DICOM Pseudonymization

Unlike anonymization, pseudonymization maintains a secure, reversible mapping between the original identifier and the pseudonym. This allows authorized systems to re-identify data if clinically necessary.

• Uses a master patient index (MPI) or trusted third-party service
• Original Patient ID (0010,0020) is replaced with a study-specific pseudonym
• Mapping table is stored in a separate, highly secured database
• Enables longitudinal studies by linking multiple exams from the same patient

Pseudonymization follows the DICOM PS3.15 Security and System Management Profiles, specifically the Basic Application Level Confidentiality Profile.

• Patient Name (0010,0010) is replaced with a coded pseudonym
• Patient ID (0010,0020) is substituted while preserving referential integrity
• Other Patient IDs (0010,1000) and Other Patient Names (0010,1001) are cleaned
• Retains essential clinical metadata: modality, body part, acquisition parameters

The primary advantage of pseudonymization over full anonymization is the ability to track a patient's clinical timeline across multiple studies without knowing their real identity.

• All exams for Patient X map to the same pseudonym SUBJ-7A3F
• Enables temporal analysis of disease progression
• Supports clinical trial cohorts where treatment response must be tracked
• Critical for radiomics and AI model training on sequential imaging data

Medical device vendors often store identifying information in private DICOM tags (odd group numbers) that fall outside standard de-identification profiles.

• Requires a vendor-specific tag dictionary to locate hidden PHI
• Private creator blocks (e.g., GEMS_SIEMENS_01) must be audited
• Burned-in annotations in pixel data must be detected and redacted
• Unknown private tags should be removed entirely to prevent accidental disclosure

Modern systems use deterministic cryptographic hashing to generate pseudonyms, ensuring the same input always produces the same pseudonym without storing a mapping table.

• HMAC-SHA256 with a secret salt key produces irreversible pseudonyms
• Eliminates the risk of a compromised mapping database
• Same Patient ID + same salt = same pseudonym across all systems
• Requires strict key management to prevent brute-force reversal

Pseudonymization is typically deployed as a DICOM proxy service that intercepts and modifies data in transit between modalities and PACS.

• Acts as a DIMSE or DICOMweb intermediary
• Processes C-STORE operations in real-time before archival
• Can be integrated with Modality Worklist (MWL) to pseudonymize at acquisition
• Maintains an audit log of all transformations for regulatory compliance

The irreversible destruction of patient identity. This process goes beyond header metadata to address Burned-in Annotations—text physically rendered into the pixel data of ultrasound or secondary capture images.

• Technical Challenge: Requires optical character recognition (OCR) or masking algorithms to black out regions of interest in the raw pixel matrix.
• Risk: If the DICOM UID mapping is destroyed, the data can never be re-linked to the patient's longitudinal record.

A globally unique identifier (e.g., 1.2.840.113619.2.55...) registered under the ISO 8824 object identifier tree. In pseudonymization, the original Study Instance UID and Series Instance UID must often be replaced with new, consistent pseudonyms to prevent cross-referencing while maintaining internal data integrity.

• Critical Rule: All references to the original UID within the dataset must be remapped atomically.
• Failure Mode: A broken UID reference chain renders a DICOM series unreadable by a PACS.

Patient data physically fused into the pixel bitmap, typically by legacy modalities or video capture devices. DICOM Pseudonymization engines must detect these regions using pattern recognition and apply destructive overlay masks.

• Detection Methods: Hybrid approaches using OCR and deep learning object detection.
• Standard Compliance: DICOM Part 15 requires that any Burned-in Annotation indicating PHI must be removed, not just flagged, for the dataset to be considered safe.

A machine-readable document object (SOP Class) that encodes clinical observations using coded concepts. Pseudonymizing DICOM SR is complex because PHI can hide inside free-text TEXT value fields or nested content sequences.

• Challenge: Unlike pixel data, text fields require natural language processing (NLP) to identify unstructured names or dates.
• Integration: A robust pseudonymization pipeline must recursively traverse the SR Document Content Tree to scrub every node.

The modern RESTful API standard (STOW-RS, WADO-RS, QIDO-RS) for exchanging medical images over HTTP. Pseudonymization proxies often sit as middleware between a DICOMweb client and server, intercepting JSON or XML payloads to swap real tags for pseudonyms in real-time without altering the original archive.

• Advantage: Enables dynamic, on-the-fly de-identification for federated queries.
• Protocol: Uses application/dicom+json media type for metadata manipulation.