Patent Description:
<CIT> discusses a multi-channel recorder/encoder for collecting, integrating, synchronizing and recording medical or surgical data received as independent live or real-time data streams from a plurality of hardware units. The medical or surgical data relating to a live or real-time medical procedure. Example hardware units include a control interface, cameras, sensors, audio devices, and patient monitoring hardware. Further example systems may include a cloud based platform incorporating the encoder.

<CIT> discusses a visual media de-identification system. The system includes an image merger and a de-identifying engine. The image merger is configured to merge a sequence of images from a set of visual media data into an averaged image. The de-identifying engine is configured to: bound portions of the averaged image that are determined to be relatively fixed, wherein each bounded portion is identified by a corresponding position in the averaged image; generate a template comprising the bounded portions and the corresponding position for each bounded portion in the averaged image; and de-identify the sequence of images by obfuscating content in the bounded portions.

Recorded videos of medical procedures such as surgeries contain highly valuable and rich information for medical education and training, assessing and analyzing the quality of the surgeries and skills of the surgeons, and for improving the outcomes of the surgeries and skills of the surgeons. There are many surgical procedures which involve displaying and capturing video images of the surgical procedures. For example, almost all minimally invasive procedures (MIS), such as endoscopy, laparoscopy, and arthroscopy, involve using video cameras and video images to assist the surgeons. Furthermore, the state-of-the-art robotic-assisted surgeries require intraoperative video images being captured and displayed on the monitors for the surgeons. Consequently, for many of the aforementioned surgical procedures, e.g., a gastric sleeve or cholecystectomy, a large cache of surgical videos already exist and continue to be created as a result of a large number of surgical cases performed by many different surgeons from different hospitals.

The simple fact of the existence of a huge (and constantly increasing) number of surgical videos of a particular surgical procedure makes processing and analyzing the surgical videos of the given procedure a potential machine learning problem. However, raw surgical videos from recordings in the operating room (OR) can contain all sorts of patient information in the form of text-based identifiers including the patient's name, medical record number, age, sex, demographic, date and time of surgery, among others. Furthermore, some surgical procedure videos can also contain sensitive and personal information captured inside the OR, such as information written on the whiteboard in the OR and the faces of surgical staff. Hence, before raw surgical videos can be used for various research purposes such as for building machine-learning tools, the raw surgical procedure videos need to be anonymized in order to be free of personally-identifiable information and to be compliant with HIPAA regulations and processes.

There are several automatic anonymization tools available for removing text identifiers from files and for detecting and removing sensitive information from medical image files, such as patient's CT scans, X-rays, etc. However, existing techniques for anonymizing sensitive information buried in raw procedure videos are generally manual-based which require human operators to review individual videos to identify the sensitive information in the video frames and then manually anonymized (e.g., by removing or burring out) the sensitive information. Manual-based video anonymizing processes are both labor-intensive and time-consuming. In particular, building machine learning tools requires that a large number of raw surgical procedure videos be first anonymized, which makes manual-based video anonymization impractical for machine learning purposes. Unfortunately, there are no existing automatic anonymization tools for anonymizing sensitive information buried in raw surgical videos.

Optional features are provided in the appended dependent claims.

The structure and operation of the present disclosure will be understood from a review of the following detailed description and the accompanying drawings in which like reference numerals refer to like parts and in which:.

The detailed description set forth below is intended as a description of various configurations of the subject technology and is not intended to represent the only configurations in which the subject technology may be practiced. However, the subject technology is not limited to the specific details set forth herein and may be practiced without these specific details. In some instances, structures and components are shown in block diagram form in order to avoid obscuring the concepts of the subject technology.

Throughout the specification, the terms "anonymization" and "de-identification" are used interchangeably to mean de-identification of personally-identifiable information. Moreover, the terms "anonymize" and "de-identify" are used interchangeably to mean the action of de-identification of personally-identifiable information. Moreover, the terms "anonymized" and "de-identified" are used interchangeably to mean the result of de-identification of personally-identifiable information.

Raw surgical videos often include all sorts of personally-identifiable information, including both patient identifiable information and surgical staff identifiable information. Patient identifiable information (or "patient data" hereinafter) is any information that can be used to identify the patient, which can include, but are not limited to the name, date of birth (DOB), social security number (SSN), age, sex, address, medical record number (MRN) of the patient, and the time of the surgery. Surgical staff identifiable information (or "staff data" hereinafter) is any information that can be used to identify a given surgical staff member, such as the name of the surgeon performing the procedure. The above-described personally-identifiable information can be in text format. For example, after recording a surgical video, some of the personally-identifiable information can be embedded in the metadata associated with the video files and the file folder which contains the surgical video files. Note that any conventional text-data analysis technique can be used to anonymize or de-identify text-based patient identifiable information associated with recorded raw surgical videos.

In some embodiments, the above-described personally-identifiable information can be in image format and embedded in some of the video frames within a given surgical video. Image-based personally-identifiable information can include text being recorded in various manners during a surgical procedure. For example, text printed on surgical tools used inside patient's body can be recorded during an endoscopic procedure. Such text may identify surgeon's name and the type of the tool be engaged. For example, the video images can capture such text as "Dr. Hogan's scissors" or "Dr. Hogan's staplers" on the corresponding surgical tools. Image-based personally-identifiable information can also include a text box inserted into a recorded procedure video which shows such identifiable information as the name of the surgeon and the name of the hospital. Furthermore, image-based personally-identifiable information can also include patient and/or staff data written on a whiteboard or displayed on a monitor inside an OR room. Note that such information is often accidentally recorded during an out of body event of an endoscope procedure (described in more detail below). Note that personally-identifiable information can also include non-textual information. In particular, non-textual personally-identifiable information can include face images of the patient and/or the surgical staff. Again, such face images can be accidentally recorded during an out of body event of an endoscope procedure. Non-textual personally-identifiable information can also include recorded audio tracks embedded in a raw surgical video.

Note that each raw endoscope video can include a number of out-of-body (OOB) events. An OOB event is generally defined as a time period when the endoscope is taken out of the patient's body for one of various reasons during the surgical procedure while the endoscope camera continues to record, or right before and/or right after the surgical procedure while the endoscope camera is recording. During a surgical procedure, an OOB event can take place for a number of reasons. For example, an OOB event will occur if the endoscope lens has to be cleaned. Note that a number of surgical events can cause the endoscopic view to be partially or entirely blocked to prevent surgeon from viewing the anatomy. These surgical events can include, but are not limited to: (a) endoscope lens is covered with blood (e.g., due to a bleeding complication); (b) fogging of the endoscope lens due to condensation; and (c) endoscope lens is covered with cautery-generated tissue particles, which stick to the lens and eventually block the endoscopic view. In each of the above scenarios, the endoscope camera needs to be taken out of the body so that the endoscope lens can be cleaned to restore visibility or warmed up for condensation removal. After cleaning and/or other necessary treatment, the endoscope camera often needs to be re-calibrated, including performing white-balancing before it can be put back into the patient's body. Note that this lens-cleaning type of OOB event can take a few minutes to complete. Moreover, an initial OOB time/event can exist at the beginning of a surgical procedure if the endoscope camera is turned on prior to being inserted into the patient's body; and a final OOB time/event can exist at the end of a surgical procedure if the endoscope camera remains turned on for a period of time after the completion of the surgical procedure when the endoscope camera has been taken out of the patient's body.

However, each time the endoscope camera is taken out of the patient's body, it is possible that the surgeon unintentionally points the camera to someone in the OR, such as the patient or a surgical staff member including the surgeon him/herself, so that the face images of one or more persons in the OR can be captured in the raw surgical video. Moreover, during an OOB event, it is possible that the surgeon accidentally points the camera at an OR whiteboard which shows personally-identifiable information such as the name and DOB of the patient, the names of the surgical staff, the name of the procedure and the hospital, among others. Both the textual personally-identifiable information and face images in the video images captured during these OOB events have to be anonymized/de-identified.

The disclosed raw surgical video anonymization techniques can be used to detect and anonymize/de-identify each type of the above-described personally-identifiable information, either in forms of textual information embedded in video frames or in forms of face images in video frames. For example, the textual information embedded in video frames can include text/dialog panels/boxes inserted in the video frames, text printed on surgical tools, and textual information on a whiteboard or a monitor inside an OR accidentally captured during an OOB event; whereas face images in video frames can include faces of the patient and surgical staff inside an OR accidentally captured during an OOB event. After processing a given surgical procedure video with the disclosed video anonymization techniques, the given surgical video becomes fully anonymized such that the identity of either the patient or a surgical staff member can not be identified from the anonymized video images.

<FIG> shows a block diagram of an exemplary raw surgical video anonymization system <NUM> in accordance with some embodiments described herein. As can be seen in <FIG>, raw surgical video anonymization system <NUM> (or "video anonymization system <NUM>" hereinafter) includes a text-data-de-identification module <NUM>, a file merging module <NUM>, an image-data-de-identification module <NUM>, a verification module <NUM>, and a raw data purging module <NUM>, which are coupled to each other in the illustrated order.

Generally speaking, file merging module <NUM> is configured to stitch together a set of video clips/files into a full procedure video; text-data-de-identification module <NUM> is configured to process a raw surgical video to detect and de-identify text-based personally-identifiable information embedded in file and file-folder identifiers; image-data-de-identification module <NUM> is configured to process a raw surgical video to detect and de-identify various types of image-based personally-identifiable information embedded in raw video images; verification module <NUM> is configured to ensure that an anonymized surgical video outputted by image-data-de-identification module <NUM> is indeed free of any personally-identifiable information; and raw data purging module <NUM> is configured to permanently remove raw surgical videos and associated file identifiers from a raw surgical video repository and replace the removed raw videos with de-identified videos. We now describe each of the components of video anonymization system <NUM> in more detail.

As shown in <FIG>, text-data-de-identification module <NUM> of video anonymization system <NUM> is coupled to a surgical video repository <NUM>, which is generally not part of video-anonymization system <NUM>. In some embodiments, surgical video repository <NUM> is a HIPAA compliant video repository. In some embodiments, surgical video repository <NUM> can temporarily store raw surgical procedure videos recorded for surgical procedures performed in the ORs, wherein the surgical procedures can include open surgery procedures, endoscopic surgery procedures, or robotic surgery procedures. As such, the raw surgical procedure videos can include various types of raw surgical videos, including but not limited to raw open surgery videos, raw endoscopic surgery videos, and raw robotic surgery videos.

Note that if a full surgical procedure is recorded into a single video file, the video can be a few hours in length (e.g., <NUM>-<NUM> hours) and multiple gigabytes in file size (e.g., <NUM>-<NUM> GB). However, hospital IT department often places some restrictions on how big the actual file sizes can be because these recorded raw video files have to be transferred to different storage devices. As a result, a long surgical procedure is typically broken down and recorded as a set of shorter video segments, such as a set of video files of <NUM>-megabyte (MB) per file. For example, a full surgical procedure corresponding to a <NUM>-gigabyte (GB) procedure video will be recorded as eight <NUM> MB video files instead of a single <NUM>-GB video. However, the original order or some time-sequence information of the set of recorded segments needs to be known in order to reconstruct the full surgical procedure later on, e.g., by file merging module <NUM>.

In the embodiment shown, text-data-de-identification module <NUM> receives a set of raw surgical video files <NUM> corresponding to a set of recorded video segments/clips of a full surgical procedure from surgical video repository <NUM>. Text-data-de-identification module <NUM> is configured to process the received set raw video files to detect text-based personally-identifiable information embedded in file identifiers (e.g., filenames), folder identifiers (e.g., folder names), file properties, and other metadata associated with the set of raw surgical video files <NUM>. Text-data-de-identification module <NUM> subsequently removes or otherwise de-identifies the detected text-based personally-identifiable information from the corresponding file identifiers, folder identifiers, and other metadata associated with the set of raw video files <NUM>. Text-data-de-identification module <NUM> then outputs a set of partially-processed raw video files <NUM>. Note that text-data-de-identification module <NUM> can be implemented with open source text detection and removal tools or based on conventional text detection techniques.

In some embodiments, file merging module <NUM> receives the set of partially-processed raw video files <NUM> corresponding to the set of recorded video segments/clips of the full surgical procedure from text-data-de-identification module <NUM>, and subsequently stitches together the set of partially-processed raw video files to recreate a partially-processed full procedure video <NUM> (or "full procedure video <NUM>"). Note that to be able to merge the set of raw video files <NUM> into a single video file, the set of raw video files needs to have the same format. Also note that for a surgical procedure comprising a set of raw video segments, the set of video segments would have different file names and is typically stored within a single file folder with a folder name. Unfortunately, different recording devices generally have different naming conventions: e.g., some may name the video segments with identifiers "A, B, C, D, E," etc., and some other may name the video segments with identifiers "1A, 1B 1C, 1D," etc. As such, file merging module <NUM> should be configured to analyze different naming conventions to determine the right order for the set of received video segments associated with a particular recording device in order to merge these segments back to a proper full-length procedure video. Note that if a given surgical procedure is made up of a single video segment, no file merging would actually occur.

In an alternative embodiment to the one shown <FIG>, instead of receiving the set of partially-processed raw video files <NUM> from text-data-de-identification module <NUM>, file merging module <NUM> can separately receive the set of raw video files <NUM> from surgical video repository <NUM>, and subsequently merge the set of raw video files to recreate a merged (i.e., full procedure) raw surgical video.

Next, image-data-de-identification module <NUM> receives the partially-processed full procedure video <NUM>. In some embodiments, image-data-de-identification module <NUM> is configured to detect various types of image-based personally-identifiable information embedded in the raw video images/frames of full procedure video <NUM>, and subsequently de-identify the detected personally-identifiable information in the corresponding video images/frames. As can be seen in <FIG>, image-data-de-identification module <NUM> can include a set of data anonymization submodules, such as an image-text de-identification submodule <NUM>-<NUM> and an OOB-event removal submodule <NUM>-<NUM>. More specifically, image-text de-identification submodule <NUM>-<NUM> is configure to detect various personally-identifiable text either being recorded or automatically inserted into the raw video images so that they are a part of the raw video images. For example, recorded text can include text printed on surgical tools used during laparoscopic or endoscopic surgical procedure. Recorded text can also include various text-based information displayed inside an OR but accidentally recorded by an laparoscope or endoscope camera during an OOB event, e.g., text written on a whiteboard inside the OR, text printed on surgical staff's scrubs or uniforms, text displayed on a monitor inside the OR, or other text-bearing objects inside the OR. Personally-identifiable text can also include inserted text such as a standard user interface (UI) text box/panel automatically inserted into a recorded procedure video which shows such identifiable information as the name of the surgeon, and the name of the hospital.

After detecting such personally-identifiable text in one or more video frames of the partially-processed full procedure video <NUM>, image-text de-identification submodule <NUM>-<NUM> can also be configured to automatically blur out or otherwise make the detected text unreadable using other special effects or techniques in the corresponding video frames. In some embodiments, for a detected text box within a video frame which is not considered a part of the surgical video, the entire text box may be blurred out or otherwise edited out. In some other embodiments, the text within a detected text box can be recognized first, and then the recognized text can be separated into sensitive text and the informative text. Next, only the determined sensitive text, such as the name of the surgeon will be blurred out or otherwise edited out, whereas the determined informative text, such as the surgical tool type/name can be left in the video images untouched.

In various embodiments, image-text de-identification submodule <NUM>-<NUM> can include one or more machine-learning models trained to detect and identify various recorded text and text boxes within a given video image, such as text printed on a surgical tool or displayed within a text box. Hence, image-text de-identification submodule <NUM>-<NUM> can use the one or more machine-learning models to automatically identify different types of personally-identifiable text embedded in the video images of partially-processed video <NUM>, and automatically blur out/make unreadable or otherwise de-identify the detected text data in the corresponding video images.

As an example, image-text de-identification submodule <NUM>-<NUM> can include a surgical-tool-text-detection model configured to first detect a surgical tool within a video image with a machine-learning-based tool-detection-and-recognition model. Next, surgical-tool-text-detection model further processes the detected tool image to detect any personally-identifiable text within a boundary of the detected tool image. If such text is detected, image-text de-identification submodule <NUM>-<NUM> is configured to blur out or otherwise make the detected text unreadable.

As another example, image-text de-identification submodule <NUM>-<NUM> can include a text-box detection model configured to detect a standard UI panel or a standard dialog box within video images. In some embodiments, this text-box detection model may be trained based on a set of video images containing inserted text panels. To prepare the training data, properly-sized boxes can be drawn around the text panels within the training images, indicating that the contents inside the text boxes are not part of the surgical video. Next, the text-box detection model can be trained based on these generated text boxes to teach the model to look for such standard UI panels within other video frames which could contain personally-identifiable text that needs be edited out. Note that a single video frame may contain more than one such standard UI panel/text box which should be detected by the model. In some embodiments, the text-box detection model can also learn from the training data the potential locations of the potential UI panels/text boxes within a given video frame to facilitate detecting these standard UI panels/text boxes with higher accuracy and faster speed.

In some embodiments, multiple machine-learning-based image-text detection models can be constructed such that each of the detection models is used to detect a particular type of image-text embedded in the video images. For example, in additional to the above-described text-box detection model, there can be a surgical-tool-text detection model constructed to detect text printed on surgical tools, a whiteboard-text detection model constructed to detect text captured from an OR whiteboard, and a monitor-text detection model constructed to detect text captured from an OR monitor. In various embodiments, the above-described one or more image-text detection models for detecting text embedded in video images can include a regression model, a deep neural network-based model, a support vector machine, a decision tree, a Naive Bayes classifier, a Bayesian network, or a k-nearest neighbors (KNN) model. In some embodiments, each of these machine-learning models is constructed based on a convolutional neural network (CNN) architecture, a recurrent neural network (RNN) architecture, or another form of deep neural network (DNN) architecture.

Referring back to <FIG>, OOB-event removal submodule <NUM>-<NUM> of data-de-identification module <NUM> is configured to detect each OOB event within a raw surgical video and subsequently remove the identified OOB segment from the raw surgical video. In some embodiments, OOB-event removal submodule <NUM>-<NUM> can include an OOB event detector which is configured to scan a procedure video to look for OOB events. For example, such an OOB event detector can include an image processing unit configured to detect when the endoscope is being taken out of the patient's body, i.e., the beginning of an OOB event. The image processing unit is also configured to detect when the endoscope is being inserted back into the patient's body, i.e., the end of the OOB event. Hence, the sequence of video frames between the detected beginning and the end of the OOB event corresponds to a detected OOB segment within the full procedure video. In some embodiments, for each detected OOB segment, each video frame in the detected OOB segment can be completely blurred out or otherwise edited out (e.g., replaced with a black screen), so that any personally-identifiable information within an edited video frame, such as all recorded text and inserted text boxes, and non-textual personally-identifiable information such as human faces cannot be identified. Note that generally the video frames associated with each detected OOB segment are only blurred out or otherwise edited out but the actual frames are not cut out from the video, thereby maintaining the original timing information for the detected OOB events.

In various embodiments, OOB-event removal submodule <NUM>-<NUM> can include a machine-learning-based OOB-event detection model trained to detect an OOB segment within a raw surgical video. This OOB-event detection model may be trained based on a set of labeled video segments of a set of actual OOB events extracted from actual surgical procedure videos. The OOB-event detection model can also be trained based on a set of video segments of a set of simulated OOB events extracted from actual procedure videos or training videos. For example, if a training OOB video segment corresponds to a <NUM>-second segment of a procedure video, then all the video frames from the <NUM>-second segment can be labeled with an "OOB" identifier. Next, the OOB-event detection model can be trained based on these labeled video frames to teach the model to detect and identify similar events in raw surgical videos.

As mentioned above, different OOB events may be caused by different reasons, e.g., one may be due to switching from a robotic procedure to a laparoscopic procedure while another can be due to lens cleaning. However, there are strong similarities among different OOB events because they typically all include a beginning phase when the endoscope camera is been taken out of the patient's body and an ending phase when the endoscope camera is been placed back into the patient's body. Hence, a single trained OOB-event detection model may be used by OOB-event removal submodule <NUM>-<NUM> to detect various OOB events within a full procedure video caused by different reasons, and each detected OOB video segment is subsequently blurred out, blacked out, or otherwise de-identified. However, in some embodiments, multiple machine-learning-based OOB-event detection models can be constructed such that each of the OOB-event detection models is used to detect one type of OOB events caused by a particular triggering reason/event.

In various embodiments, the above-described single or multiple OOB-event detection models for detecting OOB segments in full surgical procedure videos can include a regression model, a deep neural network-based model, a support vector machine, a decision tree, a Naive Bayes classifier, a Bayesian network, or a k-nearest neighbors (KNN) model. In some embodiments, each of these machine-learning models is constructed based on a convolutional neural network (CNN) architecture, a recurrent neural network (RNN) architecture, or another form of deep neural network (DNN) architecture.

Note that personally-identifiable information embedded in the raw video images can also include non-textual personally-identifiable information. In particular, non-textual personally-identifiable information can include face images of the patient and/or the surgical staff. For example, such face images can be accidentally recorded during an OOB event. However, any face images captured during an OOB event can be effectively removed using the above-described OOB-event removal submodule <NUM>-<NUM>. In some embodiments however, image-data-de-identification module <NUM> can also include a face-image removal submodule (not shown in <FIG>) configured to detect faces embedded in raw video images (e.g., by using conventional face detection techniques), and subsequently blur out or otherwise de-identify each detected faces from the corresponding video images. In some embodiments, to de-identify raw video images, image-data-de-identification module <NUM> can first apply OOB-event removal submodule <NUM>-<NUM> to a raw surgical video to remove OOB events from the raw surgical video. Next, image-data-de-identification module <NUM> applies the herein-described face-image removal submodule to the processed video images to search for any faces in video frames outside of the detected OOB segments and subsequently blur out any detected face.

While not explicitly shown, video anonymization system <NUM> can include additional modules for detecting and de-identifying other types of personally-identifiable information within a raw surgical video not described in conjunction with text-data-de-identification module <NUM> and image-data-de-identification module <NUM>. For example, video anonymization system <NUM> may also include an audio-data-de-identification module configured to detect and de-identify audio data containing personally-identifiable information, such as surgical staff communications recorded during the surgical procedure. In some embodiment, an audio-data-de-identification module is configured to completely remove all voice tracks embedded in a given raw surgical video.

As can be seen in <FIG>, image-data-de-identification module <NUM> outputs a fully-processed full procedure video <NUM>, which is received by verification module <NUM>. In some embodiments, verification module <NUM> is configured to ensure that a given fully-processed surgical video is indeed free of any personally-identifiable information. In some embodiments, verification module <NUM> is configured to perform a random sampling of fully-processed surgical video <NUM>, i.e., by randomly selecting a number of video segments within the fully-processed surgical video and verifying that the randomly selected video segments are free of any personally-identifiable information.

In some embodiments, instead of selecting video segments with full randomness for verification, verification module <NUM> can perform a strategic random sampling to choose a set of video segments from portions of a processed surgical video having higher probability to contain personally-identifiable information for verification. For example, if it can be learned from statistics that during a particular step/phase or steps/phases of a given surgical procedure, the surgeon would often or almost always take the camera out for cleaning or for other reasons, then it becomes more predictable roughly when one or more OOB events might have taken place during a recorded procedure. Hence, instead of randomly sampling the full video to verify the anonymization result of image-data-de-identification module <NUM>, verification module <NUM> can first determine one or more time periods associated with the one or more particular procedure steps/phases which have high probabilities to contain an OOB event. Verification module <NUM> subsequently selects a set of video segments within or around the determined high-probability time periods to verify that the selected video segments are free of any personally-identifiable information.

In some embodiments, verification module <NUM> can collaborate with a surgical-phase segmentation engine, which is configured to segment a surgical procedure video into a set of pre-defined phases, wherein each phase represents a particular stage of the associated surgical procedure that serves a unique and distinguishable purpose in the entire surgical procedure. More detail of the surgical phase segmentation technique based on surgical video analysis has been described in a related patent application having serial number <CIT>.

More specifically, fully-processed procedure video <NUM> or even partially-processed procedure video <NUM> can be first sent to a phase segmentation engine configured to identify different phases for the surgical procedure video. The outputs from the phase segmentation engine include a set of pre-defined phases and the associated timing information with respect to the full procedure video. Combined with the knowledge of which pre-defined phase(s) have high probability to include an OOB event, verification module <NUM> can then "zoom" into each of the "high OOB probability" phases of fully-processed procedure video <NUM>, and strategically select a set of video segments from these high-probability phases of the fully-processed video for verification that the selected video segments are free of any personally-identifiable information.

In some embodiments, verification module <NUM> can also reuse the above-described OOB-event-detection model to identify the exact segments of fully-processed procedure video <NUM> that correspond to the detect OOB events. Each identified OOB video segment is then directly verified (e.g., by a human operator) to determine whether the OOB video segment is free of any personally-identifiable information.

In some embodiments, if verification module <NUM> determines that a given sampled video segment is not completely free of personally-identifiable information, video anonymization system <NUM> can be configured to reapply image-data-de-identification module <NUM> on a portion of fully-processed procedure video <NUM> containing the problematic video segment in an attempt to de-identify any remaining personally-identifiable information in the portion of the video (shown in <FIG> by the arrow going back to module <NUM> from verification module <NUM>). Alternatively, a manual de-identification process can be used to de-identify any remaining personally-identifiable information within the sampled video segments determined to contain personally-identifiable information. In some embodiments, after reapplying image-data-de-identification module <NUM> to or performing manual de-identification on the problematic video segments, verification module <NUM> can be reapplied on the further processed surgical video to perform another pass of the above-described verification operations.

Referring back to <FIG>, after verification module <NUM> has verified the anonymization result of fully-processed full procedure video <NUM>, verification module <NUM> outputs a de-identified surgical video <NUM> free of any personally-identifiable information, i.e., any patient or surgical staff in the video is completely unidentifiable. Upon receiving de-identified surgical video <NUM>, raw data purging module <NUM> can be configured to permanently remove any raw and partially-processed video file along with the detected textual-based personally identifiers. For example, raw data purging module <NUM> can permanently remove raw surgical video files <NUM>, raw surgical video file <NUM>, partially-processed full procedure video file <NUM> and fully-processed full procedure video file <NUM>.

In some embodiments, after purging the raw and partially-processed surgical videos, raw data purging module <NUM> is also configured to store de-identified surgical video <NUM> back into surgical video repository <NUM>. If surgical video repository <NUM> also stores the original raw surgical video files <NUM> of de-identified surgical video <NUM>, raw data purging module <NUM> can be configured to permanently remove any copy of the raw surgical video files <NUM> from surgical video repository <NUM>. In some embodiments, raw data purging module <NUM> is also configured to create a database of the de-identified surgical videos. In some embodiments, a database entry in surgical video repository <NUM> associated with de-identified surgical video <NUM> can store the filename, along with other statistical data and properties of de-identified surgical video <NUM> extracted during the above-described video anonymization process. For example, these statistical data and properties can include, but are not limited to the type of the surgical procedure, a full video/video segment identifier, a laparoscopic procedure/robotic procedure identifier, the number of surgeons contributed to the given procedure, the number of OOB events during the procedure, among others.

Next, the de-identified surgical videos stored in surgical video repository <NUM> can be released to or otherwise made available to clinical experts for various research purposes. For example, the de-identified surgical videos can be released to surgical video data experts who can use the de-identified surgical videos to construct various machine-learning-based analysis tools. More specifically, the de-identified surgical videos can be used to establish machine learning targets in preparation for mining surgical data from surgical videos of a given surgical procedure as described in a related patent application having serial number <CIT>; to build machine-learning-based surgical tool inventory and tool usage tracking tools as described in a related patent application having serial number <CIT>; or to build surgical phase segmentation tools also described in the related patent application having serial number <CIT>.

<FIG> presents a flowchart illustrating an exemplary process <NUM> for anonymizing a raw surgical video to de-identify personally-identifiable information embedded in the video images in accordance with some embodiments described herein. In one or more embodiments, one or more of the steps in <FIG> may be omitted, repeated, and/or performed in a different order. Accordingly, the specific arrangement of steps shown in <FIG> should not be construed as limiting the scope of the technique.

Process <NUM> may begin by receiving a set of raw surgical videos corresponding to a set of recorded video segments/clips of a full surgical procedure performed in the OR (step <NUM>). As mentioned above, the set of raw surgical videos corresponds to a set of shorter video segments/clips of the full surgical procedure, wherein each of the raw surgical videos can be generated as a result of a maximum file-size constraint, e.g., <NUM> MB/video. In some embodiments, process <NUM> can receive the set of raw surgical videos from a HIPAA compliant video repository. In these embodiments, the set of recorded raw surgical videos were first transferred from the OR to the HIPAA compliant repository for temporary storage. In other embodiments, process <NUM> can receive the set of raw surgical videos directly from a recording device within the OR through a secure network connection, without having to retrieve the stored videos from a HIPAA compliant video repository. Note that when receiving the set of raw surgical video files, process <NUM> can receive the set of raw video files along with a file folder.

Next, process <NUM> performs text-based de-identification on the set of received raw surgical videos and the file folder to detect and de-identify text-based personally-identifiable information associated with the raw surgical videos and the associated file folder (step <NUM>). As described-above, the text-based de-identification operation analyzes those text data associated with the raw surgical videos and the file folder (containing the raw surgical videos) that are not embedded in the video images. More specifically, the text-based de-identification operation detects text-based personally-identifiable information embedded in file identifiers (e.g., filenames), folder identifiers (e.g., folder names), file metadata such as file properties, and other metadata associated with the set of raw video files and file folder. As mentioned above, the text-based personally-identifiable information can include both text-based patient data and text-based staff data, and text-based patient data can include, but are not limited to the name, DOB, age, sex, SSN, address, MRN of the patient embedded in the text-based data of the video files and file folder.

Process <NUM> subsequently removes or otherwise de-identifies the detected text-based personally-identifiable information from the file identifiers, the folder identifiers, and other metadata associated with the set of raw video files and file folder. As mentioned above, process <NUM> can use open source text detection and removal tools or conventional text detection techniques in step <NUM>. Note that at the end of step <NUM>, the set of raw video files is considered partially-processed: i.e., while the text-based personally-identifiable information has been de-identified, potential personally-identifiable information embedded in the video images has not been de-identified.

Next, process <NUM> stitches together the set of partially-processed videos to recreate a full procedure video corresponding to the full surgical procedure (step <NUM>). As mentioned above, different recording devices often have different naming conventions. In some embodiment, merging the set of partially-processed video files involves first analyzing the particular naming convention used by the set of video files to determine the correct order for the set of video segments with respect to the full surgical procedure, and subsequently putting together the set of partially-processed videos back to the full procedure video.

Next, process <NUM> performs image-based de-identification on the partially-processed full procedure video to detect and de-identify image-based personally-identifiable information embedded in the corresponding video images (step <NUM>). As described above, the image-based personally-identifiable information can include various texts either being recorded or automatically inserted into the video frames so that they can be displayed along with the video images. Hence, process <NUM> can use the above-described image-text de-identification submodule <NUM>-<NUM> to automatically identify different types of personally-identifiable text within raw video images of the full procedure video, and automatically blur out/make unreadable or otherwise de-identify the detected text data embedded in the corresponding video images.

Furthermore, for personally-identifiable information captured during an OOB event, process <NUM> can use the above-described OOB-event removal submodule <NUM>-<NUM> to automatically detect various OOB segments within the full procedure video, and subsequently blur out, black out, or otherwise de-identify the identified OOB segments from the full procedure video. Moreover, process <NUM> can use a dedicated face-image removal submodule to search for any face not removed by OOB-event removal submodule <NUM>-<NUM> in video frames outside of the detected OOB segments and blur out each detected face. Note that at the end of step <NUM>, the full procedure video is considered fully-processed.

Next, process <NUM> performs a verification operation on the fully-processed procedure video to verify that the fully-processed procedure video is free of any personally-identifiable information (step <NUM>). As mentioned above, process <NUM> can use the above-described verification module <NUM> to automatically perform either a random sampling of the fully-processed procedure video or a strategic sampling of the fully-processed procedure video.

Next, process <NUM> determines if the verification operation is successful (step <NUM>). If one or more sampled video segments are found to be not completely free of personally-identifiable information, process <NUM> can perform either another automatic de-identification operation or a manual de-identification operation on each failed video segment (step <NUM>). After each problematic video segment has been properly processed, the verification operation can be repeated (i.e., process <NUM> returns to step <NUM>). If the verification operation is determined to be successful at step <NUM>, the video de-identification process is completed. Process <NUM> then permanently removes the raw surgical videos and related file data from the video repository and stores the de-identified procedure video in place of the removed raw surgical video (step <NUM>).

Note that while the disclosed anonymizing techniques have been described in the scope of anonymizing raw surgical procedure videos, the disclosed techniques can also be used to anonymize still images captured inside an OR to de-identify personally-identifiable information embedded in the still images. Moreover, while some disclosed anonymizing techniques have been described in the scope of anonymizing a set of raw surgical procedure videos corresponding to a long surgical procedure, the disclosed anonymizing techniques can also be applied to a single surgical procedure video to de-identify personally-identifiable information embedded in the single surgical procedure video.

<FIG> presents a flowchart illustrating an exemplary process <NUM> for detecting and removing an OOB video segment from a raw surgical video to de-identify personally-identifiable information embedded in the associated OOB video images in accordance with some embodiments described herein. In one or more embodiments, one or more of the steps in <FIG> may be omitted, repeated, and/or performed in a different order. Accordingly, the specific arrangement of steps shown in <FIG> should not be construed as limiting the scope of the technique.

Process <NUM> may begin by training an OOB-event detection model (step <NUM>). In some embodiment, this OOB-event detection model may be trained based on a set of labeled video segments of a set of actual OOB events extracted from actual surgical procedure videos. For example, if a training OOB video segment corresponds to a <NUM>-second segment of a procedure video, then all the video frames from the <NUM>-second segment can be labeled with an "OOB" identifier. Next, the OOB-event detection model can be trained based on these labeled video frames to teach the model to detect and identify similar events in raw surgical videos. In particular, the OOB-event detection model can be trained to detect the beginning phase of an OOB event, i.e., a sequence of video images corresponding to the event that an endoscope is being taken out of the patient's body; and an ending phase of an OOB event, i.e., a sequence of video images corresponding to the event that the endoscope is being inserted back into the patient's body. The OOB-event detection model is also trained to correlate a detected beginning phase to a detected ending phase to the same OOB event. For example, if the detected ending phase of an OOB event immediately follows the detected beginning phase of an OOB event, and the time interval between the two detections is below a pre-determined threshold, the two detected phases may be considered to belong to the same OOB event.

Process <NUM> next applies the trained OOB-event detection model to a raw procedure video to detect the beginning phase of an OOB event (step <NUM>). If the beginning phase of an OOB event is detected, process <NUM> subsequent applies the trained OOB-event detection model to the raw procedure video to detect an ending phase of an OOB event (step <NUM>). Next, process <NUM> determines if the detected beginning phase and the ending phase belong to the same OOB event (step <NUM>), and if so, process <NUM> blurs out, blacks out, or otherwise de-identifies all video frames between the detected beginning phase and ending phase of the OOB event (step <NUM>). However, if process <NUM> determines that the detected beginning phase and the ending phase do not belong to the same OOB event, process <NUM> may generate an alert indicating an exception is detected (step <NUM>).

<FIG> conceptually illustrates a computer system with which some embodiments of the subject technology can be implemented. Computer system <NUM> can be a client, a server, a computer, a smartphone, a PDA, a laptop, or a tablet computer with one or more processors embedded therein or coupled thereto, or any other sort of computing device. Such a computer system includes various types of computer-readable media and interfaces for various other types of computer-readable media. Computer system <NUM> includes a bus <NUM>, processing unit(s) <NUM>, a system memory <NUM>, a read-only memory (ROM) <NUM>, a permanent storage device <NUM>, an input device interface <NUM>, an output device interface <NUM>, and a network interface <NUM>. In some embodiments, computer system <NUM> is a part of a robotic surgical system.

Bus <NUM> collectively represents all system, peripheral, and chipset buses that communicatively connect the numerous internal devices of computer system <NUM>. For instance, bus <NUM> communicatively connects processing unit(s) <NUM> with ROM <NUM>, system memory <NUM>, and permanent storage device <NUM>.

From these various memory units, processing unit(s) <NUM> retrieves instructions to execute and data to process in order to execute various processes described in this patent disclosure, including the above-described processes of anonymizing raw surgical videos to de-identify personally-identifiable information embedded in the corresponding file and folder identifiers, and the corresponding video images in conjunction with <FIG>. The processing unit(s) <NUM> can include any type of processor, including, but not limited to, a microprocessor, a graphics processing unit (GPU), a tensor processing unit (TPU), an intelligent processor unit (IPU), a digital signal processor (DSP), a field-programmable gate array (FPGA), and an application-specific integrated circuit (ASIC). Processing unit(s) <NUM> can be a single processor or a multi-core processor in different implementations.

ROM <NUM> stores static data and instructions that are needed by processing unit(s) <NUM> and other modules of the computer system. Permanent storage device <NUM>, on the other hand, is a read-and-write memory device. This device is a non-volatile memory unit that stores instructions and data even when computer system <NUM> is off. Some implementations of the subject disclosure use a mass-storage device (such as a magnetic or optical disk and its corresponding disk drive) as permanent storage device <NUM>.

Other implementations use a removable storage device (such as a floppy disk, flash drive, and its corresponding disk drive) as permanent storage device <NUM>. Like permanent storage device <NUM>, system memory <NUM> is a read-and-write memory device. However, unlike storage device <NUM>, system memory <NUM> is a volatile read-and-write memory, such as a random access memory. System memory <NUM> stores some of the instructions and data that the processor needs at runtime. In some implementations, various processes described in this patent disclosure, including the above-described processes of anonymizing raw surgical videos to de-identify personally-identifiable information embedded in the corresponding file and folder identifiers, and in the corresponding video images in conjunction with <FIG>, are stored in system memory <NUM>, permanent storage device <NUM>, and/or ROM <NUM>. From these various memory units, processing unit(s) <NUM> retrieve instructions to execute and data to process in order to execute the processes of some implementations.

Bus <NUM> also connects to input and output devices <NUM> and <NUM>. Input devices <NUM> enable the user to communicate information to and select commands for the computer system. Input devices <NUM> can include, for example, alphanumeric keyboards and pointing devices (also called "cursor control devices"). Output devices <NUM> enable, for example, the display of images generated by computer system <NUM>. Output devices <NUM> can include, for example, printers and display devices, such as cathode ray tubes (CRT) or liquid crystal displays (LCD). Some implementations include devices such as a touchscreen that functions as both input and output devices.

Finally, as shown in <FIG>, bus <NUM> also couples computer system <NUM> to a network (not shown) through a network interface <NUM>. In this manner, the computer can be a part of a network of computers (such as a local area network ("LAN"), a wide area network ("WAN"), an intranet, or a network of networks, such as the Internet. Any or all components of computer system <NUM> can be used in conjunction with the subject disclosure.

The various illustrative logical blocks, modules, circuits, and algorithm steps described in connection with the embodiments disclosed in this patent disclosure may be implemented as electronic hardware, computer software, or combinations of both.

The hardware used to implement the various illustrative logics, logical blocks, modules, and circuits described in connection with the aspects disclosed herein may be implemented or performed with a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable-logic device, discrete gate or transistor logic, discrete hardware components, or any combination thereof designed to perform the functions described herein. A processor may also be implemented as a combination of receiver devices, e.g., a combination of a DSP and a microprocessor, a plurality of microprocessors, one or more microprocessors in conjunction with a DSP core, or any other such configuration.

In one or more exemplary aspects, the functions described may be implemented in hardware, software, firmware, or any combination thereof. If implemented in software, the functions may be stored as one or more instructions or code on a non-transitory computer-readable storage medium or non-transitory processor-readable storage medium. The steps of a method or algorithm disclosed herein may be embodied in processor-executable instructions that may reside on a non-transitory computer-readable or processor-readable storage medium. Non-transitory computer-readable or processor-readable storage media may be any storage media that may be accessed by a computer or a processor. By way of example but not limitation, such non-transitory computer-readable or processor-readable storage media may include RAM, ROM, EEPROM, flash memory, CD-ROM or other optical disk storage, magnetic disk storage or other magnetic storage devices, or any other medium that may be used to store desired program code in the form of instructions or data structures and that may be accessed by a computer. Disk and disc, as used herein, include compact disc (CD), laser disc, optical disc, digital versatile disc (DVD), floppy disk, and Blu-ray disc, where disks usually reproduce data magnetically, while discs reproduce data optically with lasers. Combinations of the above are also included within the scope of non-transitory computer-readable and processor-readable media. Additionally, the operations of a method or algorithm may reside as one or any combination or set of codes and/or instructions on a non-transitory processor-readable storage medium and/or computer-readable storage medium, which may be incorporated into a computer-program product.

While this patent document contains many specifics, these should not be construed as limitations on the scope of any disclosed technology or of what may be claimed, but rather as descriptions of features that may be specific to particular embodiments of particular techniques. Certain features that are described in this patent document in the context of separate embodiments can also be implemented in combination in a single embodiment.

Claim 1:
A computer-implemented method for anonymizing raw surgical procedure videos recorded by a recording device within an operating room, the method comprising:
receiving (<NUM>) a set of raw surgical videos (<NUM>) produced by the recording device and corresponding to a surgical procedure performed within the operating room;
merging (<NUM>) the set of raw surgical videos to generate a surgical procedure video (<NUM>) corresponding to the surgical procedure, wherein the surgical procedure video comprises a set of raw video images; and
detecting image-based personally-identifiable information embedded in the set of raw video images of the surgical procedure video, wherein detecting the image-based personally-identifiable information embedded in the set of raw video images of the surgical procedure video further includes:
scanning the set of raw video images to detect a video segment corresponding to an out-of-body event when the recording device was taken out of a patient's body, wherein personally-identifiable information can be captured by the recording device during the out-of-body event; and
in response to detecting an out-of-body event within the set of raw video images, blurring out, editing out or otherwise de-identifying each video image in the detected video segment corresponding to the detected out-of-body event, so that any personally-identifiable information embedded within the detected video segment cannot be identified.