The National Electrical Manufacturers Association (NEMA) maintains the DICOM standard, specifically **PS 3.15 Annex E** (Application Level Confidentiality Profile). This standard categorizes DICOM attributes into actions: - **Clean (`C`)**: Replace with a dummy value or pseudo-identifier. - **Delete (`D`)**: Remove the attribute completely from the dataset. - **Keep (`K`)**: Retain clinical values necessary for diagnostic or research interpretation (e.g. Slice Thickness, Pixel Spacing).
Medical Imaging
DICOM De-Identification: Medical Imaging & Burned-In Annotation Removal
Technical guide to de-identifying DICOM files according to PS 3.15 standards across metadata, private tags, and pixel data.
Medical imaging studies stored in DICOM format contain protected health information in two distinct locations: structured header elements and burned-in visual text within the pixel matrix. A complete de-identification pipeline must address both per NEMA DICOM PS 3.15.
Understanding DICOM PS 3.15 Confidentiality Profiles
Standard Patient Header Attributes to Sanitize
Standard DICOM files contain dozens of explicit patient identifiers in the file preamble and dataset: - `PatientName (0010,0010)`: Patient full name. - `PatientID (0010,0020)`: Medical record number or internal identifier. - `PatientBirthDate (0010,0030)` & `PatientSex (0010,0040)`: Demographic details. - `StudyDate (0008,0020)`, `SeriesDate (0008,0021)`, `AcquisitionDate (0008,0022)`: Timestamps subject to Safe Harbor date rules. - `AccessionNumber (0008,0050)` & `StudyID (0020,0010)`: Order and requisition numbers. - `InstitutionName (0008,0080)` & `ReferringPhysicianName (0008,0090)`: Facility and provider identities.
The Hidden Danger: Vendor Private Tags
Medical imaging hardware vendors (GE, Siemens, Philips, Toshiba, etc.) frequently store proprietary scan telemetry in private tags (odd group numbers such as `0019`, `0029`, or `7FE1`). These private blocks often replicate patient names, hospital internal network paths, or technician identifiers.
PHIPass enforces a safe approach to private tags: - Standard private tag dictionaries are parsed to retain non-identifying technical calibration parameters where safe. - Unrecognized or non-standard private tags containing text strings are safely stripped.
Burned-In Pixel Annotation Scrubbing
In modalities such as Ultrasound (US), Secondary Capture (SC), Fluoroscopy (XA), and Nuclear Medicine, patient names, dates, and medical device serial numbers are often burned directly into the image pixels: - PHIPass isolates the high-risk border regions of the pixel array where equipment overlays typically reside. - Local OCR scans these regions for text strings matching patient metadata or clinical patterns. - Bounding boxes are sanitized by writing solid mask values into the raw pixel matrix (e.g. 0 for `MONOCHROME2` or maximum intensity for `MONOCHROME1`). - The modified pixel data is saved using Explicit VR Little Endian transfer syntax, ensuring downstream DICOM viewers render the study cleanly without artifacts.
Verification and Re-Parsing
After redaction, PHIPass re-reads the output DICOM dataset using an independent parser to verify that: 1. All target header attributes have been purged or replaced. 2. Transfer syntax and pixel dimensions remain valid. 3. No residual private sequences remain uninspected.
Next Step
Put these de-identification practices into action.
Experience local healthcare document redaction on your own macOS or Windows workstation with zero document data egress.