DICOM and report de-identification
Header cleaning to PS3.15, burned-in text, report redaction and consistent date shifts.
Imaging is de-identified end to end before it leaves the site: headers, pixels, reports and dates.
- 01HeadersCleaned to the PS3.15 confidentiality profile; UIDs remapped.
- 02PixelsBurned-in text detected and masked.
- 03ReportsFree-text redaction; findings kept.
- 04DatesShifted by one offset per patient.
Headers
Tags are handled to the DICOM PS3.15 Basic Application Level Confidentiality Profile with the Clean Pixel Data, Clean Descriptors, Retain Longitudinal Temporal Information with Modified Dates, and Retain Patient Characteristics options. Private tags are removed unless they're on a reviewed safe list. The full kept-and-removed list is on the medical imaging spec.
Pixels
Every image is scanned for burned-in text (names, dates and IDs printed onto ultrasound frames, secondary captures or scanned documents). Detected regions are masked. Series that can't be cleaned reliably, such as scanned paper requests, are excluded and counted in the report.
Reports
Reports are redacted with free-text de-identification: names, dates, places, phone numbers and IDs are replaced with tags, and the clinical text is kept as written.
Dates and linkage
All dates for a patient move by the same offset, so the time between a scan and its follow-up is preserved. Patient and study IDs become stable pseudonyms, so longitudinal studies stay linked.
US health data
For US health data, de-identification meets HIPAA's Safe Harbor method or is confirmed by Expert Determination; which one is stated in the dataset's report. See re-identification risk testing.