Patent Publication Number: US-9904798-B2

Title: Focused personal identifying information redaction

Description:
CROSS-REFERENCE TO RELATED APPLICATION 
     This application is a continuation of U.S. patent application Ser. No. 13/676,712, filed Nov. 14, 2012, which application is incorporated herein by reference in its entirety. 
    
    
     FIELD OF THE INVENTION 
     The invention relates to computer data access control and privacy in general, and more particularly to document redaction. 
     BACKGROUND OF THE INVENTION 
     Many organizations maintain documents that include information, such as of a medical or financial nature, that is deemed sensitive and whose exposure to individuals is restricted by company policy, or even by law. Such organizations may employ document redaction software that removes sensitive information from documents before they are shown to individuals requesting access to such documents. Document redaction software typically removes sensitive information from documents automatically according to a set of predefined rules that identify sensitive information within documents by using dictionaries of sensitive words, such as of given names and surnames, or by using visual characteristics, such as where a rule dictates that all 16-digit numbers that appear within a document be removed on the assumption that they are credit card numbers. 
     SUMMARY OF THE INVENTION 
     In one aspect of the invention a method is provided for redacting information in a first document by at least one computing processor retrieving personal information from at least one data source. At least one computing processor identifies personal information associated with a first individual. A second document is generated by at least one computing processor that is a version of the first document, wherein in the second document any of the personal information associated with the first individual cannot be discerned. 
     Systems and computer program products embodying the invention are also provided. 
     The term “document” as used herein refers to any data file that may be stored on a computer-readable data storage device, such as word processing files, database files, image files, and audio files. 
    
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
       The invention will be understood and appreciated more fully from the following detailed description taken in conjunction with the appended drawings in which: 
         FIG. 1  is a simplified conceptual illustration of a document redaction system, constructed and operative in accordance with an embodiment of the invention: 
         FIG. 2  is a simplified flowchart illustration of an exemplary method of operation of the system of  FIG. 1 , operative in accordance with an embodiment of the invention; 
         FIGS. 3A and 3B  are simplified illustrations of an exemplary document illustrating aspects of the invention; and 
         FIG. 4  is a simplified block diagram illustration of an exemplary hardware implementation of a computing system, constructed and operative in accordance with an embodiment of the invention. 
     
    
    
     DETAILED DESCRIPTION OF THE INVENTION 
     The descriptions of the various embodiments of the present invention have been presented for purposes of illustration, but are not intended to be exhaustive or limited to the embodiments disclosed. Many modifications and variations will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the described embodiments. The terminology used herein was chosen to best explain the principles of the embodiments, the practical application or technical improvement over technologies found in the marketplace, or to enable others of ordinary skill in the art to understand the embodiments disclosed herein. 
     The present invention is now described within the context of one or more embodiments, although the description is intended to be illustrative of the invention as a whole, and is not to be construed as limiting the invention to the embodiments shown. It is appreciated that various modifications may occur to those skilled in the art that, while not specifically shown herein, are nevertheless within the true spirit and scope of the invention. 
     As will be appreciated by one skilled in the art, aspects of the present invention may be embodied as a system, method or computer program product. Accordingly, aspects of the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment (including firmware, resident software, micro-code, etc.) or an embodiment combining software and hardware aspects that may all generally be referred to herein as a “circuit,” “module” or “system.” Furthermore, aspects of the present invention may take the form of a computer program product embodied in one or more computer readable medium(s) having computer readable program code embodied thereon. 
     Any combination of one or more computer readable medium(s) may be utilized. The computer readable medium may be a computer readable signal medium or a computer readable storage medium. A computer readable storage medium may be, for example, but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. More specific examples (a non-exhaustive list) of the computer readable storage medium would include the following: an electrical connection having one or more wires, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In the context of this document, a computer readable storage medium may be any tangible medium that can contain, or store a program for use by or in connection with an instruction execution system, apparatus, or device. 
     Computer readable signal medium may include a propagated data signal with computer readable program code embodied therein, for example, in baseband or as part of a carrier wave. Such a propagated signal may take any of a variety of forms, including, but not limited to, electro-magnetic, optical, or any suitable combination thereof. A computer readable signal medium may be any computer readable medium that is not a computer readable storage medium and that can communicate, propagate, or transport a program for use by or in connection with an instruction execution system, apparatus, or device. 
     Program code embodied on a computer readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing. 
     Computer program code for carrying out operations for aspects of the present invention may be written in any combination of one or more programming languages, including an object oriented programming language such as Java, Smalltalk, C++ or the like and conventional procedural programming languages, such as the “C” programming language or similar programming languages. The program code may execute entirely on the user&#39;s computer, partly on the user&#39;s computer, as a stand-alone software package, partly on the user&#39;s computer and partly on a remote computer or entirely on the remote computer or server. In the latter scenario, the remote computer may be connected to the user&#39;s computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection may be made to an external computer (for example, through the Internet using an Internet Service Provider). 
     Aspects of the present invention are described below with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems) and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and/or block diagrams, and combinations of blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions/acts specified in the flowchart and/or block diagram block or blocks. 
     These computer program instructions may also be stored in a computer readable medium that can direct a computer, other programmable data processing apparatus, or other devices to function in a particular manner, such that the instructions stored in the computer readable medium produce an article of manufacture including instructions which implement the function/act specified in the flowchart and/or block diagram block or blocks. 
     The computer program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other devices to cause a series of operational steps to be performed on the computer, other programmable apparatus or other devices to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide processes for implementing the functions/acts specified in the flowchart and/or block diagram block or blocks. 
     Reference is now made to  FIG. 1 , which is a simplified conceptual illustration of a document redaction system, constructed and operative in accordance with an embodiment of the invention. In the system of  FIG. 1 , personally identifiable information (PII) identifier  100  is configured to identify PII  104  associated with a given individual, which preferably includes using one or more techniques that are unsuitable for manual implementation by a human. Initially, a certain limited amount of PII  104  is known to be associated with the individual. To identify additional PII  104  for the individual, identifier  100  is given the known, i.e., predetermined, PII  104 . Based on the predetermined PII  104 , identifier  100  locates and retrieves additional PII  104  for the individual from multiple data sources  102 . By using multiple data sources and employing techniques described herein, identifier  100  increases the amount of PII  104  that is determined to be associated with the individual. This increase in PII  104  for the given individual ideally provides sufficient PII  104  for the given individual so that redaction merely by category may be avoided, wherein PII  104  of only the given individual may be redacted rather than entire information categories that are conventionally known and used independently of the given individual. Redacting based on categories of information rather than a large collection of PII  104  for the given individual would tend to redact PII  104  of other persons in addition to that of the given individual. That is, in embodiments of the present invention, PII  104  for the given individual, which is determined by searching multiple data sources for data about the individual and processing the potential data that is found, is increased to such a significant degree that it achieves a comprehensive threshold amount that is sufficient as the basis for redaction without resorting to conventional, generic category-based redaction. In some instances, the comprehensive threshold amount of PII  104  for the individual is sufficient partly due to being combined with rule-based selection disclosed herein of material in the document subjected to redaction. Identifying techniques that identifier  100  is configured to use preferably include entity analysis techniques such as:
         Recognizing identities (entity resolution) to determine whether multiple records that appear to describe different individuals or organizations, even with different name variations, are actually records for a single resolved identity. This is done using, for example, name standardization (a data quality technique), address verification and correction (a data enhancement technique).   Detecting relationships which link entities. This can be done using shared attributes, such as telephone numbers and addresses, to uncover relevant, yet non-obvious relationships. Using these relationships, networks of associations and entities can be assembled using individual data attributes (such as identification numbers and names), locations (such as IP addresses), facilities, organizations, money, and accounts, thus identifying suspect or interesting relationships, even those that are hidden or disguised.       

     Software tools that may be used to carry out these techniques include IBM Identity Insight™, commercially available from International Business Machines Corporation. Armonk, N.Y.; NetOwl™, Text and Entity Analytics for Big Data, commercially available from SRA International, Inc., Fairfax, Va.; and Rosette Entity Extractor™, commercially available from Basis Technology Corporation, Cambridge, Mass. 
     The term “PII” includes not only “personally identifiable information” as stated herein above, but also the variants “personal identifying information,” “personally identifying information,” and “personal identifiable information.” In general usage, PII may have a variety of meanings, at least some of which are legally significant meanings that may vary from jurisdiction to jurisdiction. Although the technology disclosed herein may have applications to matters governed by privacy law, the present disclosure relates more generally to technology for information redaction. Consequently, the term “PII” is used broadly herein as a technical term generally referring to information that at least tends to indicate a person&#39;s identity, particularly in combination with other information that tends to indicate a person&#39;s identity. In some instances, certain information such as a social security number may uniquely indicate a person&#39;s identity all by itself, without additional information. In other instances, one item of information may contribute to indicating a person&#39;s identity, but more than one item may be needed to uniquely indicate their identity, such as a name combined with an address. “PII” herein refers to information which may at least contribute to someone being located, contacted, or personally identified, hence “personally identifiable” information. Exactly what constitutes PII for a particular embodiment of the invention is preferably predefined prior to identifier  100  locating and retrieving additional PII  104  for the given individual. For example, if a given individual is named “Arthur Brown,” PII  104  associated with the individual may include, among other information,
         Social Security Number (“SSN”): xxx-xx-xxxx   Date of Birth: Aug. 23, 1960   Address: 52 Adam Street, Somewhere CA 91975   Telephone Number: xxx-xxx-xxxx
 
where x represents numbers, of course, which are not provided in this example merely to avoid any unintended similarity to identifying information of a real person. Regarding the information in examples herein, including text and figures, the information depicts a fictional person or persons. Any similarity of the example information to information about real persons is unintended.
       

     As to the matter of multiple data sources or records previously mentioned, PII  104  may, for example, be gathered from one or more database records in one or more databases, where given a data item associated with the given individual, additional data associated with the given individual may be retrieved from database records that contain the data item. For example, given the name “Arthur Brown” as initially predetermined PII  104  for the given individual, a database record containing the name “Arthur Brown” might also contain his birth date, in which case identifier  100  will gather the birth date from the database record. In another example, given the name “Arthur Brown” as initially predetermined PII  104  for the given individual, a first database record containing the name “Arthur Brown” might also contain his telephone number, in which case identifier  100  will gather the telephone number from the first database record. Also, identifier  100  may then use the telephone number found in the first data source for Arthur Brown as a linking basis to find additional PII  104  for Arthur Brown in another data source (e.g., another record in the same database, information in another data source, such as another record in another database or information in another unstructured data source, etc.) For example, the telephone number for Arthur Brown may appear in a second data source, which may even be without a clear association to Arthur Brown&#39;s name. Identifier  100  may use the telephone number from the first data source to find additional PII  104  for Arthur Brown that is associated with the telephone number in the second data source. 
     Additionally or alternatively, the PII  104  may, for example, be gathered from scan images of paper documents, such as forms, using predefined templates that indicate where data items such as names and telephone numbers and other fields are found on a form, as well as indicating other visual features that are unique to a given form in order to distinguish between different types of forms. 
     Additionally or alternatively, the PII  104  may, for example, be in the form of graphical elements that are associated with the given individual, such as in the form of photographs of the individual. For example, facial recognition techniques may be used to identify photographs of a given individual given an initial photograph of the individual. 
     The PII  104  identified by PII identifier  100  is shown in  FIG. 1  as PII  104 . 
     A PII variant identifier  106  is configured to determine, in accordance with conventional techniques, one or more variants of PII  104 , and add the variants to PII  104 . For example, one or more variants may be determined for the name “Arthur Brown, Jr.”, such as
         “Brown, Arthur, Junior”   “Arthur Brown. Junior”   “Artie Brown”       

     Similarly, one or more variants may be determined for an address in the state of California, the city of Lakeside, on 52 Adam Street, such as
         “52 Adam Street, Somewhere, CA, 91975”   “52 Adam St., Somewhere, California”       

     Likewise, one or more variants may be determined for the date “Aug. 23, 1960”, such as
         “Aug. 23, 1960”   “8/23/1960”   “8 Aug. 1960”       

     One or more rules  108  are preferably defined for determining when any of PII  104  is to be selected for redaction when PII  104  is found within a computer-readable document. Rules  108  may be defined by coding them as data and instructions in a programming language and storing them in a computer-readable storage device. For example, a dictionary or word list may be created from PII  104 . A rule may, for example, be defined whereby any entry in the dictionary or word list that is found within a computer-readable document should be selected for redaction. Similarly, a rule may, for example, be defined whereby any entry in the dictionary or word list that is found within a computer-readable document should be selected for redaction only if another entry in the dictionary or word list is also nearby within the same document, e.g., within a predefined number of words, such as twenty. Similarly, a rule may, for example, be defined whereby semantic-category recognition algorithms are used to match a telephone number in the dictionary or word list with a string of digits that is found within a computer-readable document, whereupon the string of digits is selected for redaction, if a) the digits match the telephone number&#39;s digits and b1) if the string of digits is proximate to the word “Tel.” or “Phone,” or b2) if the string of digits matches a predefined pattern associated with telephone numbers, such as “nnn-nnn-nnnn,” “(nnn) nnn nnnn,” “+n-nnn-nnnnnnn.” Rules  108  may include defined similarity thresholds that may be used to select for redaction any entry in the dictionary or word list that is found within the computer-readable document in accordance with one or more rules, but in a misspelled form. 
     A PII selector  110  is configured to read PII  104  and process a computer-readable document  112  (or information therefrom) for locating in document  112  any of PII  104 , and select the located PII  104  for redaction, preferably through application of any of the aforementioned rules  108  to computer-readable document  112  or information therefrom. PII selector  110  may evaluate rules  108  using System T™, commercially available from International Business Machines Corporation, Armonk, N.Y., or similar software. It is appreciated that the computer-readable document  112  selected for processing by PII selector  110  may include both PII  104  that is associated with the given individual, as well as PII  104  that is associated with one or more other individuals. Where computer-readable document  112  includes both PII  104  that is associated with the given individual and PII  104  that is associated with one or more other individuals, PII  104  of the different individuals may also share one or more data types, such as names, telephone numbers, and addresses. 
     A document redactor  114  is configured to create a redacted version of the computer-readable document  112  in which any of the PII  104  selected for redaction by PII selector  110  cannot be discerned. This may, for example, be achieved by altering computer-readable document  112  by removing from computer-readable document  112  any of the PII  104  selected for redaction, or by otherwise causing any of the PII  104  selected for redaction to be unreadable or otherwise unrecognizable within computer-readable document  112 . Alternatively, this may be achieved by creating a copy  116  of computer-readable document  112  in which any of the PII  104  selected for redaction is omitted or rendered unreadable or otherwise unrecognizable. Where, before it is processed by document redactor  114 , computer-readable document  112  includes both PII  104  that is associated with the given individual and PII  104  that is associated with one or more other individuals, the redacted version of the computer-readable document  112  created by document redactor  114  preferably retains PII  104  that is associated with the one or more other individuals. 
     Any of the elements shown in  FIG. 1  are preferably implemented by, are embodied within, or are otherwise accessible to, a computer  118 , such as by implementing any of the elements in computer hardware and/or in computer software embodied in a computer-readable storage medium in accordance with conventional techniques. 
     Reference is now made to  FIG. 2 , which is a simplified flowchart illustration of an exemplary method of operation of the system of  FIG. 1 , operative in accordance with an embodiment of the invention. In the method of  FIG. 2 , personally identifiable information (PII) associated with a given individual is identified (step  200 ), preferably where the PII is identified by one or more computers using one or more techniques that are unsuitable for manual implementation by a human, and where the PHI is retrieved from multiple data sources. 
     Note that if, in searching for PII in step  200  or similar step, resource consumption (e.g., CPU cycle) might be excessive, then the searching may be bounded as follows in one or more embodiments of the invention: In each time unit (e.g., minute), the ration n/R is calculated, where n is the number of new PII items and R is the resource consumption in that time period. If the ration n/R drops below a certain pre-configured value (which is configured in accordance with the perceived value of high accuracy in finding and redacting PII), then the search is stopped and the system proceeds to the next phase as described below. 
     One or more variants of the identified PII may optionally be determined (step  202 ) in accordance with conventional techniques, and the variants added to the PII associated with the given individual (step  204 ). One or more rules are preferably defined for determining when any of the PII associated with the given individual is to be selected for redaction when the PII is found within a computer-readable document (step  206 ). Any of the PII associated with the given individual is located within a computer-readable document and selected for redaction (step  208 ), preferably through application of any of the aforementioned rules. A redacted version of the computer-readable document is created in which any of the PII selected for redaction cannot be discerned (step  210 ). This may, for example, be achieved by altering the computer-readable document by removing from the document any of the PII selected for redaction, or by otherwise causing any of the PII selected for redaction to be unreadable or otherwise unrecognizable within the document. Alternatively, this may be achieved by creating a copy of the original computer-readable document in which any of the PII selected for redaction is omitted or rendered unreadable or otherwise unrecognizable. 
     It will be appreciated that the invention disclosed herein enables PII associated with a given individual to be located within a computer-readable document and selected for redaction, while PII of other individuals is not selected for redaction. A redacted version of the document is then created in which only the PII associated with the given individual and selected for redaction is not discernible. 
     Reference is now made to  FIGS. 3A and 3B , which are simplified illustrations of an exemplary document illustrating aspects of the invention. In  FIG. 3A  a document  300  of a patient&#39;s medical information is shown. The system and method of  FIGS. 1 and 2  may be employed to prepare a redacted version of document  300 , such as for use by medical researchers. Taking a specific example, consider a hospital record, such as a document, that is sent to a researcher. The PII of the patient is to be redacted from the document, but not PII of other people mentioned, such as physicians and staff. In  FIG. 3B  a redacted version  302  is shown in which PII relating to the patient is not discernible, while PII relating to other individuals as seen in document  300  is retained within redacted version  302 . 
     Referring now to  FIG. 4 , block diagram  400  illustrates an exemplary hardware implementation of a computing system in accordance with which one or more components/methodologies of the invention (e.g., components/methodologies described in the context of  FIGS. 1-2 ) may be implemented, according to an embodiment of the invention. 
     As shown, the techniques for controlling access to at least one resource may be implemented in accordance with a processor  410 , a memory  412 , I/O devices  414 , and a network interface  416 , coupled via a computer bus  418  or alternate connection arrangement. 
     It is to be appreciated that the term “processor” as used herein is intended to include any processing device, such as, for example, one that includes a CPU (central processing unit) and/or other processing circuitry. It is also to be understood that the term “processor” may refer to more than one processing device and that various elements associated with a processing device may be shared by other processing devices. 
     The term “memory” as used herein is intended to include memory associated with a processor or CPU, such as, for example, RAM, ROM, a fixed memory device (e.g., hard drive), a removable memory device (e.g., diskette), flash memory, etc. Such memory may be considered a computer readable storage medium. 
     In addition, the phrase “input/output devices” or “I/O devices” as used herein is intended to include, for example, one or more input devices (e.g., keyboard, mouse, scanner, etc.) for entering data to the processing unit, and/or one or more output devices (e.g., speaker, display, printer, etc.) for presenting results associated with the processing unit. 
     The flowchart and block diagrams in the Figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods and computer program products according to various embodiments of the present invention. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of code, which comprises one or more executable instructions for implementing the specified logical function(s). It should also be noted that, in some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams and/or flowchart illustration, and combinations of blocks in the block diagrams and/or flowchart illustration, can be implemented by special purpose hardware-based systems that perform the specified functions or acts, or combinations of special purpose hardware and computer instructions. 
     It will be appreciated that any of the elements described hereinabove may be implemented as a computer program product embodied in a computer-readable medium, such as in the form of computer program instructions stored on computer-readable storage media, such as magnetic or optical storage media, or embedded within computer hardware, and may be executed by or otherwise accessible to a computer. 
     While the methods and apparatus herein may or may not have been described with reference to specific computer hardware or software, it is appreciated that the methods and apparatus described herein may be readily implemented in computer hardware or software using conventional techniques. 
     While the invention has been described with reference to one or more specific embodiments, the description is intended to be illustrative of the invention as a whole and is not to be construed as limiting the invention to the embodiments shown. It is appreciated that various modifications may occur to those skilled in the art that, while not specifically shown herein, are nevertheless within the true spirit and scope of the invention.