Data generation device, data generation method, and data generation program

Abstract

To provide a data generation device, a data generation method, and a data generation program for generating highly anonymous data that is useful in medical research and the like and that does not allow individuals to be identified.SOLUTION: A medical data management system 1 includes: a medical institution terminal 2 used mainly by medical personnel in a medical institution; and a management server 3 that stores medical data provided from the medical institution terminal 2 and manages the stored medical data. The medical institution terminal 2 and the management server 3 are connected so as to be able to communicate with each other via a public line (public network) 4 such as the Internet.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present invention relates to a data generating device, a data generating method, and a data generating program for generating anonymized medical data obtained by, for example, a medical test. [Background technology]

[0002] Conventionally, large amounts of medical data have been accumulated in various medical institutions. Attempts have been made to collect this large amount of medical data and utilize it in medical research, etc. For example, a method has been proposed in which patients' medical data is collectively managed at a management institution, allowing data to be shared among multiple medical institutions (see Patent Document 1).

[0003] While such medical data is useful for medical research, there is a risk that individuals may be identified from the medical data, which could lead to the leakage of personal information.

[0004] One way to solve this problem is to remove information such as names and addresses. However, simply removing information such as names and addresses could potentially allow individuals to be identified by combining multiple pieces of information contained in the medical data, which is insufficient from the perspective of protecting personal information. On the other hand, deleting information related to test results from the perspective of protecting personal information would result in the loss of usefulness for medical research, etc. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] Japanese Patent Application Publication No. 11-45304 Summary of the Invention [Problem to be solved by the invention]

[0006] In view of the above-mentioned problems, the present invention aims to provide a data generation device, a data generation method, and a data generation program that are capable of generating secondary data based on medical data, which is useful in medical research, etc., and is highly anonymous data that does not allow individuals to be identified. [Means for solving the problem]

[0007] This invention is characterized by a data generation device, data generation method, and data generation program that include a pre-processed medical data acquisition means for acquiring pre-processed medical data including a patient's identification information and the patient's test results obtained through medical tests, a selection means for selecting a test result expressed as a quantitative numerical value from among multiple test results included in the pre-processed medical data as the test result to be processed, and a generation means for generating processed medical data by deleting part of the patient's identification information from the pre-processed medical data and adding a predetermined fluctuation value to the test result to be processed. [Effects of the Invention]

[0008] This invention provides a data generation device, a data generation method, and a data generation program that can generate secondary data based on medical data, which is useful in medical research, etc., and is highly anonymous so that individuals cannot be identified. [Brief explanation of the drawings]

[0009] [Figure 1] FIG. 1 is a block diagram showing the system configuration of a medical data management system. [Figure 2] FIG. 4 is an explanatory diagram showing an example of data stored in an auxiliary storage unit of a management server. [Figure 3A] FIG. 2 is an explanatory diagram showing an example of the data structure of unprocessed medical data. [Figure 3B] FIG. 4 is an explanatory diagram showing an example of the data structure of processed medical data. [Figure 4] FIG. 10 is an explanatory diagram showing an example of whether processing is possible for each inspection item. [Figure 5]FIG. 10 is an explanatory diagram showing an example of standard values ​​and processing coefficients for each inspection item. [Figure 6] FIG. 10 is a flow diagram of a process in which the control unit of the management server generates processed medical data. [Figure 7] FIG. 2 is an explanatory diagram showing an example of the relationship between pre-processed medical data and post-processed medical data. [Figure 8] 10 is a flowchart of a number of times adjustment process executed by a control unit of a management server. [Figure 9] FIG. 10 is an explanatory diagram showing the number of data items within a target period in unprocessed medical data. [Figure 10] FIG. 10 is an explanatory diagram showing the number of data items within a target period in processed medical data. [Figure 11] FIG. 2 is an explanatory diagram showing an example of statistical data of unprocessed medical data and processed medical data. DETAILED DESCRIPTION OF THE INVENTION

[0010] An embodiment of the present invention will now be described with reference to the drawings. <System configuration>

[0011] 1 is a block diagram showing the system configuration of a medical data management system 1 in this embodiment. The medical data management system 1 includes a medical institution terminal 2 that is mainly used by medical personnel at a medical institution, and a management server 3 that stores medical data provided from the medical institution terminal 2 and manages the stored medical data. The medical institution terminal 2 and the management server 3 are connected to each other so that they can communicate with each other via a public line (public network) 4 such as the Internet. Although not shown in the figure, the management server 3 is also connected to an analysis terminal that is used by medical researchers at research institutions such as universities.

[0012] It should be noted that a plurality of medical institution terminals 2 may be provided in the medical data management system 1. For example, a medical institution terminal 2 may be provided for each medical institution, or a plurality of medical institution terminals 2 may be provided in the same medical institution.

[0013] The medical institution terminal 2 is configured as a general-purpose computer (terminal) such as a tablet PC, desktop PC, notebook (laptop) PC, or mobile terminal (smartphone). The management server 3 is configured as a general-purpose server computer. The management server 3 may be configured as a single server computer or multiple server computers. Furthermore, some or all of the management server 3 may be a cloud server.

[0014] The medical institution terminal 2 includes a control unit 21, an input unit 22, a display unit 23, a communication unit 24, and an auxiliary storage unit 25. The input unit 22, the display unit 23, the communication unit 24, and the auxiliary storage unit 25 are each connected to the control unit 21 via a communication line (bus).

[0015] The management server 3 includes a control unit 31, an input unit 32, a display unit 33, a communication unit 34, and an auxiliary storage unit 35. The input unit 32, the display unit 33, the communication unit 34, and the auxiliary storage unit 35 are each connected to the control unit 31 via a communication line.

[0016] The control unit 21 includes a calculation unit 26 and a main memory unit 27, and executes various calculations and control operations in the medical institution terminal 2. The control unit 31 includes a calculation unit 36 ​​and a main memory unit 37, and executes various calculations and control operations in the management server 3.

[0017] The calculation unit (26, 36) is a calculation processing unit including a CPU or an MPU. The main memory unit (27, 37) includes a RAM (DRAM) and a ROM. The RAM is used as a work area and a buffer area for the calculation unit (26, 36). The ROM stores the startup program of the medical institution terminal 2 or the management server 3, default values ​​for various information, and the like.

[0018] The input unit (22, 32) includes an input component that accepts operational input from the user of the medical institution terminal 2 or the user (system administrator) of the management server 3, and an input detection circuit interposed between the input component and the calculation unit (26, 36). The input component is, for example, a touch panel and / or hardware operation buttons or keys. The touch panel can be of any type, such as a capacitance type, an electromagnetic induction type, a resistive film type, or an infrared type. The input detection circuit outputs an operation signal or operation data corresponding to the operation of each input component to the calculation unit (26, 36).

[0019] The display unit (23, 33) includes a display and a display control circuit interposed between the display and the calculation unit (26, 36). The display may be, for example, an LCD (liquid crystal display) or an organic EL display. The display control circuit includes a GPU and a VRAM. Under the direction of the calculation unit (26, 36), the GPU uses image generation data stored in the RAM to generate display image data in the VRAM for displaying various screens on the display, and outputs the generated display image data to the display.

[0020] The communication units (24, 34) include a communication circuit for connecting to the public line 4. The communication circuit is a wired communication circuit or a wireless communication circuit, and communicates with an external computer via the public line 4 according to instructions from the calculation units (26, 36). The communication unit 24 of the medical institution terminal 2 may also be provided with a communication circuit for connecting to testing equipment installed in the medical institution.

[0021] The auxiliary memory unit (25, 35) is composed of other non-volatile memory such as an HDD, SSD, flash memory, EEPROM, etc., and stores programs and various data used by the calculation unit (26, 36) to control the operation of the medical institution terminal 2 or management server 3.

[0022] The auxiliary memory unit 25 of the medical institution terminal 2 stores a control program 25a for executing various operations of the medical institution terminal 2 in this system in response to operational inputs from the user of the medical institution terminal 2, and medical data 25b including test result data of medical tests performed on patients at the medical institution.

[0023] The control program 25a and medical data 25b are read out from the auxiliary storage unit 25 as needed and stored (expanded) in the main storage unit 27 (RAM). The operation of the medical institution terminal 2 is realized by the calculation unit 26 executing the control program 25a expanded in the main storage unit 27 (RAM).

[0024] The control program 25a includes a registration program for registering (storing in the auxiliary storage unit 25) the medical data 25b, and a main processing program for selecting and executing various functions of the medical institution terminal 2. The medical data 25b includes patient identification information data (patient identification data) for specifying (identifying) the patient, identification information data of the received medical institution (medical institution identification data), and test result information data of the medical examination (test result data). For example, the identification data and medical institution data are input from the input unit 22. The test result data is transmitted from a testing device installed in the medical institution or input from the input unit 22.

[0025] Medical data 25b is the raw data of patient information and test result information that has not been processed in any way, and may be referred to as unprocessed medical data hereinafter. Unprocessed medical data is created each time a patient visits a medical institution, and the registration program registers the unprocessed medical data each time the patient visits a medical institution.

[0026] The auxiliary memory unit 35 of the management server 3 stores a management program 35a for executing various operations of the management server 3 in this system in response to operational inputs from the system administrator, and management data 35b required for using this system.

[0027] The management program 35a and management data 35b are read out from the auxiliary storage unit 35 as needed and stored (deployed) in the main storage unit 37 (RAM). The operation of the management server 3 is realized by the calculation unit 36 ​​executing the management program 35a deployed in the main storage unit 37 (RAM).

[0028] The management program 35a includes at least an acquisition program for acquiring unprocessed medical data stored (registered) in the medical institution terminal 2, a selection program for selecting data to be processed based on specified processing conditions when generating anonymized data (processed medical data) from the unprocessed medical data while maintaining its medical significance, a generation program for processing the data to be processed among the unprocessed medical data to generate processed medical data, a registration program for registering (storing in the auxiliary memory unit 35) the unprocessed medical data acquired from the medical institution terminal 2 and the processed medical data generated by the management server 3, and a program for selecting and executing various functions provided by the management server 3. The management data 35b includes the unprocessed medical data, the processed medical data, and various data for selecting and executing various functions provided by the management server 3.

[0029] 1 are merely examples and are not intended to be limiting. For example, the medical institution terminal 2 and the management server 3 may be provided with an interface (external storage medium connector) for reading data from various storage media (external storage media) such as an SD card or USB memory, or for writing data to the external storage medium. In this case, data may be exchanged between the testing equipment and the medical institution terminal 2, or between the medical institution terminal 2 and the management server 3, via the external storage medium. <Data structure>

[0030] Fig. 2 is an explanatory diagram showing an example of data stored in the auxiliary storage unit 35 of the management server 3. Fig. 3A is an explanatory diagram showing an example of the data structure of pre-processed medical data 50. Fig. 3B is an explanatory diagram showing an example of the data structure of processed medical data 60.

[0031] As described above, various data used in the medical data management system 1 is stored (registered) in the auxiliary storage unit 35 of the management server 3. For example, as shown in Fig. 2, the auxiliary storage unit 35 of the management server 3 registers a pre-processing medical data DB (database) 40, a post-processing medical data DB (database) 41, a processing feasibility data DB (database) 42, a processing target data DB (database) 43, a processing coefficient data DB (database) 44, an evaluation range data DB (database) 45, and the like.

[0032] The unprocessed medical data DB 40 registers unprocessed medical data 50 acquired from the medical institution terminal 2. When multiple unprocessed medical data 50 are registered, each unprocessed medical data 50 is basically registered so as to be distinguishable from one another.

[0033] As shown in Figure 3A, the raw medical data 50 includes first patient identification data 51, which is data on the patient's identification information (patient identification information), first date and time data 52, which is data on the date and time (date) that the patient visited the medical institution, medical institution identification data 53, which is data on the medical institution's identification information (medical institution identification information), and first test result data 54, which is data on various test results. Using this, when multiple pieces of raw medical data 50 are registered, raw medical data 50 including the same first patient identification data 51, i.e., raw medical data 50 of the same patient, can be associated and registered. Furthermore, when multiple pieces of raw medical data 50 are registered, raw medical data 50 including the same medical institution identification data 53, i.e., raw medical data 50 generated and registered at the same medical institution, can be associated and registered.

[0034] The patient identification information includes information such as the patient's name, the patient's My Number, the patient's date of birth, the patient's age, the patient's gender, the patient's name in katakana, the patient's address, the patient's telephone number, etc. The medical institution identification information includes information such as the name of the medical institution, the medical institution code (medical institution number), the medical institution's address, the medical institution's telephone number, etc.

[0035] The test results include test results about the patient's physical characteristics (physical characteristic information) and the patient's medical test results (medical information). The physical characteristic information includes information such as height, weight, waist circumference, body fat percentage, and BMI (body mass index).

[0036] Medical information exists for each test item in various medical tests. For example, medical information includes umbilical circumference, AST (GOT), ALT (GPT), γ-GTP, CRE, eGFR, blood pressure (minimum value, mean value), blood pressure (maximum value, mean value), LDL cholesterol, HDL cholesterol, total cholesterol, triglycerides (fasting), red blood cells, white blood cells, platelets, blood glucose (fasting), hemoglobin, hematocrit, heart rate, smoking status (medical interview), anemia (medical interview), occult blood in urine, glucose in urine (qualitative), protein in urine, electrocardiogram findings, medical history (stroke), medical history (cerebrovascular), medical history (heart disease), medical history (cardiovascular), medical history (kidney disease), medication status (blood pressure), medication status (blood glucose), medication status (lipids), sleep, physical activity, eating habits (medical interview), and alcohol intake. The first test result data 54 does not need to include all medical information, and the type of medical information that is included depends on the test items of the medical test that the patient underwent.

[0037] Processed medical data 60, which is anonymized from pre-processed medical data while maintaining its medical significance, is registered in the processed medical data DB 41. When multiple pieces of processed medical data 60 are registered, each piece of processed medical data 60 is basically registered so as to be distinguishable from one another.

[0038] 3B, the processed medical data 60 includes second patient identification data 61, which is data obtained by processing first patient identification data 51 (patient identification information), second date and time data 62, which is data obtained by processing first date and time data 52 (date the patient visited the medical institution), medical institution identification data 63, which is data on the medical institution's identification information (medical institution identification information) (duplicate data of medical institution identification data 53), and second test result data 64, which is data obtained by processing a portion of the first test result data 54. When multiple pieces of processed medical data 60 are registered, processed medical data 60 including the same medical institution identification data 63, i.e., processed medical data 60 generated and registered at the same medical institution, can also be associated and registered.

[0039] The second patient identification data 61 is data of information (processed identification information) that has been processed from patient identification information. Processed identification information is information that has been anonymized by processing a portion of the patient identification information so that the patient cannot be identified. For example, the processed identification information deletes the patient's name, the patient's My Number, the patient's name with furigana, the patient's date of birth, the patient's address, and the patient's telephone number. Furthermore, with regard to the patient's address, at least the town name and lot number have been deleted and it has been changed to a broader area name (e.g., the prefecture or a local area name within a prefecture). Furthermore, the patient's age has been rounded or abstracted. For example, if the patient's actual age is 42, the patient's age in the processed identification information has been changed to 40. However, information regarding the patient's gender included in the patient identification information has not been processed. The patient's gender is not changed to ensure the medical significance of the medical data (usefulness in medical research, etc.).

[0040] Furthermore, the processed identification information includes an irreversible individual ID for the patient identification information. For this reason, the processed medical data 60 cannot be matched with the original unprocessed medical data 50 on which it was based. However, the same individual ID is assigned to the processed medical data 60 of the same patient, and the processed medical data 60 containing the same second patient identification data 61, i.e., the processed medical data 60 of the same patient, are associated and registered. Therefore, multiple processed medical data 60 of the same patient can be tracked.

[0041] The second date and time data 62 is data of information (processed date and time information) in which dates have been processed so that the patient cannot be identified from the date the patient visited a medical institution. For example, the processed date and time information is the actual date the patient visited a medical institution that has been changed (rounded) to a week, month, or year. The processed date and time information may also be the actual date the patient visited a medical institution that has been changed to align with a specific day such as the beginning (1st), end, 10th, or 20th of the month.

[0042] The second test result data 64 is anonymized data obtained by processing part of the test results indicated by the first test result data 54 so that the patient cannot be identified from the various test results. The specific procedure for creating the second test result data 64 will be described later.

[0043] 2, in generating the second inspection result data 64 from the first inspection result data 54, the processing feasibility data DB 42 stores processing feasibility data (processable item data) indicating whether each inspection result is processable or unprocessable. The processing feasibility data may be data indicating only processable inspection results (processable data) or data indicating only unprocessable inspection results (unprocessable data).

[0044] Whether each test result can be processed or not is set in advance according to the characteristics or content of the test item. Specifically, test results that are expressed as quantitative numerical values, i.e., test items whose test results are quantitative numerical values, and test results obtained by calculation using multiple test results expressed as quantitative numerical values, are set to be processable.

[0045] On the other hand, test results corresponding to test items other than those for which the test results are quantitative numerical values ​​are set to be unprocessable. For example, test results corresponding to qualitative test items that show positive / negative results, test results based on interviews, and test results based on doctor's findings are set to be unprocessable.

[0046] Fig. 4 is an explanatory diagram showing an example of whether each test item can be processed. In this embodiment, as shown in Fig. 4, test results corresponding to test items that are quantitative values, such as height, weight, heart rate, white blood cell count, red blood cell count, hemoglobin, hematocrit value, glucose (fasting), and creatinine, are set to be processable.

[0047] On the other hand, test results such as urine glucose (qualitative), hearing, and doctor's findings are set to be unmanipulable. The reason for this is explained below. For example, urine glucose (qualitative) test results are "(-)," "(±)," "(1+)," "(2+)," "(3+)," and "(4+)." When these results are converted to quantitative glucose values ​​(mg / dL), they become "under 20," "50," "100," "200," "500," and "1000," respectively. Changing the urine glucose (qualitative) test result by one level will significantly change the glucose value, resulting in a significant deviation from the actual test result. Therefore, because the medical significance of the data cannot be guaranteed, urine glucose (qualitative) test results are set to be unmanipulable.

[0048] Hearing tests measure the audible volume (measured in dB) when a test frequency sound is presented to the ear. A low dB value indicates that the sound is audible. For example, a hearing test result of less than 25 dB is considered "normal," a hearing test result of 26-40 dB is considered "mild hearing loss," a hearing test result of 41-60 dB is considered "moderate hearing loss," a hearing test result of 61-80 dB is considered "severe hearing loss," and a hearing test result of 81 dB or greater is considered "profound hearing loss." While it is possible to adjust the hearing test results by 5 dB or 10 dB, this can lead to significant deviations from the actual measured value, resulting in symptoms that do not actually exist or hearing loss being set to the normal value. Furthermore, adjusting the results by 1 dB can result in unrealistic measurement data. Therefore, hearing test results are set to be unprocessable, as this would mean that their medical significance as medical data cannot be guaranteed.

[0049] Furthermore, in the case of doctor's findings, the names of rare diseases or special findings including proper nouns may be entered in the findings section, which may allow individuals to be identified, making it impossible to guarantee anonymity. Furthermore, since it is difficult and impractical to process text while preserving its medical significance as medical data, the test results corresponding to doctor's findings are set to be unprocessable. Furthermore, to ensure anonymity, doctor's findings may be deleted when the processed medical data 60 is generated.

[0050] Furthermore, although not shown in the figure, there is a possibility that an individual may be identified by the combination of special test results (special test results) and a region. For this reason, in some regions, special test results may be deleted or the region name may be further abstracted when generating the processed medical data 60. Special test results include test results for heavy metals such as mercury, lead, cadmium, aluminum, nickel, and arsenic, and test results for chemical substances such as chlorinated biphenyls, hydrogen fluoride, para-nitrochlorobenzene, acetone, isobutyl alcohol, and benzene.

[0051] Returning to Fig. 2, processing target data indicating whether or not any of the processable inspection results is to be set as the inspection result to be processed is registered in the processing target data DB 43. Which of the processable inspection results is to be set as the inspection result to be processed is set in advance. For example, all of the processable inspection results may be set as the inspection result to be processed.

[0052] Furthermore, if there are multiple inspection results that can be processed, some of them may be set as the inspection results to be processed. In this case, when the first inspection result data 54 is processed to generate the second inspection result data 64, processing conditions (data generation conditions) may be accepted, and the inspection results to be processed may be set according to the processing conditions.

[0053] The processing conditions can specify a medical specialty or a specific disease name. For example, if respiratory medicine is specified as a processing condition, the test results required for a respiratory medicine diagnosis are set as the test results to be processed, and if cardiac disease is specified, the test results required for a cardiac disease diagnosis are set as the test results to be processed. It is also possible to specify test items as processing conditions, in which case the test results corresponding to the test items specified as processing conditions are set as the test results to be processed. Furthermore, it is also possible to specify an individual ID, test date (the date the pre-processing medical data 50 was generated), and medical institution as processing conditions. It is also possible to specify a combination of the above-mentioned multiple conditions as processing conditions, or to randomly extract test results to be processed.

[0054] The processing coefficient data DB 44 stores processing coefficient data indicating processing coefficients that are set in advance for each of the test results (test items) that can be processed. The evaluation range data DB 45 stores evaluation range data indicating the numerical range (medical evaluation range) for determining whether each test result (test item) is normal / abnormal. However, for test results such as height, which cannot be determined to be normal / abnormal based on a single test result, an evaluation range may not be set.

[0055] The processing coefficient data and evaluation range data are registered for each medical test item (type of test result). The processing coefficient (fluctuation coefficient) is set within a processable range that is set based on the evaluation range for each test item. The processable range is set to a range that is a predetermined percentage of the range of standard values ​​(normal values) for each test item. The processable range and processing coefficient are set to a range or value that does not allow the identification of individuals and that maintains medical significance.

[0056] Fig. 5 is an explanatory diagram showing an example of standard values ​​and processing coefficients for each test item. In this embodiment, as shown in Fig. 5, the processing coefficients are set within a range of 1% of the standard value for each test item, and preferably within a range of 0.5% of the standard value for each test item. The processing coefficients may be set based on the minimum standard value, the maximum standard value, or the median standard value.

[0057] Various data registered in the auxiliary storage unit 35 of the management server 3 is read out from the auxiliary storage unit 35 as needed and loaded into the main storage unit 37 (RAM). The operation of the management server 3 is realized by the calculation unit 36 ​​executing various programs stored in the main storage unit 37 using the data loaded into the main storage unit 37. <Processing flow for generating processed medical data>

[0058] 6 is a flow diagram of a process (processed medical data generation process) in which the control unit 31 of the management server 3 generates processed medical data 60. The flow of the processed medical data generation process will be described below with reference to FIG.

[0059] First, the unprocessed medical data 50 is acquired from the medical institution terminal 2 (step S1), and second patient identification data 61 is generated by processing the first patient identification data 51 of the unprocessed medical data 50 acquired in step S1, and second date and time data 62 is generated by processing the first date and time data 52 of the unprocessed medical data 50 acquired in step S1 (step S2), and it is determined whether there are any test results that can be processed among the test results included in the first test result data 54 of the unprocessed medical data 50 acquired in step S1 (step S3).

[0060] If there are no inspection results that can be processed (step S3: NO), the process proceeds to step S11, which will be described later. On the other hand, if there are inspection results that can be processed (step S3: YES), it is determined whether there are any inspection results to be processed (step S4).

[0061] If there are no inspection results to be processed (step S4: NO), the process proceeds to step S11, which will be described later. On the other hand, if there are inspection results to be processed (step S4: YES), the process reads out a processing coefficient related to the inspection result to be processed (step S5), generates a random integer number within the range of -1 to 1 excluding 0 (step S6), calculates a processing value (fluctuation value) by multiplying the processing coefficient related to the inspection result to be processed by the random integer number generated in step S6 (step S7), reads out an evaluation range related to the inspection result to be processed (step S8), and determines whether the evaluation range of the inspection result to be processed changes (transitions to another evaluation range) when the fluctuation value is added (or subtracted) to the numerical value of the inspection result to be processed before processing (step S9).

[0062] If the evaluation range of the test result to be processed changes (step S9: YES), i.e., if there is a transition to another evaluation range, return to step S6. On the other hand, if the evaluation range of the test result to be processed does not change (step S9: NO), i.e., if there is no transition to another evaluation range, second test result data 64 is generated by adding a fluctuation value to the pre-processing numerical value of the test result to be processed (step S10). That is, in steps S6 to S10, the test result to be processed is processed so that the medical evaluation range does not change before and after processing.

[0063] Next, processed medical data 60 including the second patient identification data 61 and second date and time data 62 generated in step S2, medical institution identification data 63 copied from the unprocessed medical data 50 acquired in step S1, and, if second test result data 64 is generated, the second test result data 64 is registered (step S11), and the processed medical data generation process is terminated. Note that if the evaluation range of the test result to be processed changes (step S9: YES), the processing value may be set to "0" (without adding a fluctuation value) only for the test result whose evaluation range changes, and the process may proceed to step S11.

[0064] FIG. 7 is an explanatory diagram showing an example of the relationship between pre-processed medical data 50 (first test result data 54) and processed medical data 60 (second test result data 64) generated by the processed medical data generation process of the present invention. FIG. 7 shows a case in which processed medical data 60 is generated from pre-processed medical data 50 for eight tests (January 1, February 1, March 1, April 1, May 1, June 1, July 1, and August 1) of a certain patient. FIG. 7 also shows height values ​​and glucose (fasting) values ​​as test results. Height and glucose (fasting) are test results that can be processed (see FIG. 4). The unit of height is "cm," and the unit of glucose (fasting) is mg / dL. Hereinafter, the units will be omitted.

[0065] As shown in FIG. 7, the height values ​​of each pre-processed medical data 50 (first examination result data 54) are between 170.1 and 171.5. Here, the processable range for height is set to 0.1, and the height processing coefficient is set to "0.1" (the maximum value of the processable range). Therefore, the height fluctuation value is "0.1" or "-0.1", obtained by multiplying the processing coefficient "0.1" by the integer random number -1 or 1. Therefore, the height value of the post-processed medical data 60 (second examination result data 64) is the height value of the pre-processed medical data 50 for each time by adding or subtracting the fluctuation value "0.1". Note that an evaluation range is not set for height, so the height is the value to which the initially calculated fluctuation value is added or subtracted.

[0066] Next, the glucose (fasting) value of each pre-processed medical data 50 is a value between 105 and 112. Here, the processable range of glucose (fasting) is set to 1 (see FIG. 5), and the processing coefficient for glucose (fasting) is set to "1" (the maximum value of the processable range). Therefore, the fluctuation value of glucose (fasting) is "1" or "-1", obtained by multiplying the processing coefficient "1" by the integer random number -1 or 1. Therefore, the glucose (fasting) value of the processed medical data 60 is a value obtained by adding or subtracting the fluctuation value "1" to or from the glucose (fasting) value of the pre-processed medical data 50 for each time.

[0067] However, the standard value for glucose (fasting) is set to 73 to 109 (see Figure 5). Therefore, the glucose (fasting) value of the processed medical data 60 is processed so that the evaluation range does not change before and after processing in each of the ranges below 72, between 73 and 109, and above 110.

[0068] In the example shown in FIG. 7, the glucose (fasting) value of the pre-processed medical data 50 generated on 5 / 1 is 110. If the integer random number is -1, the fluctuation value will be "-1", and adding this to the glucose (fasting) value of the pre-processed medical data 50 on 5 / 1 will result in 109. In this case, the evaluation range will change before and after processing (transitioning from outside the standard value range to within the standard value range), so the integer random number is limited to 1 (when 1 is added). Similarly, the glucose (fasting) value of the pre-processed medical data 50 on 7 / 1 is 109, so if the fluctuation value is "1", the evaluation range will change before and after processing, so the integer random number is limited to -1 (when -1 is added).

[0069] With the above configuration, the medical data management system 1 generates processed medical data 60 by adding a predetermined fluctuation value to the test results to be processed, which are included in the pre-processed medical data 50 obtained from the test results of a patient's medical tests. The fluctuation value is set to a value that prevents identification of an individual while maintaining medical significance. Therefore, the processed medical data 60 is secondary data based on medical data, and can be said to be highly anonymous data that is useful in medical research and the like and does not allow identification of an individual. In other words, the medical data management system 1 of the present invention can generate highly anonymous data that is useful in medical research and the like and does not allow identification of an individual. Furthermore, such processed medical data 60 can be provided to medical researchers.

[0070] In addition, by controlling the positive and negative fluctuation values, the test results to be processed are processed so that the evaluation range does not change before and after processing, so that processed medical data that is useful in medical research, etc. can be generated or provided.

[0071] Furthermore, there are test results calculated based on multiple test results, such as BMI, eGFR, and total cholesterol. Test results calculated from multiple test results such as these vary significantly depending on the positive or negative fluctuation values ​​of the underlying test results. For example, in the case of BMI, if the fluctuation value of height is positive and the fluctuation value of weight is negative, or if the fluctuation value of height is negative and the fluctuation value of weight is positive, the amount of change between the BMI before and after processing will be large. Therefore, for the test results (the bases) related to the test results calculated by calculation, the positive and negative fluctuation values ​​can be unified, or the processing coefficient can be reduced (approximated) to reduce the amount of change between the processed test results and the unprocessed test results by reducing the fluctuation coefficient (for example, 1 / 10 to 1 / 2). This ensures the medical significance of medical data (usefulness in medical research, etc.). In addition, if approximation of the test results is required, the fluctuation values ​​can be restricted to be uniform in positive and negative sign, and if approximation of the test results is not required, the fluctuation values ​​can be processed randomly without being restricted in positive and negative sign.

[0072] Furthermore, there are test results that tend to correlate with each other, such as a combination of hemoglobin and hematocrit values. In such correlated test results, the relative amount of change can be reduced and balanced after processing by unifying the positive and negative fluctuation values ​​or by reducing the processing coefficient (for example, 1 / 10 to 1 / 2). Therefore, the medical significance of the medical data can be ensured. <Flowchart of the number of times adjustment process>

[0073] Furthermore, in the present invention, it is also possible to collectively generate processed medical data 60 for multiple patients from the pre-processed medical data 50 of multiple patients. However, the number of visits each patient has varies, and if the number of visits is significantly high or low, there is a possibility that an individual may be identified from the number of data in the processed medical data 60, making it impossible to guarantee anonymity.

[0074] Therefore, when generating processed medical data 60 for multiple patients from the unprocessed medical data 50 of multiple patients, a frequency adjustment process is performed to adjust the number of visits each patient makes (the number of unprocessed medical data 50 for each patient).

[0075] Figure 8 is a flow diagram of the number of times adjustment process executed by the control unit 31 of the management server 3. Figure 9 is an explanatory diagram showing the number of data within a predetermined period in the unprocessed medical data. Figure 10 is an explanatory diagram showing the number of data within a predetermined period in the processed medical data. The flow of the number of times adjustment process will be explained below with reference to Figures 8 to 10. However, the number of times adjustment process is executed only when unprocessed medical data 50 of multiple patients is specified, and is executed before the processed medical data generation process.

[0076] First, all of the unprocessed medical data 50 of multiple patients that was generated within a predetermined period is acquired from the medical institution terminal 2 (step S21). The control unit 31 of the management server 3 references the first patient identification data 51 and the first date and time data 52 in each unprocessed medical data 50 to acquire, from the unprocessed medical data 50 of the specified patient, the unprocessed medical data 50 that was generated by the patient visiting the hospital within the target period.

[0077] Next, a reference number for the number of data items in the pre-processed medical data 50 for each patient acquired in step S21 is set. That is, the reference number for the number of visits for each patient is calculated. In this embodiment, the average number of visits is used as the reference number, and the reference number is an integer with the decimal point discarded. In the example shown in FIG. 9, patient A visited four times, patient B visited five times, patient C visited five times, patient D visited four times, patient E visited nine times, and patient F visited one time. In this case, the average number of visits for each patient is 4.7 times. The reference number is 4 times, with the decimal point discarded from 4.7. The most frequent number of visits may also be used as the reference number. If there are multiple modes, the smaller number or the larger number may be used as the reference number, or the average of the multiple modes may be used as the reference number.

[0078] Next, it is determined whether any of the data items in the pre-processed medical data 50 for each patient (number of visits for each patient) acquired in step S21 is less than the reference number (step S23). If there is no data item less than the reference number (step S23: NO), proceed to step S25, which will be described later. On the other hand, if there is data item less than the reference number (step S23: YES), delete all of the pre-processed medical data 50 for patients whose number of data items (number of visits) in the pre-processed medical data 50 is less than the reference number (step S24). In other words, patients whose number of data items (number of visits) in the pre-processed medical data 50 is less than the reference number are excluded from consideration. In the example shown in FIG. 9, all of the pre-processed medical data 50 for patient F, whose number of visits is less than the reference number "4," is deleted (see FIG. 10).

[0079] Next, it is determined whether or not the number of data items (number of visits per patient) in the pre-processed medical data 50 for each patient acquired in step S21 exceeds a reference number (step S25). If no data items exceed the reference number (step S25: NO), the frequency adjustment process is terminated. On the other hand, if any data items exceed the reference number (step S25: YES), the data items exceeding the reference number are deleted (thinned out) from the pre-processed medical data 50 of patients whose number of data items (number of visits) in the pre-processed medical data 50 exceeds the reference number (step S26), and the frequency adjustment process is terminated. Data items exceeding the reference number may be thinned out by deleting data items with minimum or maximum values ​​for specific test result information, or, if multiple data items exist for the same month, data items other than the first or last day may be deleted. In the example shown in FIG. 9, data items exceeding the reference number "4" are deleted from the pre-processed medical data 50 of patients B, C, and E whose number of visits exceeds the reference number "4" (see FIG. 10).

[0080] With the above configuration, even when generating processed medical data 60 for multiple patients, this medical data management system 1 can generate or provide processed medical data that ensures anonymity by preventing individuals from being identified from the number of visits each patient makes (the number of data points in the processed medical data 60).

[0081] FIG. 11 is an explanatory diagram showing an example of statistical data of 10 sets of pre-processed medical data and post-processed medical data for a patient's height. The example shown in FIG. 11 includes items such as mean value, standard deviation, median, mode, variance, kurtosis, skewness, numerical range, minimum value, maximum value, and total value. For each item, there is a difference of less than 1%, more specifically, less than 0.5%, between the pre-processed medical data and the post-processed medical data. This is because the processable range and processing coefficients are set to values ​​that maintain medical significance (within 0.5% to 1% of the standard value). Therefore, the present invention can generate or provide post-processed medical data that is statistically useful in medical research, etc.

[0082] The data generation device in this invention corresponds to the management server 3, and similarly, the pre-processed medical data acquisition means corresponds to the control unit 31 of the management server 3 that executes step S1, the selection means corresponds to the control unit 31 of the management server 3 that executes step S4, the generation means corresponds to the control unit 31 of the management server 3 that executes steps S2 and S10, the processing coefficient storage means corresponds to the processing coefficient data DB 44 and the auxiliary memory unit 35, the calculation means corresponds to the control unit 31 of the management server 3 that executes step S7, and the evaluation range storage means corresponds to the evaluation range data DB 45 and the auxiliary memory unit 35, but this invention is not limited to this embodiment and can be made into various other embodiments. [Industrial Applicability]

[0083] The present invention can be used in industries that generate and provide anonymous data of personal biometric information. [Explanation of symbols]

[0084] 1. Medical data management system 2...Medical institution terminal 3...Administrative Server 4...Public line 21, 31...Control section 22, 32...input section 23, 33...Display section 24, 34…Communications Department 25, 35...Auxiliary storage section

Claims

1. raw medical data acquisition means for acquiring raw medical data including patient identification information and test results of the patient obtained by medical testing; a selection means for selecting a test result expressed as a quantitative numerical value as the test result to be processed from among the plurality of test results included in the unprocessed medical data; a generating means for generating processed medical data by deleting a part of the patient's identification information from the unprocessed medical data and adding a predetermined fluctuation value to the test results of the processing target; Data generation device.

2. a processing coefficient storage means for storing processing coefficients set within a predetermined processable range for standard values ​​for each test item in the medical test; further comprising a calculation means for multiplying an integer random number within a range of −1 to 1 excluding 0 by the processing coefficient to calculate the fluctuation value; The generating means generates processed medical data by adding the fluctuation value to the numerical value of the test result to be processed.

2. The data generating device according to claim 1.

3. further comprising evaluation range storage means for storing medical evaluation ranges set for each type of test item in the medical test; The generating means processes the inspection result information of the processing target so that the evaluation range does not change before and after the processing.

3. The data generating device according to claim 1.

4. A computer comprising: Obtain raw medical data including patient identification information and patient test results obtained from medical tests; selecting a test result expressed as a quantitative numerical value as the test result to be processed from among the plurality of test results included in the unprocessed medical data; A part of the patient's identification information is deleted from the unprocessed medical data, and a predetermined fluctuation value is added to the test results to be processed to generate processed medical data. Data generation method.

5. Computer, raw medical data acquisition means for acquiring raw medical data including patient identification information and test results of the patient obtained by medical testing; a selection means for selecting a test result expressed as a quantitative numerical value as the test result to be processed from among the plurality of test results included in the unprocessed medical data; and causing the device to function as a generating means for generating processed medical data by deleting a part of the patient's identification information from the unprocessed medical data and adding a predetermined fluctuation value to the test results of the processing target. Data generator.

Images