DICOM Standard De-identification Protocol

In PS 3.15 Appendix E, the DICOM standard specifies a set of de-identification rules for use in various situations. The rules are grouped into a Basic Application Confidentiality Profile, which removes all protected health information (PHI), and a set of options which relax certain classes of PHI that may be retained in certain cases. The sections below describe the de-identification protocol implemented by the Anonymizer with reference to the DICOM Profile and its options.

113100: Basic Application Confidentiality Profile

The RSNA DICOM Anonymizer program implements the Basic Profile. The program either imports the site identifier (SiteID and UIDRoot) from an Index Excel file exported by the Java Anonymizer or auto-generates a new unique SiteID and uses a default UIDRoot. The PatientName (0010,0010) and PatientID (0010,0020) elements are modified by assigning sequential integers to unique PHI PatientIDs as they are encountered. The sequential integer is appended to the SiteID parameter, producing a string in the form [SiteID]-[sequential integer], which is used to populate both elements. If the PHI PatientID is missing or blank, the program assigns [SiteID]-000000 to the PatientID and PatientName elements. The program maintains a database to ensure that all studies of the same patient are de-identified in the same way.

UIDs are replaced by those generated with the format: [UIDRoot].[SiteID].[sequential integer]
All UIDs are removed in groups.
All elements in groups 0032 through 4008 are removed.
All private groups are removed.
The PatientIdentityRemoved element (0012,0062) is assigned the value 'YES'.
The DeIdentificationMethod element (0012,0063) is assigned the value 'RSNA DICOM ANONYMIZER'.
113100 is appended to the DeIdentificationMethodCodeSequence element (0012,0064).
Private Block: 0x0013 is created and assigned the value "RSNA", the ProjectName and SiteID are added to this block.

113101: Clean Pixel Data Option

Not implemented.

113102: Clean Recognizable Visual Features Option

Not implemented

113103: Clean Graphics Option

Not implemented but curve and overlay groups (5XXX and 6XXX) are removed.

113104: Clean Structured Content Option

Not implemented however project settings can allow/disallow SR (Structured Report) related storage classes.

113105: Clean Descriptors Option

This option is partially implemented. Only the following elements defined by the option are kept:

(0008,1030) StudyDescription
(0008,103e) SeriesDescription

113106: Retain Longitudinal Temporal Information Full Dates Option

Not Implemented

113107 Retain Longitudinal Temporal Information Modified Dates Option

This option is partially implemented.

All dates are modified by calculating the MD5 hash of PHI PatientID.
The integer value of the hash is divided by the number of days in 10 years (3652) and the remainder is used to offset the date being modified.
This retains the temporal relationships between studies of a single patient while using different offsets for different patients.
Time (time of day) elements are not modified.
113107 is appended to the DeIdentificationMethodCodeSequence element (0012,0064).

113108: Retain Patient Characteristics Option

Keeps patient-characteristic attributes from DICOM PS 3.15 Table E.1-1 that the Basic profile removes (for example sex, size, weight, ethnic group, smoking status). Patient age stays band-rounded. 113108 is appended to DeIdentificationMethodCodeSequence (0012,0064).

113109: Retain Device Identity Option

Keeps device-identity attributes from Table E.1-1 plus product manufacturer/model/software tags that Basic removes (for example Manufacturer, ManufacturerModelName, DeviceSerialNumber, StationName, SoftwareVersions). 113109 is appended to DeIdentificationMethodCodeSequence (0012,0064).

113110: Retain UIDs Option

Keeps original DICOM UIDs instead of remapping them (script overlay).

113111: Retain Safe Private Option

At import, applies the TCIA private-tag knowledge base instead of removing all private tags.