Medical data providing system and method for providing medical data

Abstract

To provide a medical data providing system capable of preventing an individual from being identified from medical data to be provided.SOLUTION: In a medical data providing system 1, a consent request regarding the use of medical data is made to subjects whose medical data meet research conditions, the response of each subject indicating whether or not to consent to the use of the medical data is obtained, subjects who meet search conditions and from whom consent has been obtained are extracted, a determination is made as to whether the number of the extracted subjects exceeds a predetermined number, and when the number of the extracted subjects exceeds the predetermined number, the extracted number is output, and when the number of the extracted subjects is equal to or less than the predetermined number, the number is not output and is concealed.SELECTED DRAWING: Figure 9

Description

[Technical Field]

[0001] The present invention relates to a medical data providing system and a medical data providing method for providing, for example, biometric information of an individual. [Background technology]

[0002] Conventionally, large amounts of medical data have been accumulated at various medical institutions. This large amount of medical data is sometimes collected and shared among multiple medical institutions and research institutions for research purposes.

[0003] For example, in a system having a server that stores medical data of multiple users, a medical data viewing method has been proposed that allows external information terminals, such as those of research institutions, to view the medical data based on whether or not the users have consented to sharing the medical data (see Patent Document 1).

[0004] However, in the medical data browsing method of the prior art, when providing data for research purposes, there is a possibility that an individual may be identified from the provided medical data depending on the format of the data provided. In other words, with the prior art, there is a possibility that personal information may be leaked or that an individual may be identified, which is problematic from the perspective of personal information protection. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] Patent Publication No. 2024-4731 Summary of the Invention [Problem to be solved by the invention]

[0006] In view of the above-mentioned problems, the present invention aims to provide a medical data providing system and a medical data providing method that can prevent individuals from being identified from the medical data provided and ensure personal information protection. [Means for solving the problem]

[0007] This invention comprises a management server that manages medical data of a plurality of subjects, and a research institution terminal used by recipients of the medical data, wherein the management server comprises medical data acquisition means for acquiring the medical data including at least the subjects' physical characteristics or medical test results, and medical data storage means for storing the medical data, and the research institution terminal comprises registration means for registering a research plan including research conditions that are conditions for conducting research, and search condition receiving means for receiving input of predetermined search conditions for extracting medical data that can be used for the research, and the management server or the research institution terminal sends the medical data to subjects of the medical data that match the research conditions. The medical data provision system and medical data provision method are characterized by comprising: a consent request means for making a consent request regarding the use of medical data; a response acquisition means for acquiring the subject's response to the consent request as to whether or not they agree to the use of the medical data; a person extraction means for extracting subjects who match the search conditions and for whom consent has been obtained; a data number determination means for determining whether the number of extracted subjects is equal to or less than a predetermined number; a number output means for outputting the number of extracted subjects if the number of extracted subjects exceeds the predetermined number; and a concealment means for concealing the number of extracted subjects without outputting it if the number of extracted subjects is equal to or less than the predetermined number. [Effects of the Invention]

[0008] According to the present invention, it is possible to provide a medical data providing system and a medical data providing method that can prevent individuals from being identified from the medical data provided and ensure personal information protection. [Brief explanation of the drawings]

[0009] [Figure 1] FIG. 1 is a block diagram showing the system configuration of a medical data providing system. [Figure 2] 10 is a flow diagram of a process in which the management server stores medical data. [Figure 3] 10 is a flowchart of a process in which the management server stores agreed-upon data. [Figure 4] Screen layout diagram of the research plan content display screen. [Figure 5] Screen layout diagram of the research participation request display screen. [Figure 6] A diagram showing the screen layout of the detailed display screen before consent. [Figure 7] A diagram showing the screen layout of the detailed display screen after consent. [Figure 8] Screen layout diagram of the consent withdrawal screen. [Figure 9] 10 is a flow diagram of the process in which the management server displays the extraction results on the research institution terminal. [Figure 10] 10 is a diagram showing the layout of a search criteria input screen. [Figure 11] 10 is a diagram showing the screen layout of the normal number of people output screen. [Figure 12] FIG. 10 is a diagram showing the screen layout of the number of people output screen when confidentiality is enabled. DETAILED DESCRIPTION OF THE INVENTION

[0010] An embodiment of the present invention will now be described with reference to the drawings. The present invention relates to a medical data provision system that provides anonymized biometric information of an individual. Fig. 1 is a block diagram showing the system configuration of a medical data provision system 1 according to this embodiment.

[0011] As shown in Figure 1, the medical data provision system 1 includes a medical institution terminal 2 that is mainly used by medical personnel at medical institutions, a management server 3 that stores various data and manages the stored data, a research institution terminal (information terminal) 4 that is mainly used by medical researchers at research institutions, and a subject terminal 5 that is used by people (subjects) whose own medical data exists. The medical institution terminal 2, management server 3, research institution terminal 4, and subject terminal 5 are connected to a public line (public network) 6 such as the Internet.

[0012] A medical institution is a medical facility (medical provider institution) such as a hospital or clinic. A research institution is a facility (medical research institution) that conducts medical research, such as a university. A hospital may also be a medical research institution. Therefore, a terminal installed in a medical facility may function as a medical institution terminal 2 or a research institution terminal 4.

[0013] The medical institution terminal 2, research institution terminal 4, and subject terminal 5 are configured as general-purpose computers (terminals) such as tablet PCs, desktop PCs, notebook (laptop) PCs, or mobile terminals (smartphones). The management server 3 is configured as a general-purpose server computer. The management server 3 may be configured as a single server computer or multiple server computers. Furthermore, some or all of the management server 3 may be cloud servers.

[0014] The medical institution terminal 2 includes a control unit 21, an input unit 22, a display unit 23, a communication unit 24, and an auxiliary storage unit 25. The input unit 22, the display unit 23, the communication unit 24, and the auxiliary storage unit 25 are each connected to the control unit 21.

[0015] The management server 3 includes a control unit 31, an input unit 32, a display unit 33, a communication unit 34, and an auxiliary storage unit 35. The input unit 32, the display unit 33, the communication unit 34, and the auxiliary storage unit 35 are each connected to the control unit 31.

[0016] The research institution terminal 4 includes a control unit 41, an input unit 42, a display unit 43, a communication unit 44, and an auxiliary storage unit 45. The input unit 42, the display unit 43, the communication unit 44, and the auxiliary storage unit 45 are each connected to the control unit 41.

[0017] The subject terminal 5 includes a control unit 51, an input unit 52, a display unit 53, a communication unit 54, and an auxiliary storage unit 55. The input unit 52, the display unit 53, the communication unit 54, and the auxiliary storage unit 55 are each connected to the control unit 51.

[0018] The control unit 21 includes a calculation unit and a main memory unit, and executes various calculations and control operations in the medical institution terminal 2. The control unit 31 includes a calculation unit and a main memory unit, and executes various calculations and control operations in the management server 3. The control unit 41 includes a calculation unit and a main memory unit, and executes various calculations and control operations in the research institution terminal 4. The control unit 51 includes a calculation unit and a main memory unit, and executes various calculations and control operations in the subject terminal 5.

[0019] The calculation unit in the control unit (21, 31, 41, 51) is a calculation processing unit including a CPU or MPU. The main memory unit in the control unit (21, 31, 41, 51) includes a RAM (DRAM) and a ROM. The RAM is used as a work area and buffer area for the calculation unit. The ROM stores default values ​​for startup programs and various information for the medical institution terminal 2, management server 3, research institution terminal 4, or subject terminal 5.

[0020] The input unit (22, 32, 42, 52) includes input components that accept operational inputs and an input detection circuit interposed between the calculation unit in the control unit (21, 31, 41, 51) and the input components. The input components are, for example, a touch panel and / or hardware operation buttons or keys. The touch panel can be of any type, such as a capacitive type, an electromagnetic induction type, a resistive film type, or an infrared type. The input detection circuit outputs an operation signal or operation data corresponding to the operation of each input component to the calculation unit.

[0021] The display unit (23, 33, 43, 53) includes a display and a display control circuit interposed between the calculation unit in the control unit (21, 31, 41, 51) and the display (display device). The display may be, for example, an LCD (liquid crystal display) or an organic EL display. The display control circuit includes a GPU, a VRAM, and the like. Under the direction of the calculation unit, the GPU generates display image data for displaying various screens on the display using image generation data stored in the RAM, and outputs the generated display image data to the display.

[0022] The communication unit (24, 34, 44, 54) includes a communication circuit for connecting to the public line 6. The communication circuit is a wired communication circuit or a wireless communication circuit, and communicates with an external computer via the public line 6 according to instructions from the calculation unit in the control unit (21, 31, 41, 51). The communication unit 24 of the medical institution terminal 2 may also be provided with a communication circuit for connecting to testing equipment installed in the medical institution.

[0023] The auxiliary memory unit (25, 35, 45, 55) is composed of other non-volatile memory such as an HDD, SSD, flash memory, EEPROM, etc., and stores programs and various data for the calculation unit in the control unit (21, 31, 41, 51) to control the operation of the medical institution terminal 2, management server 3, research institution terminal 4, or subject terminal 5.

[0024] The auxiliary memory unit 25 of the medical institution terminal 2 stores a control program for the medical institution terminal to execute various operations of the medical institution terminal 2 in this system in response to operational inputs from the user of the medical institution terminal 2, and medical institution data including test result data of medical tests performed on a person (subject) at a medical institution (hereinafter referred to as "medical data").

[0025] The control program for the medical institution terminal and medical institution data are read out from the auxiliary storage unit 25 as needed and stored (expanded) in the main storage unit (RAM) of the medical institution terminal 2. The operation of the medical institution terminal 2 is realized by the calculation unit executing the control program for the medical institution terminal expanded in the main storage unit (RAM).

[0026] The control program for the medical institution terminal includes a registration program for registering medical data (storing it in the auxiliary storage unit 25), a main processing program for selecting and executing various functions provided in the medical institution terminal 2, and the like.

[0027] The medical data includes at least data on the subject's identification information (subject identification data) for identifying the subject, physical characteristic data such as the subject's gender, height, weight, age, body fat percentage, and BMI, and test result data of tests conducted on the subject. The subject identification data includes data such as the subject's ID, date of birth, name, address information, personal identification number, and health insurance card number. The test result data includes blood pressure values, component values ​​obtained from blood tests, component values ​​obtained from urine tests, images obtained from diagnostic imaging devices such as X-rays and MRIs, and doctor's findings. For example, the medical data may be input via the input unit 22 or transmitted from testing equipment installed in the medical institution.

[0028] The auxiliary memory unit 35 of the management server 3 stores a management program 35a for executing various operations of the management server 3 in this system in response to operational inputs from the user (system administrator) of the management server 3, and management data 35b required for using this system.

[0029] The management program 35a and management data 35b are read out from the auxiliary storage unit 35 as needed and stored (deployed) in the main storage unit (RAM). The operation of the management server 3 is realized by the calculation unit executing the management program 35a deployed in the main storage unit (RAM).

[0030] The management program 35a includes at least a medical data acquisition program for acquiring medical data from the medical institution terminal 2, a research plan acquisition program for acquiring research plan data (research plan data) from the research institution terminal 4, a consent request program for requesting consent from subjects (requesting consent) regarding the use of medical data that can be used for the research plan data, a consented data registration program for registering medical data for which consent regarding the use of the medical data has been obtained as consented data, a search condition acquisition program for acquiring search condition data (search condition data) from the research institution terminal 4, a number extraction program for extracting the number of subjects (number of consenting persons) related to the consented data that matches the search conditions, an output program for outputting the number of consenting persons, and programs for selecting and executing various functions provided by the management server 3.

[0031] The management data 35b includes medical data acquired from the medical institution terminal 2, research plan data and search condition data acquired from the research institution terminal 4, consented data for which consent has been obtained for use of the medical data, and various data for selecting and executing various functions provided by the management server 3.

[0032] The auxiliary memory unit 45 of the research institution terminal 4 stores a control program for the research institution terminal to execute various operations of the research institution terminal 4 in this system in response to operational inputs by the user of the research institution terminal 4, and research institution data required for using this system.

[0033] The control program for the research institution terminal and the research institution data are read out from the auxiliary storage unit 45 as needed and stored (expanded) in the main storage unit (RAM) of the research institution terminal 4. The operation of the research institution terminal 4 is realized by the calculation unit executing the control program for the medical institution terminal that has been expanded in the main storage unit (RAM).

[0034] The control program for the research institution terminal includes a research plan registration program for registering a research plan, a search condition program for registering specified search conditions for extracting medical data to be used in the research, an output program for outputting the number of medical data items available for the research plan, and a main processing program for selecting and executing various functions provided by the medical institution terminal 2.

[0035] The auxiliary memory unit 55 of the subject terminal 5 stores a control program for the subject terminal to execute various operations of the subject terminal 5 in this system in response to operational inputs by the user (subject) of the subject terminal 5, and subject data required for using this system.

[0036] The control program for the subject terminal and subject data are read out from the auxiliary storage unit 55 as needed and stored (expanded) in the main storage unit (RAM) of the subject terminal 5. The operation of the subject terminal 5 is realized by the calculation unit executing the control program for the medical institution terminal expanded in the main storage unit (RAM).

[0037] The control program for the subject terminal includes a response program for prompting the subject to respond as to whether or not they agree to the use of their medical data when a consent request is received, a response sending program for sending the response results to the consent request to the management server 3, and a main processing program for selecting and executing various functions provided by the subject terminal 5.

[0038] 1 are merely examples and are not intended to be limiting. For example, the medical institution terminal 2, management server 3, and research institution terminal 4 may be provided with an interface (external storage medium connector) for reading data from or writing data to various storage media (external storage media) such as an SD card or USB memory. In this case, data may be exchanged between the testing equipment and the medical institution terminal 2, or between the medical institution terminal 2 and management server 3, via the external storage medium.

[0039] 2 is an example of a flow diagram of a process (medical data storage process) in which the control unit 31 of the management server 3 executes a medical data acquisition program to acquire medical data from the medical institution terminal 2 and store the acquired medical data. The flow of the medical data storage process will be described below with reference to FIG. 2.

[0040] First, when the control unit 31 starts the medical data storage process, it acquires (receives) medical data from the medical institution terminal 2 (step S1). As described above, the medical data acquired in step S1 includes subject identification data and subject's physical characteristic data or test result data.

[0041] When the control unit 31 receives the medical data, it searches for registered (stored) medical data in the management data 35b (step S2), and determines whether the medical data received in step S1 is data of a registered subject (step S3). Here, it determines whether the registered medical data contains data of subject identification data that is the same as the medical data acquired in step S1.

[0042] If the medical data received in step S1 is data of a registered subject (step S3: YES), the medical data is registered in association with the subject identification data (step S4), and the medical data storage process is terminated. On the other hand, if the medical data received in step S1 is not data of a registered subject (medical data of a new subject) (step S3: NO), subject identification data to be used in the management server 3 is created and the medical data is registered (step S5), and the medical data storage process is terminated.

[0043] There is no particular limitation on the timing at which medical data is transmitted from the medical institution terminal 2 to the management server 3. For example, the user of the medical institution terminal 2 may transmit medical data from the medical institution terminal 2 to the management server 3 at a timing of his / her choice, or the medical data may be automatically transmitted from the medical institution terminal 2 to the management server 3 at a predetermined timing.

[0044] 3 is an example of a flow diagram of a process (agreed data registration process) in which the control unit 31 of the management server 3 executes an agreed-upon data registration program to register medical data for which consent has been obtained as agreed-upon data. The flow of the agreed-upon data registration process will be described below with reference to FIGS. 3 to 8.

[0045] First, when the control unit 31 starts the consented data registration process, it acquires (receives) research plan data from the research institution terminal 4 (step S11). Here, various conditions related to the research plan (research plan conditions) are set in the research plan data.

[0046] 4 is a screen configuration diagram of the research plan display screen 100. The research plan display screen 100 is a screen displayed on the display unit 43 of the research institution terminal 4, which is mainly used to create (draft) a research plan.

[0047] As shown in FIG. 4, the research plan display screen 100 includes a research plan condition display section 101, a number of people display section 102, a research plan condition setting button 103, a research plan withdrawal button 104, a planned research period extension button 105, a research cancellation button 106, and a research completion button 107. The research plan condition setting button 103, the research plan withdrawal button 104, the planned research period extension button 105, the research cancellation button 106, and the research completion button 107 each function as a software key (operation button) displayed on the screen. Hereinafter, the software key will be simply referred to as a "button." The research plan condition setting button 103, the research plan withdrawal button 104, the planned research period extension button 105, the research cancellation button 106, and the research completion button 107 may each be configured as a hardware key provided on the research institution terminal 4.

[0048] The research plan condition display section 101 includes a research project display section 101a displaying the research project name, a consent request period display section 101b displaying the consent request period (informed consent period), a planned research period display section 101c displaying the planned research period, a desired number of consents display section 101d displaying the desired number of consents to participate in the research (the number desired by the research institution), a questionnaire display section 101e displaying the content of the questionnaire, the distribution date of the questionnaire, and the deadline for response if a questionnaire for the subject is available, a research institution display section 101f displaying the name of the research institution, the address of the research institution, the telephone number of the research institution, and the name of the principal investigator, and a research subject data display section 101g displaying the name of the research subject data, indicating one or more of the physical characteristic data and test result data of the research subject to be used in this research. The consent request period display section 101b and the planned research period display section 101c also display the start date (first day) and end date (last day) of each period. The consent request period is set to a period prior to the planned research period. In addition, the research plan condition display section 101 displays a display section for displaying how to handle data after research completion, which indicates how to handle data after the research is completed, a research details display instruction section for displaying research details on a separate screen, and an ethics review committee review result notification display instruction section for displaying the ethics review committee review result notification on a separate screen.

[0049] The number display unit 102 displays the number of subjects, which indicates the number of subjects who meet the research plan conditions, the number of subjects who consented to the research, which indicates the number of subjects who agreed to the research, and the number of subjects who withdrew their consent, which indicates the number of subjects who once consented but then withdrew their consent.

[0050] The research plan condition setting button 103 is assigned the function of displaying a setting screen (research plan condition setting screen) for setting research plan conditions. When the research plan condition setting button 103 is operated, the research plan condition setting screen (not shown) is displayed. On the research plan condition setting screen, any research plan condition can be set (newly set and modified) according to the research purpose. For example, the research plan condition setting screen is provided with a planned research period input section for inputting the planned research period, a consent request period input section for inputting the consent request period, etc. The data of the research plan conditions set on the research plan display screen 100 is stored in the management server 3.

[0051] The function of withdrawing a research plan before the research begins is assigned to the research plan withdrawal button 104. When the research plan withdrawal button 104 is operated, the withdrawal of the research plan is confirmed. The research plan withdrawal button 104 is configured so that it cannot be operated after the research begins or after the withdrawal of the research plan is confirmed.

[0052] The planned research period extension button 105 is assigned the function of extending the planned research period. When the planned research period extension button 105 is operated, the planned research period is extended by a predetermined period. The extended period is either predetermined, or, alternatively, after the planned research period extension button 105 is operated, a screen for inputting an arbitrary extension period is displayed, and the planned research period can be extended according to the input period. In this way, it is possible to respond flexibly to the progress of the research.

[0053] The research stop button 106 is assigned the function of stopping the research after it has started (accepting the cancellation of the research). The research stop button 106 is configured so that it cannot be operated before the research has started, and when the research stop button 106 is operated, the research is stopped. The management server 3 has a function (research stop notification function) to notify the subject who requested consent of the cancellation of the research when the research is stopped. For example, an email stating that the research has been stopped is sent to the subject terminal 5 used by the subject who requested consent, or a notification screen is displayed on the display unit 53 of the subject terminal 5. In this way, when the research is stopped, the subject who requested consent can recognize that the research has been stopped and can understand that their personal information will not be used any further.

[0054] The function of registering the completion of research is assigned to the research completion button 107. The research completion button 107 is configured so that it cannot be operated before the research has started, and when the research completion button 107 is operated, the completion of research is registered.

[0055] In addition to the conditions mentioned above, the research plan condition display section 101 displays research plan conditions such as a research ID for identifying the research, a statement summarizing the research content (research summary), a statement outlining the research content (research overview), an explanatory statement to be presented to the subject when consent is requested (an explanatory statement regarding research participation), research institution information such as the address and contact information of the research institution, the name of the research director (principal researcher) and the names of co-researchers.

[0056] Returning to Figure 3, the control unit 31 designates medical data that matches the research plan (research plan conditions) as data subject to a consent request (step S12), and determines whether the start of the consent request period has passed and is before the end of the consent request period (within the consent request period) (step S13).

[0057] If the start date of the consent request period has passed and the end date of the consent request period has not yet passed (i.e., the consent request period is still in progress) (step S13: NO), the control unit 31 executes a consent request to the subject related to the requested data (step S14).

[0058] Fig. 5 is a screen configuration diagram of the research participation request display screen 110. Fig. 6 is a screen configuration diagram of the pre-consent detail display screen 120. Note that the research participation request display screen 110 and the pre-consent detail display screen 120 are screens that are mainly displayed on the display unit 53 of the subject terminal 5 of the subject (request subject) related to the requested data.

[0059] 5, a research participation request display screen 110 is provided with a research participation request display section 111 that displays a research participation request. The research participation request display section 111 is provided with an individual content display section 112 for each research plan. In addition, a details confirmation button 113 is provided in association with the individual content display section 112.

[0060] An outline of the corresponding research plan is displayed in the individual content display section 112. For example, the individual content display section 112 displays the name of the research topic, the name of the research organization that created the research plan, the data to be used set in the research plan, the period for soliciting research participants, the planned research period, a research summary, etc. The period for soliciting research participants is automatically set to the same period as the consent request period.

[0061] When the details confirmation button 113 is selected, a pre-consent details display screen 120 is displayed, showing details of the research plan (selected research plan) associated with the selected details confirmation button 113, as shown in Fig. 6. The pre-consent details display screen 120 is the screen displayed before consent is given regarding the use of medical data.

[0062] The pre-consent detail display screen 120 has a research plan condition display section 121, a questionnaire response button 122, and an consent button 123. The research plan condition display section 121 displays information indicating the research plan conditions, such as the research topic name, the recruitment period for research participation, the planned research period, the research summary, the research outline, an explanation regarding research participation, the questionnaire, the name of the research organization that formulated the research plan, research institution information, the name of the principal researcher, the names of the co-researchers, the data to be used set in the research plan, an explanation regarding the handling of data after the research is completed, and detailed materials.

[0063] The questionnaire response button 122 is assigned a function of displaying a questionnaire screen regarding the research plan. When the questionnaire response button 122 is selected, a questionnaire screen (not shown) regarding the research plan is displayed. The subject can respond to the questionnaire by following the questionnaire screen. The contents of the questionnaire may include medical information such as information about daily lifestyle habits, medication status, and other illness treatment status.

[0064] The consent button 123 is assigned the function of giving consent regarding the use of medical data for the selected research plan. When the consent button 123 is selected, the request subject is treated as having given consent regarding the use of medical data for the selected research plan in the medical data provision system 1. In other words, the medical data provision system 1 treats the request subject as having given consent regarding the requested data corresponding to the utilization data set in the research plan.

[0065] Returning to Figure 3, the medical data for which consent has been obtained is registered as consented data (step S15), and the consented data for which consent has been withdrawn is deleted (step S16), and the process returns to step S13. Note that in step S16, the data is simply deleted as consented data, and the original medical data remains. On the other hand, if the consent request period has ended (step S13: YES), the consented data registration process is terminated.

[0066] Here, we will explain the case where consent is withdrawn. Fig. 7 is a screen configuration diagram of the details display screen 130 after consent is given. Fig. 8 is a screen configuration diagram of the consent withdrawal screen 140. Note that the details display screen 130 after consent and the consent withdrawal screen 140 are screens that are mainly displayed on the display unit 53 of the target person terminal 5 of the target person (request target) who has registered the request target data.

[0067] When the details confirmation button 113 (see Figure 5) for the research plan for which consent has been obtained is selected, a post-consent details display screen 130 is displayed, as shown in Figure 7. The details display screen 130 is the screen that appears after consent regarding the use of medical data has been given.

[0068] The detailed display screen 130 after consent is provided with a research plan condition display section 131, a questionnaire response button 132, and a consent withdrawal button 133. The research plan condition display section 131 displays information indicating the same research plan conditions as the research plan condition display section 121 on the detailed display screen 120 before consent.

[0069] The questionnaire response button 132 is assigned the same function as the questionnaire response button 122. The request recipient can select the questionnaire response button 132 to respond to the questionnaire or to correct the content of their response.

[0070] The consent withdrawal button 133 is assigned a function of transitioning to a consent withdrawal screen 140 (see FIG. 8) for withdrawing consent. When the consent withdrawal button 133 is selected, the consent withdrawal screen 140 for withdrawing consent is displayed, as shown in FIG.

[0071] The consent withdrawal screen 140 is provided with a reason for withdrawal input section 141 for inputting the reason for withdrawing consent, a caution explanation section 142, a back button 143, and a consent withdrawal decision button (confirmation button) 144.

[0072] The cancellation reason input unit 141 has a standard reason selection unit 141a that presents options corresponding to standard reasons (standard reasons) and allows the user to select a standard reason, and an arbitrary reason input unit 141b that allows the user to input an arbitrary reason. For example, the standard reason selection unit 141a has a pull-down menu that displays options corresponding to the standard reasons. The arbitrary reason input unit 141b has a text box that accepts arbitrary character input.

[0073] The precautions explanation section 142 has an explanation (precautions explanation) that explains precautions to take when withdrawing consent, and a confirmation section 142a that indicates an intention to confirm and understand the precautions. The confirmation section 142a is a checkbox, and selecting a blank checkbox checks the checkbox and indicates a selected state, while selecting a checked checkbox removes the check from the checkbox and indicates a non-selected state. When the checkbox is selected, it is treated as an intention to confirm and understand the precautions.

[0074] The back button 143 is assigned a function to return (transition to) the screen before the consent withdrawal screen 140 (the post-consent detail display screen 130 or the research participation request display screen 110). When the back button 143 is selected, the screen returns to the previous screen without the consent being withdrawn (the consent is maintained).

[0075] The consent withdrawal decision button 144 is assigned the function of deciding (confirming) the withdrawal of consent. When the consent withdrawal decision button 144 is selected, it is treated as if consent has been withdrawn (the consented data is deleted). Note that when consent is withdrawn for a certain research plan, the consent button 123 is not displayed on the detail display screen 120 for that research plan before consent.

[0076] 9 is a flow diagram of a process (extraction result output process) in which the control unit 31 of the management server 3 outputs (displays) the extraction results on the research institution terminal 4. The flow of the extraction result output process will be described below with reference to FIGS. 9 to 12.

[0077] First, when the control unit 31 starts the extraction result output process, it acquires search condition data from the research institution terminal 4 (step S21). In the search condition data, conditions (search conditions) for extracting medical data to be used in research are set.

[0078] 10 is a screen configuration diagram of a search condition input screen 150. The search condition input screen 150 is a screen that is mainly displayed on the display unit 43 of the research institution terminal 4. As shown in FIG. 10, the search condition input screen 150 is provided with a search title input section 151, a search item setting section 152 for setting items (search items) for searching for research subjects, a search condition setting section 153, a search formula display section 154, and a search execution button 155.

[0079] The search title input section 151 is provided with a text box for accepting input of an arbitrary search title. The user of the research institution terminal 4 can input any text as a search title into the search title input section 151.

[0080] The search item setting unit 152 is provided for setting items related to search conditions (search items). In the search item setting unit 152, search items can be selected by dividing them into major items, medium items, and minor items in order of the range of information they contain. For the major items and medium items, buttons corresponding to each item are displayed in a list, and buttons for selecting minor items are displayed according to the selected major item or medium item. The buttons for selecting minor items are check boxes, and selecting a check box can switch between a selected state and a non-selected state.

[0081] In the search condition setting section 153, items (selected items) that have been selected using buttons for selecting sub-items are displayed side by side. In the search condition setting section 153, specific search conditions such as ranges (numerical ranges, etc.) can be set for each selected item. In addition, in the search condition setting section 153, it is also possible to select whether to perform an AND search or an OR search for each selected item.

[0082] The search conditions set in the search condition setting section 153 are displayed in the form of a search formula in the search formula display section 154. When the contents of the search condition setting section 153 are changed, the display contents of the search formula display section 154 are automatically changed to match the changed search conditions.

[0083] The search execution button 155 is assigned a function of confirming the search conditions and executing the search. At this time, the confirmed search condition data is sent to the management server 3. Returning to Fig. 9, when the control unit 31 acquires the search condition data in step S21, it extracts the consented data and the number of subjects that currently match the search conditions (step S22), and determines whether the number of subjects extracted in step S22 (the consented number) is equal to or less than a predetermined number (predetermined number) (step S23).

[0084] The predetermined number can be arbitrarily determined by the user (system administrator) of the management server 3 depending on the type of data to be provided and the risk of personal information being leaked. For example, it can be 10, 50, 100, etc. In this embodiment, the predetermined number is set to "10."

[0085] If the number of extracted subjects is not less than the predetermined number (if it exceeds the predetermined number), the extraction result is output (step S24), and the extraction result output process ends. On the other hand, if the number of extracted subjects is less than the predetermined number, the extraction result is partially concealed (step S25), and the extraction result output process ends.

[0086] Fig. 11 is a screen configuration diagram of a normal number of people output screen 160A (160). Fig. 12 is a screen configuration diagram of a number of people output screen 160B (160) when the number of subjects is concealed.

[0087] The normal number of people output screen 160A and the number of people output screen 160B when the number of subjects is concealed are screens that are mainly displayed on the display unit 43 of the research institution terminal 4 based on the data on the number of subjects output from the management server 3.

[0088] As shown in FIGS. 11 and 12, the number of people output screen 160A and the number of people output screen 160B are provided with an agreed number of people display section 161, a statistical available number of people display section 162, a search condition summary display section 163, and a back button 164.

[0089] Regardless of whether the number of people who have given consent is equal to or less than a predetermined number, the number of people who can use the statistics and the number of medical data items that can be used in relation to the number of people who can use the statistics are displayed in the statistical use number display section 162. Note that the statistical use data is not personal data, and therefore can be used without obtaining consent.

[0090] An outline of the set search conditions (search title, search conditions, and search formula) is displayed in the search condition outline display section 163. A back button 164 is assigned the function of returning to the previous screen (search condition input screen 150).

[0091] As shown in Figure 11, if the number of people who have given their consent exceeds a predetermined number, the number of people who have given their consent display section 161A displays the number of people who have given their consent, and the number of available consented data items related to the number of people who have given their consent. When the extraction results are output in step S24, a number of people output screen 160A is displayed. The number of people output screen 160A also has a registration button 165 for importing the extraction results (number of people and available consented data) into the research plan data. When the registration button 165 is selected, the number of extracted subjects and the available consented data are stored in the management server 3 in association with the research plan data.

[0092] On the other hand, as shown in FIG. 12, if the number of people who have given consent is equal to or less than the predetermined number, the number of people and the available consented data are not displayed in the number of people who have given consent display section 161B. In other words, the extraction results are partially concealed. If the extraction results are partially concealed in step S25, the number of people output screen 160B is displayed. Furthermore, the number of people output screen 160B does not have a registration button 165. In other words, if the number of people who have given consent is equal to or less than the predetermined number, the number of people and the available consented data cannot be stored in association with the research plan data. Therefore, the user of the research institution terminal 4 must change the search conditions or, if it is within the consent request period, search again at a later time so that the number of people who have given consent exceeds the predetermined number.

[0093] In any case, according to the present invention, if the number of people who have consented at the time of search is below a predetermined number, the number of subjects and the available consented data are not displayed and are kept confidential, thereby providing a medical data provision system that does not allow individuals to be identified.

[0094] In addition, subjects can decide whether or not to consent after reviewing the outline and details of the research plan, which prevents them from cooperating with research that they do not wish to participate in. Furthermore, subjects can withdraw their consent, which can prevent inconvenience if the content of their cooperation differs from what they expected or if their living environment changes.

[0095] In addition, if there are few subjects who qualify for the research, the number of subjects who consent will be kept confidential, preventing the subjects who meet the conditions from being identified (for example, someone who matches the height of the tallest person in Japan).

[0096] Furthermore, since it is possible to terminate research and notify the subjects of the termination, research termination can be carried out smoothly for various reasons.

[0097] Furthermore, because it is possible to administer questionnaires to subjects who have agreed to participate in research, it is possible to obtain data from various perspectives, such as follow-up surveys of separate test results at a later date, follow-up surveys of subsequent progress, follow-up surveys of physical sensations, etc. Therefore, researchers can analyze the results of their research in detail for a large number of people, and it can be used effectively.

[0098] The management server in this invention corresponds to the management server 3, and similarly below, the research institution terminal corresponds to the research institution terminal 4, the medical data acquisition means corresponds to the control unit 31 of the management server 3 that executes step S1, the medical data storage means corresponds to the auxiliary storage unit 35 of the management server 3 and the control unit 31 of the management server 3 that executes steps S4 and S5, the search condition acceptance means corresponds to the search condition input screen 150, the search item setting unit 152 and the search condition setting unit 153, the consent request means corresponds to the control unit 31 of the management server 3 that executes step S14, or the research participation request display screen 110 and the pre-consent detail display screen 120, the response acquisition means corresponds to the control unit 31 of the management server 3 that executes step S15, or the pre-consent detail display screen 120 or the consent button 123, and the subject extraction means corresponds to the control unit 31 of the management server 3 that executes step S22, or the search condition The input screen 150 and the search execution button 155 correspond to the input screen 150 and the search execution button 155, the number of people output means corresponds to the control unit 31 of the management server 3 that executes step S24, or the normal number of people output screen 160A and the number of people who have consented display unit 161A, the concealment means corresponds to the control unit 31 of the management server 3 that executes step S25, or the number of people output screen 160B and the number of people who have consented display unit 161B, the planned research period input means corresponds to the research plan condition setting screen and the planned research period input unit, the planned research period extension means corresponds to the planned research period extension button 105, the research cancellation acceptance means corresponds to the research cancellation button 106, the notification means corresponds to the research cancellation notification function of the management server 3, the questionnaire sending means corresponds to the pre-consent detail display screen 120 and the questionnaire response button 122, and the reminder means corresponds to the reminder button described below, but this invention is not limited to this embodiment and can be various other embodiments. Furthermore, the specific configurations etc. listed in the above embodiment are merely examples and can be changed as appropriate depending on the actual product.

[0099] For example, the system may further include a reminder means for reminding a requesting subject (requested subject) to complete a questionnaire if the subject has not completed the questionnaire. Specifically, if there are requesting subjects who have given consent but have not completed the questionnaire, the research institution terminal 4 may be configured to display a list of requesting subjects who have not completed the questionnaire, and a reminder button that is assigned the function of reminding specific requesting subjects or all unanswered requesting subjects. In this case, when the reminder button is selected, an email urging the requesting subject to complete the questionnaire is sent to the subject terminal 5 used by the requesting subject, or a notification screen informing the requesting subject of the questionnaire is displayed on the display unit 53 of the subject terminal 5. This can increase the response rate to the questionnaire and enable research to be conducted using more information.

[0100] In the above embodiment, consent is obtained by selecting the consent button 123 displayed on the subject terminal 5 (consent by electromagnetic means), but this is not a necessary method and consent may be obtained in writing. For example, a consent document may be given to the subject by mail or hand delivery, and the subject may then send the document containing the necessary information (signature, seal, etc.) to indicate their consent to the system administrator. [Industrial Applicability]

[0101] The present invention can be applied to the medical data providing system and medical data providing method industry that provides biometric information of individuals. [Explanation of symbols]

[0102] 1. Medical data provision system 2...Medical institution terminal 3...Administrative Server 4...Research institution terminal 5...Target device 6...Public line 21, 31, 41, 51...Control section 22, 32, 42, 52...input section 23, 33, 43, 53...Display section 24, 34, 44, 54...Communications Department 25, 35, 45, 55...Auxiliary storage section 35a...Management Program 35b...Administrative data

Claims

1. a management server that manages medical data of multiple subjects; a research institution terminal used by a recipient of the medical data; The management server a medical data acquisition means for acquiring the medical data including at least the subject's physical characteristics or medical test results; medical data storage means for storing the medical data; The research institution terminal includes: a registration means for registering a research plan including research conditions, which are the conditions for conducting medical research; a search condition receiving means for receiving input of predetermined search conditions for extracting medical data to be used in the research; The management server or the research institution terminal consent request means for requesting consent regarding the use of the medical data from the subject of the medical data who meets the research conditions; a response acquisition means for acquiring a response from the subject as to whether or not the subject agrees to the use of the medical data in response to the consent request; a subject extraction means for extracting subjects who meet the search conditions and for whom consent has been obtained; a data number determination means for determining whether the number of extracted subjects is equal to or less than a predetermined number; a number output means for outputting the number of extracted subjects when the number of subjects exceeds a predetermined number; and an anonymization means for anonymizing the number of extracted subjects without outputting the number of subjects when the number of extracted subjects is equal to or less than a predetermined number. Medical data provision system.

2. The research plan includes data on the planned research period during which the research will be conducted; The research institution terminal includes: a planned research period input means for inputting the planned research period; and a planned research period extension means for extending the planned research period. The medical data providing system according to claim 1.

3. the research institution terminal further comprises a research cancellation acceptance means for accepting cancellation of research related to the research plan; The management server or the research institution terminal The system further includes a notification means for notifying the subject who requested consent of the study that the study will be discontinued if the study is discontinued. The medical data providing system according to claim 2.

4. The management server or the research institution terminal has a questionnaire sending means for sending a questionnaire to subjects; The system further comprises a reminder means for reminding the subject to answer the questionnaire if the subject has not answered the questionnaire.

4. The medical data providing system according to claim 1, 2 or 3.

5. A medical data provision method in a medical data provision system including a management server that manages medical data of multiple subjects and a research institution terminal used by a recipient of the medical data, The management server obtaining said medical data including at least a physical characteristic or medical test result of the subject; storing the medical data; The research institution terminal includes: Register a research plan, including the research conditions, which are the conditions for conducting medical research; Accepting input of predetermined search conditions for extracting medical data to be used in the research; The management server or the research institution terminal Request consent for the use of said medical data from the subjects of said medical data who meet the conditions of said research; Obtaining the subject's response to the consent request as to whether or not they consent to the use of the medical data; Extracting subjects who meet the search criteria and have given consent; Determine whether the number of extracted subjects is equal to or less than a predetermined number; If the number of extracted subjects exceeds a predetermined number, the number of subjects is output. If the number of extracted subjects is less than a predetermined number, the number is not output and is kept confidential. How medical data is provided.

Images