Medical Data Management System

Abstract

To facilitate association between an analysis result of anonymous medical data and medical data before anonymization.SOLUTION: A medical data management system according to an embodiment comprises: a management server; and an analysis server. The management server anonymizes medical data including personal information to create anonymous medical data not including the personal information. The management server gives an anonymous ID which is associated with a personal ID within the personal information to the anonymous medical data, and transmits anonymous medical data, to which the anonymous ID is given, to the analysis server. The management server causes an analysis result sent back from the analysis server to be stored in a storage unit. The analysis server analyzes the transmitted anonymous medical data to obtain an analysis result. The analysis server gives the anonymous ID which is given to the transmitted anonymous medical data to the analysis result, and sends back the analysis result, to which the anonymous ID is given, to the management server.SELECTED DRAWING: Figure 5

Description

[Technical Field]

[0001] FIELD OF THE INVENTION An embodiment of the present invention relates to a medical data management system. [Background technology]

[0002] In recent years, efforts to implement PHR (Personal Health Record) have become popular in the United States. PHR is a system in which personal medical data is owned and managed by each individual, not a hospital. According to PHR, each individual's medical data may be stored on a PHR server in an environment such as the cloud.

[0003] On the other hand, there is a system for supporting medical treatment by sending medical data such as CT (computed tomography) images to an analysis server, which then returns the analysis results. Applying this system could increase demand for services that analyze medical data. For example, in addition to providing medical treatment support to hospitals, individuals may request the service to analyze medical data stored on their personal health record (PHR) servers. In this case, the medical data requested for analysis must be anonymized in advance.

[0004] Therefore, the PHR server anonymizes the medical data by deleting personal information from the medical data in advance and transmits the resulting anonymous medical data. The analysis server analyzes the anonymous medical data and returns the analysis results to the PHR server.

[0005] However, there is a concern that it may be difficult for the PHR server to associate the analysis results of anonymous medical data with the medical data before anonymization. [Prior art documents] [Patent documents]

[0006] [Patent Document 1] Japanese Patent Application Publication No. 2018-36836 Summary of the Invention [Problem to be solved by the invention]

[0007] One of the problems to be solved by the embodiments disclosed in this specification and the drawings is to facilitate association of the analysis results of anonymous medical data with the medical data before anonymization.

[0008] However, the problems to be solved by the embodiments disclosed in this specification and the drawings are not limited to the above problems. Problems corresponding to the effects of the configurations shown in the embodiments described below can also be positioned as other problems. [Means for solving the problem]

[0009] A medical data management system according to an embodiment includes a management server and an analysis server. The management server includes an anonymization unit, a first assignment unit, and a control unit. The analysis server includes an analysis unit and a second assignment unit.

[0010] The anonymization unit anonymizes medical data including personal information to generate anonymous medical data that does not include the personal information. The first assignment unit assigns an anonymous ID associated with a personal ID in the personal information to the anonymous medical data and transmits the anonymous medical data with the anonymous ID assigned to the analysis server. The control unit stores the analysis results returned from the analysis server in a storage unit.

[0011] The analysis unit analyzes the transmitted anonymous medical data to obtain an analysis result, and the second assignment unit assigns the anonymous ID assigned to the transmitted anonymous medical data to the analysis result and returns the analysis result with the assigned anonymous ID to the management server. [Brief explanation of the drawings]

[0012] [Figure 1] FIG. 1 is a block diagram showing an example of the configuration of a medical data management system according to the first embodiment. [Figure 2] FIG. 2 is a block diagram showing an example of the configuration of the PHR server in the first embodiment. [Figure 3]FIG. 3 is a schematic diagram illustrating the memory of the PHR server in the first embodiment. [Figure 4] FIG. 4 is a block diagram illustrating an example of the configuration of the analysis server according to the first embodiment. [Figure 5] FIG. 5 is a sequence diagram illustrating an example of an operation in the first embodiment. [Figure 6] FIG. 6 is a schematic diagram for explaining an example of the operation in the first embodiment. [Figure 7] FIG. 7 is a schematic diagram for explaining the memory of the PHR server in a modified example of the first embodiment. [Figure 8] FIG. 8 is a sequence diagram illustrating an example of an operation in the second embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0013] The medical data management system according to each embodiment will be described below with reference to the drawings. In the following description, an example is given in which the management server is a PHR server and the network is the Internet. However, the medical data management system is not limited to these examples. For example, instead of a PHR server for individuals to manage their medical data, the management server may be an EHR (electronic health record) server for sharing medical data among multiple medical institutions. Also, for example, instead of the Internet, the network may be a WAN (wide area network).

[0014] First Embodiment 1 is a block diagram showing an example of the configuration of a medical data management system according to the first embodiment. This medical data management system includes a PHR server 10 and an analysis server 20 connected to each other via a network NW such as the Internet.

[0015] As shown in FIG. 2, the PHR server 10 includes a memory 11, a communication interface 13, and a processing circuit 15.

[0016] The memory 11 is composed of memory units that record electrical information, such as a read-only memory (ROM), a random access memory (RAM), a hardware disk drive (HDD), and an image memory, as well as peripheral circuits associated with the memory units, such as a memory controller and a memory interface. The memory 11 stores various programs, such as the program for the PHR server 10, and various data, such as medical data, anonymous medical data, analysis results, pre-processed data, in-process data, processed data, pre-saved data, and correspondence tables. Medical data may include, for example, image data based on the DICOM standard or data based on the HL7 standard. DICOM stands for "Digital Imaging and Communication in Medicine." HL7 stands for "Health Level Seven." Pre-saved data may include, for example, a public key certificate for each individual. As correspondence tables, for example, an ID correspondence table 11a and a data correspondence table 11b, as shown in FIG. 3, may be used as appropriate.

[0017] The ID correspondence table 11a describes mutually associated personal IDs, anonymous IDs, etc. Here, ID is an abbreviation for identification information.

[0018] A personal ID is a code that can uniquely identify an individual, such as a patient number or My Number, and is included in personal information. Personal information can be, for example, a personal ID (patient number, My Number), name, date of birth, address, age, gender, or any combination thereof that can uniquely identify an individual.

[0019] The anonymous ID is a code that can identify anonymous medical data, such as a random number or pseudo-random number, that is assigned to anonymous medical data before transmission, and is not included in personal information. For example, a number consisting of numeric or alphanumeric characters, a random character string, an encryption key (personal public key), a hash value, an HTTP session ID, etc. can be used as appropriate as the anonymous ID. The HTTP session ID may be included in a cookie or in a hidden field.

[0020] The data correspondence table 11b describes the mutually associated file names of medical data, file names of anonymous medical data, anonymous IDs, file names of analysis results, etc. The data correspondence table 11b and memory 11 are an example of a storage unit.

[0021] The file name of the medical data has the name of the file of the medical data including personal information in the first half, and an extension indicating the type of the file in the second half.

[0022] The file name of anonymous medical data has the name of the anonymous medical data file obtained by anonymizing medical data in the first half, and an extension indicating the type of file in the second half. Anonymous medical data is medical data that has been anonymized by deleting personal information and does not contain personal information. The first half of the file name (file name) of anonymous medical data is different from the first half of the file name (file name) of the medical data before anonymization, and it is preferable that the names appear unrelated to each other. The file name extension of anonymous medical data is the same as the file name extension of the medical data before anonymization.

[0023] The anonymous ID is as described above and matches the anonymous ID in the ID correspondence table 11a.

[0024] The file name of the analysis result has the name of the analysis result file obtained by analyzing the anonymous medical data in the first half, and an extension indicating the type of file in the second half. The file name of the analysis result is a name different from the file name of the anonymous medical data. Here, the first half of the file name of the analysis result (file name) is a name different from the first half of the file name of the anonymous medical data (file name). The extension of the file name of the analysis result is a name different from the file name of the anonymous medical data in both the file name of the first half and the extension of the second half.

[0025] Returning to Figure 2, the communication interface 13 is a circuit that connects the PHR server 10 to a network NW such as the Internet to communicate with other devices such as the analysis server 20 and personal terminals. In the following explanation, the fact that the communication interface 13 is involved in communication between the PHR server 10 and other devices will be omitted.

[0026] The processing circuitry 15 controls the PHR server 10 in accordance with instructions received from a personal terminal (not shown) and programs stored in the memory 11. For example, the processing circuitry 15 is a processor that, triggered by instructions received from the personal terminal, implements each function of the PHR server 10 in accordance with a program read from the memory 11. Examples of each function include an anonymization function 15a, an assignment function 15b, and a control function 15c. Note that each function may be implemented by distributing it among multiple processors as appropriate. Alternatively, each function or part of each function may be executed by another device as appropriate.

[0027] Next, the anonymization function 15a, the assignment function 15b, and the control function 15c will be described in order. However, the allocation of the functions described below is for convenience and can be changed as appropriate. This is because even if a process that is assigned to one function is assigned to another function, the processing circuit 15 still executes that process. Note that the fact that the allocation of the functions can be changed also applies to the following embodiments and modified examples.

[0028] The anonymization function 15a anonymizes medical data including personal information to generate anonymous medical data that does not include personal information. The anonymization function 15a and the processing circuit 15 are an example of an anonymization unit.

[0029] The assignment function 15b assigns an anonymous ID associated with the personal ID in the personal information to the anonymous medical data and transmits the anonymous medical data with the assigned anonymous ID to the analysis server 20. Here, the assignment function 15b may assign the anonymous ID to a header of the anonymous medical data, for example, as a user ID for identifying a patient. For example, the assignment function 15b may assign the anonymous ID to the auxiliary information of the anonymous medical data, which includes the auxiliary information and image data as medical image data in the DICOM protocol. Specifically, the assignment function 15b may store the anonymous ID in a data element identified by an arbitrary DICOM tag in the auxiliary information. In this case, the same anonymous ID is stored in a data element identified by the same DICOM tag in the analysis result described later. For example, the anonymous ID may be stored in a data element identified by the examination description tag (0008,1010) in the object information group in DICOM. However, the arbitrary DICOM tag may be, for example, a tag in the patient information group, a tag in the object information group, or a tag in the collection information group. Furthermore, the assigning function 15b may or may not issue an anonymous ID. When issuing an anonymous ID, the assigning function 15b may, for example, calculate a hash value of personal information and use the hash value as the anonymous ID. When not issuing an anonymous ID, the assigning function 15b may, for example, use an HTTP session ID as the anonymous ID. The session ID may be included in a cookie or in a hidden field. In either case, when using a new anonymous ID, the assigning function 15b associates the personal ID and the anonymous ID with each other and stores them in the ID correspondence table 11a. Alternatively, the assigning function 15b may use a previous anonymous ID in the ID correspondence table 11a. The assigning function 15b and the processing circuit 15 are an example of a first assigning unit.

[0030] The control function 15c stores the analysis results returned from the analysis server 20 in the memory 11. The control function 15c may associate the medical data, anonymous medical data, anonymous ID, and analysis results with one another and store them in the data correspondence table 11b in the memory 11. The control function 15c and the processing circuit 15 are an example of a control unit.

[0031] On the other hand, the analysis server 20 includes a memory 21, a communication interface 23, and a processing circuit 25, as shown in FIG.

[0032] The memory 21 is composed of memory bodies that record electrical information, such as a read-only memory (ROM), a random access memory (RAM), a hardware disk drive (HDD), and an image memory, as well as peripheral circuits associated with the memory bodies, such as a memory controller and a memory interface. The memory 21 stores various programs, such as the program of the analysis server 20, and various data, such as data before processing, data in the middle of processing, data after processing, and data to be saved in advance. The memory 21 may also store in advance a trained model that analyzes medical data and outputs analysis results. The trained model is, for example, a trained machine learning model generated by having a machine learning model perform machine learning based on training data.

[0033] The communication interface 23 is a circuit that connects the analysis server 20 to a network NW such as the Internet to communicate with other devices such as the PHR server 10. In the following description, the fact that the communication interface 23 is involved in communication between the analysis server 20 and other devices will be omitted.

[0034] The processing circuitry 25 reads out a program from the memory 21 and controls the analysis server 20 in accordance with the program. For example, the processing circuitry 25 is a processor that implements each function of the analysis server 20 in accordance with the program read out from the memory 21. The functions include, for example, an analysis function 25a and an assignment function 25b. Note that each function may be implemented by distributing it among multiple processors as appropriate. Alternatively, each function or part of each function may be executed by another device as appropriate.

[0035] Next, the analysis function 25a and the assignment function 25b as functions will be described in order. However, the allocation of functions described below is for convenience and can be changed as appropriate. This is because even if a process that is assigned to one function is assigned to another function, the processing circuitry 25 still executes that process. Note that the fact that the allocation of functions can be changed also applies to the following embodiments and modified examples.

[0036] The analysis function 25a analyzes the anonymous medical data transmitted from the PHR server 10 to obtain an analysis result. For example, the analysis function 25a may be a trained model that has undergone deep learning to output an analysis result of the input medical data. In this case, the processing circuitry 25 may implement the analysis function 25a by reading the trained model from the memory 21 and operating the trained model. Alternatively, the processing circuitry 25 may implement the analysis function 25a by incorporating the trained model into a processor circuit, such as an ASIC or FPGA. For example, information related to the pathology or information for evaluation or diagnosis can be used as the analysis result. The analysis function 25a and the processing circuitry 25 are examples of an analysis unit.

[0037] The assignment function 25b assigns the anonymous ID assigned to the anonymous medical data transmitted from the PHR server 10 to the analysis result, and returns the analysis result with the assigned anonymous ID to the PHR server 10. The assignment function 25b and the processing circuit 25 are an example of a second assignment unit.

[0038] Next, the operation of the medical data management system configured as above will be described with reference to the sequence diagram of FIG. 5 and the schematic diagram of FIG.

[0039] First, it is assumed that the PHR server 10 stores medical data of each individual. Here, it is assumed that a certain individual transmits an instruction to analyze the medical data to the PHR server 10 from a personal terminal (not shown) such as a personal computer or smartphone at home. This starts step ST1.

[0040] In step ST1, the processing circuit 15 of the PHR server 10 reads out medical data from the memory 11 based on an analysis request received from a personal terminal (not shown). The medical data includes personal information.

[0041] After step ST1, in step ST2, the processing circuitry 15 anonymizes the medical data including the personal information to generate anonymous medical data that does not include the personal information. For example, the anonymous medical data is generated by deleting the personal information from the medical data.

[0042] After step ST2, in step ST3, processing circuitry 15 searches ID correspondence table 11a based on the personal ID in the personal information and assigns an anonymous ID associated with the personal ID in ID correspondence table 11a to the anonymous medical data. If the search results in no hit, processing circuitry 15 associates the personal ID in the personal information with the anonymous ID, writes the association between the personal ID and the anonymous ID in ID correspondence table 11a, and assigns the anonymous ID to the anonymous medical data. Thereafter, processing circuitry 15 associates the medical data, anonymous medical data, and anonymous ID with each other and stores them in data correspondence table 11b in memory 11. Specifically, processing circuitry 15 associates the file name of the medical data, the file name of the anonymous medical data, and the anonymous ID with each other and stores them in data correspondence table 11b in memory 11.

[0043] After step ST3, in step ST4, the processing circuitry 15 transmits the anonymous medical data to which the anonymous ID has been assigned to the analysis server 20.

[0044] After step ST4, in step ST5, the processing circuitry 25 of the analysis server 20 analyzes the transmitted anonymous medical data to obtain an analysis result.

[0045] After step ST5, in step ST6, the processing circuitry 25 of the analysis server 20 assigns the anonymous ID assigned to the transmitted anonymous medical data to the analysis result.

[0046] After step ST6, in step ST7, the processing circuit 25 of the analysis server 20 returns the analysis result to which the anonymous ID has been assigned to the PHR server 10.

[0047] After step ST7, in step ST8, the processing circuitry 15 of the PHR server 10 stores the analysis results returned from the analysis server 20 in the memory 11. Thereafter, the processing circuitry 15 writes the analysis results in the data correspondence table 11b in association with the medical data, anonymous medical data, and anonymous ID in the data correspondence table 11b based on the anonymous ID assigned to the analysis results. Specifically, the processing circuitry 15 writes the file name of the analysis results in association with the file name of the medical data, the file name of the anonymous medical data, and the anonymous ID in the data correspondence table 11b. As a result, the analysis results are managed in association with the medical data before anonymization. Thereafter, the analysis results are returned to a personal terminal (not shown) as a response to an analysis request received from the personal terminal.

[0048] As described above, according to the first embodiment, the medical data management system includes a PHR server 10 as a management server and an analysis server 20. The PHR server 10 anonymizes medical data including personal information to generate anonymous medical data that does not include the personal information. The PHR server 10 assigns an anonymous ID associated with a personal ID in the personal information to the anonymous medical data and transmits the anonymous medical data with the anonymous ID to the analysis server 20. The PHR server 10 stores the analysis results returned from the analysis server 20 in the memory 11. The analysis server 20 analyzes the transmitted anonymous medical data to obtain the analysis results. The analysis server 20 assigns the anonymous ID, which was assigned to the transmitted anonymous medical data, to the analysis results and transmits the analysis results with the anonymous ID to the PHR server 10.

[0049] In this way, by using medical data including personal information, anonymous medical data to which an anonymous ID corresponding to the personal ID in the personal information has been assigned, and analysis results to which an anonymous ID has been assigned, it is possible to easily associate the analysis results of the anonymous medical data with the medical data before anonymization.

[0050] Furthermore, according to the first embodiment, it becomes easy to associate the analysis results of anonymous medical data with the medical data before anonymization, so it is expected that systematic data management will be possible while protecting personal information through anonymization even in an environment of PHR and cloud analysis services.

[0051] For example, from the viewpoint of systematic data management, medical data, anonymous medical data, anonymous IDs, and analysis results may be associated with one another and stored in memory 11. In this case, in addition to the effects described above, it is possible to further facilitate association of analysis results of anonymous medical data that does not include personal information with medical data that includes personal information.

[0052] The first embodiment may be implemented as each of the following modified examples, and each of the modified examples may be applied to each of the following embodiments.

[0053] The first modification of the first embodiment is configured to use an HTTP session ID as the anonymous ID. The session ID may be included in a cookie or in a hidden field.

[0054] Accordingly, the assignment function 15b of the processing circuit 15 of the PHR server 10 operates as follows in addition to the functions described above. When the assignment function 15b receives an HTTP request for an analysis instruction of medical data from a personal terminal (not shown), it issues an HTTP session ID and uses this session ID to perform a series of communications with the analysis server 20 and the personal terminal. That is, the assignment function 15b assigns an anonymous ID, which is a session ID, to the anonymous medical data in a format in which the session ID is included in a cookie or hidden field. In this case, the analysis server 20 also assigns an anonymous ID, which is a session ID, to the analysis result in a format in which the session ID is included in a cookie or hidden field.

[0055] The other configurations are the same as those in the first embodiment.

[0056] According to the first modification as described above, in addition to the effects of the first embodiment, it is possible to reduce the load for issuing an anonymous ID, such as the load for calculating a hash value. Additionally, since the session ID is also used as the anonymous ID, the process of issuing only the anonymous ID can be omitted.

[0057] On the other hand, the second modification of the first embodiment is configured to use medical image data based on the DICOM standard as the medical data, anonymous medical data, and analysis results. The anonymous ID is stored in a data element identified by an arbitrary DICOM tag among the incidental information. Here, the same ID information is stored in the data element identified by the same DICOM tag between the anonymous medical data and the analysis results. In this case, the file extensions of the medical data file, the anonymous medical data file, and the analysis results file in the data correspondence table 11b are all the same.

[0058] The other configurations are the same as those in the first embodiment.

[0059] According to the second modified example described above, even if medical image data based on the DICOM standard is used as medical data, anonymous medical data, and analysis results, the same effects as those of the first embodiment can be obtained.

[0060] On the other hand, the third modified example of the first embodiment is configured to use the public key of an individual's public key certificate as the anonymous ID. The individual's public key certificate is provided to the PHR server 10 from a personal terminal (not shown), for example, when applying for use of the PHR and cloud analysis service. The provided public key certificate is stored in memory 11 by the PHR server 10 in association with the individual's ID. This allows the processing circuit 15 of the PHR server 10 to use the public key certificate in memory 11.

[0061] The other configurations are the same as those in the first embodiment.

[0062] According to the third modification as described above, it is possible to reduce the load for issuing an anonymous ID, such as the load for calculating a hash value, as in the first modification of the first embodiment. Additionally, since an individual's public key is also used as the anonymous ID, it is possible to omit the process of issuing only the anonymous ID.

[0063] Furthermore, according to the second modification, when the analysis result is encrypted and returned to the personal terminal, the encryption process can be easily executed by using the personal public key for the encryption.

[0064] <Second embodiment> Next, a medical data management system according to a second embodiment will be described. Components that are substantially the same as those in the above-described drawings will be assigned the same reference numerals, and detailed description thereof will be omitted. Only different parts will be described here.

[0065] The second embodiment is a modification of the first embodiment, and is configured for the case where the analysis server 20 requests additional anonymous medical data. For example, this may occur when, as a result of analyzing anonymous medical data related to a certain test, anonymous medical data related to another test becomes necessary.

[0066] Accordingly, the analysis function 25a and the assignment function 25b of the processing circuit 25 of the analysis server 20 operate as follows in addition to the functions described above.

[0067] When the analysis function 25a requests additional medical data based on the analysis results obtained from the anonymous medical data transmitted from the PHR server 10, it generates an additional request including a specification of the additional medical data.

[0068] The assignment function 25b assigns the anonymous ID assigned to the anonymous medical data transmitted from the PHR server 10 to the addition request, and returns the addition request with the assigned anonymous ID to the PHR server 10.

[0069] On the other hand, the anonymization function 15a and the assignment function 15b of the processing circuit 15 of the PHR server 10 operate as follows in addition to the above-mentioned functions.

[0070] Based on the addition request returned from the analysis server 20, the anonymization function 15a anonymizes additional medical data including personal information of the personal ID associated with the anonymous ID assigned to the addition request, and generates additional anonymous medical data that does not include the personal information.

[0071] The assigning function 15b assigns the anonymous ID assigned in the addition request to the additional anonymous medical data, and transmits the additional anonymous medical data to which the anonymous ID has been assigned to the analysis server 20.

[0072] As shown in FIG. 7, the control function 15c of the processing circuit 15 may store the medical data, anonymous medical data, anonymous IDs, and analysis results in the data correspondence table 11b in the memory 11 for each series name indicating the series of medical data. Here, the series of medical data may be information indicating the name of a disease or the purpose of an examination. For example, in the data correspondence table 11b of FIG. 7, the first and second lines show a case where medical data, anonymous medical data, anonymous IDs, and analysis results on different examination dates are described for the same examination purpose "Examination A." Note that the same anonymous ID is used because they belong to the same series.

[0073] Furthermore, the data correspondence table 11b in the memory 11 may store personal IDs, anonymous IDs, and medical data series in correspondence with each other. Here, the anonymous ID may have a different value for each medical data series. For example, in the data correspondence table 11b of FIG. 7, the second and third rows show a case where medical data, anonymous medical data, anonymous IDs, and analysis results with different filename extensions are described for different examination purposes "Examination A" and "Examination B." Note that different anonymous IDs are used for the different series. Also, for example, in the data correspondence table 11b of FIG. 7, the third and fourth rows show a case where medical data, anonymous medical data, anonymous IDs, and analysis results with different filename extensions are described for different examination purposes "Examination B" and "Examination C." However, the third and fourth rows of the data correspondence table 11b use the same anonymous ID, even though they are for different series. Additionally, the inspection purposes "Inspection B" and "Inspection C" in the third and fourth rows of the data correspondence table 11b represent an additional inspection purpose "Inspection C" when an additional inspection becomes necessary for an inspection purpose "Inspection B." The data correspondence table 11b and the memory 11 are examples of a storage unit.

[0074] The other configurations are the same as those in the first embodiment.

[0075] Next, the operation of the medical data management system configured as above will be described with reference to the sequence diagram of FIG.

[0076] Now, it is assumed that steps ST1 to ST6 have been executed in the same manner as described above, and that after analysis, an anonymous ID has been assigned to the analysis result.

[0077] Also, step ST6-a is executed before or after step ST6. In step ST6-a, the processing circuitry 25 of the analysis server 20 determines whether or not to request additional medical data based on the analysis results obtained from the anonymous medical data. If no additional medical data is requested, the processing ends, and if additional medical data is requested, the processing proceeds to step ST7-a.

[0078] Furthermore, after step ST6, steps ST7 to ST8 are executed as described above, the analysis results with the anonymous ID assigned are returned from the analysis server 20 to the PHR server 10, the analysis results are stored in the memory 11, and the data correspondence table 11b is updated.

[0079] Furthermore, step ST7-a is executed before or after step ST7. In step ST7-a, when requesting additional medical data, the processing circuitry 25 of the analysis server 20 generates an addition request including a designation of anonymous medical data. Furthermore, the processing circuitry 25 assigns the anonymous ID assigned to the anonymous medical data to the addition request, and returns the addition request with the anonymous ID attached to the PHR server 10. Note that step ST7 and step ST7-a may be executed simultaneously. That is, the processing circuitry 25 of the analysis server 20 may return a response including the analysis result of step ST7 and the addition request of step ST7-a to the PHR server 10.

[0080] After step ST7-a, in step ST9, the processing circuit 15 of the PHR server 10 executes processing of the addition request similar to steps ST1 to ST4 based on the addition request returned from the analysis server 20.

[0081] That is, the processing circuit 15 reads out a personal ID from the ID correspondence table 11a in the memory 11 based on the anonymous ID assigned to the addition request. The processing circuit 15 also reads out additional medical data including personal information of the personal ID from the memory 11 based on the read out personal ID (step ST1). The processing circuit 15 also anonymizes the read out additional medical data to generate additional anonymous medical data that does not include the personal information (step ST2).

[0082] Thereafter, the processing circuit 15 assigns the anonymous ID assigned in the addition request to the additional anonymous medical data (step ST3), and transmits the additional anonymous medical data with the assigned anonymous ID to the analysis server 20 (step ST4).

[0083] Thereafter, the processes from step ST5 onwards are executed in the same manner as described above.

[0084] As described above, according to the second embodiment, when the analysis server 20 requests additional medical data based on the analysis results of anonymous medical data, it replies to the PHR server 10 with an additional request that includes the anonymous ID assigned to the anonymous medical data and a specification of the additional medical data.

[0085] Based on the returned addition request, the PHR server 10 anonymizes the additional medical data including personal information of the personal ID associated with the anonymous ID assigned to the addition request to generate additional anonymous medical data that does not include personal information. The PHR server 10 also assigns the anonymous ID assigned to the addition request to the additional anonymous medical data, and transmits the additional anonymous medical data with the assigned anonymous ID to the analysis server 20.

[0086] In this way, with the configuration in which the analysis server 20 makes an additional request, in addition to the effect of the first embodiment, necessary anonymous medical data can be obtained even when the necessary medical data is insufficient.

[0087] Furthermore, according to the second embodiment, for each series of medical data, the medical data, anonymous medical data, anonymous ID, and analysis results may be stored in the memory 11. In this case, in addition to the effect of the first embodiment, systematic data management for each series can be performed.

[0088] According to the second embodiment, the series of medical data may be information indicating the name of a disease or the purpose of an examination. In this case, in addition to the effect of the first embodiment, systematic data management can be performed for each piece of information indicating the name of a disease or the purpose of an examination.

[0089] According to the second embodiment, the memory 11 may store personal IDs, anonymous IDs, and series in association with each other. In this case, in addition to the effect of the first embodiment, it is possible to perform systematic ID management for each series.

[0090] Furthermore, according to the second embodiment, the anonymous ID may have a different value for each series. In this case, systematic data management can be performed based on the anonymous IDs with different values for each series.

[0091] According to at least one of the embodiments described above, it is possible to easily associate the analysis results of anonymous medical data with the medical data before anonymization.

[0092] The term "processor" used in the above description refers to a circuit such as a CPU (central processing unit), a GPU (graphics processing unit), an application specific integrated circuit (ASIC), a programmable logic device (e.g., a simple programmable logic device (SPLD), a complex programmable logic device (CPLD), and a field programmable gate array (FPGA)). A processor realizes its functions by reading and executing a program stored in a memory. Note that instead of storing a program in a memory, the processor may be configured so that the program is directly embedded in the circuit. In this case, the processor realizes its functions by reading and executing the program embedded in the circuit. Note that each processor in the present embodiment is not limited to being configured as a single circuit, but may be configured as a single processor by combining multiple independent circuits to realize its functions. Furthermore, multiple components in FIG. 1, FIG. 2, or FIG. 4 may be integrated into a single processor to realize its functions.

[0093] Although several embodiments of the present invention have been described, these embodiments are presented as examples and are not intended to limit the scope of the invention. These embodiments can be embodied in various other forms, and various omissions, substitutions, and modifications can be made without departing from the spirit of the invention. These embodiments and their modifications are included in the scope of the invention and its equivalents as defined in the claims, as well as in the scope and spirit of the invention. [Explanation of symbols]

[0094] 10 PHR Server 11,21 Memory 11a ID Correspondence Table 11b Data Correspondence Table 13,23 Communication Interface 15,25 Processing circuit 15a Anonymization function 15b, 25b added function 15c Control Functions 20 Analysis Server 25a Analysis function NW Network

Claims

1. A medical data management system comprising a management server and an analysis server, The management server an anonymization unit that anonymizes medical data including personal information to generate anonymous medical data that does not include the personal information; a first assigning unit that assigns an anonymous ID associated with a personal ID in the personal information to the anonymous medical data and transmits the anonymous medical data to which the anonymous ID has been assigned to the analysis server; a control unit that stores the analysis results returned from the analysis server in a storage unit; Equipped with The analysis server an analysis unit that analyzes the transmitted anonymous medical data and obtains an analysis result; a second assigning unit that assigns the anonymous ID assigned to the transmitted anonymous medical data to the analysis result and returns the analysis result to which the anonymous ID has been assigned to the management server; Equipped with When the analysis unit requests additional medical data based on an analysis result obtained from the transmitted anonymous medical data, the analysis unit generates an additional request including a designation of the additional medical data; the second assigning unit assigns the anonymous ID assigned to the transmitted anonymous medical data to the addition request, and returns the addition request with the assigned anonymous ID to the management server; the anonymization unit anonymizes additional medical data including personal information of a personal ID associated with the anonymous ID assigned to the addition request based on the returned addition request, to generate additional anonymous medical data not including the personal information; the first assigning unit assigns the anonymous ID assigned in the addition request to the additional anonymous medical data, and transmits the additional anonymous medical data assigned the anonymous ID to the analysis server; Medical data management system.

2. The medical data management system according to claim 1 , wherein the control unit stores the medical data, the anonymous medical data, the anonymous ID, and the analysis result in the storage unit in association with one another.

3. 3. The medical data management system according to claim 2, wherein the control unit stores the medical data, the anonymous medical data, the anonymous ID, and the analysis results in the storage unit for each series of the medical data.

4. 4. The medical data management system according to claim 3, wherein the series of medical data is information indicating a disease name or a test purpose.

5. 5. The medical data management system according to claim 3, wherein the storage unit stores the personal ID, the anonymous ID, and the series of medical data in association with one another.

6. 6. The medical data management system according to claim 5, wherein the anonymous ID has a different value for each series of the medical data.

Images