Introduction to the anonymization of medical images in DICOM format

Today, digital medical imaging in the healthcare field has become a fundamental tool for medical diagnosis. Health data is a major issue, and it is essential to treat it with the highest levels of precaution. To do this, anonymizing data is the easiest but also the most secure approach ensuring personal data protection, but there are some nuances to be considered when anonymizing DICOM files.

Images in the DICOM standard

“Digital Imaging and Communications in Medicine (DICOM) was developed to standardise medical image data and to easily share medical image data between computer systems. It is currently the global standard for handling, storing, printing and transmitting information in medical imaging. A DICOM image consists of a DICOM header and the viewable image. The DICOM header saves identifying information of patients and images which may include patient information, study information, institution information, etc.”

Anonymization of DICOMs for sharing and transmission of medical images

“The DICOM format is now used by most of the medical imaging community, not only for clinical practice but also for clinical research raising the possibility of data sharing or exchange. However, sharing sensitive medical image data to a third party demands protection of the data itself to ensure data safety and patient privacy”.¹ 

Anonymization is a processing operation which consists of using a set of techniques in such a way as to make it impossible, in practice, to identify the person by any means whatsoever and in an irreversible manner. There are, however, exceptions to this irreversibility: for example, in the context of clinical research. 

The complexity lies in anonymizing while preserving the value of the DICOM dataset. 

DICOM defines de-identification as the protection of confidential attributes by  deletion or encryption. DICOM defines re-identification as the reverse process of "protective removal". It should be noted that this definition is not perfect: re-identification is not always possible if the original data has been cleaned or deleted.

The objective is therefore to strike a balance between anonymization, pseudonymization, de- and re-identification of DICOM.

Of course, this does not mean simply removing confidential information such as patient identification and study dates, etc., but it also means that we have to be careful about the information that we collect. Certain attributes are required and therefore, their removal would result in DICOM being unusable.

DICOM - The types of data elements

This table shows the types of data elements and how they are processed. 
SOP: Service Object Pair. This is the combination of an "Information Object" (e.g. an image) with a "Service" (e.g. the printing of this image). Therefore, it is the SOP classes that define the types of services to be performed and the information that the DICOM files should contain. Example of tag: 0010,0010. If the condition is not met, then the tag is not sent in the DICOM metadata file.

How to deal with DICOM Type 1 "required attributes"?

We have previously seen it: for DICOM to be valid, a “required attribute” must be present but must be turned into something meaningless and unrelated to the original identification value (this anonymization with pseudo-values is called pseudonymization). 

Part PS3.15 of the DICOM standard², published a few years ago, defined existing data encryption techniques for use with DICOM data. 
These techniques serve three important purposes: data encryption, verification of data origin, and verification of data integrity.

The Attribute Confidentiality Profile (DICOM PS 3.15: Appendix E) provides a standard for image de-identification, reducing the complexity of secure de-identification of DICOM image data while retaining the flexibility to preserve certain information. The privacy profiles include a basic profile as well as a number of optional profiles. They provide instructions on how to securely clean DICOM elements that may contain personal data.

The Basic Application Level Confidentiality Profile is an extremely conservative approach that hides all confidential data related to the following attributes:

• the identity and demographics of the patient (e.g. name of patient-0010,0010, age of patient-0010,1010, date of birth-0010,0030)
• the identity of responsible parties or family members (e.g. name of observer organization-121009),
• the identity of the staff involved in the procedure (e.g. name of human actor-0040,4037),
• the identity of the organizations involved in the application or execution of the procedure (e.g. requesting service-0032,1033),
• anything that could be used to match the examples if they were given access to the originals, such as UIDs, dates and times, and;
• private attributes.

To apply this profile, you must at least take all the attributes listed in the table below, encrypt their original value with a standard (encryption algorithms such as RSA, AES, and Triple-DES5 are accepted by the DICOM standard for converting original DICOM data into a protected format) and store the result of the encryption in the modified attribute sequence while replacing the values in their original location with insignificant false values. For example, we could replace DROP^JACK with GOLP^CE28, it would be stored in the patient’s name attribute (0010,0010) and the original value of DROP^JACK would be encrypted and then placed in an attribute sequence.

In addition to the Basic Application Level Confidentiality Profile, the DICOM Standards Committee has published Basic Application Level Confidentiality Options:
The different options are defined to be applied to the Basic Application Level Confidentiality Profile. Some of these options require the deletion of additional information, and others require the retention of information that would otherwise be deleted.

The following is a list of options that require additional information to be removed:

• Clean Pixel Data Option
• Clean Recognizable Visual Features Option
• Clean Graphics Option
• Clean Structured Content Option
• Clean Descriptors Option

The following is a list of options that require retention of information that would otherwise be removed but that is needed for specific uses:

• Retain Longitudinal Temporal Information with Full Dates Option
• Retain Longitudinal Temporal Information with Modified Dates Option
• Retain Patient Characteristics Option
• Retain Device Identity Option
• Retain Institution Identity Option
• Retain UIDs
• Retain Safe Private Option

To ensure compliance with the anonymization / pseudonymization of your DICOM worldwide, IMAIOS recommends that you follow the recommendations of the DICOM Standards Committee.

In a forthcoming article, we will discuss in detail how to proceed with anonymizing your DICOM using IMAIOS procedures as an example.