De-identifying radiology at the source
Headers, pixels and reports: how a radiology study is made safe before it ever leaves the hospital.
Medical imaging is one of the clearest cases where better data would make better models, and one of the hardest places to move data safely. A radiology study is more than a stack of pixels. It carries identifiers in its headers, sometimes in the image itself, and almost always in the report that explains it. Our approach is to remove all of that before anything leaves the hospital or diagnostic chain that holds it.
Why at the source
The common alternative is to export studies to a central location and clean them there. That means identifiable data travels, even briefly, and sits somewhere it didn't need to be. Every copy is a risk, and every transfer is a conversation with a compliance team.
Running de-identification inside the owner's environment, as a container or an on-premise agent, changes the shape of the problem. Raw DICOM and reports never reach Quarry or the lab. What leaves is de-identified output and a log of hashes that lets anyone verify what was delivered. The owner keeps control of the original data throughout.
Headers
DICOM headers carry a long list of fields that can identify a patient directly or indirectly: names and IDs, dates of birth, accession numbers, referring physicians, institution names, device serial numbers, and free-text comments. The DICOM standard's confidentiality profiles describe which attributes to remove, replace or keep, and we follow them.
Some information is worth keeping in a safer form. Exact dates become shifted dates, moved consistently per patient so that intervals between studies stay true. Age becomes an age band. The site becomes a region. The aim is to keep what a model can learn from while removing what could point back to a person.
Pixels
Headers are only half the story. Older modalities, secondary captures and some ultrasound and X-ray workflows burn text directly into the image: a name in a corner, a date on an overlay. Cleaning the header doesn't touch it.
So the pixel data is scanned for burned-in text and those regions are masked. This is an area where automated tools are good but not perfect, which is why every batch is also sampled and reviewed by people before release.
Reports
The radiology report is where much of a study's value lives, and where de-identification is most delicate. Reports are free text, written quickly, and can mention names, dates, places and other identifiers anywhere. They are redacted with tools built for clinical text and then checked.
Where a study links to other records (prior imaging, follow-ups, lab results, diagnoses), consistent pseudonymous IDs keep those links intact without revealing who the patient is. A longitudinal dataset stays longitudinal.
Verifying, not assuming
De-identification is a process with failure modes, so it needs evidence. Each batch is sampled and reviewed by people and by automated scans; the owner signs off on a sample before anything is exported; and each dataset gets a re-identification risk assessment. For US health data, that means meeting HIPAA's Safe Harbor or Expert Determination standard. For Indian data, it means working within the DPDP framework.
Every delivery comes with a de-identification report: the method and version used, which entity types were removed, the results of sample-based QA, the residual-risk assessment, and who signed off. Licences then forbid any attempt to re-identify individuals or to link the data with other sources to do so.
The result
Done this way, a hospital can contribute to better models without its patients' identities ever leaving its walls, and a lab receives studies it can use with a clear record of how they were made safe. That's the trade we think medical data should make: maximum usefulness, minimum movement.