Free imaging software for anonymization

Data preprocessing is an important and mandatory step for any good data scientist to take when embarking on a data analysis project. It consists of several steps that vary depending on the type of project you are going to conduct and the type of data you have.

Medical Imaging data preprocessing in AI : An essential step

In a series of articles, we will focus on the data preprocessing of medical images (e.g. CT images, MR images) for a computer vision project using deep learning methods. Commonly, medical images are stored in DICOM format in the PACS of the health facility where they were collected. In order to use them in a computer vision project, it is essential that they be anonymized because they contain Personal Health Information (PHI).

As seen in a previous article, the anonymization or de-identification of DICOM files involves processing information from several "tags" in the file that may contain personal patient information. You will find details regarding these "tags" and the various confidentiality profiles recommended by the DICOM PS 3.15 standard: Appendix E in this article. In addition to this process, you must ensure that the image itself does not contain any personal data, especially when annotations are burned into the image (called “burned in annotations”). If the image includes annotations, the de-identification must also be done by "cleaning" the pixels of the image. 

There are many tools to anonymize the DICOM "tags" containing the metadata associated with the image, but few also allow the anonymization of the "pixel data".

In this article we will investigate the de-identification of DICOM files (metadata and pixel data) and the free tools available on the market to achieve this.

Testing de-identification tools

For one of our R&D projects, we needed to de-identify the DICOM files before using the CT images in a classification algorithm. We therefore investigated what resources were currently available and, thanks to [1], became aware of free tools available for anonymizing the metadata and pixel data of a DICOM file. In order to choose the appropriate tool, we tested them and shared the results in this article.
The tools for anonymizing the DICOM files identified by [1] were separated into two groups: those allowing the de-identification of metadata and pixel data, and those allowing the de-identification of metadata only. Some of the tools identified by [1] were excluded from our comparison, either because they are no longer supported (TudorDicom, K-PACS), or because they need extra  add-ons in order to be functional (Conquest Dicom, GDCM), which makes the installation a little more complex.

Burned in annotations de-identification tools

Of the ten anonymization software programs referenced by [1], only the following 3 include pixel cleaning of the CT / MR image: 

• RSNA Clinical Trial Processor (CTP):

The software is provided by the Medical Imaging Resource Center (MIRC) of the Radiological Society of North America (RSNA) [2]. It can operate in two modes:

• occasional ("Launcher"), and
• continuous ("Runner") for institutional use.

We chose the occasional mode as it meets the needs of our image analysis R&D project. It works like a server and its graphical interface allows you to set up the data flows between the server ("Launcher") and the database (the hard disk in this case) containing the DICOM files to be processed.

It can also be used to configure the chosen image processing workflow. This can be:

• selected among several preconfigured ones,
• or a new user-defined pipeline.

We chose the "DICOM De-identification to Local Storage" pipeline because it conforms with our project and its environment (DICOM files stored locally on our computer). In order for the data to flow between our local storage (e.g. the computer hard drive) and the server, the FileSender plug-in needs to be installed. Then, just start the server, set up the connection between FileSender and the server, and select the DICOM file to be anonymized. This file is processed by the de-identification pipeline and saved (by default "./CTP/roots/FileStorageService/__default/").

The tool uses a script to automatically define the areas of the image to be anonymized. The default script can ignore the area where the annotations are located, so the anonymization may be incomplete (see before/after images below).

In this case, the default pixel anonymization script must be completed using dataset-specific fields, then saved as a pipeline parameter (see screenshot).

Pros: It can process several DICOM files simultaneously (e.g. per study, per series), the area of the image to be anonymized is automatically detected by the tool, no need to make a manual selection.

Cons: While the area of the image to be anonymized is automatically detected by the tool, you need to know scripting language to tweak the definition of the image areas to be anonymized, otherwise the burned in annotations may be incorrectly identified by the tool and only partially anonymized.

• DICOM Cleaner ^TM:

The software, provided by PixelMed^TM [3], allows you to blacken the pixels of the image with identifying information. The graphical interface consists of three main parts: the two file tree areas where the original and anonymized files are stored, and the configuration area for the de-identification process.

After importing a DICOM file, it’s possible to set specific values for metadata de-identification and to apply random values or default values.

The tool first anonymizes the metadata of the DICOM file, then, from the anonymized file, it allows you to blacken the embedded pixels of the CT/MR image.

There are three types of blackening:

• overlay: The lowest possible pixel value will be used, given the signature and bit depth of the pixel data,
• fill: the pixel fill value will be used if it’s present in the header,
• value zero.

The area is manually specified by the user using a bounding box. If all the images to be anonymized are of the same size and the annotations are in the same locations, then it’s possible to process them all at the same time.

Pros: you can manually select the areas of the image to be anonymized. Several files can be processed at once (e.g. per study, per series), if the images are all the same size and the annotations are in the same location.

Cons: the tool cannot be used in a batch anonymization process with a de-identification script, which would black out burned-in pixels based on image size or metadata.

• YAKAMI DICOM tools:

The software suite was developed by Kyoto University [4]. Despite the fact that there has been no update since 2014, it seems appropriate to present it since, like the other two tools, it's one of the few to allow the anonymization of the burned in annotations of the image included in the list of [1].

We only tested the DICOM file viewer and the de-identification tool. The software suite is easy to install. The DICOM viewer is simple to use and has all the tools expected from a viewer such as: load an image, multi-window display, overlay DICOM file metadata, change windowing and contrast, etc... It also allows you to add annotations such as points, lines, polygons, distance measurement.

The de-identification tool works either by using a conversion script where the fields of the file to be modified and the way to do it are defined, or by configuring the conversion options through the user interface (see screenshots below).

Unfortunately, we were unable to view the outcome of the conversion because the outgoing file was corrupted and we couldn’t identify where the error came from.

Pros: The tool allows you to choose values to anonymize the metadata of the DICOM file, the DICOM file viewing tool is very complete.

Cons: It’s hard to find user documentation or an active forum. It isn’t very user friendly, making it difficult to understand how the file conversion (de-identification) tool works.

Metadata de-identification tools

Having seen how to anonymize the "pixel data" of DICOM files, let's take a look at the de-identification of image metadata.

The three tools presented above can anonymize the pixels and the image metadata. We explain this second option in more detail below and look at a few additional tools that anonymize only the image metadata stored in the DICOM file (DICOM Library, DicomWorks).

• RSNA CTP: 

When using the de-identification pipeline, the image metadata related to patient and study information is anonymized by replacing with random values or by being removed (see screenshot below).

The replacement rules are defined in a script that is set as a parameter of the de-identification pipeline.

Pros: The accuracy in the configuration thanks to the anonymizer parameterization scripts.

Cons: You need to be familiar with the scripting language to define the rules for replacing values.

• DICOM Cleaner ^TM:

Prior to pixel de-identification, the tool replaces patient and study metadata. You can determine which of the following replacement rules are applied:

• either random values, 
• or default values, 
• or by customized values (see screenshot).

You can also select the metadata to delete when they are not replaced (see screenshot).

Pros: the graphical interface makes it easy to define the replacement values and those to be deleted. Several files can be processed at the same time (e.g. per study, per series).  

Cons: the tool cannot be used in a batch anonymization process with a de-identification script, allowing multiple patients to be treated with different replacement identifiers (pseudonymization).

• YAKAMI DICOM tools:

The files saved after anonymizing patient information were corrupted. We were unable to fully evaluate the tool.

• DICOM Library:

We already showed you this online tool [5] during the presentation of the 5 best DICOM viewers.  It anonymizes the metadata of the DICOM file. The list of anonymized DICOM "tags" and their replacement rules are available in the conditions of use. However, the tool does not de-identify the pixels of the image if they are embedded, as the DICOM Library website informs with the mention “Do not upload files with information written on image!”

Pros: No installation or tool setup required.

Cons: An internet connection is mandatory.

• DICOM Works:

The tool is proposed by [6]. The graphical interface and file loading are easy to use. Anonymization of file metadata is available with the licensed version of the tool. DicomWorks searches for all DICOM "tags" that belong to groups (0010) and (0008), i.e. patient and study information. It then replaces them with predefined values such as "Anonymized with DicomWorks" and "???"(see screenshot below).

Pros: No settings.

Cons: You need a license to access the anonymization of the metadata of the DICOM file. In trying to obtain the license, we were unable to complete the request process due to a service bug.

Comparative table - DICOM de-identification tools

Here is a comparative table of the solutions presented previously. The evaluation criteria are the following:

1. respect of the data privacy during processing;
2. ease of installation;
3. ease of use;
4. comprehensiveness of the tool (anonymization of metadata and "pixel data");
5. quality of the anonymization (type of confidential profile used, pixel cleaning);
6. ability to process a series of images.

Rating: 0 criterion not met, 5 criterion met, N/A criterion not applicable (e.g. unable to assess the tool according to this criterion)

Solution	Criterion 1: data privacy	Criterion 2: ease of installation	Criterion 3: ease of use	Criterion 4: completeness of the tool	Criterion 5: anonymization quality	Criterion 6:  ability to process a series of images
RSNA CTP	5 Software installed on the computer	3 Several components to install, documentation made for system engineers	3 Knowledge of scripting language and client-server operation needed	5	5 Setting up the anonymization scripts according to the dataset needed	5
DICOM CleanerTM	5 Software installed on the computer	5 Download then launch executable	5 Clear user interface	5	5	0
YAKAMI DICOM Tools	5 Software installed on the computer	5 Download archive, extract, then launch executable	3 The DICOM Viewer is easy to use, the DICOM converter is less obvious, especially due to user documentation lack	5	NA Files saved after anonymization were corrupted	NA Files saved after anonymization were corrupted
DICOM Library	5 Anonymization service before uploading to the site's server	NA	5 Automatic web service for anonymization	5	5	5
DICOM Works	5 Software installed on the computer	5 Download archive, extract, then launch executable	5 Provided you have a license for the tool	5  Provided you have a license for the tool	NA  Without a license the anonymization tool is unavailable	NA  Without a license the anonymization tool is unavailable

Our opinion on DICOM anonymization software

DICOM Cleaner^TM by PixelMed^TM software seems to be the most flexible and user-friendly free anonymization tool for DICOM files. Despite its inability to incorporate a batch anonymization process (e.g. for pseudonymization), like CTP RSNA, it allows de-identification of both burned pixels and image metadata.

There are other ways of anonymizing metadata than de-identification software. For example, if the image is only used in the computer vision project and does not have embedded pixels, then a conversion of the DICOM file to NIfTI format is possible. The NIfTI format stores only the pixels of the image. Or, if the metadata must be kept, as they will be explanatory variables during image analysis, then the coding of a script to de-identify the DICOM tags can be considered.

Concerning the anonymization of the pixels of the image, machine learning / deep learning methods can be a solution to manual de-identification.

These other paths to DICOM de-identification files will be the topic of upcoming articles.