The Importance of Security in Medical AI Development

1. Data Sensitivity in Medical AI

Medical data refers to a collection of highly sensitive information, including medical records, test results, prescription details, medical history, imaging data, as well as the patient's lifestyle and genetic information. This information falls under the category of "sensitive personal information" that requires particularly strict handling among so-called "personal information," and there are stringent legal requirements governing its management.

In the development of medical AI, since a large amount of sensitive information is handled, even a single information leak can severely damage the social trust in the developing companies and medical institutions. Additionally, it may have a significant impact on the physical and mental well-being and lives of the patients involved.

Additionally, the reliability of medical data directly impacts the performance of AI. If incidents such as tampering or leaks occur, doubts will arise regarding the accuracy and effectiveness of the AI model, potentially jeopardizing the continuation of the entire project. Therefore, security measures in medical AI development are not merely about risk avoidance but are a crucial element in protecting the quality of the product itself.

2. Often Overlooked Security of the Entire Supply Chain

The development of medical AI is not something that can be completed by a single company alone. It consists of a multi-layered supply chain including medical institutions that collect and provide data, intermediary businesses responsible for data anonymization, AI companies that develop algorithms, and vendors in charge of data annotation.

If there is even one security weakness anywhere within this, it becomes a vulnerability for the entire system, posing risks such as information leaks and unauthorized access incidents. Especially in annotation sites, where multiple workers are involved, inadequate security training and management systems can also become risk factors.

Therefore, it is essential not only for the development companies themselves to thoroughly implement security measures but also to manage security optimally across all related parties. In other words, the safety of medical AI development cannot be guaranteed unless the entire system is secure, rather than just the individual company.

3. "Security Quality" ~The Criterion for Vendor Selection~

In AI development, the criteria for selecting partners and vendors have traditionally focused on "cost, delivery time, and quality." However, in sensitive areas such as medical AI, it is essential to also prioritize a high level of "security quality."

Security quality can be assessed based on compliance with the following laws and guidelines.

・Compliance system for the Personal Information Protection Law
・Compliance with the Guidelines for Safety Management of Medical Information Systems (Ministry of Health, Labour and Welfare)
・Acquisition and operational status of HIPAA (U.S. Health Insurance Portability and Accountability Act), ISMS (Information Security Management System), etc.

Since these laws and guidelines are regularly revised, it is important not only to be "currently compliant" but also to have a continuous improvement system in place that responds to legal amendments and technological advancements.
When selecting vendors, it is necessary to evaluate security quality not only from the perspective of "whether they comply with security guidelines" but also "whether they can truly operate them at the field level."

Reference Blog: Challenges and Solutions in Medical AI Annotation - Utilizing Outsourcing Vendors with Expertise

4. Responsibilities and Measures as an Annotation Company

At Human Science, as a specialized company in data annotation for medical AI development, we have established and operate a high-level security system. In addition to managing personal information in compliance with laws and regulations, our company has obtained ISMS certification. Within the ISMS framework, we not only manage and operate personal information and anonymized data safely and appropriately but also maintain and improve our information management standards through the PDCA cycle.

Our Company's Key Initiatives on Personal Information

Organizational Security Management Measures

· Established and operate the "Personal Information Protection Policy" and "Information Security Management Policy." The purpose of use and handling of personal information are posted on the website.
Reference link: Human Science Company Information - Information Management & Quality Control
· Assigned ISMS officers to each department to promote company-wide information security activities.
· Set access permissions according to the confidentiality level of information and operate under clear rules.
· Continuously improve through internal audits and audits by external inspection bodies.

Human Safety Management Measures

· Security training is conducted for all employees
· NDA agreements are mandatory for subcontractors, with annual security training and security status surveys conducted
· Security education and additional NDA agreements are provided on a per-project basis
· An incident response system is established to ensure appropriate and strict handling and reporting in case of incidents

Physical Security Measures

· Areas handling personal information or confidential data are managed with ID cards or security locks for entry and exit control
· Handling of customer data is restricted to security rooms according to customer requests and project security requirements
· Entry to security rooms is prohibited for anyone other than project personnel, including employees, and bringing personal devices is not allowed
· A project manager is stationed in the security room to thoroughly manage and monitor the project operations
· All devices are encrypted, and portable devices used in the security room are always secured with wire locks and locked away after use
· Personal and confidential information entrusted by customers is managed in ledgers and promptly destroyed upon project completion

Technical Safety Management Measures

·For managing data entrusted by our clients, we use company-approved cloud servers with strict access control (configured on a per-project basis)
·Two-factor authentication and IP restrictions are implemented for cloud server access to prevent unauthorized use
·The Information Systems Department centrally manages OS and security software update statuses and issues alerts for devices that are not updated
·We also support work using local annotation tools and on-premises servers upon request

Others

· Upon request, we will also accommodate the description of the handling policy for anonymized processed information on our website.
* Support is limited to the section regarding the handling of anonymized processed information.

In particular, medical AI projects that require high difficulty and high security levels demand partners with proven track records and responsiveness. Our company has the structure and experience to meet such on-site expectations.

5. Summary

Medical AI is an extremely promising technology that enhances the quality of healthcare and contributes to people's health. For its advancement, the utilization of high-quality medical data is essential. However, at the same time, the responsibility and risks associated with handling data are also increasing, making "security" one of the most important themes in medical AI development.

All companies and institutions supporting medical AI are required to view themselves as "security bearers" and pursue safety throughout the entire supply chain.

At Human Science, we will continue to serve as a trusted partner, contributing to the advancement of medical AI and the development of secure social infrastructure through safe and reliable annotation services.

6. Medical Annotation Services in Human Sciences

●Extensive annotation experience in medical imaging

Our company has extensive experience in medical image annotation that requires skill transfer, such as surgical images and MRI images, which are of high difficulty and specialization. In addition to experienced project managers in medical image annotation projects, we also have many skilled workers, ensuring high-quality annotation even for projects that are complex, specialized, and require skill transfer.

●Support for physician supervision and annotations by physicians

It can be concerning to have only general workers perform all tasks. In such cases, we receive requests for supervision by a physician for certain check tasks. To meet these requests, we have further strengthened our physician supervision system, allowing us to handle more complex annotations. Additionally, even if you request annotations by physicians instead of general workers, our project managers will provide comprehensive management services, ensuring resource allocation, quality, and progress management.

●Resource management without using crowdsourcing

At Human Science, we do not use crowdsourcing. Instead, projects are handled by personnel who are contracted with us directly. Based on a solid understanding of each member's practical experience and their evaluations from previous projects, we form teams that can deliver maximum performance.

●Equipped with a security room in-house

Within our Shinjuku office at Human Science, we have secure rooms that meet ISMS standards. Therefore, we can guarantee security, even for projects that include highly confidential data. We consider the preservation of confidentiality to be extremely important for all projects. When working remotely as well, our information security management system has received high praise from clients, because not only do we implement hardware measures, we continuously provide security training to our personnel.

Supports not only annotation but also the creation and structuring of generative AI LLM datasets.

In addition to labeling for data organization and annotation for identification-based AI systems, Human Science also supports the structuring of document data for generative AI and LLM RAG construction. Since our founding, our primary business has been in manual production, and we can leverage our deep knowledge of various document structures to provide you with optimal solutions.