A medical data desensitization conversion method, device and equipment based on reverse reconstruction verification

Abstract

The application provides a medical data desensitization conversion method, device and equipment based on reverse reconstruction verification. Semantic similarity and character similarity between a source field and an intermediate format field are calculated, a field corresponding relationship is determined according to a weighted result, and intermediate format data is generated. A random proxy key is set to maintain cross-table entity association and delete direct identifiers, and desensitized intermediate data is obtained. A conversion rule dictionary is established by analyzing and converting configuration, a forward processing function is called to generate target format data and processing logs, a matched rule is selected according to conversion constraints, and a non-direct identification field in original medical data is compared. The conversion rule of the field that does not pass the verification is located, and the field is re-converted and verified according to the correction configuration. The application can maintain cross-table association in desensitization conversion, distinguish allowed data changes from abnormal differences, and improve the accuracy of conversion error positioning and correction.

Description

Technical Field

[0001] This invention relates to the field of medical data processing technology, specifically to a method, apparatus, and equipment for desensitizing and converting medical data based on reverse reconstruction verification. Background Technology

[0002] Medical data processing systems typically need to convert electronic health records from different medical institutions or business systems into a unified data format to support the storage, retrieval, and computer analysis of medical data. This raw medical data records patient test results, vital sign measurements, treatment events, and related time information in structured tables. The same type of medical information may use different field names, data formats, and value representations in different data sources. To form a dataset that can be read by subsequent programs, it is usually necessary to establish a correspondence between source and target fields, perform format conversion on field values, and maintain entity relationships between different data tables while removing direct identifiers.

[0003] In the above processing, the fact that the target data conforms to the preset table structure and field types does not mean that it accurately preserves the original medical information. Especially when the same conversion process includes format unification, field splitting or merging, and numerical precision adjustment, the number of fields and their values ​​may change before and after the conversion. Some of these changes are within the acceptable range of the target format, while others may stem from missing fields or errors in the execution of conversion rules. Simply checking the completeness and value range of the target data's fields is insufficient to identify situations where the structure is valid but the content has deviated from the original record; directly requiring complete consistency in field values ​​before and after conversion easily leads to normal changes in representation being judged as conversion errors. In view of the above, this application is hereby submitted. Summary of the Invention

[0004] This invention discloses a method, apparatus, and device for desensitizing and converting medical data based on reverse reconstruction verification. It aims to solve the problem that it is difficult to distinguish between permissible changes in data representation and unexpected information distortions during the desensitization and conversion process of multi-source heterogeneous medical data, which makes it difficult to accurately identify and locate conversion errors.

[0005] The first embodiment of the present invention provides a medical data de-identification and transformation method based on reverse reconstruction verification, comprising: Calculate the semantic similarity and character similarity between the source field and the intermediate format field, determine the field correspondence based on the weighted result of the two, and map the original medical data into intermediate format data according to the field correspondence; Set the same random surrogate key for cross-table records of the same entity in the intermediate format data, and delete the direct identifier to obtain the de-identified intermediate data; Parse the conversion configuration, establish a conversion rule dictionary based on the field mapping relationships, remarks tags and conversion constraints, and call the forward processing function according to the conversion rule dictionary to convert the de-identified intermediate data, generating target format data and processing logs; The paired reverse processing function is called according to the transformation rule dictionary to reconstruct the target format data into a source-level simulation record. The matching rule is selected according to the transformation constraints. The source-level simulation record is compared with the indirect identification field in the original medical data using the processing log to generate a comparison result. For fields that fail verification in the comparison results, the conversion rules are located through the conversion rule dictionary, the desensitized intermediate data is reconstructed according to the received correction configuration, the obtained target format data is reverse-reconstructed and compared, and an updated comparison result is generated.

[0006] Beneficial effects: By calculating the semantic and character similarity between the source field and the intermediate format field, the field correspondence is determined based on the weighted result, reducing the impact of field naming differences on data mapping. Before deleting the direct identifier, the same random surrogate key is set for cross-table records of the same entity, so that the anonymized medical data maintains cross-table entity association, providing a data foundation with field alignment and complete association for subsequent configuration-driven format conversion.

[0007] A transformation rule dictionary is established by parsing the transformation configuration, enabling forward transformation, reverse reconstruction, and anomaly localization to adopt corresponding field mapping relationships and processing functions. Matching rules are selected based on transformation constraints, and the non-directly identified fields in the reconstruction records and the original medical data are compared using the processing log to distinguish between allowed representation changes and unexpected distortions, reducing the situation where normal transformation differences are judged as errors. Fields that fail verification are traced back to the corresponding transformation rules. By re-transforming and comparing after correcting the configuration, the accuracy of transformation error localization and correction is improved. Attached Figure Description

[0008] Figure 1 This is a flowchart illustrating a medical data desensitization and conversion method based on reverse reconstruction verification provided in the first embodiment of the present invention; Figure 2 This is a schematic diagram of a medical data desensitization and conversion method based on reverse reconstruction verification provided in the second embodiment of the present invention. Detailed Implementation

[0009] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0010] To better understand the technical solution of the present invention, the embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

[0011] This invention discloses a method, apparatus, and device for desensitizing and converting medical data based on reverse reconstruction verification. It aims to solve the problem that it is difficult to distinguish between permissible changes in data representation and unexpected information distortions during the desensitization and conversion process of multi-source heterogeneous medical data, which makes it difficult to accurately identify and locate conversion errors.

[0012] The first embodiment of this invention provides a medical data anonymization and transformation method based on reverse reconstruction verification, executed by a computer with data reading, storage, and processing capabilities. The computer reads the original medical data, generates intermediate format data through field alignment, obtains anonymized intermediate data after setting a random surrogate key and deleting direct identifiers, then generates target format data according to the transformation configuration, performs reverse reconstruction and classification comparison on the target format data, and identifies the transformation rules that need to be corrected based on the comparison results. The original medical data processed by the method is structured tabular data, which includes patient basic information, hospitalization information, laboratory records, vital sign measurement records, and medical event records.

[0013] The intermediate format is a predefined, unified field structure used to accommodate raw medical data from different sources; the target format is the data organization structure used for subsequent storage, retrieval, or computer analysis. The correspondence between source fields and intermediate format fields is used for field alignment, and the mapping between intermediate format fields and target format fields is used for data transformation. The computer associates and saves these two types of relationships, enabling subsequent tracing from the target field to the corresponding intermediate format field and source field.

[0014] S1, calculate the semantic similarity and character similarity between the source field and the intermediate format field, determine the field correspondence based on the weighted result of the two, and map the original medical data into intermediate format data according to the field correspondence; The computer reads the field names and values ​​from the current source table and the corresponding field names from the intermediate format table. Field matching is performed within the scope of the current source table and the corresponding intermediate format table. Each source field corresponds to one intermediate format field within this scope, and the same intermediate format field is not duplicated by multiple source fields. For source tables from different sources, corresponding field matching is performed separately, ensuring that different source tables can organize data using a unified intermediate format field structure.

[0015] The computer processes the source field names and intermediate format field names according to preset field name normalization rules to obtain the corresponding normalized field names, while retaining the original field names before normalization. For each source field, the non-empty field values ​​under that field are read, the frequency of occurrence of different non-empty field values ​​is counted, and sample values ​​are selected from high to low frequency. In this implementation, no more than eight high-frequency non-empty sample values ​​are selected; when there are fewer than eight available sample values, the actual available sample values ​​are used.

[0016] The computer concatenates the normalized field name, the original field name, and the selected sample value of the source field to form the source field semantic text, and concatenates the normalized field name and the original field name of the intermediate format field to form the intermediate format field semantic text. For source fields without available non-empty sample values, semantic text is constructed based on their normalized field name and the original field name. The sample values ​​are only used as auxiliary input for field semantic encoding and are not used to replace field values ​​in the original medical data.

[0017] The computer inputs the two types of semantic text into a locally deployed semantic encoding model to obtain corresponding semantic vectors, and then normalizes these semantic vectors. This implementation uses a locally deployed BAAI / bge-base-zh-v1.5 model for encoding. For a candidate field pair consisting of a source field and an intermediate format field, the cosine similarity between their normalized semantic vectors is calculated and used as the semantic similarity of the candidate field pair.

[0018] By incorporating sample values ​​into the semantic text of the source fields, comparisons of field meanings can be made using both the field names and the actual data content they carry. For the source field "SBP" and the intermediate format field "systolic blood pressure," the computer generates vector representations based on their corresponding semantic texts to compare the similarity of their meanings. For fields like "body temperature" and "weight," which have similar names but different meanings, sample values ​​participate in the semantic representation, thus affecting the semantic similarity of corresponding field pairs. Sample values ​​provide auxiliary distinguishing information; the field correspondence still needs to be determined based on subsequent scoring, conflict checking, and confirmation results.

[0019] The computer simultaneously employs a fuzzy character matching algorithm to compare the character sequences of the source field names and intermediate format field names within the same candidate field pair, obtaining character similarity. This character similarity corresponds to character-level morphological similarity, reflecting the degree of similarity in character composition and arrangement between the field names. Both semantic similarity and character similarity are calculated for the same candidate field pair, and the computer weights them according to preset weights to obtain a comprehensive matching score.

[0020] in, For the current source table, the first One source field, For the first in the corresponding intermediate format table An intermediate format field and Indexes for two types of fields respectively; The overall matching score for candidate field pairs; This represents the semantic similarity of the candidate field pair. This represents the character similarity of the candidate field pair; The preset semantic similarity weights satisfy... , This is the character similarity weight. In this embodiment, If we set it to 0.75, the corresponding character similarity weight is 0.25.

[0021] The computer determines whether to perform score enhancement processing based on character similarity. In this implementation, the character similarity threshold is set to 0.92. When the character similarity of candidate field pairs is not lower than 0.92, an enhancement score is calculated based on their semantic similarity, and the larger of the enhancement score and the original comprehensive matching score is taken as the subsequent matching score. The expression is as follows:

[0022] in, For use in subsequent filtering and sorting, matching scores This indicates that the maximum value among the listed values ​​is used. 0.95 is the preset baseline value for improving the score, and 0.05 is the preset coefficient for semantic similarity in improving the score. The other symbols are consistent with the previous definitions. When the character similarity of a candidate field pair is lower than 0.92, the original comprehensive matching score is used as the matching score. Subsequent candidate filtering, sorting, and ambiguity determination all use the corresponding matching score.

[0023] The computer filters candidate field pairs with matching scores not lower than the automatic matching threshold, forming a candidate set to be matched. In this implementation, the automatic matching threshold is set to 0.75. The computer sorts the candidate field pairs in descending order of matching score and records the selection status of the source field and intermediate format field respectively. Initially, all fields are in an unselected state.

[0024] The computer reads candidate field pairs in the ordered sequence, checking whether the source field and intermediate format field are already occupied by previously selected field pairs. When neither is selected, the current candidate field pair is identified as an automatic match, and the corresponding field is marked as selected; when either field is selected, the current candidate field pair is skipped, and processing continues with subsequent candidate field pairs. By performing the above process on the entire set of candidates to be matched, a global greedy matching constrained by a one-to-one correspondence is achieved.

[0025] For a source field with at least two candidate intermediate format fields, the computer determines the highest matching score and the second highest matching score from the candidate scores corresponding to the source field, and calculates the difference between the two. In this implementation, the ambiguity determination threshold is set to 0.03. When the difference is less than 0.03, even if the highest matching score reaches the automatic matching threshold, the automatic matching item corresponding to the source field is adjusted to a suggested item to retain the confirmation step for the correspondence between close candidates.

[0026] For source fields that do not generate automatic matching items and are not identified as suggested items due to the aforementioned ambiguity determination, their highest matching score is compared with the suggestion threshold. In this embodiment, the suggestion threshold is set to 0.65. When the highest matching score is not lower than 0.65, the highest-scoring candidate field pair is identified as a suggested item; when the highest matching score is lower than 0.65, the source field is marked as unmapped. The aforementioned similarity weights and thresholds use pre-configured fixed values ​​and are not dynamically adjusted based on field type, number of candidate fields, or historical confirmation results.

[0027] The computer outputs automatic matching items and suggested items, displaying the source fields, candidate intermediate format fields, similarity, overall matching score, and matching status. It also receives confirmation or adjustment instructions for the matching items. The generation of automatic matching items does not directly change the original table header. The computer determines the final field correspondence based on the received instructions and checks whether the confirmed result meets the one-to-one correspondence constraint within the current matching range.

[0028] For fields whose mapping relationships have not yet been confirmed, retain the unmapped state and the original data. Fields that need to be retained within the current processing scope will participate in mapping after the mapping relationships are supplemented or adjusted. Fields whose mapping relationships have not been confirmed are not counted as having completed field alignment. By retaining the unmapped state, it is possible to distinguish between confirmed fields and fields that still need to be verified later.

[0029] Once the field correspondence is confirmed, the computer reads the source field values ​​according to this correspondence, writes the read field values ​​into the corresponding intermediate format fields, and maintains the correspondence between the original records to which they belong, thus generating intermediate format data. This step completes field structure alignment and data organization; unit conversion, precision adjustment, and special representation processing of field values ​​are performed in subsequent conversion steps.

[0030] Field matching is performed in a local server process, with sample values ​​input only from the locally loaded semantic encoding model. The alignment result file records field names, candidate correspondences, similarity, overall matching score, and matching status, but does not save the sample values ​​involved in encoding. The computer retains the confirmed field correspondence information for later use in building the transformation rule dictionary to associate source fields, intermediate format fields, and target format fields.

[0031] S2, set the same random surrogate key for cross-table records of the same entity in the intermediate format data, and delete the direct identifier to obtain the de-identified intermediate data; The computer uses the intermediate format data generated by S1 as the processing object, reads the related fields from different data tables, and determines cross-table records belonging to the same entity based on existing entity relationships. The entities are distinguished into patient entities and hospitalization event entities according to their relationship hierarchy. Patient entities are used to organize medical records for the same patient, while hospitalization event entities are used to organize medical records for the same hospitalization period.

[0032] A single patient can correspond to multiple hospitalization events, and a single hospitalization event can correspond to multiple laboratory records, vital sign measurement records, and treatment event records. The computer processes the relationships between the patient level and the hospitalization event level separately, assigning patient proxy keys to patient entities and hospitalization event proxy keys to hospitalization event entities, so that the relationships at different levels can be preserved separately.

[0033] Random surrogate keys are assigned on an entity-by-entity basis. The same entity uses the same surrogate key within the current processing scope, while different entities maintain value differentiation within the scope of their respective surrogate keys. Once a surrogate key is assigned to an entity, it is reused when processing other associated records for that entity. For records containing both patient-related and hospitalization-related fields, corresponding patient surrogate keys and hospitalization event surrogate keys are set separately.

[0034] In one specific implementation, patient basic information is organized using the PATIENTS table, with the patient-related field being subject_id; hospitalization information is organized using the ADMISSIONS table, with the hospitalization-related field being hadm_id. The computer writes the patient proxy key into the subject_id field of the PATIENTS table and sets the same value for the subject_id field in other related tables for the same patient. The computer also writes the hospitalization event proxy key into the hadm_id field of the ADMISSIONS table and sets the same value for the hadm_id field in related records belonging to the same hospitalization event. The ADMISSIONS table also retains the patient proxy key for the respective patient, ensuring the integrity of the relationship between patient entities and hospitalization event entities.

[0035] For multiple test records generated from the same hospitalization, set the same hospitalization event proxy key, while retaining the original test items, sampling time, and test results for each record. For vital sign measurement records and medical event records, set corresponding proxy keys according to the patient and hospitalization event, retaining the medical data content of each record. The same proxy key indicates that related records belong to the same associated entity, while each record itself remains independent.

[0036] After completing the surrogate key assignment and associated field settings, the computer determines the field containing the direct identifier based on the intermediate format field definition and deletes the corresponding direct identifier content from the data used for subsequent conversion. For identity identifier content that originally also served an associated function, its associated function has been taken over by the random surrogate key; even after deleting this content, it can still be associated with the corresponding record through the surrogate key. For direct identifier content that does not serve an associated function, deletion is performed after determining its corresponding field.

[0037] The above process follows the sequence of first setting a surrogate key, then deleting the direct identifier. The computer uses the existing association information to identify cross-table records of the same entity, writes the surrogate key, and then removes the direct identifier. The deletion operation preserves the already set surrogate key, ensuring that the related records still have a clear entity affiliation even after losing their direct identifier.

[0038] After processing, the computer retains the indirect identifier field and the random surrogate key to obtain the anonymized intermediate data. The indirect identifier field provides the medical data content required for subsequent format conversion, and the random surrogate key serves as the cross-table join. When converting the anonymized intermediate data to the target format data, the patient relationships and hospitalization event relationships represented by the surrogate key are retained to maintain the corresponding relationships between the target data tables.

[0039] In this implementation, direct identifier deletion applies to the data used for transformation and output. The original medical data retained for comparison and verification in the controlled environment is managed separately. During processing, the correspondence information between the original records and the currently processed records is preserved for subsequent location of non-direct identifier fields to be compared. This internal correspondence information is used for transformation verification and is not output as a direct identifier in the target data.

[0040] The anonymization process removes directly identifying content from the output data; its technical function is not to suggest that it cannot be associated with an individual under any external information conditions. The computer manages the information required for internal verification separately from the anonymized data used for subsequent purposes by controlling access to the original data, processing context, and result data.

[0041] Subsequent reverse reconstruction and field value comparisons are all performed on non-direct identifier fields involved in the transformation. Deleted direct identifiers are not considered as content to be recovered, nor are they deemed transformation omissions simply because they do not appear in the target format data. Random surrogate keys are used to organize record associations, and their values ​​are not compared for equality with the original direct identifiers, thus providing clear processing boundaries for identifier deletion and medical data content verification.

[0042] S3, parse the conversion configuration, establish a conversion rule dictionary based on the field mapping relationship, remarks mark and conversion constraints, call the forward processing function according to the conversion rule dictionary to convert the de-identified intermediate data, and generate target format data and processing log; The computer reads the anonymized intermediate data generated by S2 and the pre-set conversion configuration, while simultaneously calling the source field and intermediate format field correspondence information confirmed by S1. The conversion configuration is saved in JSON format and includes the field mapping relationship between intermediate format fields and target format fields, data standardization rules, remarks fields, and conversion constraints.

[0043] Field mapping relationships are used to determine the data source of the target field and the location where the transformation result is written; data standardization rules are used to determine the format processing method for ordinary fields; preset markers in the remarks field are used to indicate the special processing type that needs to be called; transformation constraints are used to describe the conditions that the corresponding processing needs to meet and the data changes that are allowed to occur. The computer parses the configuration file and converts these configuration items into structured information for rule retrieval and function calls.

[0044] The computer determines the intermediate format field corresponding to the target field based on the field mapping relationship, and then determines the relevant source field based on the corresponding information stored in S1, thus linking the source field, intermediate format field, and target field. Subsequently, starting from a certain target field, the actual input field used and the original data source of that field can be retrieved.

[0045] The one-to-one correspondence constraint in S1 applies to field alignment. This step organizes the transformation relationship according to the target data structure. The same intermediate format field can be mapped to multiple target tables or target fields, and multiple intermediate format fields can also jointly provide input for a certain target field. The computer stores the relationship between the two stages separately, so that the field alignment constraint will not be misused to restrict the splitting, merging, or cross-table organization of the target data.

[0046] For ordinary fields, the computer determines the forward processing function and its corresponding reverse processing function based on data standardization rules. The forward processing function takes the intermediate format field value to be transformed as input and returns a processing result that meets the requirements of the target field. In the subsequent verification stage, the reverse processing function takes the corresponding target field value as input and performs the reverse transformation or simulated reconstruction corresponding to the forward processing. The computer identifies the functions of both as paired records.

[0047] For fields with special processing markers, the computer reads the memo field, identifies the preset markers, and retrieves the forward special processing function and its corresponding reverse processing function based on the correspondence between the markers and processing types. Special processing types include date format standardization, medical terminology standardization, and outlier handling. The computer associates the retrieved function identifiers with the mapping relationship of the current field, the memo markers, and transformation constraints, enabling the markers to actually control the processing method used for that field.

[0048] The computer stores field mapping relationships, function identifiers for paired records, memo markers, and transformation constraints into a transformation rule dictionary, and associates the corresponding information between source fields and intermediate format fields. This dictionary is created during configuration loading and is used by forward transformation, reverse reconstruction, and difference localization. Forward transformation uses the dictionary to determine the data read location and processing function; reverse verification uses the dictionary to determine the corresponding reverse function and matching constraints; and anomaly localization uses the dictionary to determine the configuration items corresponding to the differences.

[0049] During the transformation, the computer first reads the values ​​of the fields to be transformed from the de-identified intermediate data according to the field mapping relationship. Then, it calls the corresponding forward processing function based on the function identifier recorded in the dictionary, using the read field values ​​as input for processing. Finally, the function return result is written to the target table and target field specified in the configuration. Function selection, data reading, function execution, and result writing are all based on defined criteria, and the transformation result is obtained by processing the actual field values ​​through the selected function.

[0050] For target fields that receive input from a single intermediate format field, the field value is read and processed. For transformations requiring multiple input fields, the required field values ​​are read according to the mapping relationship and used as input for the same processing step. When splitting fields, the forward processing function generates multiple output field values ​​and writes them to their respective target fields. When merging fields, the input field values ​​that participate in the processing are passed to the corresponding function to generate the merged result and write it to the specified target field.

[0051] When the same intermediate format field is mapped to multiple target tables or target fields, the processing function and transformation constraints corresponding to each mapping relationship are read separately. The required transformations are then performed on the corresponding inputs, and the results are written to their respective target locations. The computer retains the input-output relationships for each transformation path, enabling subsequent verification of the transformation results at different target locations.

[0052] In the specific processing of date format unification, the computer selects the corresponding forward function through date processing markers, reads the date value from the intermediate format field, generates the target date representation according to configuration requirements, and writes it to the target field. Simultaneously, the inverse function and constraints corresponding to this processing are stored in the conversion rule dictionary. Whether the date conversion can be completely reversed depends on the information retained in the target representation and the actual conversion requirements.

[0053] In the specific process of medical terminology standardization, the computer calls the corresponding function based on the annotation tags, and converts the input field values ​​into the terminology used in the target format according to preset terminology correspondence rules. The text before and after the conversion may be different, and the corresponding conversion constraints are used to describe the meaning that needs to be preserved and the allowed equivalent expressions. Outlier handling is also determined by the tags to determine the handling function, the specific handling method is specified by the configuration, and corresponding logs are generated during the execution process.

[0054] Transformation constraints and annotation markers together provide the basis for determining the subsequent verification method. Transformations that can unambiguously restore the original field value use exact comparison; transformations that change the form of expression but should maintain semantic consistency use semantic matching; when there is information loss that cannot be fully recovered, fault tolerance judgment is performed based on specific constraints and processing logs. Unit conversions or field splitting are not necessarily irreversible transformations; they need to be determined according to the actual information to be retained.

[0055] During forward transformation, the computer records field mapping relationships and the execution process of processing functions, forming a processing log. The dictionary stores the rules defined by the configuration, while the log stores the actual processing context experienced by the data. The log correlates relevant processing records with their input fields, target fields, and processing methods, allowing for subsequent investigation into the generation process of specific target field values.

[0056] For processing involving multiple input or output fields, the log retains the association information of these fields participating in the same transformation; for unit conversions, precision adjustments, and handling of special values, the log retains the actual processing methods used and the corresponding context. Raw medical data is retained in a controlled environment as a basis for comparison, while the log provides supplementary information to explain the specific transformation process.

[0057] When organizing target data tables, the computer preserves the entity relationships represented by random surrogate keys. Related target records generated for the same patient or the same hospitalization event continue to use the corresponding surrogate keys, ensuring that field transformations and cross-table writes do not change their entity affiliation.

[0058] When the same special processing type applies to multiple fields, the same marker is set in the corresponding remarks field. The computer reads the input from each field and calls the same type of function. When a new special processing type needs to be added, the corresponding forward function and matching reverse function are added in advance, the relationship between the remarks marker and the function is established, and then the function is called through configuration. The conversion configuration can be versioned and reused. Each processing operation builds a corresponding conversion rule dictionary according to the actual loaded configuration.

[0059] After completing this step, the computer obtains the target format data, the transformation rule dictionary, and the processing log. The target format data is used for subsequent reverse engineering, the transformation rule dictionary is used to select pairing functions, determine field correspondences and transformation constraints, and the processing log provides the actual execution context.

[0060] S4. Based on the transformation rule dictionary, call the paired reverse processing function to reconstruct the target format data into a source-level simulation record. Select the matching rule according to the transformation constraints. Use the processing log to compare the source-level simulation record with the indirect identification field in the original medical data to generate a comparison result. The computer reads the target format data, transformation rule dictionary, and processing log generated by S3, and reads the raw medical data to be compared from the controlled environment. The target format field values ​​serve as input for reverse processing, the dictionary is used to select processing functions and determine field relationships, the log provides the execution context, and the raw field values ​​serve as the basis for comparison.

[0061] The computer retrieves corresponding dictionary entries for the target table and target fields to be verified, and reads the field mapping relationships, reverse processing function identifiers, and transformation constraints. The selected reverse function is configured in pairs with the forward function used to generate the target field. For fields that undergo transformation through special memo markers, the special field reverse processing function corresponding to that marker is selected.

[0062] According to the field mapping relationship, the computer reads the target field value required for reverse processing. Single field transformation uses the corresponding target field value as input; when multiple target fields are generated by splitting one field, the relevant target field values ​​participating in the same split are input into the reverse function; when multiple fields are merged to generate one target field, a matching simulated split is performed on the merged result to obtain simulated field values ​​that can be recovered from the target data.

[0063] When the same intermediate format field is mapped to multiple target locations using different rules, data is read and reversed for each transformation path, preserving the results of each path. The range of fields that need to participate in the reconstruction and the transformation paths that need to be verified separately are determined by the mapping relationships in the dictionary, avoiding the situation where some target results cover the differences of other paths.

[0064] The results of reverse processing first correspond to intermediate format fields. Based on the correspondence between the source fields and the intermediate format fields, the computer organizes these simulated field values ​​into their corresponding source field positions, and forms source-level simulated records according to the correspondence between the original records and the processed records. The simulated records employ a structure that allows for comparison with the original fields, and their field values ​​originate from the reverse processing of the target format data.

[0065] For transformations that can be fully recovered, the inverse function returns the recovered field values; for transformations that cannot be fully recovered, the special field inverse function generates a simulated representation for verification based on the target data and transformation context. This simulated reconstruction does not indicate that all discarded information has been recovered; differences corresponding to unrecoverable portions are determined by subsequent transformation constraints and fault tolerance rules.

[0066] The processing log describes the actual splitting, merging, unit conversion, precision adjustment, or special value handling that the relevant fields underwent. The computer provides the execution context from the log to the corresponding reverse processing procedure, enabling it to interpret the target field values ​​according to the actual conversion methods used. The original field values ​​are not directly filled into the source-level simulation records to replace the reconstruction results, avoiding the creation of superficial consistency by copying the benchmark.

[0067] The computer determines the transformation type and selects a matching rule based on transformation constraints and remarks. Reversible, equivalent, and irreversible transformations are used to distinguish verification methods: reversible transformations require the ability to recover and accurately compare the original field values; equivalent transformations allow for changes in expression but require adherence to predefined semantic correspondences; irreversible transformations involve information changes that cannot be fully recovered and require fault tolerance judgment based on specific constraints. The transformation type does not temporarily change due to a failed comparison.

[0068] For reversible transformations, the computer precisely compares the simulated field values ​​with the corresponding non-directly identified field values ​​in the original medical data. A perfect match is marked as successful; otherwise, the difference is recorded, and the verification status is retained. Setting a process as reversible in the configuration does not guarantee that the generated data will pass verification.

[0069] For equivalent transformations, the computer invokes the preset semantic matching rules corresponding to the transformation to verify the consistency between the simulated field values ​​and the original field values. When the standardized expression of medical terminology satisfies the preset synonym relationship with the original expression, it can be marked as verified as passed, while the difference records of different text expressions are retained. For differences that cannot be covered by existing rules or whose meanings cannot be determined, the verification status is retained as failed and submitted for subsequent review.

[0070] The semantic matching rules serve the transformation verification of specific fields, and have a different purpose from the semantic similarity calculation used for candidate field ranking in S1. S1 determines the correspondence between fields. This step judges whether the field values ​​in the corresponding records conform to the equivalent expressions allowed by the transformation. It is not possible to determine whether the field value verification is passed solely based on the similarity of field names or the high field matching score.

[0071] For irreversible transformations, the computer reads the original field values, simulated field values, and processing logs, and checks the location, form of change, and allowable range of the differences based on the transformation constraints. Differences that can be explained by the configured processing and meet the corresponding constraints are marked as allowable losses, and the fields are marked as verified. Differences that do not meet the constraints or cannot be determined based on existing information are left as unverified.

[0072] In cases of numerical precision adjustment, the target format may reduce the number of decimal places, and reverse processing cannot recover the discarded lower digits. The computer, based on the precision requirements specified in the configuration and the actual processing method in the logs, determines the difference between the simulated and original values ​​by comparing them with the corresponding fault tolerance conditions. Differences within the allowable range of this precision processing are acceptable; differences exceeding the range that this processing can explain or containing other abnormal changes cannot be directly marked as acceptable losses.

[0073] In cases of field merging or splitting, the computer determines the information that should be retained and the allowed variations in expression based on rules, and uses logs to confirm the processing relationships between fields. If the target result lacks content required by the rules, the corresponding omission is recorded; if the existing target fields and processing context are insufficient to support the determination, the differences awaiting review are retained. Allowing losses only applies to changes in constraint coverage and is not a pass condition for all refactoring failure scenarios.

[0074] For target fields or transformation results that should be generated according to the mapping relationship but are actually missing, the computer records the missing information and marks the affected fields as failing validation. For null values ​​that are allowed in the original data, the system judges them according to the original field status and the corresponding transformation constraints, so as to distinguish between allowed null values ​​and unexpected missing values ​​generated during the transformation process.

[0075] The scope of reconstruction and comparison is limited to the non-direct identifier fields currently involved in the transformation. Deleted direct identifiers are not included in the scope, and random surrogate keys are not compared for numerical equality with the original identifiers. The computer locates the comparison objects through record-corresponding information in the controlled processing process, ensuring consistency between identifier deletion and field content verification in terms of processing scope.

[0076] After completing the field comparison, the computer summarizes the corresponding fields, verification status, and differences to form the comparison results. Fields that perfectly match are marked as passed; fields that conform to semantic rules are marked as passed with both the verification status and the expression of differences; and fields that meet the fault tolerance conditions are marked as passed with both the verification status and the allowable loss flag. Fields that do not meet the corresponding rules are marked as failed, but the difference information that can locate the relevant source field, target field, and transformation path is retained.

[0077] A failed validation may indicate either a discrepancy that does not comply with the transformation constraints, or that the current automated rules are insufficient to make a judgment. The computer retains the specific details corresponding to both scenarios for subsequent auditing. Reverse comparison is used to check the consistency of transformations under the configuration conditions; whether the meanings of the fields correspond correctly is still verified by the matching confirmation step of S1 and necessary discrepancy audits.

[0078] S5. For fields that fail verification in the comparison results, locate the conversion rules through the conversion rule dictionary, reconvert the desensitized intermediate data according to the received correction configuration, perform reverse reconstruction and comparison on the obtained target format data, and generate updated comparison results.

[0079] The computer reads the S4 alignment results and filters fields requiring further processing based on their validation status. Fields that have passed precise alignment, semantic matching, or fault tolerance are retained in their pass status. For fields that have failed validation, their field information and differences are extracted, and the conversion rule dictionary is retrieved based on the relevant target table, target field, and conversion path.

[0080] The computer reads the corresponding field mapping relationships, forward and reverse processing function identifiers, remarks, and transformation constraints from the dictionary, and determines the original data source based on the correspondence between the source field and the intermediate format field. Simultaneously, it reads relevant processing logs, matching the configured rules with the actual processing procedures the data underwent, thus forming difference location information.

[0081] When the same intermediate format field corresponds to multiple target locations, the location rules are based on the actual target locations where differences occur. When multiple input fields jointly generate the target result, the location information includes the relationships between the fields that participate in the processing. This ensures that the differences observed during the audit correspond to the specific conversion path.

[0082] The computer sends the differences, field relationships, and transformation processing logic to the reviewer. The reviewer displays the original field values, simulated field values, and applicable rules for reviewers to determine the nature of the differences. The review scope covers non-direct identifier fields required for the current audit, and does not require the recovery of deleted direct identifiers as a review condition.

[0083] The computer receives the results returned by the reviewer and performs status updates or configuration corrections based on the results. When the review result indicates that the current difference belongs to an acceptable format change or equivalent semantic expression, the corresponding field is updated to "verification passed," retaining the difference content and review conclusion. This determination applies to differences that have already been reviewed and does not automatically change the verification status of other fields, nor does it automatically adjust the similarity weight or threshold in S1.

[0084] When the audit results indicate that the discrepancy stems from a transformation configuration error or mapping omission, the computer receives corrected configurations for the identified rules. These corrections can relate to the mapping between intermediate format fields and target fields, data standardization rules, memo tags, or transformation constraints. The computer applies the corrections to the corresponding configuration items to obtain the updated transformation configuration.

[0085] When an input field is incorrect, correct the configuration to adjust the data source of the target field; if the corresponding field already exists in the de-identified intermediate data but its mapping is missing in the conversion configuration, supplement the input field, target location, and processing rules; if the remarks tag is incorrect, adjust it to the tag corresponding to the processing requirements. For cases where the current de-identified intermediate data lacks the required input and cannot be corrected through the existing conversion configuration, retain the failed verification status and related differences to avoid artificially adding source data content.

[0086] The computer re-parses the updated transformation configuration and synchronously updates the transformation rule dictionary. When field mappings change, the input-output correspondence is updated; when data standardization rules or memo tags change, the forward function and its corresponding inverse function are redefined and updated in pairs; when transformation constraints change, the information required for subsequent selection of matching rules is synchronously updated.

[0087] The updates to the forward function, inverse function, and transformation constraints are interconnected, ensuring that the regenerated data uses consistent transformation and verification criteria. For newly added special processing requirements, the corresponding forward function, inverse function, and annotation markers are configured first, and then invoked through the corrected configuration. The configuration parsing itself does not replace the implementation of the newly added processing functions.

[0088] After completing the configuration and dictionary update, the computer uses the anonymized intermediate data generated by S2 as the input for re-transformation. It reads field values ​​according to the updated mapping relationship, calls the corresponding forward function to generate new results, and writes them to the corresponding target table and target fields, obtaining the updated target format data. Simultaneously, the actual mapping relationship and function processing steps are recorded, forming an updated processing log.

[0089] When the same correction rule applies to multiple records, the corresponding inputs are processed according to the updated rule, ensuring the correction applies to the data covered by the rule. The regenerated target records retain the original associations represented by the random surrogate keys, and configuration corrections do not reassign patient or hospitalization event identifiers. The original medical data continues to be retained as the comparison benchmark; transformation differences are not eliminated by rewriting the original field values.

[0090] The computer reads the newly generated target field values ​​based on the updated dictionary and calls the reverse function paired with the current forward processing to perform reconstruction. For target fields that need to participate in the processing, the complete input is read according to the updated mapping relationship, and the current processing log is used to provide context to form updated simulated field values, which are then organized into updated source-level simulated records.

[0091] The computer selects matching rules according to the updated transformation constraints, comparing the newly generated source-level simulation records with the corresponding indirect identifier fields in the original medical data. Reversible transformations perform precise comparisons, equivalent transformations perform corresponding semantic checks, and irreversible transformations utilize the current processing log for fault tolerance determination. Direct identifiers are still not included in the reconstruction and comparison scope.

[0092] After this verification is completed, the status and differences of each field are summarized to generate updated comparison results. A corrected configuration does not automatically mean the data verification has passed; fields must meet the corresponding rules in the next round of comparison, or obtain an acceptable audit result for the current differences. For fields that still fail verification, their status is retained, and the corresponding rules are located based on the current dictionary for further verification.

[0093] When all fields to be verified within the current processing scope have passed automatic verification or obtained an acceptable audit conclusion, a verification result corresponding to the target format data is generated. Differences that have not yet been judged or corrected are retained in the result and are not marked as resolved. By continuously linking difference location, audit result reception, configuration update, data regeneration, and reverse comparison, the corrective content is actually applied to the transformation process, and the effect of the correction is checked with the updated comparison results.

[0094] To verify the usability of the dataset processed by the above method in subsequent computer analysis, experiments were conducted on the dataset for medical image segmentation, medical record retrieval, and multimodal data analysis. The experiments used data that had undergone field alignment, direct identifier deletion, format conversion, and reverse reconstruction verification. Clinical records and image data of the same patient were linked using a patient proxy key, and corresponding data content was read according to different tasks to verify whether the generated dataset could support subsequent model input organization and analysis processing.

[0095] In the medical image segmentation experiment, uniformly preprocessed radiological images were input into the MedSAM, MedSAM2, MedSA, and SAMUS models, respectively. Pairwise comparisons were performed on the segmentation masks generated by each model for the same image. The consistency comparison results between the segmentation results of different models are shown in Table 1. The average intersection-union ratio (IUU) between the corresponding segmentation masks of MedSAM2 and MedSA was 0.6858, and the average Dice coefficient was 0.7960. These results reflect the consistency between the outputs of the corresponding models, providing application validation that the generated dataset can support image reading, preprocessing, and model analysis. The consistency of field content during the data conversion process was still evaluated through the comparison results between the aforementioned source-level simulated records and the original medical data.

[0096] Table 1

[0097] In this implementation, field alignment, anonymization, configuration conversion, reverse verification, and feedback correction are performed by corresponding functional units within the computer. Intermediate format data, anonymized intermediate data, target format data, conversion rule dictionary, processing logs, and comparison results are exchanged between these functional units, ensuring that the data or processing basis generated in the previous step can be directly used in subsequent steps. The method achieves consistency maintenance and content verification during the medical data conversion process through specific field reading, association key setting, processing function calls, and data comparison.

[0098] Please see Figure 2 The second embodiment of the present invention provides a medical data desensitization and conversion device based on reverse reconstruction verification, comprising: The field alignment unit 201 is used to calculate the semantic similarity and character similarity between the source field and the intermediate format field, determine the field correspondence based on the weighted result of the two, and map the original medical data into intermediate format data according to the field correspondence. The desensitization processing unit 202 is used to set the same random surrogate key for cross-table records of the same entity in the intermediate format data, and delete the direct identifier to obtain desensitized intermediate data; The configuration conversion unit 203 is used to parse the conversion configuration, establish a conversion rule dictionary based on the field mapping relationship, remark markers and conversion constraints therein, and call the forward processing function according to the conversion rule dictionary to convert the de-identified intermediate data, and generate target format data and processing logs; The reverse verification unit 204 is used to call the paired reverse processing function according to the conversion rule dictionary, reconstruct the target format data into a source-level simulation record, select a matching rule according to the conversion constraints, and use the processing log to compare the source-level simulation record with the indirect identification field in the original medical data to generate a comparison result. The feedback correction unit 205 is used to locate the conversion rule through the conversion rule dictionary for the fields that fail the verification in the comparison result, reconvert the desensitized intermediate data according to the received correction configuration, perform reverse reconstruction and comparison on the obtained target format data, and generate an updated comparison result.

[0099] The third embodiment of the present invention provides a medical data desensitization and conversion device based on reverse reconstruction verification, including a memory and a processor. The memory stores a computer program, which can be executed by the processor to implement the medical data desensitization and conversion method based on reverse reconstruction verification as described in any one of the above embodiments.

[0100] The fourth embodiment of the present invention provides a computer-readable storage medium storing a computer program, which can be executed by the processor of the device where the computer-readable storage medium is located, to implement a medical data desensitization and conversion method based on reverse reconstruction verification as described in any of the above embodiments.

[0101] Exemplary examples show that the computer program described in the third and fourth embodiments of the present invention can be divided into one or more modules, which are stored in the memory and executed by the processor to complete the present invention. The one or more modules can be a series of computer program instruction segments capable of performing specific functions, which describe the execution process of the computer program in implementing a medical data desensitization and conversion device based on reverse reconstruction verification. For example, the apparatus described in the second embodiment of the present invention.

[0102] The processor referred to can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor. This processor is the control center of the aforementioned medical data de-identification and conversion method based on reverse reconstruction verification, connecting various parts of the entire method through various interfaces and lines.

[0103] The memory can be used to store the computer program and / or modules. The processor, by running or executing the computer program and / or modules stored in the memory, and by calling the data stored in the memory, implements various functions of a medical data desensitization and transformation method based on reverse reconstruction verification. The memory may mainly include a program storage area and a data storage area. The program storage area may store the operating system, at least one application program required for a function (such as sound playback function, text conversion function, etc.), etc.; the data storage area may store data created according to the use of the mobile phone (such as audio data, text message data, etc.). In addition, the memory may include high-speed random access memory, and may also include non-volatile memory, such as hard disk, memory, plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, at least one disk storage device, flash memory device, or other volatile solid-state storage device.

[0104] If the implemented module is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, all or part of the processes in the above embodiments of the present invention can also be implemented by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by a processor, it can implement the steps of the various method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or certain intermediate forms. The computer-readable medium can include: any entity or device capable of carrying the computer program code, recording media, USB flash drives, portable hard drives, magnetic disks, optical disks, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signals, telecommunication signals, and software distribution media, etc. It should be noted that the content included in the computer-readable medium can be appropriately added or removed according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, computer-readable media do not include electrical carrier signals and telecommunication signals.

[0105] It should be noted that the device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Furthermore, in the accompanying drawings of the device embodiments provided by this invention, the connection relationships between modules indicate that they have communication connections, which can be specifically implemented as one or more communication buses or signal lines. Those skilled in the art can understand and implement this without any creative effort.

[0106] The above description is merely a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A method for de-identifying and transforming medical data based on reverse reconstruction verification, characterized in that, include: Calculate the semantic similarity and character similarity between the source field and the intermediate format field, determine the field correspondence based on the weighted result of the two, and map the original medical data into intermediate format data according to the field correspondence; Set the same random surrogate key for cross-table records of the same entity in the intermediate format data, and delete the direct identifier to obtain the de-identified intermediate data; Parse the conversion configuration, establish a conversion rule dictionary based on the field mapping relationships, remarks tags and conversion constraints, and call the forward processing function according to the conversion rule dictionary to convert the de-identified intermediate data, generating target format data and processing logs; The paired reverse processing function is called according to the transformation rule dictionary to reconstruct the target format data into a source-level simulation record. The matching rule is selected according to the transformation constraints. The source-level simulation record is compared with the indirect identification field in the original medical data using the processing log to generate a comparison result. For fields that fail verification in the comparison results, the conversion rules are located through the conversion rule dictionary, the desensitized intermediate data is reconstructed according to the received correction configuration, the obtained target format data is reverse-reconstructed and compared, and an updated comparison result is generated.

2. The medical data desensitization and transformation method based on reverse reconstruction verification according to claim 1, characterized in that, The semantic and character similarity between the source field and the intermediate format field are calculated, and the field correspondence is determined based on the weighted result of the two. Specifically: Normalize the source field name and intermediate format field name respectively to obtain the corresponding normalized field name; select a preset number of sample values ​​according to the frequency of non-empty field values ​​in the source field, and concatenate the normalized field name, original field name and selected sample values ​​of the source field to form the source field semantic text; concatenate the normalized field name and original field name of the intermediate format field to form the intermediate format field semantic text. Input the source field semantic text and the intermediate format field semantic text into the locally deployed semantic encoding model to obtain the corresponding normalized semantic vectors; for a candidate field pair consisting of a source field and an intermediate format field, calculate the cosine similarity between the corresponding normalized semantic vectors, and use it as the semantic similarity of the candidate field pair. A character fuzzy matching algorithm is used to compare the source field name and the intermediate format field name in the candidate field pair to obtain the character similarity of the candidate field pair; The overall matching score of the candidate field pairs is calculated using the following formula: in, For the first One source field, For the first An intermediate format field and Indexes for the source field and the intermediate format field, respectively; The overall matching score for the candidate field pairs; The semantic similarity; The character similarity; The preset semantic similarity weights satisfy... , Character similarity weights; Using the comprehensive matching score of each candidate field pair as the matching basis, field matching is performed under the constraint of a one-to-one correspondence between the source field and the intermediate format field to determine the field correspondence.

3. The medical data desensitization and transformation method based on reverse reconstruction verification according to claim 2, characterized in that, The process involves using the comprehensive matching score of each candidate field pair as the matching basis, and performing field matching under the constraint of a one-to-one correspondence between the source field and the intermediate format field to determine the field correspondence. Specifically: For candidate field pairs with character similarity not lower than a preset character similarity threshold, an improvement score is calculated based on the semantic similarity of the candidate field pair according to a preset score improvement rule, and the larger value between the improvement score and the comprehensive matching score is taken as the matching score; for candidate field pairs with character similarity lower than the character similarity threshold, the comprehensive matching score is used as the matching score. Filter candidate field pairs whose matching score is not lower than the preset automatic matching threshold, and sort them in descending order of matching score; check the sorted candidate field pairs one by one, and if neither the source field nor the intermediate format field in the candidate field pair is selected, determine the candidate field pair as an automatic matching item, and mark the corresponding source field and intermediate format field as selected. For a source field with at least two candidate intermediate format fields, calculate the difference between the highest matching score and the second highest matching score corresponding to the source field. When the difference is less than a preset ambiguity judgment threshold, adjust the automatic matching item corresponding to the source field to a suggested item. For a source field that is not determined as an automatic matching item and is not determined as a suggestion item due to the difference, when its highest matching score is not lower than the preset suggestion threshold, the corresponding highest score candidate field pair is determined as a suggestion item; otherwise, the source field is marked as unmapped, wherein the suggestion threshold is lower than the automatic matching threshold. Output the automatically matched items and suggested items, receive confirmation or adjustment instructions for the automatically matched items and suggested items, and determine the field correspondence under the one-to-one correspondence constraint; The character similarity threshold, automatic matching threshold, ambiguity determination threshold, and suggested threshold are all pre-configured fixed thresholds.

4. The medical data desensitization and transformation method based on reverse reconstruction verification according to claim 1, characterized in that, The step of setting the same random surrogate key for cross-table records of the same entity in the intermediate format data and deleting the direct identifier to obtain the de-identified intermediate data is as follows: Based on the existing entity association relationships between different data tables in the intermediate format data, determine the cross-table records belonging to the same entity, randomly generate surrogate keys for the entity, and set the association fields in each cross-table record belonging to the entity as the corresponding surrogate keys. The direct identifier is deleted from the intermediate format data after the association field settings are completed, while the indirect identifier field and the surrogate key are retained to form the desensitized intermediate data. When converting the de-identified intermediate data into target format data, the entity association relationship represented by the surrogate key is preserved, so that different data tables in the target format data are associated through the surrogate key; The reconstruction and comparison ranges of the source-level simulation records do not include deleted direct identifiers.

5. The medical data desensitization and transformation method based on reverse reconstruction verification according to claim 1, characterized in that, The parsing and transformation configuration establishes a transformation rule dictionary based on the field mapping relationships, remarks tags, and transformation constraints. It then calls a forward processing function based on this dictionary to transform the de-identified intermediate data, generating target format data and processing logs. Specifically: Read the JSON format conversion configuration, parse it to obtain the field mapping relationship between intermediate format fields and target format fields, data standardization rules, memo tags and conversion constraints, wherein the memo tags are used to indicate the special processing type of the corresponding target format field; Based on the data standardization rules, determine the forward and reverse processing functions corresponding to ordinary fields, retrieve the forward and reverse processing functions corresponding to special fields based on the remarks tags, and pair the identifiers of each group of forward and reverse processing functions into records. The field mapping relationship, function identifiers of paired records, memo markers, and transformation constraints are stored in the transformation rule dictionary, and the correspondence information between the source field and the intermediate format field is associated with the corresponding field mapping relationship in the transformation rule dictionary according to the field correspondence relationship; According to the field mapping relationship, the values ​​of the fields to be converted corresponding to each target format field are read from the desensitized intermediate data. The corresponding forward processing function is called according to the function identifier in the conversion rule dictionary. The conversion is performed with the values ​​of the fields to be converted as input. The conversion results are written into the corresponding target format fields to form the target format data. Record the field mapping relationship and the execution process of the processing function corresponding to the value of the field to be converted, and form the processing log; When the same intermediate format field corresponds to multiple target tables or target format fields, the corresponding forward processing function is called according to the mapping relationship of each field, and the resulting conversion results are written to the corresponding target tables or target format fields.

6. The medical data desensitization and transformation method based on reverse reconstruction verification according to claim 5, characterized in that, The step of calling the paired reverse processing function according to the conversion rule dictionary to reconstruct the target format data into a source-level simulated record specifically involves: For the field to be verified in the target format data, the corresponding field mapping relationship, reverse processing function identifier and transformation constraint are read from the conversion rule dictionary. The reverse processing function identifier is recorded in pairs with the forward processing function identifier that generates the field to be verified. Read the target format field values ​​that need to participate in the reverse processing according to the field mapping relationship, input the read target format field values ​​into the reverse processing function, perform reverse conversion on the target format field values, and obtain the simulated field values ​​of the corresponding intermediate format fields; Based on the correspondence information between the source fields and intermediate format fields in the conversion rule dictionary, the simulated field values ​​are organized into source-level simulated records with source field structures; For fields to be verified that involve field splitting, field merging, unit conversion, or precision adjustment and cannot fully restore the original field values, the corresponding special field reverse processing function is called according to the transformation constraints. The relevant target format field values ​​are used as the processing objects, and the transformation context information recorded in the processing log is used to perform simulated reconstruction. The obtained simulated field values ​​are written to the corresponding source-level simulated records.

7. The medical data desensitization and transformation method based on reverse reconstruction verification according to claim 6, characterized in that, The step of selecting a matching rule according to the transformation constraints and comparing the source-level simulation record with the indirect identification field in the original medical data using the processing log to generate a comparison result is as follows: Based on the transformation constraints and corresponding remarks, determine the transformation type corresponding to the field to be verified. The transformation type includes reversible transformation, equivalent transformation, and irreversible transformation. For reversible transformations that can unambiguously restore the original field values, an exact matching rule is selected to precisely compare the simulated field values ​​in the source-level simulated records with the field values ​​of the corresponding non-directly identified fields in the original medical data, and fields that are completely consistent are marked as verified. For equivalent transformations where the field expression changes but the semantic consistency of medical data is maintained according to transformation constraints, a corresponding preset semantic matching rule is selected to perform semantic consistency verification between the simulated field value and the corresponding original field value. Fields that meet the preset semantic matching rule are marked as verified. For irreversible transformations that cannot fully restore the original field value, select the corresponding fault-tolerant matching rule, read the transformation context information of the field from the processing log, and make a fault-tolerant judgment on the difference between the simulated field value and the corresponding original field value based on the transformation context information and transformation constraints. Mark the difference that meets the transformation constraints as an allowable loss and mark the corresponding field as verified. Fields that do not meet the selected matching rules are marked as failing validation. The validation status and differences of each field are summarized to generate the comparison results.

8. The medical data desensitization and transformation method based on reverse reconstruction verification according to claim 1, characterized in that, For fields that fail verification in the comparison results, the conversion rules are located using the conversion rule dictionary, and the desensitized intermediate data is re-converted according to the received correction configuration. The resulting target format data is then reverse-reconstructed and compared to generate updated comparison results. Specifically: Extract the fields that failed verification and their corresponding differences from the comparison results. Locate the field mapping relationship, processing function and transformation constraint corresponding to the field according to the transformation rule dictionary. Send the location result and the differences to the review end. Receive the audit result returned by the auditing end. When the audit result indicates that the difference is acceptable, update the verification status of the corresponding field to "verification passed". When the audit result indicates that the conversion rule needs to be corrected, receive the correction configuration for the identified conversion rule. The correction configuration is used to update the transformation configuration, the updated transformation configuration is parsed, and the field mapping relationships, function identifiers, remarks, or transformation constraints in the transformation rule dictionary are updated synchronously. Based on the updated conversion rule dictionary, a forward conversion is performed on the de-identified intermediate data to generate updated target format data and processing logs; Based on the updated transformation rule dictionary, the corresponding reverse processing function is called to perform reverse reconstruction on the updated target format data to obtain the updated source-level simulation record; according to the updated transformation constraints, the matching rule is selected, and the updated processing log is used to compare the updated source-level simulation record with the indirect identification field in the original medical data to generate the updated comparison result.

9. A medical data desensitization and conversion device based on reverse reconstruction verification, characterized in that, include: The field alignment unit is used to calculate the semantic similarity and character similarity between the source field and the intermediate format field, determine the field correspondence based on the weighted result of the two, and map the original medical data into intermediate format data according to the field correspondence. The desensitization processing unit is used to set the same random surrogate key for cross-table records of the same entity in the intermediate format data, and delete the direct identifier to obtain desensitized intermediate data; A configuration conversion unit is used to parse the conversion configuration, establish a conversion rule dictionary based on the field mapping relationship, remarks markers and conversion constraints, and call the forward processing function according to the conversion rule dictionary to convert the de-identified intermediate data, generating target format data and processing logs; The reverse verification unit is used to call the paired reverse processing function according to the conversion rule dictionary, reconstruct the target format data into a source-level simulation record, select the matching rule according to the conversion constraints, and use the processing log to compare the source-level simulation record with the indirect identification field in the original medical data to generate a comparison result. The feedback correction unit is used to locate the conversion rule through the conversion rule dictionary for the fields that fail the verification in the comparison result, reconvert the desensitized intermediate data according to the received correction configuration, perform reverse reconstruction and comparison on the obtained target format data, and generate an updated comparison result.

10. A medical data desensitization and conversion device based on reverse reconstruction verification, characterized in that, The device includes a memory and a processor. The memory stores a computer program that can be executed by the processor to implement a medical data desensitization and conversion method based on reverse reconstruction verification as described in any one of claims 1 to 8.

Images