2 Determine the field output status based on the access risk score and field-level access control instance; Specifically, each field-level access control instance in the set of accessible fields is processed one by one, and the output control flag, field resource address, and field digest value in the corresponding field-level access control instance are obtained.

[0073] A first risk threshold and a second risk threshold are pre-configured, with the first risk threshold being less than the second risk threshold. When the access risk score is lower than the first risk threshold, the output format corresponding to the access operation type is original text output, and the output control flag in the field-level access control instance is set to allow original text output, the output status of that field is determined to be visible in original text. When the access risk score is lower than the second risk threshold, and the output control flag in the field-level access control instance is set to allow original text output or only allow anonymized or summary output, the output status of that field is determined to be anonymized or summary visible. Specifically, when the access operation type is anonymized viewing, the anonymized value is output; when the access operation type is summary viewing, the summary value is output; when the access operation type is original text viewing but the risk does not reach the original text output threshold, the anonymized value is output. When an access operation is of type export or API call, the output form is determined based on the set of allowed operation types and output control flags in the field-level access control instance. If the authorization configuration allows plain text export or plain text API call, and the access risk score is lower than the first risk threshold and the output control flag is set to allow plain text output, then the plain text is determined to be visible. If the authorization configuration only allows de-identified export, summary export, de-identified API call, or summary API call, or the access risk score does not meet the plain text output condition but is lower than the second risk threshold, then the de-identified or summary is determined to be visible. When the access risk score is not lower than the second risk threshold, or the output control flag in the field-level access control instance is set to prohibit output, the output status of the field is determined to be masked.

[0074] Among them, "Original text visible" means that the original content of the field can be output; "Anonymized or summary visible" means that only the field content after masking, intervalization, precision reduction, truncation or summary processing can be output; "masked" means that the field value is not output, or only a field not visible prompt is returned.

[0075] It should be noted that the first risk threshold is used to determine whether a field can be output in its original form. Its value ranges from 0 to 1 and is less than the second risk threshold. An example value is 0.4 to 0.6. The basis for this value is to allow low-risk access requests to directly obtain the original content when the field itself allows output in its original form, while medium- and high-risk access requests need to be downgraded to anonymized or summary output. The second risk threshold is used to determine whether a field should be blocked. Its value ranges from 0 to 1 and is greater than the first risk threshold. An example value is 0.7 to 0.9. The basis for this value is to prevent high-risk access requests from continuing to obtain the field content, thereby preventing highly sensitive fields, export-type operations, or low-privilege subjects from obtaining identifiable health information when the risk is high.

[0076] S5.3 Read the field content based on the field resource address and perform digest consistency verification; Specifically, for fields whose output status is "visible in original text", "de-identified", or "visible in summary", the corresponding original text of the field is read from the health information data storage area according to the field resource address in the field-level access control instance.

[0077] The system reads the field code, collection time, field quality flag, field sensitivity level, allowed access destination set, allowed operation type set, output control flag, and digest parameters associated with the field digest value corresponding to the field-level access control instance. The digest parameters include the random salt value or salt value identifier used when generating the field digest value. The system converts the read field text, standard unit of measurement, field code, collection time, field quality flag, field sensitivity level, allowed access destination set, allowed operation type set, and output control flag into normalized codes according to the preset field order. It then regenerates the field digest value in combination with the digest parameters and performs a consistency comparison with the field digest value stored in the field-level access control instance. When the digest values ​​match, it confirms that the field text and corresponding control attributes have not changed inconsistently and continues to perform field output processing. When the digest values ​​do not match, it stops outputting the field and adjusts the output status of the field to masked.

[0078] S5.4 Generate a dynamic health information data view based on the field output status; Specifically, a dynamic health information data view corresponding to this access request is generated based on the output status of each field. The dynamic health information data view includes a view identifier, an authorization intent token identifier, a target health user object identifier, an access subject identifier, a view generation time, a set of field view items, and a view validity period. The set of field view items includes at least one field view item, each field view item corresponds to an accessible field, and includes the field code, field name, field collection time, field output status, field display value, field processing method, and summary verification result.

[0079] For fields whose output status is "Original Text Visible" and whose summary consistency verification has passed, the original text of the field is written as the field display value to the corresponding field view item, and the field processing method is marked as "Original Text Output". For fields whose output status is "Desensitized" or "Summary Visible" and whose summary consistency verification has passed, a desensitized value or summary value is generated according to the field type, and the desensitized value or summary value is written as the field display value to the corresponding field view item, and the field processing method is marked as "Desensitized Output" or "Summary Output". For fields whose output status is "Shaded", the original text of the field is not written, but only a field invisible prompt is written in the corresponding field view item, or no field view item is generated for that field.

[0080] It should be noted that numeric fields are generated using range-based methods, reduced precision, or threshold hints to generate de-identified values; text fields are generated using sensitive fragment masking or summarization to generate de-identified values; identifier fields are generated using partial character masking or hash digest methods to generate de-identified values; and report fields output a report summary, report time, and report type, but do not output the complete report content.

[0081] The dynamic health information data view is only a temporary output result of this health information access request. It does not change the original text of the fields in the health information data storage area, nor does it change the field-level access control instance in the health information data management object.

[0082] Example 2: Figure 4 As shown, as another aspect of the present invention, a health information data management system is also provided, comprising: The data access and attribution module is used to acquire multi-source health information data streams, determine the target health user object based on the user association identifier and the health user master index, and generate attributed health information data. The field standardization and grading module is used to standardize and quality-verify the fields of the classified health information data, generate a set of quality-marked health information fields and determine the corresponding field sensitivity levels. The field access control management module is used to generate field-level access control instances based on field encoding, field quality tags, field sensitivity levels, and authorization configurations of target health user objects, and organize them into health information data management objects. The authorization intent and risk assessment module is used to receive health information access requests, match and determine the set of accessible fields, generate an authorization intent token, and generate an access risk score based on the access subject's permissions, the sensitivity level of the fields in the set of accessible fields, and the type of access operation. The dynamic view generation module is used to determine the output status of each field based on the authorization intent token, field-level access control instance, and access risk score, and generate a dynamic health information data view according to the output status.

[0083] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. A method for managing health information data, characterized in that, include: Acquire multi-source health information data streams, and determine the target health user object based on the user association identifier and the health user master index in the multi-source health information data streams, and generate attributed health information data; Perform field standardization and quality verification on the attributed health information data, generate a set of quality-marked health information fields and determine the corresponding field sensitivity levels; Based on the set of health information fields marked with quality tags, the sensitivity level of the corresponding fields, and the authorization configuration of the target health user object, a field-level access control instance is generated. The target health user object is used as the primary key, and the field-level access control instance is organized into a health information data management object. Receive health information access requests, match the health information access requests with field-level access control instances in the health information data management object, determine the set of accessible fields, generate an authorization intent token based on the set of accessible fields, and generate an access risk score after determining the set of accessible fields. Based on the authorization intent token, field-level access control instance, and access risk score corresponding to the access request, determine the output status of each field in the set of accessible fields, and generate a dynamic health information data view according to the output status.

2. The health information data management method as described in claim 1, characterized in that: The generation of attributed health information data includes: performing access verification on the received multi-source health information data; generating a real-time access event after successful verification; extracting a set of user-associated identifiers from the real-time access event and the corresponding original data content; binding the real-time access event, the original data content, and the set of user-associated identifiers to form a health information data stream to be attributed; matching the set of user-associated identifiers with the main index of healthy users to determine the target healthy user object; and binding the health information data stream to be attributed with the target healthy user object to generate attributed health information data.

3. The health information data management method as described in claim 2, characterized in that: The process of generating a set of quality-marked health information fields and determining the corresponding field sensitivity levels includes: parsing and standardizing the source channel number and data type identifier of the attributed health information data to generate a set of standardized health information fields; performing quality verification on the set of standardized health information fields to determine the field quality marks, and determining the field sensitivity levels based on the field codes and field content categories; writing the field quality marks and field sensitivity levels into the corresponding fields to generate a set of quality-marked health information fields.

4. The health information data management method as described in claim 3, characterized in that: The process of generating a field-level access control instance includes: determining the set of allowed access destinations, the set of allowed operation types, and the output control flag for the corresponding field based on the field codes, field quality tags, and field sensitivity levels in the set of health information fields with quality tags, as well as the authorization configuration of the target healthy user object; generating a field resource address based on the target healthy user object identifier, access event number, field code, and collection time; generating a field digest value based on the field value, field quality tag, field sensitivity level, and output control flag; and binding the set of allowed access destinations, the set of allowed operation types, the output control flag, the field resource address, and the field digest value to the corresponding field to generate a field-level access control instance.

5. The health information data management method as described in claim 4, characterized in that: The step of organizing field-level access control instances into health information data management objects using the target healthy user object as the primary key includes: aggregating field-level access control instances using the target healthy user object as the primary key, and establishing field indexes based on field codes and collection times; binding field indexes, field resource addresses, and field summary values ​​with corresponding field-level access control instances to generate health information data management objects.

6. The health information data management method as described in claim 5, characterized in that: The process of determining the set of accessible fields includes: receiving a health information access request and standardizing the requested access field set, access time range, access purpose, and access operation type to obtain standardized access request parameters; retrieving the corresponding field index in the health information data management object based on the target health user object identifier, and matching the standardized access request parameters with the field code, collection time, allowed access purpose set, allowed operation type set, field quality flag, and output control flag in the field-level access control instance to determine the set of accessible fields.

7. The health information data management method as described in claim 6, characterized in that: The authorization intent token is generated based on the access subject identifier, the target healthy user object identifier, the access purpose, the access operation type, the requested access time range, the set of accessible fields, and the token validity period.

8. The health information data management method as described in claim 7, characterized in that: The access risk scoring process involves determining the set of accessible fields, reading the sensitivity level of each field in the set, identifying the highest sensitivity level, and determining the corresponding risk based on the access subject's permission level, the highest sensitivity level, and the access operation type. Based on the corresponding risk, an access risk score is generated for this health information access request.

9. The health information data management method as described in claim 8, characterized in that: The process of determining the output status of each field in the set of accessible fields and generating a dynamic health information data view according to the output status includes: validating the authorization intent token, and after successful verification, limiting the fields to be output to the set of accessible fields bound to the authorization intent token; determining the output status of each field in the set of accessible fields based on the access risk score, access operation type, and output control flag in the corresponding field-level access control instance; reading the content of the corresponding field through the field resource address and performing consistency verification based on the field digest value according to the output status of each field; and organizing the fields that have passed the verification into a dynamic health information data view according to the methods of original output, desensitized or digested output, and masking.

10. A health information data management system, based on the health information data management method according to any one of claims 1 to 9, characterized in that, include: The data access and attribution module is used to acquire multi-source health information data streams, determine the target health user object based on the user association identifier and the health user master index, and generate attributed health information data. The field standardization and grading module is used to standardize and quality-verify the fields of the classified health information data, generate a set of quality-marked health information fields and determine the corresponding field sensitivity levels. The field access control management module is used to generate field-level access control instances based on field encoding, field quality tags, field sensitivity levels, and authorization configurations of target health user objects, and organize them into health information data management objects. The authorization intent and risk assessment module is used to receive health information access requests, match and determine the set of accessible fields, generate an authorization intent token, and generate an access risk score based on the access subject's permissions, the sensitivity level of the fields in the set of accessible fields, and the type of access operation. The dynamic view generation module is used to determine the output status of each field based on the authorization intent token, field-level access control instance, and access risk score, and generate a dynamic health information data view according to the output status.

Images