AI 中文总结
针对医疗系统隐私问题，PriEval-Protect框架分两阶段统一评估与缓解隐私风险。评估阶段结合法规评分与技术分析得出综合风险评分，保护阶段依风险推荐对策，实现法规与数据级风险分析的衔接，结果具合规性与可解释性。
AI 中文摘要
在GDPR和HIPAA规定下，保障患者隐私并实现医疗数据的有效使用至关重要。现有合规方法是手动的、易出错的，且将政策审计与数据级评估分开。本文提出PriEval-Protect，这是一个用于统一隐私风险评估和缓解的两阶段框架。评估阶段将使用微调后的合法语言模型结合RAG进行监管合规评分，以及通过加密类型、数据架构和包括相似度、不确定性、对手成功率和信息增益/损失等指标进行技术分析。通过层次分析法进行加权聚合得出综合风险评分。保护阶段根据评估风险推荐包括联邦学习和差分隐私在内的对策。在医院文档和数据集上的结果展示了符合法规、可解释的评估，弥合了法律一致性和数据级风险分析之间的差距。
英文摘要
Safeguarding patient privacy while enabling meaningful healthcare data use remains critical under GDPR and HIPAA. Existing compliance methods are manual, error-prone, and separate policy audits from data-level assessments. This paper presents PriEval-Protect, a two-phase framework for unified privacy risk evaluation and mitigation. The evaluation phase combines regulatory compliance scoring using a fine-tuned legal LLM with RAG, and technical analysis via encryption type, data architecture, and metrics including similarity, uncertainty, adversary success, and information gain/loss. A composite risk score uses weighted aggregation via Analytic Hierarchy Process. The protection phase recommends countermeasures including federated learning and differential privacy based on assessed risk. Results on hospital documents and datasets demonstrate regulation-aligned, explainable assessments, bridging legal conformance and data-level risk analysis.
Comments10 pages, 3 figures. Accepted at IDT 2026
