DICOM De-identification

The pipeline must simultaneously process two distinct data domains within a DICOM file. Metadata parsing handles structured DICOM tags (e.g., PatientName 0010,0010, PatientID 0010,0020), applying rule-based redaction or tag nullification. Pixel data analysis uses Optical Character Recognition (OCR) to detect burned-in PHI, such as patient names or dates visually rendered in ultrasound frames or scanned documents. This dual-path architecture ensures no identifier is missed.

De-identification logic must be tailored to the DICOM standard's unique data types. Key operations include:

• Date Shifting: Applying a consistent, random offset to all date tags (e.g., StudyDate, PatientBirthDate) to preserve temporal intervals for research.
• UID Replacement: Generating new, globally unique Study, Series, and SOP Instance UIDs to break external linkage while maintaining internal referential integrity.
• Private Tag Curation: Identifying and either stripping or remapping vendor-specific private tags that may inadvertently contain PHI.

To maintain longitudinal data utility, the pipeline must employ a consistent pseudonym mapping strategy. Every instance of a specific real-world patient identifier is replaced with the same pseudonym across all studies and series. This is typically achieved via an encrypted lookup table or a deterministic hashing algorithm with a secret salt, ensuring that a patient's imaging history remains linked for analysis without revealing their true identity.

Different use cases require different levels of data utility. A pipeline should support configurable profiles that align with regulatory standards:

• HIPAA Safe Harbor: Removes all 18 identifiers, including all dates and geographic subdivisions smaller than a state.
• Limited Data Set: Retains dates and city/state/zip for research, requiring a Data Use Agreement.
• Custom Retention: Allows specific tags like PatientAge or modality-specific parameters to be kept for clinical trial eligibility screening.

Automated systems have a non-zero false negative rate. A critical feature is a review interface that routes low-confidence OCR detections or ambiguous metadata fields to a human auditor. The interface should display the original image region or tag alongside the model's proposed redaction, allowing for manual verification. This workflow provides a final safety net, ensuring residual PHI risk is minimized before data release.

For HIPAA compliance, the pipeline must generate a cryptographically verifiable audit trail. This log records every action taken: the original value, the transformation applied (e.g., redacted, shifted, pseudonymized), the timestamp, and the operator or model version. This provides a chain of custody, proving due diligence in the de-identification process and supporting forensic analysis in the event of a suspected breach.

Protected health information rendered directly into the pixel data of a medical image rather than stored in DICOM metadata headers. Examples include:

• Patient names burned into ultrasound frame corners
• Medical record numbers overlaid on X-ray films
• Dates of birth embedded in scanned documents

Detection requires optical character recognition (OCR) applied to each image frame, making it significantly more complex than header scrubbing. Burned-in PHI is a primary source of residual risk in automated pipelines.

The statistical probability that an attacker can correctly link de-identified DICOM data back to a specific patient using auxiliary information. Key attack vectors include:

• Linkage attacks: Cross-referencing quasi-identifiers like age, sex, and ZIP code with public datasets
• Provenance attacks: Exploiting unique scanner fingerprints or institution-specific DICOM tag patterns
• Temporal inference: Reconstructing identity from procedure dates and known clinical events

Risk assessment must account for the uniqueness of each record in the context of available external data.

A privacy-preserving technique that systematically offsets all dates in a DICOM study by a consistent, random interval. This preserves the temporal relationships between series and acquisitions—critical for clinical research—while obscuring actual calendar dates. Key properties:

• Consistency: All dates for a single patient are shifted by the same amount
• Randomization: The shift interval is randomly generated per patient
• Preservation: Intervals between studies remain analytically useful

Applied to DICOM tags like StudyDate (0008,0020) and SeriesDate (0008,0021).

DICOM relies on globally unique identifiers (UIDs) that can inadvertently leak information. Critical tags requiring de-identification include:

• Study Instance UID (0020,000D): Must be replaced with a new pseudonymous UID
• Series Instance UID (0020,000E): Requires consistent remapping across related objects
• SOP Instance UID (0008,0018): Each object needs a new unique identifier

UID replacement must maintain referential integrity—all references within the DICOM hierarchy must map to the new pseudonymous values to prevent broken study structures.