De-identification

The primary vector for re-identification is often the DICOM metadata, not the image itself. A single study can contain thousands of private tags holding PHI.

• Critical Tags: Name (0010,0010), MRN (0010,0020), and Study Date (0008,0020) must be cleared or shifted.
• Private Tags: Odd-numbered group tags (e.g., 0009,xxxx) are vendor-specific and often contain unvetted device serial numbers or technician notes.
• UID Replacement: All Study, Series, and SOP Instance UIDs must be regenerated to break linkage to the original institution.

Standard metadata scrubbing is insufficient for 3D volumetric scans where facial features can be reconstructed. Pixel defacing is required for head MRI/CT scans.

• Algorithmic Blurring: Software detects the facial region in a 3D volume and applies an irreversible smoothing kernel.
• Voxel Replacement: The facial voxels are replaced with a uniform noise pattern or zeroed out to prevent surface rendering.
• Challenge: Over-aggressive defacing can remove orbital structures needed for ophthalmic AI training.

Absolute dates (birth, admission, study) are PHI, but temporal relationships are often clinically vital. Date shifting preserves intervals while breaking absolute identity.

• Random Offset: A single random number of days is added or subtracted from all dates in a patient's longitudinal record.
• Preservation: The interval between a pre-operative scan and a post-operative scan remains mathematically accurate.
• Age Constraint: Shifts must be bounded to prevent a 70-year-old patient from being recorded as a negative age or a neonate.

HIPAA defines two distinct compliance paths for de-identification, often confused by engineering teams.

• Safe Harbor: A prescriptive checklist requiring the removal of 18 specific identifiers. It is rigid but provides legal certainty.
• Expert Determination: A statistical assessment by a qualified expert concluding that the risk of re-identification is "very small." This allows for richer data retention but requires formal documentation.
• Trade-off: Safe Harbor is easier to implement; Expert Determination preserves more clinical utility.

Protected data can be visually burned into the pixel data of the image itself, bypassing metadata scrubbing entirely.

• Ultrasound Overlays: Patient names and hospital IDs are often rasterized directly onto the ultrasound frame.
• Screen Capture Risk: Photographs of monitors or exported JPEGs may have text overlays that are not stored in DICOM tags.
• OCR Validation: A robust pipeline uses Optical Character Recognition on the final pixel output to verify no text remnants remain.

De-identification is not absolute; it is a risk mitigation. Understanding attack vectors is crucial for robust engineering.

• Linkage Attacks: Combining de-identified data with public voter rolls or news articles to triangulate identity.
• Cross-Modal Attacks: Using a de-identified CT scan to reconstruct a 3D face and matching it against social media photos.
• Fingerprinting: The unique pattern of brain folds (cortical folding) is a biometric identifier that can link a "de-identified" scan back to a specific individual.

The creation of synthetic medical data using formal privacy guarantees, such as differential privacy, to ensure generated images do not reveal identifiable information about real patients. Unlike basic de-identification, which strips metadata, privacy-preserving generation mathematically bounds the risk of re-identification from the pixel data itself by injecting calibrated noise during model training.

A decentralized training paradigm where diagnostic models learn across multiple institutions without centralizing raw data. Only model weight updates—not images—are shared. This architecture complements de-identification by ensuring sensitive scans never leave the originating hospital's firewall. Key challenges include:

• Non-IID data distributions across sites
• Communication efficiency for large imaging models
• Heterogeneous scanner hardware

The Digital Imaging and Communications in Medicine standard governs how medical images and associated metadata are stored and transmitted. De-identification pipelines must parse DICOM headers to locate and redact PHI tags, including:

• Patient Name (0010,0010)
• Medical Record Number (0010,0020)
• Study Date (0008,0020)
• Institution Name (0008,0080) Failure to handle nested sequences and private tags is a common source of data leakage.

A computational model of human anatomy and tissue properties used to simulate realistic medical images. Digital phantoms are inherently de-identified because they represent synthetic anatomies, not real patients. They are essential for:

• Validating reconstruction algorithms with known ground truth
• Generating unlimited labeled training data
• Benchmarking de-identification tools against controlled leakage scenarios

The application of federated learning specifically to healthcare, where privacy regulations like HIPAA and GDPR mandate strict data controls. This approach allows pharmaceutical companies and hospital networks to collaboratively train robust diagnostic models while maintaining full compliance. De-identification is often a prerequisite step before data enters a federated training pipeline, providing defense-in-depth against potential gradient leakage attacks.