Patent Application
20170124258
In the healthcare industry, there is a wide variety of private data about patients that is known as Protected Health Information (PHI). Such information includes the names and other personally identifying information about patients, and any information that can link individual patients to diagnoses, medications, and other individual information. PHI must be handled confidentially under U.S. law, such as the Health Insurance Portability and Accountability Act (HIPAA). If an entity obtains PHI in an authorized manner, that entity can only disclose the PHI to third parties in ways that are permitted by HIPAA. For example, if a company that transcribes a dictated report from a physician about a particular patient produces a transcript that contain PHI about that patient, such a company can provide the transcript back to the physician and to other healthcare professionals who provide healthcare services to the patient, but the company cannot provide the transcript to medical researchers or professors because the transcript contains PHI.
One problem created by this situation results from the fact that documents, such as transcripts of physician reports, which contain PHI are often very useful for performing medical research. For example, analyzing a large number of transcripts relating to patients who have received cancer surgery may reveal trends that could help to improve such surgery in the future. However, due to the privacy limitations imposed by HIPAA, such transcripts cannot be provided to medical researchers. In the prior art, this problem is addressed by making a copy of transcripts and other documents containing PHI, and stripping any PHI from such documents. This process of stripping PHI from documents is referred to as “anonymizing” or “de-identifying” the documents.
The primary disadvantage of such prior art techniques for de-identifying documents is that they result in two sets of data: the original data, and the de-identified data. Creating and maintaining such duplicate sets of data creates the need for significant extra amounts of storage and also complicates the process of searching, analyzing, and processing the data more generally.
In one aspect, a method for dynamic de-identification of a document includes generating a document including a tag associated with an element including protected health information, the tag including at least one instruction for rendering the element. The method includes identifying a level of authorization of a user requesting access to the generated document. The method includes rendering the document for display to the user according to the at least one instruction in the tag, based on the identified level of authorization.
In another aspect, a method for searching elements of a document including at least one dynamically de-identified element. The method includes generating a document including a first element and a second element, the first element associated with a first tag indicating the first element includes protected health information (PHI). The method includes receiving a query. The method includes excluding the first element from a search for elements satisfying the query, based upon the first tag. The method includes including the second element in the search. The method includes executing the search for elements satisfying the query by analyzing one or more elements including the second element and excluding the first element.
In still another aspect, a method for querying a plurality of documents including at least one dynamically de-identified document includes generating a first document including a first element associated with a first tag indicating the first element includes protected health information (PHI). The method includes generating a second document including a second element. The method includes receiving a query. The method includes excluding the first element from a search for elements satisfying the query, based upon the first tag. The method includes including the second element in the search. The method includes executing the search for elements satisfying the query by analyzing one or more elements including the second element and excluding the first element.
The foregoing and other objects, aspects, features, and advantages of the disclosure will become more apparent and better understood by referring to the following description taken in conjunction with the accompanying drawings, in which:
Methods and systems for dynamic de-identification of documents provide functionality for enabling a set of documents to be used by a plurality of entities, even in circumstances in which protected health information (PHI) is not permitted to be provided to some of the entities. By way of example, if a user who lacks authority to view the PHI in a particular document makes a request to view that document, the methods and systems described herein may provide functionality that removes the PHI from the document in the process of providing (e.g., displaying) the document to the requesting user. As a result, the original document in the dataset need not be changed or duplicated. Furthermore, the methods and systems described herein may provide functionality for de-identifying a document without making a copy of the document. This technique may be referred to as “dynamic de-identification” because the functionality performs the de-identification dynamically, i.e., on-the-fly in response to a request from a user for a particular document, rather than ahead of time before the document is requested. The methods and systems described herein, and as will be described in further detail below, facilitate the dynamic de-identification of documents by storing special data in each document when the document is created.
Although the methods and systems described herein describe the de-identification of documents containing PHI, it should be understood that these methods and systems might also be applied to documents containing any type of data that a user may wish to obfuscate, or for which some users should receive one rendering of data while other users should receive a second, different rendering of the same data, where the document itself indicates how to perform the alternative rendering of the data. As one example, frequently, patients with psychiatric problems require higher level of content protection. In such an example, it is quite likely that the PHI itself (e.g., name and medical record number) is not protected, but a specific set of conditions are excluded or redacted from the presentation.
Referring to
The method 200 includes generating a document including a tag associated with an element including protected health information, the tag including at least one instruction for rendering the element (210). As will be understood by those of ordinary skill in the art, rendering produces output on an output device and may include providing visual output (e.g., textual output), audio output (e.g., text-to-speech or other audio output), or audio-visual output (e.g., video output). As shown in
The method 200 may include transcribing, by an automatic speech recognition engine, the audio file to generate the transcript 108. As shown in
By way of example, the transcription system may be a transcription system as described in commonly-owned U.S. Pat. No. 7,584,103, entitled “Automated Extraction of Semantic Content and Generation of a Structured Document from Speech,” which is hereby incorporated by reference.
In one embodiment, as each document is generated (e.g., transcribed from speech), the data identification and tagging component 104 identifies any PHI in the document and tags each instance of PHI with metadata (such as, for example, through the use of XML tags). By way of example, the identification and tagging may occur as described in the above-referenced, commonly-owned U.S. Pat. No. 7,584,103. The data identification and tagging component 104 may analyze a transcribed document to identify the element and insert the tag into the transcribed document, based upon the analysis. In one embodiment, the data identification and tagging component 104 accesses a listing of identifiers generated based on law or regulation; for example, HIPAA regulations identify eighteen types of information that may potentially include PHI and the data identification and tagging component 104 may access a database listing the information types identified by HIPAA regulations. The metadata may indicate that the tagged element includes PHI. The metadata may indicate a type of PHI (e.g., full name, Social Security number, home address). The metadata may provide information about how to obfuscate the PHI when the document is rendered (displayed) to a user who does not have authority to view the PHI. In some embodiments, the data identification and tagging component 104 archives the finalized transcript 108, which includes the tags. For example, the document generator 102 may store the transcript 108 in a document database 110.
In some embodiments, the computing device 101a generates a transcript 108 from the spoken audio stream 120 and includes in this transcript 108 any tags needed to de-identify the transcript 108 during rendering. In one of these embodiments, therefore, a computing device 101b used by a user without authorization to access PHI does not receive any PHI; such an embodiment reduces a security risk that PHI will be located on an unauthorized client computer.
Referring back to
The authorization and rendering component 106 may render an element in the generated document according to the at least one instruction in the tag, based on the identified level of authorization and without modifying the element in the document. The authorization and rendering component 106 may implement the at least one instruction in the tag to exclude the protected health information from the rendering of the document without removing the protected health information from the document. The authorization and rendering component 106 may implement the at least one instruction in the tag to obfuscate the protected health information in the rendering of the document without removing the protected health information from the document. The authorization and rendering component 106 may implement the at least one instruction in the tag to delete the protected health information in the rendering of the document, or otherwise omit the protected health information from the rendering of the document, without removing the protected health information from the document.
The authorization and rendering component 106 may determine that the user is authorized to view protected health information. In one embodiment, the authorization and rendering component 106 may implement the at least one instruction in the tag to include the protected health information in the rendering of the document. In another embodiment, the tags in transcript 108 only include instructions for de-identifying the transcript 108 before rendering the transcript 108 to an unauthorized user, and the authorization and rendering component 106 may render the transcript 108 in its entirety without applying any of the tags.
The authorization and rendering component 106 may determine that the user lacks authority to view protected health information. The authorization and rendering component 106 may then implement the at least one instruction in the tag to exclude the protected health information from the rending of the document. The authorization and rendering component 106 may implement the at least one instruction in the tag to obfuscate the protected health information in the rendering of the document. The authorization and rendering component 106 may implement the at least one instruction in the tag to delete the protected health information in the rendering of the document, or otherwise to omit the protected health information from the rendering of the document. The authorization and rendering component 106 may implement the at least one instruction in the tag to randomize the protected health information in the rendering of the document.
The method 200 includes rendering the document for display to the user according to the at least one instruction in the tag, based on the identified level of authorization (230).
In some embodiments, the authorization and rendering component 106 selects at least one instruction from a plurality of instructions included in the tag, based on the determined level of authorization. In one of these embodiments, the authorization and rendering component 106 renders the document according to the selected at least one instruction.
As shown in
As another example, consider the patient name “Jason Fitzgerald,” which is an example of PHI. The name “Jason Fitzgerald” may be tagged with information indicating that the name “Jason Fitzgerald” should instead be displayed to the user as “John Smith” (or another common name which does not identify the patient) if the user lacks authority to view the patient's real name. When the system displays the document to a user who lacks authority to view the patient's real name, the system may use the obfuscation information that is associated with each instance of PHI to display the obfuscated version of the PHI instead of the PHI itself. For example, the system may use the information indicated above to display “John Smith” instead of “Jason Fitzgerald” when rendering the document containing “Jason Fitzgerald” to a user who lacks authority to view the patient's real name.
Although the embodiments described above are directed to tagging elements within a single document, the methods and systems described herein may also provide functionality for tagging elements across a plurality of documents. In some embodiments, the data identification and tagging component 104 may determine that a plurality of transcripts 108a-n have at least one element in common; for example, and without limitation, the data identification and tagging component 104 may analyze a plurality of transcripts 108a-n and determine that the plurality of transcripts 108a-n are all related to a single patient. For example, the data identification and tagging component 104 may generate a first tagged, draft transcript 108 and then search a document database 110 to determine whether any previously archived transcripts have at least one element in common (e.g., list the same patient as is listed in the draft transcript). Based on the determination, the data identification and tagging component 104 may identify a type of obfuscation to be applied to a particular element in each of the plurality of transcripts 108a-n. As another example, each generated draft transcript 108 may be associated with one or more items of meta-data (for example, and without limitation, hospital identifier, facility identifier, facility name, patient name, patient identifier, date of birth, physician, name, physician identifier, or time of document generation). In such an example, the system may provide functionality for applying a hash function to at least one item of meta-data (e.g., and without limitation, hospital identifier, physician identifier and hospital identifier, hospital identifier and patient identifier, visit identifier and hospital identifier and patient identifier) to generate another identifier for the generated transcript 108; transcripts 108 having the same identifier may be obfuscated in a consistent manner. The system may also provide functionality for using patient and physician identifiers to uniquely select from a population of random names. For example, the system may provide functionality for applying a hash function to a patient identifier and a physician identifier (e.g., to a concatenation of the two identifiers) and use the output of the applied hash function to select a random name for use in obfuscation (e.g., by searching a data structure for the output of the applied hash function to identify a random name associated with the output in the data structure).
In one embodiment, consistently applying a particular type of obfuscation to each of the plurality of transcripts 108a-n. Such consistency in tagging may result in a consistent record (e.g., for a particular patient). Such consistency in tagging may result analysis of the plurality of transcripts 108a-n as a unit. By way of example, and without limitation, multiple records may be associated with a particular patient and may include PHI that could be obfuscated in a variety of ways; by determining that the records associated with that patient should be consistently obfuscated in one way in particular, the system enables improved analyses of the patient data than if the data was inconsistent.
The methods and systems described herein may also provide improvements to the process of searching a dataset that contains PHI. For example, if a user who lacks authority to view PHI performs a search for PHI (e.g., “show me all users with telephone numbers starting in 456”), then the system will not perform that search. More specifically, the system will not attempt to match a query against data that is marked as PHI in the dataset. Therefore, a search may be performed using a particular query, but the query may not be applied to every element in the dataset. More specifically, the query may be applied to non-PHI data elements (such as portions of documents) in the dataset, but not to PHI data elements in the data set. As a result, the search will execute the query and produce search results, but will exclude results that would have matched the query if the query were allowed to match against PHI data elements.
Referring now to
The method 300 includes generating a document including a first element and a second element, the first element associated with a first tag indicating the first element includes protected health information (PHI) (302). The document generation may occur as described above in connection with
The method 300 includes receiving a query (304). In one embodiment, the authorization and rendering component 106 receives the query from a computing device 101b. In another embodiment, a search component 140 receives the query from a computing device 101b.
The method 300 includes excluding the first element from a search for elements satisfying the query, based upon the first tag (306). In one embodiment, the search component 140 determines whether the document includes any tags. If so, the search component 140 identifies a type code included in the tag or tags and compares the type code to a type code of the query. If the two type codes are substantially similar, the search component 140 excludes any text elements in the transcript 108 from the search results.
The method 300 includes including the second element in the search (308). If there are no tags associated with the type code associated with the element, the search component 140 may include the element in the search. If the search component 140 determines that there are no tags embedded in the transcript 108, the search component 140 may include all elements of the transcript 108 in the search.
The method 300 includes executing the search for elements satisfying the query by analyzing one or more elements including the second element and excluding the first element (310).
Referring now to
The method 350 includes generating a first document including a first element associated with a first tag indicating the first element includes protected health information (PHI) (352). The first document may be generated as described above in connection with
The method 350 includes generating a second document including a second element (354). The second document may be generated as described above in connection with
The method 350 includes receiving a query (356). The query may be received as described above in connection with
The method 350 includes excluding the first element from a search for elements satisfying the query, based upon the first tag (358). The exclusion may occur as described above in connection with
The method 350 includes including the second element in the search (360). The inclusion may occur as described above in connection with
The method 350 includes executing the search for elements satisfying the query by analyzing one or more elements including the second element and excluding the first element (362). The search may be executed as described above in connection with
Referring now to
The method 400 includes generating a first document including a first element associated with a first tag indicating the first element includes protected health information (PHI) (402). The first document may be generated as described above in connection with
The method 400 includes receiving a query (404). The query may be received as described above in connection with
The method 400 includes identifying, in response to the query, a plurality of results documents, including the first document (406). The method 400 may include receiving an identification of each of the plurality of documents from a third party search engine. Alternatively, the search component 140 may include a search engine with which to process queries.
The method 400 includes removing, from the plurality of results documents, the first document, based upon the first tag (408). The removal may occur as described above in connection with
The method 400 includes providing access to the remaining documents in the plurality of results documents (410). The search component 140 may provide copies of the remaining documents to a user of a computing device 101b from which the query originated. The search component 140 may provide an identification of the remaining documents to a user of a computing device 101b from which the query originated. The search component 140 may provide instructions for accessing each of the remaining documents to a user of a computing device 101b from which the query originated.
In other embodiments, instead of removing the first document from the plurality of results documents, the search component 140 may alter the first document based on the first tag. For example, instead of removing a document entirely, the search component 140 may determine that the tag allows distribution of the document if the PHI is obfuscated; the search component 140 may then direct the authorization and rendering component 106 to process the tag and provide access to the document including the obfuscated PHI.
Embodiments of the present invention have a variety of advantages. For example, the rendering instructions provided in the tags of the transcript 108 may allow a user who is not authorized to view PHI to view a document that is consistent and whole, in which nothing appears redacted because any redacted elements are either deleted or obfuscated in a way that gives consistency for analysis purposes. A single document may, therefore, include both PHI and non-PHI data (or, more generally, data to be de-identified and data not to be de-identified), as well as instructions for how to render the data in a de-identified manner.
It is to be understood that although the invention has been described above in terms of particular embodiments, the foregoing embodiments are provided as illustrative only, and do not limit or define the scope of the invention. Various other embodiments, including but not limited to the following, are also within the scope of the claims. For example, elements and components described herein may be further divided into additional components or joined together to form fewer components for performing the same functions.
Any of the functions disclosed herein may be implemented using means for performing those functions. Such means include, but are not limited to, any of the components disclosed herein, such as the computer-related components described below.
The techniques described above may be implemented, for example, in hardware, one or more computer programs tangibly stored on one or more computer-readable media, firmware, or any combination thereof. The techniques described above may be implemented in one or more computer programs executing on (or executable by) a programmable computer including any combination of any number of the following: a processor, a storage medium readable and/or writable by the processor (including, for example, volatile and non-volatile memory and/or storage elements), an input device, and an output device. Program code may be applied to input entered using the input device to perform the functions described and to generate output using the output device.
Embodiments of the present invention include features which are only possible and/or feasible to implement with the use of one or more computers, computer processors, and/or other elements of a computer system. Such features are either impossible or impractical to implement mentally and/or manually. For example, embodiments of the present render documents on output devices, such as computer monitors and touchscreens. Only a computing device can perform such rendering.
Each computer program within the scope of the claims below may be implemented in any programming language, such as assembly language, machine language, a high-level procedural programming language, or an object-oriented programming language. The programming language may, for example, be a compiled or interpreted programming language.
Each such computer program may be implemented in a computer program product tangibly embodied in a machine-readable storage device for execution by a computer processor. Method steps of the invention may be performed by one or more computer processors executing a program tangibly embodied on a computer-readable medium to perform functions of the invention by operating on input and generating output. Suitable processors include, by way of example, both general and special purpose microprocessors. Generally, the processor receives (reads) instructions and data from a memory (such as a read-only memory and/or a random access memory) and writes (stores) instructions and data to the memory. Storage devices suitable for tangibly embodying computer program instructions and data include, for example, all forms of non-volatile memory, such as semiconductor memory devices, including EPROM, EEPROM, and flash memory devices; magnetic disks such as internal hard disks and removable disks; magneto-optical disks; and CD-ROMs. Any of the foregoing may be supplemented by, or incorporated in, specially-designed ASICs (application-specific integrated circuits) or FPGAs (Field-Programmable Gate Arrays). A computer can generally also receive (read) programs and data from, and write (store) programs and data to, a non-transitory computer-readable storage medium such as an internal disk (not shown) or a removable disk. These elements will also be found in a conventional desktop or workstation computer as well as other computers suitable for executing computer programs implementing the methods described herein, which may be used in conjunction with any digital print engine or marking engine, display monitor, or other raster output device capable of producing color or gray scale pixels on paper, film, display screen, or other output medium.
Any data disclosed herein may be implemented, for example, in one or more data structures tangibly stored on a non-transitory computer-readable medium. Embodiments of the invention may store such data in such data structure(s) and read such data from such data structure(s).
