The Importance of Security in Medical AI Development

1. Data Sensitivity in Medical AI

Medical data is a collection of highly sensitive information, including medical records, test results, prescription details, medical history, imaging data, as well as the patient's lifestyle and genetic information. This information falls under the category of "sensitive personal information" that requires particularly strict handling among so-called "personal information," and legal regulations impose high standards for its management.

In the development of medical AI, since a large amount of such sensitive information is handled, even a single instance of information leakage can severely damage the social trust in the development companies and medical institutions. Additionally, it may have a significant impact on the physical and mental well-being and lives of the patients involved.

In addition, the reliability of medical data is directly linked to the performance of AI. If incidents such as tampering or leakage occur, doubts will arise regarding the accuracy and effectiveness of the AI model, potentially jeopardizing the continuation of the entire project. Therefore, security measures in medical AI development are not merely about risk avoidance but are a crucial element in protecting the quality of the product itself.

2. Often Overlooked Security of the Entire Supply Chain

The development of medical AI is not something that can be completed by a single company alone. It consists of a multi-layered supply chain including medical institutions that collect and provide data, intermediary businesses responsible for data anonymization processing, AI companies that develop algorithms, and vendors in charge of data annotation.

If there is even a single security weakness anywhere within this, it becomes a vulnerability for the entire system, posing risks that could lead to incidents such as information leaks or unauthorized access. Especially in annotation sites, where multiple workers are involved, deficiencies in security training and management systems can also become risk factors.

Therefore, it is essential not only for the development company itself to thoroughly implement security measures but also to establish overall optimized security management that includes all related parties. In other words, it is not enough for "our company to be safe"; the entire system must be safe to ensure the security of medical AI development.

3. "Security Quality" ~The Criteria for Vendor Selection~

In AI development, the traditional criteria for selecting partners and vendors have centered on "cost, delivery time, and quality." However, in sensitive fields like medical AI, it is essential to also place a high priority on "security quality."

Security quality can be assessed based on the status of compliance with the following laws and guidelines.

・Compliance system for the Act on the Protection of Personal Information
・Compliance with the Guidelines for Safety Management of Medical Information Systems (Ministry of Health, Labour and Welfare)
・Acquisition and operational status of HIPAA (Health Insurance Portability and Accountability Act), ISMS (Information Security Management System), etc.

Since these laws and guidelines are periodically revised, it is important not only to be "currently compliant" but also to have a continuous improvement system in place that responds to legal amendments and technological advancements.
When selecting vendors, it is essential to evaluate security quality from the perspective of not only "whether they comply with security guidelines" but also "whether they can truly operate them at the field level."

Reference Blog: Challenges and Solutions in Medical AI Annotation - Utilizing Outsourcing Vendors with Expertise

4. Responsibilities and Measures as an Annotation Company

At Human Science, as a specialized company in data annotation for medical AI development, we have established and operate a high-level security system. In addition to managing personal information in compliance with laws and regulations, our company has obtained ISMS certification and, within the ISMS framework, not only manages and operates personal information and anonymized processed information safely and appropriately but also maintains and improves the level of information management by implementing the PDCA cycle.

Our Company’s Representative Initiatives Regarding Personal Information

Organizational Safety Management Measures

· Formulated and operate the “Personal Information Protection Policy” and “Information Security Management Policy.” The purposes of use and handling of personal information are posted on the website.
Reference link: Human Science Company Information - Information Management & Quality Control
· Assigned ISMS committee members to each department to promote company-wide information security activities
· Set access permissions according to the confidentiality level of information and operate under clear rules
· Continuously implement improvements through internal audits and audits by external review organizations

Personnel Safety Management Measures

· Conduct security training for all employees
· Require NDA signing for subcontractors and conduct annual security training and security compliance surveys
· Provide security education on a project basis and support additional NDA signings
· Establish an incident response system and carry out appropriate and strict responses and reporting when incidents occur

Physical Security Measures

· Areas handling personal information and confidential data are managed for entry and exit using ID cards or security locks
· Handling of customer data is limited to security rooms according to customer requests and project security requirements
· Entry to security rooms is prohibited for anyone other than project personnel, even employees, and bringing in personal devices is forbidden
· A project manager is stationed in the security room to thoroughly operate and monitor the project
· All devices are encrypted, and portable devices used in the security room are always secured with wire locks and locked away after use
· Personal and confidential information entrusted by customers is managed in ledgers and promptly destroyed upon project completion

Technical Safety Management Measures

· For managing data entrusted by customers, we use cloud servers authorized by our company and enforce strict access control (configured on a per-project basis)
· Two-factor authentication and IP restrictions are implemented for access to cloud servers to prevent unauthorized access
· The Information Systems Department centrally manages the update status of OS and security software, issuing alerts for devices that are not updated
· We also support local annotation tools and on-premises server operations upon request

Others

·Upon request, we also respond regarding the description of the handling policy for anonymized processed information on our website.
*Our response is limited to the section concerning the handling of anonymized processed information.

Especially in medical AI projects that require high difficulty and high security levels, partners with proven track records and responsiveness are sought. Our company has the structure and experience to meet such on-site expectations.

5. Summary

Medical AI is an extremely promising technology that enhances the quality of healthcare and contributes to people's health. For its advancement, the utilization of high-quality medical data is indispensable. However, at the same time, the responsibility and risks associated with handling data are also increasing, making "security" one of the most important themes in medical AI development.

All companies and organizations supporting medical AI are required to see themselves as "security bearers" and pursue safety throughout the entire supply chain.

We at Human Science will continue to contribute as a partner company playing a vital role, through safe and reliable annotation services, to the advancement of medical AI and the construction of a secure social infrastructure.

6. Medical Annotation Services in Human Sciences

●Extensive annotation experience in medical imaging

Our company has extensive experience in medical image annotation that requires skill transfer, such as surgical images and MRI images, which are of high difficulty and specialization. In addition to experienced project managers in medical image annotation projects, we also have many skilled workers, ensuring high-quality annotation even for projects that are complex, specialized, and require skill transfer.

●Support for physician supervision and annotations by physicians

It can be concerning to have only general workers perform all tasks. In such cases, we receive requests for supervision by a physician for certain check tasks. To meet these requests, we have further strengthened our physician supervision system, allowing us to handle more complex annotations. Additionally, even if you request annotations by physicians instead of general workers, our project managers will provide comprehensive management services, ensuring resource allocation, quality, and progress management.

●Resource management without using crowdsourcing

At Human Science, we do not use crowdsourcing. Instead, projects are handled by personnel who are contracted with us directly. Based on a solid understanding of each member's practical experience and their evaluations from previous projects, we form teams that can deliver maximum performance.

●Equipped with a security room in-house

Within our Shinjuku office at Human Science, we have secure rooms that meet ISMS standards. Therefore, we can guarantee security, even for projects that include highly confidential data. We consider the preservation of confidentiality to be extremely important for all projects. When working remotely as well, our information security management system has received high praise from clients, because not only do we implement hardware measures, we continuously provide security training to our personnel.

Supports not only annotation but also the creation and structuring of generative AI LLM datasets.

In addition to labeling for data organization and annotation for identification-based AI systems, Human Science also supports the structuring of document data for generative AI and LLM RAG construction. Since our founding, our primary business has been in manual production, and we can leverage our deep knowledge of various document structures to provide you with optimal solutions.