Information processing device, information processing method, and information processing program

Abstract

An information processing device according to the present invention includes a processor. The processor generates a first masked document in which a specific-information character string related to specific information is masked from a processing target document, detects a character string to be anonymized from the first masked document, and generates, on the basis of a detection result of the character string to be anonymized, an anonymized document in which the character string to be anonymized in the processing target document is masked.

Description

Information Processing Apparatus, Information Processing Method, and Information Processing Program

[0001] The present disclosure relates to an information processing apparatus, an information processing method, and an information processing program.

[0002] A technique for generating an anonymized document by masking anonymization target character strings included in a document to be processed is known. As such a technique, for example, Japanese Patent Application Laid-Open No. 2024-96560 (Patent Document 1) describes a technique for masking personal information included in a document to be processed. In the technique described in Patent Document 1, anonymization target character strings associated with personal information are acquired from a database, and it is determined whether the acquired anonymization target character strings are included in the document to be processed.

[0003] In the above technique, when personal information is included in a specific information character string regarding specific information that is not desired to be masked, the specific information character string may be erroneously masked. That is, in the above technique, there may be a case where even a specific information character string that is not desired to be masked is masked.

[0004] The present disclosure has been made in view of the above circumstances, and an object thereof is to provide an information processing apparatus, an information processing method, and an information processing program capable of highly accurately anonymizing a document to be processed even when an anonymization target character string is included in a specific information character string.

[0005] To achieve the above object, the information processing apparatus of the present disclosure includes a processor. The processor generates a first masked document in which a specific information character string regarding specific information is masked from a document to be processed, detects an anonymization target character string from the first masked document, and generates an anonymized document in which the anonymization target character string in the document to be processed is masked based on the detection result of the anonymization target character string.

[0006] Further, to achieve the above object, the information processing method of the present disclosure generates a first masked document in which a specific information character string regarding specific information is masked from a document to be processed, detects an anonymization target character string from the first masked document, and generates an anonymized document in which the anonymization target character string in the document to be processed is masked based on the detection result of the anonymization target character string.

[0007] Furthermore, in order to achieve the above objective, the information processing program disclosed herein generates a first masked document in which specific information strings relating to specific information are masked from the document to be processed, detects the strings to be anonymized from the first masked document, and causes a computer to execute a process in which the strings to be anonymized in the document to be processed are masked based on the detection result of the strings to be anonymized.

[0008] According to this disclosure, even if the specific information string contains the string to be anonymized, the document to be processed can be anonymized with high accuracy.

[0009] This is a diagram illustrating the overview of the information processing apparatus of the embodiment. This is a block diagram showing an example of the configuration of the information processing apparatus of the embodiment. This is a functional block diagram showing an example of the configuration of the information processing apparatus of the embodiment. This is a diagram illustrating the functions of each processing unit of the information processing apparatus of the first embodiment. This is a flowchart showing an example of the information processing flow by the information processing apparatus of the first embodiment. This is a diagram illustrating the functions of each processing unit of the information processing apparatus of the second embodiment. This is a flowchart showing an example of the information processing flow by the information processing apparatus of the second embodiment. This is a diagram illustrating a modified example 3.

[0010] Embodiments of this disclosure will be described in detail below with reference to the drawings. These embodiments are not intended to limit the scope of the technology of this disclosure.

[0011] [First Embodiment] As shown in Figure 1, the information processing device of this embodiment is a device that generates an anonymized document 80 in which the string to be anonymized contained in the document to be processed 50 is masked by a mask 72. In the example shown in Figure 1, the state in which an anonymized document 80 is generated by the information processing device in which the string to be anonymized (personal information) contained in the document to be processed 50, which is the name of the patient, "Hashimoto", is masked by a mask 72. In this embodiment, as a specific example, the document to be processed 50 is a medical document related to medical care, such as an electronic medical record or a radiology report, the string to be anonymized is a string representing so-called personal information, such as the patient's name and address, and the specific information is medical information, and the specific information string is a medical information string related to medical information, which will be described in detail later.

[0012] Figure 2 shows a block diagram illustrating an example of the configuration of the information processing device 10 of this embodiment. As shown in Figure 2, the information processing device 10 of this embodiment comprises a control unit 20, a storage unit 22, a communication interface unit 24, an operation unit 26, and a display unit 28. The control unit 20, storage unit 22, communication interface unit 24, operation unit 26, and display unit 28 are connected to each other via a bus 29, such as a system bus or a control bus, enabling the exchange of various types of information.

[0013] The control unit 20 in this embodiment controls the overall operation of the information processing device 10. The control unit 20 is a processor and includes a CPU (Central Processing Unit) 20A. The control unit 20 is also connected to the storage unit 22, which will be described later. The control unit 20 may also include a GPU (Graphics Processing Unit).

[0014] The operation unit 26 is used for the user to input information related to anonymization. The operation unit 26 is not particularly limited and may include, for example, various switches, a touch panel, a stylus, a mouse, and a microphone for voice input. The display unit 28 displays the anonymized document 80 and various other information. The operation unit 26 and the display unit 28 may be integrated to form a touch panel display.

[0015] The communication interface unit 24 communicates various types of information with external devices of the information processing device 10 via the network 9 using wireless or wired communication.

[0016] The memory unit 22 includes a ROM (Read Only Memory) 22A, a RAM (Random Access Memory) 22B, and a storage unit 22C. The ROM 22A is pre-stored with various programs executed by the CPU 20A. The RAM 22B temporarily stores various data. The storage unit 22C stores the information processing program 30 executed by the CPU 20A, and other various information. The storage unit 22C is a non-volatile memory unit, such as an HDD (Hard Disk Drive) or an SSD (Solid State Drive).

[0017] Furthermore, Figure 3 shows a functional block diagram of an example configuration of the information processing device 10 of this embodiment. As shown in Figure 3, the information processing device 10 comprises an acquisition unit 40, a specific information string masking unit 42, an anonymization target string detection unit 44, an anonymized document generation unit 46, and a display control unit 48. As an example, in the information processing device 10 of this embodiment, the CPU 20A of the control unit 20 executes an information processing program 30 stored in the storage 22C, so that the CPU 20A functions as the acquisition unit 40, the specific information string masking unit 42, the anonymization target string detection unit 44, the anonymized document generation unit 46, and the display control unit 48.

[0018] The acquisition unit 40 acquires the document to be processed 50. The source from which the acquisition unit 40 acquires the document to be processed 50, and the specific acquisition method, are not limited. For example, if the document to be processed 50 is stored in the storage 22C, the acquisition unit 40 acquires the document to be processed 50 from the storage 22C. Alternatively, if the document to be processed 50 is stored in a device outside the information processing device 10, the acquisition unit 40 acquires the document to be processed 50 from the external device via the network using the communication I / F 24. The document to be processed 50 may be a single document or may contain multiple documents. The acquisition unit 40 outputs the acquired document to the specific information string masking unit 42.

[0019] The specific information string masking unit 42 generates a first masked document from the document to be processed 50 in which specific information strings relating to specific information are masked. As described above, the specific information in this embodiment is medical information including at least one of disease name, test name, drug name, surgical procedure name, instrument name, device name, and symptom, and the specific information string is a medical information string relating to medical information.

[0020] As an example, the specific information string masking unit 42 of this embodiment generates a first masked document 60 by converting the specific information string in the document to be processed 50 into information 62, based on a conversion list 55 in which information 62 and specific information strings are associated, as shown in Figure 4. Information 62 is the converted information obtained by converting the specific information string through masking. It is preferable to use an identifier that is uniquely determined for the specific information string as information 62.

[0021] Furthermore, in the subsequent anonymized document generation unit 46, personal information that is the string to be anonymized is detected and masked, so the information 62 used is information that is not detected as personal information. It is also preferable that the information 62 is information that is considered unlikely to be used in medical documents. Examples of such information 62 include hash values ​​obtained by converting a specific information string using a hash function or the like. In addition, as an example, in this embodiment, the conversion list 55 is prepared in advance and is stored, for example, in the storage 22C of the information processing device 10 or in an external device, and can be referenced.

[0022] In the conversion list 55 shown in Figure 4, the specific information string "Hashimoto's disease" is associated with information 62 obtained by the hash function "p1aBDt84", the specific information string "endometriosis" is associated with information 62 obtained by the hash function "9mGw59Lk", and the specific information string "conscious and alert" is associated with information 62 obtained by the hash function "F2rjoH541". When the specific information string masking unit 42 detects the string "Hashimoto's disease", which is a specific information string, from the document to be processed 50, it converts it to information 62 "p1aBDt84". Furthermore, when the specific information string masking unit 42 detects the string "endometriosis", which is a specific information string, from the document to be processed 50, it converts it to information 62 "9mGw59Lk", and when it detects the string "conscious and alert", which is a specific information string, it converts it to information 62 "F2rjoH541".

[0023] Furthermore, as a method by which the specific information string masking unit 42 converts specific information strings in the document 50 to be processed into information 62, for example, it may first detect all specific information strings in the document 50 to be processed and then convert all detected specific information strings into information 62. Alternatively, for example, the process of converting detected specific information strings into information 62 may be repeated each time a specific information string is detected in the document 50 to be processed.

[0024] The specific information string masking unit 42 outputs the generated first masking document 60 to the anonymization target string detection unit 44. The conversion list 55 in this embodiment is an example of the conversion list and the first list of this disclosure, and the information 62 in this embodiment is an example of the first information of this disclosure.

[0025] The anonymization target string detection unit 44 detects the string to be anonymized from the first masking document 60. As described above, the string to be anonymized in this embodiment is personal information. Therefore, the anonymization target string detection unit 44 detects a string representing personal information from the first masking document 60. In the example shown in Figure 4, the anonymization target string detection unit 44 detects the personal information "Hashimoto," which is the patient's name, as the string to be anonymized from the first masking document 60. Note that the method by which the anonymization target string detection unit 44 detects personal information from the first masking document 60 is not limited. For example, if the document to be processed 50 is a medical document related to a hospital or facility, personal information may be detected from the first masking document 60 by referring to the employee roster, patient roster, etc. of that hospital or facility. Also, if the document to be processed 50 is a medical document, personal information such as the names and addresses of medical personnel such as doctors and nurses in charge, or the patient in question, which are associated with the medical document, may be detected. Furthermore, personal information may be detected from the first masking document 60 by referring to publicly available open-source biographical dictionaries, address books, and atlases. Also, for example, if a user specifies a string representing personal information for the first masking document 60, personal information may be detected from the first masking document 60 based on that specification. The anonymization target string detection unit 44 outputs the detection result of the anonymization target string and the first masking document 60 to the anonymization document generation unit 46.

[0026] The anonymized document generation unit 46 generates an anonymized document 80 in which the strings to be anonymized in the document 50 to be processed are masked, based on the detection results of the strings to be anonymized.

[0027] As shown in Figure 3, the anonymized document generation unit 46 of this embodiment includes an anonymized string masking unit 47. Based on the detection result of the anonymized string, the anonymized string masking unit 47 generates a second masked document 70 in which the anonymized string in the first masked document 60 is masked. In the example shown in Figure 4, the anonymized string masking unit 47 converts the anonymized string, which is personal information such as the patient's name "Hashimoto," into a mask 72. Although Figure 4 shows an embodiment in which the anonymized string is masked by a mask 72, the information after converting the anonymized string by masking other than the mask 72 is not limited to the mask 72. For example, it may be any string. Also, for example, it may be converted into different types of information depending on the type of personal information (anonymized string). In this case, as a specific example, if the type of personal information is the patient's name, it may be converted into the string "Patient's Name," and if the type of personal information is a telephone number, it may be converted into the string "Telephone Number" to perform masking. In other words, in this embodiment, masking is not limited to converting the target string into a mask, but rather to making the target string unreadable. For example, this includes converting the target string into information different from that string. Note that converting to different information also includes converting the target string to a blank space.

[0028] The anonymization target string masking unit 47 processes the specific information string in the processing target document 50, converting it into information 62 and generating a second masked document 70 in which the anonymization target string has been converted into a mask 72.

[0029] The anonymized document generation unit 46 generates the anonymized document 80 by restoring the information 62 in the second masked document 70 to a specific information string based on the conversion list 55. In other words, the anonymized document generation unit 46 of this embodiment restores the specific information string in the second masked document 70 by performing the reverse processing of the specific information string masking unit 42 described above.

[0030] In the example shown in Figure 4, when the anonymized document generation unit 46 detects the string "p1aBDt84", which is information 62, from the second masked document 70, it refers to the conversion list 55 and restores it to the specific information string "Hashimoto's disease". Also, when the anonymized document generation unit 46 detects the string "9mGw59Lk", which is information 62, from the second masked document 70, it refers to the conversion list 55 and restores it to the specific information string "endometriosis", and when it detects the string "F2rjoH541", which is information 62, it restores it to the specific information string "conscious and alert". Through this process, an anonymized document 80 is generated in which the strings to be anonymized in the document 50 to be processed are masked. Figure 4 shows the state in which an anonymized document 80 has been generated in which the personal information strings to be anonymized, namely "Hashimoto", which is the patient's name, are masked by the mask 72.

[0031] The anonymized document generation unit 46 outputs the generated anonymized document 80 to the display control unit 48.

[0032] The display control unit 48 controls the display of the anonymized document 80 on the display unit 28.

[0033] Next, the operation of the information processing device 10 of this embodiment will be described with reference to the drawings. Figure 5 shows a flowchart illustrating an example of the flow of information processing performed in the information processing device 10 of this embodiment. In this embodiment, as an example, the information processing device 10 executes the information processing shown as an example in Figure 5 by having the CPU 20A of the control unit 20 execute the information processing program 30 stored in the storage 22C based on a user's start instruction made by the operation unit 26.

[0034] In step S100 of Figure 5, the acquisition unit 40 acquires the document to be processed 50 as described above.

[0035] In the next step S102, the specific information string masking unit 42 generates a first masked document 60 in which the specific information string is masked from the document to be processed 50, as described above. As described above, the specific information string masking unit 42 of this embodiment converts the specific information string in the document to be processed 50 into information 62 based on the conversion list 55.

[0036] In the next step S104, the anonymization target string detection unit 44 detects the anonymization target string from the first masking document 60, as described above.

[0037] In the next step S106, the anonymization target string masking unit 47 of the anonymization document generation unit 46 generates a second masking document 70 in which the anonymization target string is masked from the first masking document 60, as described above. As described above, the anonymization document generation unit 46 of this embodiment converts the personal information in the first masking document 60 into a mask 72.

[0038] In the next step S108, the anonymized document generation unit 46 restores the information 62 in the second masked document 70 to a specific information string. As described above, the anonymized document generation unit 46 of this embodiment restores the information 62 in the anonymized document 80 to anonymization target string based on the conversion list 55. The anonymized document 80 is generated by the processing in steps S106 and S108.

[0039] In the next step S110, the display control unit 48 controls the display unit 28 to display the generated anonymized document 80. When the processing in step S110 is completed, the information processing shown in Figure 5 is completed.

[0040] In the information processing shown in Figure 5, in step S104, the anonymization target string detection unit 44 detects all anonymization target strings contained in the first masking document 60, and then in step S106, the anonymization target string masking unit 47 masks all anonymization target strings contained in the first masking document 60. However, the processing flow is not limited to this embodiment. For example, each time the anonymization target string detection unit 44 detects an anonymization target string, the anonymization target string masking unit 47 may mask the detected anonymization target string. In other words, the processing of steps S104 and S106 may be repeated.

[0041] [Second Embodiment] A detailed explanation of the configuration similar to that of the information processing device 10 in the first embodiment will be omitted. As shown in Figure 6, in the information processing device 10 of this embodiment as well, the specific information string masking unit 42 masks the specific information string to generate the first masked document 60. In this embodiment, unlike the first embodiment, masking is performed by converting the specific information string to the same information 63 regardless of what kind of string it is. In the example shown in Figure 6, "Hashimoto's disease," "endometriosis," and "conscious and alert" are all converted to "(emoji)." Note that the notation "(emoji)" in Figure 6 does not mean the string "emoji," but rather indicates that it is any emoji. It is preferable that the information 63 has fewer characters, as this shortens the processing time when detecting the string from the first masked document 60. The specific information string masking unit 42 may detect the specific information string from the document to be processed 50 based on the conversion list 55, but it may also detect the specific information string without using the conversion list 55 and convert it to information 63. In this case, one piece of information 63 to be converted from a specific information string may be defined in advance, and the specific information string masking unit 42 may refer to a medical information dictionary or the like that which is publicly available as open source, and convert the specific information string, which is medical information detected from the document to be processed 50, into the defined piece of information 63.

[0042] The anonymization target string detection unit 44 detects the string to be anonymized from the first masking document 60. In the example shown in Figure 6, the patient's name, "Hashimoto," is detected from the first masking document 60.

[0043] The anonymized document generation unit 46 identifies the location of the string to be anonymized in the document to be processed 50 based on the detection result of the string to be anonymized detection unit 44. The string to be anonymized masking unit 47 generates an anonymized document 80 by masking the string to be anonymized in the document to be processed 50 based on the identified location. In the example shown in Figure 6, based on the location of the string to be anonymized, "Hashimoto," detected in the first masked document 60, the anonymized document generation unit 46 generates an anonymized document 80 by masking the string to be anonymized, "Hashimoto," in the document to be processed 50 with a mask 72.

[0044] Thus, in this embodiment, unlike the first embodiment, since the masked specific information string is not restored, as described above, masking can be performed on different specific information strings with the common information 63.

[0045] FIG. 7 shows a flowchart representing an example of the flow of information processing executed in the information processing apparatus 10 of this embodiment.

[0046] In step S100 of FIG. 7, the acquisition unit 40 acquires the document 50 to be processed, similarly to step S100 of the information processing (see FIG. 5) of the first embodiment.

[0047] In the next step S103, the specific information string masking unit 42 performs masking to convert all the specific information strings in the document 50 to be processed into the same information 63, and generates the first masked document 60.

[0048] In the next step S104, the anonymization target string detection unit 44 detects the anonymization target string from the first masked document 60, similarly to step S104 of the information processing (see FIG. 5) of the first embodiment.

[0049] In the next step S107, the anonymized document generation unit 46 identifies the positions of the anonymization target strings in the document 50 to be processed based on the detection result of step S104.

[0050] In the next step S109, the anonymization target string masking unit 47 masks the anonymization target strings in the document 50 to be processed based on the positions identified in step S107.

[0051] In the next step S110, the display control unit 48 performs control to display the generated anonymized document 80 on the display unit 28, similarly to step S110 of the information processing (see FIG. 5) of the first embodiment. When the processing of step S110 ends, the information processing shown in FIG. 7 ends.

[0052] It goes without saying that the configuration and operation of the information processing device 10, etc., described in each of the above embodiments are merely examples and can be modified as needed without departing from the spirit of the present invention. For example, the following modified forms may be used, and the above embodiments and the following modified forms may be combined as appropriate.

[0053] (Modification 1) In the above embodiments, a configuration in which the conversion list 55 is provided in advance has been described. However, the specific information string masking unit 42 may generate the conversion list 55 while it is generating the first masking document 60. For example, in the example shown in Figure 4, when "Hashimoto's disease" is detected for the first time from the document to be processed 50, an arbitrary hash function is used to convert "Hashimoto's disease" to "p1aBDt84", and "Hashimoto's disease" and "p1aBDt84" are associated and registered in the conversion list 55. Thereafter, when the specific information string masking unit 42 detects the specific information string "Hashimoto's disease" from the document to be processed 50, it converts "Hashimoto's disease" to "p1aBDt84" based on the conversion list 55.

[0054] According to this modified method, a conversion list 55 is generated for each document 50 to be processed. However, since the conversion list 55 itself is dedicated to the document 50 to be processed, its size can be reduced compared to a conversion list 55 that supports multiple documents 50 to be processed.

[0055] (Modification 2) The information processing device 10 may also generate the conversion list 55 in advance. For example, the information processing device 10 may generate the conversion list 55 based on the frequency of occurrence of specific information strings extracted from documents of the same type as the document to be processed 50. For example, the conversion list 55 may be generated by extracting specific information strings from medical documents over a predetermined period in the past and registering the specific information strings whose frequency of occurrence is above a threshold in the conversion list 55. Alternatively, for example, the conversion list 55 generated by extracting specific information strings from medical documents of a certain hospital and registering the specific information strings whose frequency of occurrence is above a threshold in the conversion list 55 may be used to anonymize medical documents of other hospitals.

[0056] Furthermore, when generating the conversion list 55 in this manner, it is preferable that the names of persons related to the document are removed from the same type of document as the document to be processed 50 used to generate the conversion list 55. The removal of names may be done manually in advance, for example, or it may be done by combining detection by the information processing device 10 and manual detection.

[0057] (Modification 3) As shown in Figure 8, the anonymization target string masking unit 47 may generate a second masking document 70 by performing masking by converting the anonymization target string in the first masking document 60 to information 73 based on a conversion list 65 in which information 73 and the anonymization target string are associated. The conversion list 65 in this modification is an example of the second list in this disclosure, and the information 73 in this modification is an example of the second information in this disclosure.

[0058] (Modification 4) In each of the above embodiments, the string to be anonymized and masked may be changed as desired. For example, if the string to be anonymized is personal information, one processing document 50 may generate an anonymized document 80 in which the entire address is masked, and another anonymized document 80 in which the prefecture name of the address is not masked.

[0059] (Modification 5) The detection result obtained by the specific information string masking unit 42 from the document 50 to be processed may be displayed on the display unit 28 or the like to present it to the user. This allows the user to confirm whether the string to be anonymized has been properly detected and to correct the detection result as necessary. If the information processing device 10 receives a correction from the user regarding the detection result of the specific information string, the subsequent processing will be performed based on the corrected detection result.

[0060] (Modification 6) In order to detect specific information strings and anonymized strings from the document to be processed 50, it is preferable that the document to be processed 50 is free of errors. For this reason, processing to extract or correct errors from the document to be processed 50 may be performed in advance. For example, an Artificial Intelligence (AI) or application that takes text as input and outputs text that points out or corrects errors may be used to perform error correction processing on the document to be processed 50.

[0061] As described above, the information processing device 10 in each of the above embodiments includes a specific information string masking unit 42, an anonymization target string detection unit 44, and an anonymized document generation unit 46. The specific information string masking unit 42 generates a first masked document 60 in which specific information strings relating to specific information are masked from the document to be processed 50. The anonymization target string detection unit 44 detects the anonymization target strings from the first masked document 60. The anonymized document generation unit 46 generates an anonymized document 80 in which the anonymization target strings in the document to be processed 50 are masked based on the detection result of the anonymization target strings.

[0062] Thus, in the information processing device 10 of each of the above embodiments, the string to be anonymized is detected from the first masked document 60 after the specific information string has been masked. Therefore, even if the specific information string contains a string similar to the string to be anonymized, that string will not be detected as the string to be anonymized. Accordingly, according to the information processing device 10 of each of the above embodiments, even if the specific information string contains the string to be anonymized, the document to be processed can be anonymized with high accuracy. In other words, even if the specific information string contains the string to be anonymized, the string to be anonymized can be anonymized while the specific information string in the document to be processed remains.

[0063] In the above embodiments and modifications, the processing target document 50 is described as a medical document, the specific information string is a medical information string, and the anonymization target string is personal information. However, the types of processing target document 50, specific information string, and anonymization target string are not limited to these.

[0064] Furthermore, in this embodiment, each process is executed on any computer. Alternatively, any computer may execute these processes using a processor as hardware, a program as software, or a combination thereof. In that case, the processor is configured to work in cooperation with the program to execute the various processes in this embodiment, and can function as a unit or means in this embodiment. The execution order of the processes by the processor is not limited to the order described and may be changed as appropriate. Any computer may be a general-purpose computer, a computer designed for a specific purpose, a workstation, or any other system capable of executing each process.

[0065] A processor may consist of one or more hardware components, and the type of hardware is not limited. For example, a processor may consist of programmable logic devices such as a CPU (Central Processing Unit), MPU (Micro Processing Unit), FPGA (Field Programmable Gate Array), dedicated circuits for performing specific processing such as an ASIC (Application Specific Integrated Circuit), a GPU (Graphics Processing Unit), or an NPU (Neural Processing Unit). Furthermore, the type of hardware may be a combination of different types of hardware. When multiple hardware components are configured to execute one or more processes of a processor, these components may reside in physically separate devices or in the same device. Furthermore, in any embodiment, the order of the processes performed by the processor is not limited to the order described above and may be changed as appropriate. The hardware components are composed of electrical circuits (circuits) and the like, which are combinations of circuit elements such as semiconductor elements.

[0066] Furthermore, the program may be firmware or software such as microcode. Alternatively, the program may be, for example, a set of program modules, each function of which may be implemented by a processor configured to perform its respective function. The program may be program code or multiple code segments stored on one or more non-temporary computer-readable media (e.g., storage media or other storage). The program may be divided and stored on multiple non-temporary computer-readable media located on physically separate devices. Program code or code segments may represent any combination of procedures, functions, subprograms, routines, subroutines, modules, software packages, classes, or instructions, data structures, or program statements. Program code or code segments may be connected to other code segments or hardware circuits by sending and receiving information, data, arguments, parameters, or memory contents.

[0067] Furthermore, although the above embodiment describes an embodiment in which the information processing program 30 is pre-stored (installed) in the storage 22C of the memory unit 22, the invention is not limited to this. The information processing program 30 may be provided in the form of a recording medium such as a CD-ROM (Compact Disc Read Only Memory), DVD-ROM (Digital Versatile Disc Read Only Memory), or USB (Universal Serial Bus) memory. Alternatively, the information processing program 30 may be provided in the form of a download from an external device via a network.

[0068] Furthermore, the technology disclosed herein extends to all program products. Program products include all forms of products for providing programs. For example, program products include programs provided via networks such as the Internet, and non-temporary computer-readable recording media such as CD-ROMs, DVDs, and USB memory sticks on which programs are stored.

[0069] The following additional information is disclosed regarding the above-described embodiments.

[0070] (Note 1) An information processing device comprising a processor, wherein the processor generates a first masked document in which a specific information string relating to specific information is masked from a document to be processed, detects a string to be anonymized from the first masked document, and generates an anonymized document in which the string to be anonymized in the document to be processed is masked based on the detection result of the string to be anonymized.

[0071] (Note 2) The information processing apparatus according to Note 1, wherein the processor generates the first masking document by converting the specific information string to the first information based on a first list in which the first information and the specific information string are associated.

[0072] (Note 3) The information processing device according to Note 1, wherein the processor generates a first list associating the specific information string in the first masking document with the first information after masking, and generates the first masking document by converting the specific information string to the first information based on the first list.

[0073] (Note 4) The information processing apparatus according to any one of Notes 1 to 3, wherein the processor generates a second masking document in which the string to be anonymized in the first masking document is masked based on the detection result of the string to be anonymized, and restores the masked specific information string in the second masking document to generate the anonymized document.

[0074] (Note 5) The information processing apparatus according to Note 2, wherein the processor generates a conversion list representing the correspondence between the specific information string and the converted first information, generates a second masking document in which the anonymized target string in the first masking document is masked based on the detection result of the anonymized target string, and restores the first information in the second masking document to the specific information string based on the conversion list.

[0075] (Note 6) The information processing apparatus described in Note 4, wherein the processor generates the second masking document by converting the anonymized string to the second information based on a second list in which the second information and the string to be anonymized are associated.

[0076] (Note 7) The information processing device described in Note 2, wherein the processor generates the first list based on the frequency of occurrence of each specific information string extracted from documents of the same type as the document to be processed.

[0077] (Note 8) The information processing device described in Note 7, wherein the processor extracts the specific information string from the same type of document from which the names of persons relating to the same type of document have been deleted.

[0078] (Note 9) The first information is an information processing device as described in Note 2, which is a unique identifier corresponding to the specific information string.

[0079] (Note 10) The information processing apparatus described in Note 2, wherein the processor detects all of the specified information strings in the document to be processed, and then converts all of the detected specified information strings into the first information.

[0080] (Note 11) The processor is an information processing device according to Note 10 that presents the detection result of the specific information string.

[0081] (Note 12) The information processing apparatus described in Note 2, wherein the processor repeatedly performs the process of converting the detected specific information string into the first information each time it detects the specific information string in the document to be processed.

[0082] (Note 13) The information processing apparatus according to any one of Notes 1 to 12, wherein the processor masks the string to be anonymized into a string corresponding to the type of string to be anonymized.

[0083] (Note 14) The information processing apparatus according to any one of Notes 1 to 13, wherein the processor detects all the strings to be anonymized from the first masking document and then masks all of the detected strings to be anonymized.

[0084] (Note 15) The information processing apparatus according to any one of Notes 1 to 13, wherein the processor repeatedly performs the process of masking the detected string to be anonymized each time it detects a string to be anonymized from the first masking document.

[0085] (Note 16) The information processing apparatus according to any one of Notes 1 to 15, wherein the processor identifies the position of the string to be anonymized in the document to be processed based on the detection result of the string to be anonymized, and generates the anonymized document by masking the string to be anonymized in the document to be processed based on the identified position.

[0086] (Note 17) The information processing apparatus described in Note 16, wherein the processor masks all of the specified information strings in the document to be processed with the same string.

[0087] (Note 18) The information processing apparatus according to any one of Notes 1 to 17, wherein the processor masks the specific information string with information predetermined to be unlikely to be used in the document to be processed.

[0088] (Note 19) The information processing device described in any one of Notes 1 to 18, wherein the specific information is medical information including at least one of disease name, test name, drug name, surgical procedure name, instrument name, device name, and symptom, and the specific information string is a medical information string relating to the medical information.

[0089] (Note 20) An information processing method that generates a first masked document in which a specific information string relating to specific information is masked from a document to be processed, detects an anonymized string from the first masked document, and generates an anonymized document in which the anonymized string in the document to be processed is masked based on the detection result of the anonymized string.

[0090] (Note 21) An information processing program that causes a computer to perform the following processes: generate a first masked document in which a specific information string relating to specific information is masked from a document to be processed; detect a string to be anonymized from the first masked document; and generate an anonymized document in which the string to be anonymized in the document to be processed is masked based on the detection result of the string to be anonymized.

[0091] (Note 22) A computer program product that includes an information processing program that causes a processor to perform the following processes: generate a first masked document in which specific information strings relating to specific information are masked from a document to be processed; detect anonymized strings from the first masked document; and generate an anonymized document in which the anonymized strings in the document to be processed are masked based on the detection result of the anonymized strings.

[0092] (Note 23) A computer-readable storage medium storing an information processing program that causes the processor to execute a process of generating a first masked document in which a specific information string relating to specific information is masked from a document to be processed, detecting an anonymized string from the first masked document, and generating an anonymized document in which the anonymized string in the document to be processed is masked based on the detection result of the anonymized string.

[0093] The disclosure of Japanese Patent Application No. 2024-161305 is incorporated herein by reference in its entirety.

[0094] All documents, patent applications, and technical standards described herein are incorporated by reference to the same extent as if each individual document, patent application, and technical standard were specifically and individually noted to be incorporated by reference.

Claims

1. An information processing device comprising a processor, the processor generates a first masked document in which a specific information string relating to specific information is masked from a document to be processed, detects a string to be anonymized from the first masked document, and generates an anonymized document in which the string to be anonymized in the document to be processed is masked based on the detection result of the string to be anonymized.

2. The information processing apparatus according to claim 1, wherein the processor generates the first masking document by converting the specific information string to the first information based on a first list in which the first information and the specific information string are associated.

3. The information processing apparatus according to claim 1, wherein the processor generates a first list associating the specific information string in the first masking document with the first information after masking, and generates the first masking document by converting the specific information string to the first information based on the first list.

4. The information processing apparatus according to claim 1, wherein the processor generates a second masking document in which the string to be anonymized in the first masking document is masked based on the detection result of the string to be anonymized, and restores the masked specific information string in the second masking document to generate the anonymized document.

5. The information processing apparatus according to claim 2, wherein the processor generates a conversion list representing the correspondence between the specific information string and the converted first information, generates a second masking document in which the anonymized target string in the first masking document is masked based on the detection result of the anonymized target string, and restores the first information in the second masking document to the specific information string based on the conversion list.

6. The information processing apparatus according to claim 4, wherein the processor converts the anonymized string to the second information based on a second list in which the second information and the anonymized string are associated, and generates the second masked document.

7. The information processing apparatus according to claim 2, wherein the processor generates the first list based on the frequency of occurrence of each specific information string extracted from documents of the same type as the document to be processed.

8. The information processing apparatus according to claim 7, wherein the processor extracts the specific information string from the same type of document from which the names of persons relating to the same type of document have been deleted.

9. The information processing apparatus according to claim 2, wherein the first information is a unique identifier corresponding to the specific information string.

10. The information processing apparatus according to claim 2, wherein the processor detects all of the specified information strings in the document to be processed, and then converts all of the detected specified information strings into the first information.

11. The information processing apparatus according to claim 10, wherein the processor presents the detection result of the specific information string.

12. The information processing apparatus according to claim 2, wherein the processor repeatedly performs a process of converting the detected specific information string into the first information each time it detects the specific information string in the document to be processed.

13. The information processing apparatus according to claim 1, wherein the processor masks the string to be anonymized into a string corresponding to the type of the string to be anonymized.

14. The information processing apparatus according to claim 1, wherein the processor detects all strings to be anonymized from the first masking document and then masks all of the detected strings to be anonymized.

15. The information processing apparatus according to claim 1, wherein the processor repeatedly performs a process of masking the detected string to be anonymized each time it detects a string to be anonymized from the first masking document.

16. The information processing apparatus according to claim 1, wherein the processor identifies the location of the string to be anonymized in the document to be processed based on the detection result of the string to be anonymized, and generates the anonymized document by masking the string to be anonymized in the document to be processed based on the identified location.

17. The information processing apparatus according to claim 16, wherein the processor masks all of the specified information strings in the document to be processed with the same string.

18. The information processing apparatus according to claim 1, wherein the processor masks the specific information string with information predetermined to be unlikely to be used in the document to be processed.

19. The information processing device according to claim 1, wherein the specific information is medical information including at least one of a disease name, test name, drug name, surgical procedure name, instrument name, device name, and symptom, and the specific information string is a medical information string relating to the medical information.

20. An information processing method that generates a first masked document in which a specific information string relating to specific information is masked from a document to be processed; detects an anonymized string from the first masked document; and generates an anonymized document in which the anonymized string in the document to be processed is masked based on the detection result of the anonymized string.

21. An information processing program that causes a computer to perform the following processes: generate a first masked document in which specific information strings relating to specific information are masked from a document to be processed; detect anonymized strings from the first masked document; and generate an anonymized document in which the anonymized strings in the document to be processed are masked based on the detection result of the anonymized strings.

Images