By · Last updated 2026-04-26

返回博客医疗保健

研究中的可逆加密重新识别协议

你无法联系「Patient_001」进行随访。IRB 现在要求记录在案的重新识别协议——证明你在符合伦理条件时「能够」重新识别。

April 26, 20268 分钟阅读
research re-identification protocollongitudinal study follow-upIRB pseudonymization requirementcontrolled re-identificationdeterministic encryption

IRB 重新联系协议:可逆加密指南

IRB 的要求已不仅限于去标识化方案,还需要重新联系方案。你必须证明两件事:其一,外部各方无法获取真实患者姓名;其二,你的团队在获得伦理批准时可以做到。

这一双重要求来自现实经验。长期研究曾在试验中期发现紧急结果,但记录已被锁死,没有任何回溯路径,患者医疗因此受阻。监管机构注意到了这一问题。

我们如何支持这一需求,请参阅合规概览安全实践

IRB 为何需要一扇双向门

根据 DLA Piper 2025 年年度报告,GDPR 罚款在 2024 年增长 56%。GDPR 第 89 条对这一趋势作出回应,要求对研究数据实施假名化而非完全删除。该规则承认,研究有时需要一条回溯到真实记录的路径。

2024 年《NEJM AI》的一篇论文研究了基于 LLM 的去标识化,发现一个核心问题:脱敏后的临床记录通过使其具有研究价值的同一临床规律仍与患者身份相关联。论文建议:使用假名化并配备记录在案的密钥管理方案,以保持重新联系的路径畅通。

IRB 需要看到这扇门的两面:谁可以重新识别?在什么条件下?谁持有密钥?记录什么?

架构原理

AES-256-GCM 在固定模式下运行,每个患者 ID 始终映射到同一个令牌。「Patient_001」每次产生相同的输出,这个令牌出现在基线期、3 个月随访和最终审查中。团队仅使用令牌追踪每位患者,工作文件中没有任何真实姓名。

密钥分割满足 EDPB 要求:研究团队持有加密数据,数据托管人在独立系统中持有密钥。双方均无法单独完成重新识别——团队无法解密,托管人没有数据无法建立密钥与患者的对应关系。

重新联系获批后,托管人对指定记录应用密钥,每个步骤均有日志记录:哪些记录、时间、谁给予了批准。该日志是 GDPR 第 89 条要求的合规证明。

实践中的样子

一家肿瘤中心在三个国家开展一项纳入 5,000 名患者的队列研究。每个研究中心仅使用令牌,牵头中心的数据专员持有密钥。

研究进行中,影像检查标记出 47 名高风险患者。伦理委员会批准重新联系,专员仅对这 47 条记录解密,医疗团队联系这 47 名患者,另外 4,953 名患者在三个研究中心均保持匿名。

密钥不移动,数据保持加密,只有这 47 条记录被与真实姓名关联。

关于假名化与完全匿名化的更多区别,请参阅我们的可逆去标识化指南

参考来源

准备好保护您的数据了吗?

开始使用 285 种实体类型在 48 种语言中匿名化 PII。

About this page

We update this page when our platform or the law changes.

Read our founder note for how we work.

Each change shows up in the timestamp at the top.

Related reading

We follow these rules

  • GDPR (EU 2016/679).
  • ISO/IEC 27001:2022.
  • NIS2 (EU 2022/2555).
  • HIPAA safe harbor under 45 CFR § 164.514(b)(2).

Our promise

We do not sell your data.

We do not train models on your text.

We store your files in Germany.

You can delete your account at any time.

You own your work.

Where we run

Our servers live in Falkenstein, Germany.

We use Hetzner. They hold ISO 27001 certification.

All data stays in the EU.

Backups run every day.

Need help?

Email support@anonym.legal.

We reply within one business day.

How we test

We run a full check suite on every release.

Each surface gets its own sweep script and report.

Human reviewers spot-check the output each week.

We track recall and precision on a labelled set.

Bad runs block the deploy.

What we never do

  • We never sell your information to third parties.
  • We never train models on what you upload.
  • We never keep your work after you delete it.
  • We never share keys with any outside firm.
  • We never run ads inside the product.

Plans in plain words

We sell credits, not seats.

One credit covers one short job.

Long jobs use a few credits each.

You can top up at any time.

Unused credits roll over each month.

Read the plans page for current rates.

Who built this

A small team of engineers and lawyers built this.

We ship from Europe and work in the open.

Our founder note spells out why we started.

Where to start

How the parts fit

A browser add-on cleans text inside Chrome.

A Word plug-in handles drafts in Office.

A small desktop tool works on whole folders.

An agent protocol link feeds large models safely.

All four share one core engine and one rule set.

Words from our team

We started this work after a lunch about cookies.

One friend kept getting odd ads on her phone.

We asked why a court file leaked through a draft.

We sketched the first build on a napkin that week.

By month three we had a tiny demo for a friend.

She used it on her first case the next day.

Common questions we hear

Can the tool read scanned PDFs? Yes, with OCR.

Does it work on long files? Yes, in small chunks.

Can I roll my own rule set? Yes, save it as a preset.

Does it run offline? The desktop build runs offline.

Do you keep my files? No, the cloud build wipes after each run.

Will it learn from my work? No, we never train on inputs.

A short tour of the workflow

Upload a file or paste a snippet of prose.

Pick the entities you want gone from the draft.

Choose a method: replace, mask, hash, encrypt, or redact.

Press run and watch the side panel show each hit.

Skim the result and tweak any rule that misfired.

Save the cleaned file or send it to a teammate.