Information processing system

Abstract

To provide an information processing system that publicizes individual-related information so that an individual cannot be identified.SOLUTION: An SNS information processing system (400) includes: a database (102) for storing individual-related publicized information; an information publicizing server (104); and a person metadata generator (402). The SNS information processing system is connected to the outside via a network (190). The database stores each piece of individual-related publicized information together with a flag showing whether or not the information is publicized so that an individual cannot be identified. The person metadata generator generates person metadata on the basis of the publicized information shown to be publicized so that the individual cannot be identified. The information publicizing server separately publicizes, among the publicized information stored in the database, the publicized information, which is not shown to be publicized so that the individual cannot be identified, and the generated person metadata.SELECTED DRAWING: Figure 4

Description

[Technical Field]

[0001] The present invention relates to an information processing system, and more particularly to an information processing system that processes information relating to an individual. [Background technology]

[0002] In recent years, the usefulness of utilizing big data has been attracting attention. Big data is unstructured and atypical data that comes in a variety of types and formats, and is a collection of data that accumulates and grows daily. Conventional technology was unable to manage such vast amounts of data and so data groups were overlooked, but now they are being recorded, stored, and instantly analyzed, and are being used effectively in business and other areas.

[0003] Big data originates from social networking services (SNS) such as Facebook (registered trademark) and Twitter (registered trademark), and includes the large amounts of information sent out daily from these sources, as well as GPS information from smartphones.

[0004] By utilizing big data, it becomes possible to accurately grasp market needs, for example, in product development, etc. Therefore, data publicly available on the Internet, such as the above-mentioned SNS, has traditionally been used and analyzed as big data.

[0005] It is also expected that information such as medical records and prescriptions of patients and visitors to hospitals and other medical institutions will be used as big data. If information such as medical records and prescriptions can be used as big data, pharmaceutical companies and other such companies will be able to develop products that better meet market needs. Summary of the Invention

[0006] However, SNSs publish information on the Internet so that it can be accessed only by specific people who form a community, or by anyone. Information that is published so that it can be accessed only by specific people is difficult to use as big data because access from outside is restricted. Information that is published so that it can be accessed by anyone can be used as big data.

[0007] Fig. 1 is a diagram showing a schematic configuration of an SNS information processing system. Fig. 1 shows a network 190, such as the Internet, to which an SNS information processing system 100 is connected, and user terminals 160 and 162 and a search server 180 connected to the SNS information processing system 100 via the network 190.

[0008] The SNS information processing system 100 can be configured with one or more computers equipped with a processor such as a CPU, semiconductor memory or magnetic or optical memory, wired or wireless communication devices, input devices such as a keyboard, input pad, mouse pointer, microphone, and output devices such as a display, printer, and speaker.

[0009] The SNS information processing system 100 includes a database (DB) 102, an information disclosure server 104, a communication server 106, and an authentication server .

[0010] The database 102 is a database that stores information for each user of the SNS information processing system 100. The database 102 is held in memory, and information is written to and read from the database 102 in response to a request.

[0011] 2 is a diagram showing an example of user information stored in database 102. Database 102 includes authentication information 202 (user ID, password), registration information 204 (name, date of birth, address, telephone number, email address, gender), and public information 206 (profiles 1 and 2, blog articles, etc.). Database 102 can also include a contact list 208 (names, email addresses, telephone numbers, etc. of other users). The example shown in FIG. 2 shows that information entered / set by user AAA from user terminal 160 is stored.

[0012] The information disclosure server 104 is implemented by causing a processor to execute a program such as an HTML (HyperText Markup Language) server. The information disclosure server 104 can make user information stored in the database 102 publicly available at a specified address.

[0013] FIG. 3 is a diagram showing an example of user information made public by the information disclosure server 104. FIG. 3 illustrates an example of the public information 206 of user AAA stored in the database 102 shown in FIG. 2 arranged in a blog format and made public. User AAA's blog can be accessed from the user terminal 162 of another user (e.g., user BBB in user AAA's contact list) by specifying the Internet address aaa. It can also be searched using the search server 180. In the example of FIG. 3, the blog displays activatable areas (buttons) for sending messages such as emails to AAA and for writing comments on blog posts. For example, user BBB can access the publicly available blog of user AAA from the user terminal 162 and activate the message button, which displays a user interface for sending a message to AAA's email address (ID1@xxx) on the user terminal 162, allowing the user to create and send the message. User BBB can also activate the comment button, which displays a user interface UI for creating a comment on the public information on the user terminal 162, allowing the user to write a comment on the publicly available information.

[0014] The communication server 106 is implemented, for example, by a processor and a communication device that executes a program supporting Internet Protocol (IP) communication. The communication server 106 may be a server that executes a mail server program using protocols such as Post Office Protocol (POP) / Simple Mail Transfer Protocol (SMTP) or Internet Message Access Protocol (IMAP), or a short message service (SMS) program. The communication server 106 may also be a file server that executes a file transfer program using protocols such as File Transfer Protocol (FTP). The communication server 106 may communicate with the user terminals 160 and 162, the search server 180, the information disclosure server 104, the authentication server 108, other mail servers, SNS servers, or other file servers.

[0015] The authentication server 108 provides a function for authenticating users of the information disclosure server 104 (for example, password verification) as well as a function for controlling access to information stored in the database 102 .

[0016] However, as shown in Figure 3, many people feel reluctant to include information about their physical characteristics, such as their constitution, or information about their health or medical history in the information they make public on social media. In other words, they feel reluctant to disclose information about their physical characteristics, such as their constitution, or information about their health or medical history in a way that could identify them. Similarly, some people feel reluctant to disclose information about their hobbies and interests. This affects the amount of information that can be made public on the Internet and used as big data.

[0017] The present invention has been made in view of the above problems, and an object of the present invention is to provide an information processing system that makes information about an individual public in a manner that prevents the individual from being identified.

[0018] In order to solve the above-mentioned problems, an information processing system according to one embodiment of the present invention comprises a storage means connected to the outside via a network and storing information about individuals, an information disclosure means, and a person metadata generation means, wherein the storage means is configured to store each piece of information about individuals with a flag indicating whether the information should be disclosed so that the individual cannot be identified, the person metadata generation means is configured to generate person metadata based on the information about the individual indicated by the flag to be disclosed so that the individual cannot be identified, and the information disclosure means is configured to disclose the person metadata so that it can be accessed via the network.

[0019] According to the present invention, it is possible to provide an information processing system that makes information about an individual public in a manner that prevents the individual from being identified. [Brief explanation of the drawings]

[0020] [Figure 1] FIG. 1 is a diagram illustrating a schematic configuration of an SNS information processing system. [Figure 2] FIG. 2 is a diagram showing an example of user information stored in a database 102. [Figure 3] 10 is a diagram showing an example of user information made public by the information disclosure server 104. FIG. [Figure 4] 1 is a diagram showing a schematic configuration of an SNS information processing system according to an embodiment of the present invention. [Figure 5] FIG. 2 is a diagram showing an example of user information stored in a database 102 according to an embodiment of the present invention. [Figure 6] FIG. 2 is a diagram showing an example of user information stored in a database 102 according to an embodiment of the present invention. [Figure 7] FIG. 10 is a diagram showing an example of user information made public by the information disclosure server 104 according to an embodiment of the present invention. [Figure 8] 1 is a diagram showing a schematic configuration of a hospital information processing system according to an embodiment of the present invention. [Figure 9A]FIG. 8 is a diagram showing an example of patient information stored in a patient information database 802 according to an embodiment of the present invention, and is a diagram showing an example of diagnostic record information. [Figure 9B] FIG. 10 is a diagram showing an example of patient information stored in a patient information database 802 according to an embodiment of the present invention, and is a diagram showing prescription information. [Figure 9C] FIG. 10 is a diagram showing an example of patient information stored in a patient information database 802 according to an embodiment of the present invention, and is a diagram showing prescription information. [Figure 9D] FIG. 10 is a diagram showing an example of patient information stored in a patient information database 802 according to an embodiment of the present invention, and FIG. 11 is a diagram showing prescription information. [Figure 10A] FIG. 9B is a diagram showing person metadata according to an embodiment of the present invention, and is a diagram showing person metadata corresponding to FIG. 9A. [Figure 10B] FIG. 9B is a diagram showing person metadata according to an embodiment of the present invention, and is a diagram showing person metadata corresponding to FIG. 9B. [Figure 10C] FIG. 9D is a diagram showing person metadata according to an embodiment of the present invention, and is a diagram showing person metadata corresponding to FIG. 9C. [Figure 10D] FIG. 9D is a diagram showing person metadata according to an embodiment of the present invention, and is a diagram showing person metadata corresponding to FIG. 9D. [Figure 11] FIG. 2 is a diagram showing a processing flow in the information processing system of the present invention. DETAILED DESCRIPTION OF THE INVENTION

[0021] Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings. The same or similar reference numerals indicate the same or similar elements, and repeated explanations will be omitted. Note that the embodiment described below is an example of the present invention, and therefore the present invention is not limited to the following embodiment and can be implemented in other forms without loss of generality.

[0022] An information processing system according to an embodiment of the present invention is an information processing system connected to an external device via a network, and includes a memory for storing information about individuals, an information disclosure server (SV), and a person metadata generation unit. The memory stores each piece of information about an individual with a flag indicating whether the information should be made public in a manner that prevents the individual from being identified. The person metadata generation unit generates person metadata based on information about the individual that is indicated by the flag to be made public in a manner that prevents the individual from being identified. The information disclosure server separately publishes information about individuals that is not indicated by the flag to be made public in a manner that prevents the individual from being identified and the person metadata so that they can be accessed via the network.

[0023] Person metadata includes all or part of a person's background data. Background data for a person includes, for example, personal information that describes that person's characteristics, such as their personality, hobbies, blood type, height, weight, medical history (e.g., atopy), career history, and contact information. Person metadata can be used to express more detailed characteristics of a person, separate from information that typically identifies that person, such as their personal identification number, name, and address. Information identifying a person, such as their personal identification number, name, and address (hereinafter also referred to as "main data"), and person metadata may be constructed separately and then associated with each other. In another example, the personal identification number may be included in the main data, and the name and address, along with other information elements, may be included in the person metadata. In this case, however, the person's identifying information, such as their name and address, is typically not made public as person metadata.

[0024] Fig. 4 is a diagram showing a schematic configuration of an SNS information processing system according to an embodiment of the present invention. SNS information processing system 400 can be connected to user terminals 160 and 162 and search server 180 via network 190. SNS information processing system 400 shown in Fig. 4 can be configured with one or more computers equipped with a processor such as a CPU, semiconductor memory or magnetic or optical memory, a wired or wireless communication device, input devices such as a keyboard, input pad, mouse pointer, and microphone, and output devices such as a display, printer, and speakers.

[0025] 1, the SNS information processing system 400 includes a database 102, an information disclosure server 104, a communication server 106, and an authentication server 108. As shown in FIG. 4, the SNS information processing system 400 of this embodiment further includes a person metadata generation unit 402.

[0026] The database 102 stores information about each individual user of the SNS system. The database 102 is held in memory.

[0027] 5 is a diagram showing an example of user information stored in the database 102 according to this embodiment. As in FIG. 2, the database 102 includes authentication information 202 (user ID, password), registration information 204 (name, date of birth, address, telephone number, email address, gender), and public information 206 (profiles 1 and 2, blog posts, etc.). The database 102 may also include a contact list 208 (other users' names, email addresses, telephone numbers, etc.). As shown in FIG. 5, the database 102 according to this embodiment includes a flag 502.

[0028] Flag 502 indicates whether each piece of information about an individual stored in database 102 is to be made public in a manner that prevents the individual from being identified. For example, information with a flag set to "1" (e.g., Profile 1, 2) indicates that it will be made public as person metadata, i.e., information that conceals information that identifies the individual, as described below. Information with a flag set to "0" (e.g., blog posts) is made public in the conventional form. Information with a flag set to "1" (e.g., Profile 1, 2) is made public separately from information with a flag set to "0." For example, they may be made public in different designs / formats, on different servers, or at different addresses. Information with a flag set to "1" and information with a flag set to "0" are not provided together with or associated with the other when accessing one of them.

[0029] In the above example, flag "1" is associated with the profile to be made public, but other categories of information may also be associated. For example, each flag value may be associated with a type of public information, such as "1" for "medical data" to be made public, "2" for "hobbies" to be made public, and "3" for "food preferences" to be made public. This makes it possible to organize and search public information.

[0030] In the above, an example was described in which flags are used to identify whether information is to be made public and to identify the category of information. In yet another example, flags can be used to identify whether information is to be made public and to identify who is permitted to access it (the subject of disclosure). For example, as shown in FIG. 6, flags are set in the registration information stored in the database 102 as shown in Table 1. The flag values ​​"0" to "5" shown in Table 1 are pre-associated with whether information is to be made public and who is permitted to access it (the subject of disclosure), as shown in Table 2.

[0031] [Table 1]

[0032] [Table 2]

[0033] In the example shown in Table 1, person metadata is created and published so that email, food preferences (likes), and color preferences are accessible to medical professionals, food manufacturers, and sporting goods manufacturers, but not to publishers, health food manufacturers, and others. Alternatively, instead of creating person metadata, when the information disclosure server 104 publishes the registration information shown in Table 1, it may determine which flag the accessor corresponds to (determine which registration information has been assigned access rights), and allow the access to the registration information according to the determined flag. For example, an accessor accessing information provides information for determining access rights (e.g., information indicating the type of occupation, industry, etc.) from the user terminal 160, 162 to the search server 180 or the information disclosure server 104. The search server 180 provides information for determining access rights from the user terminal to the information disclosure server 104. If the information disclosure server 104 determines based on the provided information that the accessor is a medical professional and corresponds to flag "1," the information disclosure server 104 may be configured to provide the information registered as email, profile 1, color preferences (likes), color tastes (dislikes), and color preferences, and to mask the information registered as name, address, and profile 2. Here, examples such as medical professionals and food manufacturers are given, but the flags do not necessarily represent the type of occupation or industry, and can represent the authority or distinction of the person accessing the data.

[0034] Furthermore, information to be made public may be identified without using flags so that individuals cannot be identified. For example, specific data items in a database record may be predetermined as information to be made public so that individuals cannot be identified. The person metadata generation unit may generate person metadata containing the contents of those data items, and the information disclosure server may then make the information public. For example, a method may be used in which Profile 1 and Profile 2 in Figure 5 are set to be public in advance in the program. Alternatively, all items except for name, address, telephone number, email address, etc. may be determined to be public data. In this case, in addition to the method of generating and disclosing person metadata containing only public information as described below, a concealed disclosure method may also be considered.

[0035] In the example shown in Table 1, a flag 502 is set for each piece of information about an individual stored in database 102, indicating whether the information should be made public without identifying the individual. However, as described above, main data, including data items that identify a person, such as a personal identification number, name, and address, and person metadata, which can be used to describe a person's characteristics in more detail, may be constructed separately and associated with each other. For example, if a person's personal identification number is 0001, the main data for that person may be assigned the identifier A001, and the person metadata may be assigned the identifier B001, and these may be stored in database 102. Information disclosure server 104 may be configured to disclose only the person metadata assigned B001. In this case, only the person metadata content of B001 may be made public, and the personal identification number 0001 included in the main data of A001 may be kept private.

[0036] Alternatively, any other method may be used as long as the main data and person metadata can be stored separately and associated. For example, the main data and person metadata may be stored separately in tabular format, and then another table-format data may be created and stored that associates the two tabular main data and person metadata as information about the same person. Alternatively, instead of another table-format data, the identifier A001 and the identifier B001 may be linked and stored to identify information about a person with a series of identifiers. The tabular data and the series of identifiers are like a kind of map that indicates where the data is stored.

[0037] By linking the main data and person metadata using a separate table-format data or a series of identifiers in this way, even if data is leaked, only the main data, person metadata, or another table-format data or a series of identifiers will be leaked. Therefore, the leaked data alone is not particularly meaningful and is difficult for someone who illegally obtains the data to use, so the damage is minimal and security is safe. Further dividing the person metadata into individual number only, name only, address only (or multiple pieces, such as name and address together), provides greater security because each piece of personal information is divided into multiple pieces of person metadata. The separate table-format data or a series of identifiers may also include a flag indicating whether the person metadata is public. This allows the public or private status of the person metadata to be indicated not by the person metadata but by a separate table-format data or a series of identifiers.

[0038] FIG. 6 is a diagram showing an example of user information stored in database 102 according to an embodiment of the present invention. FIG. 6 shows an example in which information with a flag set to "0" is published at an address that is a combination of aaa, which is the server address, and ID1, which is the user ID of user AAA, and information with a flag set to "1" (e.g., profiles 1 and 2) is published at different addresses. The information disclosure server 104 or another element is configured to determine the server and address that will publish the information with a flag set to "1." The information disclosure server 104 or another element may refer to a list (stored in memory) of multiple servers and addresses that publish person metadata and randomly select a server and address from the list that will publish each piece of person metadata. Such a list may store the person metadata published by each server in association with a theme or category. In this case, the information disclosure server 104 or another element may determine a theme or classification through analysis (e.g., morphological analysis) and judgment (e.g., judgment based on statistical judgment and / or learning model) of the content of the person metadata to be disclosed, and select a server and address that matches this from the list. When a server and address are selected based on analysis of the content of the person metadata to be disclosed, person metadata of the same or similar theme or classification for multiple users (multiple individuals) is aggregated and disclosed on the same server and address.

[0039] The person metadata generator 402 can be implemented by a processor that executes a program stored in a memory. The person metadata generator 402 generates person metadata based on information about an individual that is indicated by a flag to be made public so that the individual cannot be identified.

[0040] 7 is a diagram showing an example of user information made public by the information disclosure server 104 according to an embodiment of the present invention. Of the user information shown in FIG. 6, person metadata 702 and 704 generated from information with a flag set to "1" are made public on different servers and addresses ("bbb" and "ccc"), respectively, while information with a flag set to "0" is made public as AAA's blog at the address "aaa / ~ID1." For example, user BBB, who is registered in user AAA's contact list, can access person metadata 702 and 704 and blog information from user terminal 162. User BBB can recognize that the blog is user AAA's information, but cannot recognize who the person metadata 702 and 704 are related to.

[0041] As shown in FIG. 7 , the information disclosure server 104 publishes person metadata 702, 704 on the user terminals 160, 162 (laptop PCs, tablet PCs, mobile terminals, mobile phones, smartphones) of users who access the person metadata 702, 704, along with an area (button) that can be activated to present a user interface UI for creating a message or comment on the person metadata. The UI is displayed on the user terminal so that the message or comment can be created without specifying the address information of the user (individual) who provided the information that formed the person metadata, or by specifying address information that does not belong to the individual (e.g., a dedicated address for sending messages). For example, a message including the address to which the person metadata will be published is received by the communication server 106 of the SNS information processing system 400, and the comment is stored as log information associated with the person metadata on the server (bbb or ccc) that publishes the person metadata. The communication server 106 may use the individual's address information registered in the database 102 to notify the individual, who is prevented from being identified from the person metadata, of the existence of a message or comment on the person metadata.

[0042] In the above embodiment, the SNS information processing system 100 is configured to be connected to the external search server 180 via a network. However, the SNS information processing system 100 may include the search server 180 itself.

[0043] Furthermore, without using the above-mentioned flags, a specific area stored in the database 102 may be designated in advance to generate person metadata.

[0044] Additionally, the area that can be activated to present the above user interface may instead display an address to which messages or comments should be sent (address information that is not that of the individual in question (e.g., a dedicated address for sending messages)).

[0045] As described above, this embodiment makes it possible to provide an SNS information processing system that publishes information about individuals without identifying them. Because information about individuals can be published without identifying them, it becomes easier to publish information about physical characteristics such as physical constitution, or information about health and medical history. For example, if a user wanted to know information about a medical history or a special hobby, they would conventionally have to inform the other party of their medical history or special hobby, which could lead to problems such as other people finding out about their medical history or special hobby. However, the SNS information processing system of this embodiment solves this problem by publishing the information as person metadata. In other words, it becomes easier to publish information, and it is expected that the information can be utilized as big data. Furthermore, since it is possible to send messages or provide comments on published person metadata, it is expected that feedback on information about medical history or special hobbies will become easier to obtain.

[0046] In the above embodiment, an example of a social networking service (SNS) information processing system has been described. However, the present invention is not limited to SNS information processing systems and can be used in many other embodiments as long as person metadata can be stored separately. For example, by applying the present invention to information about individuals held by companies, facilities, government offices, etc., it is possible to make the person metadata public, share it with others, or exchange it with others and utilize it as big data. For example, the present invention can be implemented as an information system related to medical care or nursing care. Below, an example is described in which the present invention is also implemented as an information processing system related to a hospital (referred to as a hospital information processing system in this specification).

[0047] FIG. 8 is a diagram showing a schematic configuration of a hospital information processing system according to an embodiment of the present invention.

[0048] The hospital information processing system 800 can be connected to the user terminals 160 and 162 and the search server 180 via a network 190. The hospital information processing system 800 can be configured with one or more computers equipped with a processor such as a CPU, semiconductor memory, magnetic or optical memory, wired or wireless communication devices, input devices such as a keyboard, input pad, mouse pointer, microphone, and output devices such as a display, printer, speaker, and the like.

[0049] The hospital information processing system 800 includes an information disclosure server 104, a communication server 106, and an authentication server 108. The hospital information processing system 800 includes a patient information database 802, a person metadata generator 804, and a person metadata database 806.

[0050] The patient information database 802 is a database that stores patient information and is held in memory.

[0051] 9A to 9D are diagrams showing an example of patient information stored in the patient information database 802. FIG. 9A is a diagram showing an example of diagnostic record information 901, and FIGS. 9B to 9D are diagrams showing prescription information 902 to 904 associated with the diagnostic record information 901. As shown in FIG. 9A, the diagnostic record information 901 stores diagnostic record information and prescription information about an individual patient, with a flag indicating whether the information should be made public so that the individual cannot be identified. Patient information (diagnostic record information 901, prescription information 902 to 904) with a flag set to "1" indicates that the information will be made public as person metadata, i.e., information that conceals information that identifies the individual. The diagnostic record information 901 also includes the address to which the patient's information will be made public, and the patient's contact information (e.g., email address) to which the presence of messages or comments on the published person metadata will be notified.

[0052] The person metadata generator 804 can be implemented by a processor that executes a program stored in memory. The person metadata generator 804 generates person metadata based on information about the individual (patient's diagnostic record information 901 and prescription information 902-904) that is flagged as being disclosed so that the individual cannot be identified. For example, the person metadata generator 804 can generate person metadata by deleting information that identifies the individual (name, date of birth, email address) from the patient's information. The person metadata generator 804 can also generate person metadata by replacing information that identifies the individual (name) with an alphanumeric string.

[0053] The person metadata database 806 stores the generated person metadata and is held in memory.

[0054] 10A to 10D are diagrams showing person metadata according to an embodiment of the present invention. FIGS. 10A to 10D show person metadata 1001 corresponding to the diagnosis record information 901 in FIG. 9A and the prescription information 902 to 904 in FIGS. 9B to 9D, respectively. The person metadata 1001 in FIG. 10A has information identifying the individual (patient) removed from the diagnosis record information 901 by deleting the date of birth and replacing the name with numbers. The person metadata in FIGS. 10B to 10D corresponds to the prescription information 902 to 904 in FIGS. 9B to 9D, respectively. The person metadata in FIGS. 10B to 10D has information identifying the individual (patient) removed from the prescription information in FIGS. 9B to 9D by deleting the date of birth and replacing the name with numbers. It would be useful if person metadata including details of a patient's health condition could be used as big data. For example, if pharmaceutical companies could obtain more accurate information about the medications that patients are actually taking, it would be beneficial for the development of new drugs.

[0055] As described with reference to FIG. 7 , the information disclosure server 104 of the hospital information processing system 800 can publish the person metadata 1001-1004. The person metadata 1001-1004 may be published together with an area (button) that can be activated to present a user interface for creating a message or comment on the person metadata on the user terminal of an accessing user. A pharmaceutical company, for example, can access the person metadata 1001-1004 as a search result from the search server 180 from a user terminal 162. At this time, a user interface is displayed on the pharmaceutical company's user terminal 162 so that a message or comment can be created without specifying the address information of the patient (individual) who provided the patient information that formed the person metadata, or by specifying address information that does not belong to the patient (e.g., a dedicated address for sending messages from the hospital information processing system 800). Using this user interface, the pharmaceutical company can create a message or comment on the metadata. For example, a message including the address (http: / / ccc) to which the person metadata is to be made public is received by communication server 106 of hospital information processing system 800, and the comment is stored as log information in association with the person metadata on the server (ccc) that makes the person metadata public. Communication server 106 of the hospital information processing system may use the patient's address information (ID1@xxx) registered in patient information database 802 to notify individuals who are not identifiable from the person metadata of the presence of a message or comment on the person metadata. The patient can access the message or comment on the person metadata from user terminal 160, for example, and view the content.

[0056] As described above, the information disclosure server 104 or another element may determine a theme or category for the content of the person metadata 1001-1004 to be published through analysis (e.g., morphological analysis) and judgment (hard or soft judgment) and then select a server and address that matches this from a list. In this case, person metadata of the same or similar theme or category for multiple users (multiple individuals) is aggregated and published at the same server and address. For example, person metadata related to atopy may be aggregated at server (ccc). In this way, by selecting a server and address according to theme or category, person metadata of the same theme or category can be aggregated at the same server and address. However, multiple areas may be provided on the same server, and person metadata of different themes or categories may be aggregated in different areas.

[0057] 8, the search server 180 can access person metadata published by multiple hospital information processing systems 800, 812, and 814, and can search across these person metadata. The search server 180 may be provided in at least one of the multiple hospital information processing systems 800, 812, and 814.

[0058] In the above description, an example has been described in which the hospital information processing systems 800, 812, and 814 each have a person metadata database 806. However, the person metadata database 806 may also be provided in the external search server 180, and the person metadata generator 804 of each hospital information processing system may store the generated person metadata in the person metadata database 806 of the external search server 180. In this case, the hospital information processing systems 800, 812, and 814 may also store contact information (email addresses) so that notifications regarding the provided metadata can be received from the external search server 180. The external search server 180 provides a search service for the person metadata database 806 and provides person metadata as search results. When a message or comment is generated for person metadata, the external search server 180 can obtain the contact information stored together with the person metadata and notify the hospital information processing system. For example, the notification may include an identification number included in the person metadata. The notification may also include the message or comment, and may include instructions for accessing the message or comment. The communication server 106 of the hospital information processing system in question can obtain contact information (e.g., email address) of the patient who is the source of the person metadata from the patient information database 802 and notify the patient of the presence of a message or comment on the person metadata. As described above, the person metadata generation unit 804 of each hospital information processing system can store the generated person metadata in the person metadata database 806 of the external search server 180. Each hospital information processing system includes a search server 180, and the person metadata generation unit 804 may store the person metadata in a different space within the search server. When storing the person metadata in the external search server 180, the external search server 180 may add additional information in the form of a string that combines an identifier that identifies the theme or classification of the data item and an identifier that identifies whether or not disclosure is permitted and the target of disclosure, and store the additional information together with the person metadata.The search server 180 can use additional information instead of or in combination with the flags described above. For example, the additional information corresponding to the registration information and flags in Table 1 can be organized in string format as follows: A: Yamada Taro: 0; B: Kanagawa Prefecture: 0; B: a@bbb.jp: 125; C: Tennis: 12345; D: Atopy: 34; E: Eel: 125; F: Parsley: 125; G: Yellow: 125, and stored in the person metadata database 806. Here, A through G are examples of identifiers identifying themes or categories, with A being an identifier corresponding to a name, B being an identifier corresponding to contact information, C being an identifier corresponding to hobbies, D being an identifier corresponding to a physical constitution, and E through G being identifiers corresponding to likes and dislikes. The string "D: Atopy: 34" in the additional information indicates that the theme or category of the third data item in the data record corresponds to a physical constitution, the data value is "atopy," and disclosure is permitted for "publishers" and "health food professionals." If information on themes or classifications related to physical constitutions is permitted only to medical professionals, the string in the additional information corresponding to the third data item in the data record can be "D:Atopy:1." Instead of storing data values ​​in each string of the additional information, addresses (pointers) in the recording medium where the data values ​​are stored can be stored. In this way, even if the data storage location is known, a system (e.g., hospital information management systems 800, 812, 814, search server 180) having a person metadata database 806 storing person metadata can refer to the string in the additional information to deny or restrict access to the person metadata, allowing for greater freedom in disclosing or not disclosing the person metadata. Furthermore, even if the string in the additional information is attacked from the outside, it is more secure because the content is not the data value but the address (pointer) in the recording medium where the data value is stored.

[0059] As described above, according to this embodiment, it is possible to provide a hospital information processing system that publishes information about patients (individuals) in a manner that does not allow the patient to be identified. Because patient information can be published in a manner that does not allow the patient to be identified, it is expected that the information can be used as big data. Furthermore, because it is possible to send messages or provide comments regarding the published person metadata, it is expected that feedback for patients will be more easily obtained.

[0060] In the embodiment of the hospital information processing system, an example has been described in which data items (main data) that identify a person, such as a name, and data items (person metadata) that can be used to describe a person in more detail are included in a single table-format data. However, the main data and person metadata may be configured separately and associated with each other. As described above, for example, the main data and person metadata may be stored separately in a table format, and then a separate table-format data may be created and stored that associates the two tabular main data and person metadata as information about the same person. Furthermore, instead of a separate table-format data, the main data identifier and the person metadata identifier may be linked and stored, allowing information about a person with a series of identifiers to be identified.

[0061] Fig. 11 is a diagram showing a processing flow in the information processing system of the present invention. The information processing method shown in Fig. 11 can be implemented in an information processing system including the above-mentioned SNS information processing system 400 or hospital information processing system 800. The user terminal 160 is, for example, a terminal used by a user who publishes personal information as person metadata. The user terminal 162 is a terminal used by a user who accesses the metadata.

[0062] In S1101, the information processing system (communication server) accepts and stores input data. For example, the SNS information processing system 400 communicates with the user terminal 160 operated by the user to receive input profile data and flag settings for the profile. The hospital information processing system 800 also communicates with the user terminal 160 operated by the doctor to receive input patient information (diagnosis record information and prescription information). Flag settings are also received as necessary.

[0063] In S1103, the information processing system (person metadata generation unit) generates person metadata based on the input data. In S1105, the information processing system (information disclosure server) publishes the generated person metadata.

[0064] At S1107, the user terminal sends a search request to the search server. At S1109, the search server executes the requested search. At S1111, the search server returns the search results to the user terminal. At S1113, the user terminal accesses the person metadata and generates and sends a message or comment via a user interface presented on the terminal.

[0065] In S1115, the information processing system (communication server or other element) extracts the address of the provider of the input data corresponding to the person metadata to which the message or comment was sent. The extraction of the address of the provider of the input data can be performed in response to the information processing system (communication server or other element) receiving a message sent to the information processing system's address or detecting that a comment has been logged on a server that publishes person metadata.

[0066] In S1117, the information processing system (communication server) notifies that a message or comment is available.

[0067] In S1119, the user terminal accesses the message or comment addressed to the person metadata.

[0068] In addition, in response to receiving a request to access published person metadata, the information processing system (information disclosure server) may authenticate a user associated with the request. The user authentication may be authentication using an authenticator, including, for example, password authentication or biometric authentication. The authenticator may be previously associated with information indicating the type of occupation, industry, etc., as described above. Similarly, the search server may authenticate a user associated with the search request before executing the requested search.

[0069] As described above, the present invention can be implemented as an information processing method for disclosing information about an individual in a manner that prevents the individual from being identified. The present invention can also be implemented as a computer program that causes a computer to execute the information processing method. [Explanation of symbols]

[0070] 100,400 SNS information processing system 102 databases 104 Information Disclosure Server 106 Communication Server 108 Authentication Server 160, 162 User terminal 180 Search Server 190 Network 202 Authentication Information 204 Registration Information 206 Public Information 208 Contact List 402 Person Metadata Generation Unit 502 Flag 602 Public Address 702,704 Person Metadata 800, 812, 814 Hospital Information Processing System 802 Patient Information Database 804 Person Metadata Generation Unit 806 Person Metadata Database 901 Diagnostic Record Information 902,903,904 Prescription Information 1001,1002,1003,1004 Person Metadata

Claims

1. An information processing system connected to an external device via a network, the information processing system comprising: a storage means for storing information about individuals; an information disclosure means; and a person metadata generation means; the storage means is configured to store each piece of information about the individual with a flag indicating whether or not the information is to be made public so that the individual cannot be identified; the person metadata generation means is configured to generate person metadata based on information about the individual indicated by the flag to be made public so that the individual cannot be identified; the information publishing means is configured to publish the person metadata so that it can be accessed via the network; The information processing system is characterized in that the information disclosure means is configured to disclose information about the individual that is not indicated by the flag as being disclosed so that the individual cannot be identified, and the person metadata separately so that they can be accessed via the network.

2. 2. The information processing system according to claim 1, wherein the information disclosure means is configured to collectively or associatedly disclose person metadata having the same or similar content regarding information about a plurality of individuals.

3. Equipped with means of communication, the storage means is configured to store address information of the individual; the information publishing means is configured to publish the person metadata together with an area that can be activated to present a user interface for creating a message or comment on the person metadata to a user terminal that has accessed the person metadata; the message or comment is made without specifying address information for the individual or specifying address information that is not for the individual; The information processing system according to claim 1 or 2, characterized in that the communication means is configured to notify the individual, who is not identifiable from the person metadata, of the presence of a message or comment on the person metadata using the individual's address information.

4. 4. The information processing system according to claim 1, wherein the information processing system is a social networking service (SNS) information processing system.

5. 5. The information processing system of claim 1, wherein the information processing system is one or more medical, health or welfare information processing systems, and the information about the individual includes at least one of patient diagnostic record information and prescription information.

6. 6. The information processing system according to claim 1, wherein the flag indicates whether or not the information is to be made public in a manner that prevents the identification of an individual, and indicates the type of information to be made public.

7. 6. The information processing system according to claim 1, wherein the flag indicates whether the information is to be made public so that individuals cannot be identified, and indicates a target of the information to be made public.

8. The information processing system of any one of claims 1 to 7, characterized in that the person metadata includes, for each piece of information about the individual, additional information in a string format that combines an identifier that identifies the theme or classification of the information about the individual and an identifier that identifies whether the information about the individual is permitted to be made public and the subject to whom the information about the individual is to be made public.

9. An information processing method implemented by an information processing system connected to an external device via a network and equipped with a storage means for storing information relating to an individual with a flag indicating whether the information is to be made public so that the individual cannot be identified, generating person metadata based on information about the individual indicated by the flag to be made public in a manner that does not identify the individual; publishing the person metadata so that it is accessible via the network; Including, An information processing method characterized in that the step of making public includes a step of making public information about the individual that is not indicated by the flag as being made public so that the individual cannot be identified, and the person metadata, separately so that they can be accessed via the network.

10. A computer with a processor and memory connected to the outside world via a network, Each piece of information about an individual is stored with a flag indicating whether or not the information should be made public so that the individual cannot be identified; generating person metadata based on information about the individual indicated by the flag to be made public in a manner that does not identify the individual; a computer program for publishing the person metadata so that it can be accessed via the network, the computer program comprising: A computer program characterized in that making the person metadata public includes making the person metadata and information about the individual that is not indicated by the flag to be made public so that the individual cannot be identified separately from the person metadata so that they can be accessed via the network.

11. An information processing system connected to an external device via a network, comprising: a storage means for storing information about individuals; an information disclosure means; a person metadata generation means; and a communication means; the person metadata generation means is configured to generate person metadata based on information about the individual that is to be made public so that the individual cannot be identified; the information publishing means is configured to publish the person metadata so that it can be accessed via the network; the storage means is configured to store address information of the individual; the information publishing means is configured to publish the person metadata together with an information area for presenting a user interface for creating a message or comment on the person metadata to a user terminal that has accessed the person metadata; the message or comment is made without specifying address information for the individual or specifying address information that is not for the individual; An information processing system characterized in that the communication means is configured to notify the individual, who is not identifiable from the person metadata, of the presence of a message or comment on the person metadata using the individual's address information.

12. The information processing system of claim 11, wherein the information about the individual that is to be made public so that the individual cannot be identified is based on a specific data item of a database record for the information about the individual stored in the storage means.

Images