A scope of disclosure for personal information is embedded in a personal search ID (511), a personal encryption ID (512), and a piece of encrypted personal information (513) stored in a personal information storage unit (51). A scope of disclosure for medical data is embedded in a medical search ID and a medical encryption ID stored in a medical data storage unit. A search query generation unit generates a search query Q resulting from encrypting an anonymous ID acquired from a user for use in a search with the attribute information of the user embedded therein. A search unit performs a secret search with respect to the personal search ID (511) and a pathological search ID (521) using the search query Q. The search unit outputs search results obtained on the basis of the attribute information of the user, the scope of disclosure for personal information, and the scope of disclosure for medical data.
