ANONYMIZING medical images ?

[Sébastien Barré]

I'm trying to implement a function to anonymize/sanitize medical images,
so that I may use/distribute them as test files.

Basically, I'm wondering what is (legally ?) the smallest set of
elements I should rename/remove from the DICOM data element set ?

I guess I could provide different "level" of anonymization :
- remove person names (VR=PN)
- remove Patient Identification (Name, ID, Birth Name, etc)
- remove Patient Demographic (Birth Date, Sex, etc.)
- remove Patient Medical (Medical alerts, allergies, etc.)

Furthermore, I'm wondering, should I remove the corresponding ID and UID
? Is a UID sufficient to recognize a patient ? Or may I consider that if
someone has enough "rights" to establish the link between an indirect
information (like an UID, a Birth Date) and the patient, then he
probably has already direct access to the name database, or is in the
medical field and is aware of these confidentiality stuff.

Thanks
--
Sebastien Barre : http://www.hds.utc.fr/~barre/medical/

[Jean-Christophe Staub]

Hi,

I have already been working on such process. I had the problem that even by
removing every possible elements that may contains some link to patient
information, it was impossible (at least difficult) to remove/detect the
patient name clearly written in the overlay(s). Of course, It depend on your
knowledge of the targeted images, I knew the source modalities of my images
and implemented an anonymisation database to know what to do with image
objects to fully anonymise them... big work!

for the UIDs, To be sure of the result you may consider creating new UIDs
for anonymised studies?!

PS2Seb.: Your site is cool, but when will we have access to your
demonstration images?

[Sébastien Barré]

Hi

Jean-Christophe Staub <St...@dim.hcuge.ch> wrote:

>I have already been working on such process. I had the problem that even by
>removing every possible elements that may contains some link to patient
>information,

I have established such a list, which is quite long. Do you really think
that we have to remove every elements related to the patient ? For
example :

// pat_id = Patient Identification

{0x0010, 0x0010}, // PN 1 Patient's Name
{0x0010, 0x0020}, // LO 1 Patient's ID
{0x0010, 0x1000}, // LO 1-n Other Patient's IDs
{0x0010, 0x1001}, // PN 1-n Other Patient's Names
{0x0010, 0x1005}, // PN 1 Patient's Birth Name
{0x0010, 0x1060}, // PN 1 Patient's Mother's Birth Name

// pat_demo = Patient Demographic

{0x0010, 0x0030}, // DA 1 Patient's Birth Date
{0x0010, 0x0032}, // TM 1 Patient's Birth Time
{0x0010, 0x0040}, // CS 1 Patient's Sex
{0x0010, 0x1040}, // LO 1 Patient's Address
{0x0010, 0x2150}, // LO 1 Country of Residence
{0x0010, 0x2152}, // LO 1 Region of Residence
{0x0010, 0x2154}, // SH 1-n Patient's Telephone Numbers
{0x0010, 0x2160}, // SH 1 Ethnic Group
{0x0010, 0x21F0}, // LO 1 Patient's Religious Preference
{0x0010, 0x4000}, // LT 1 Patient Comments

Even if the birth date is present, it is not sufficient to recognize the
patient, or the one able to do that should be someone from the hospital,
and therefore may already have access to all informations (but that
could be problematic if the Patient's adress or telephone numbers are
present).

>it was impossible (at least difficult) to remove/detect the
>patient name clearly written in the overlay(s).

I won't distribute file with such overlays in my medical image samples
page.

>for the UIDs, To be sure of the result you may consider creating new UIDs
>for anonymised studies?!

Wow.

>PS2Seb.: Your site is cool, but when will we have access to your
>demonstration images?

Which one ?

Thanks
(do you speak french ?)

[David Clunie]

Hi Sébastien

"Sébastien BarrÈ" wrote:

I would remove (and replace with dummies for mandatory attributes)
at the very least:

- everything in group 0x0010 (since in future someone may add
more patient related attributes and they would probably go
here, even though there are no semantics attached to group
numbers any more)

- all private attributes (i.e. all odd groups)

- all overlays and curves

- all comment fields at study/series/image levels

- all study identifiers, accession numbers etc.

- generate all new UIDs

An alternative approach is to reconstruct an appropriate IOD
copying only what is needed, and anonymizing what should be
changed, dropping all other attributes.

One still has to examine the image pixel data to be sure
there is no burned in annotation (as you point out).

Some people have done work on detecting and removing burned in text.
See for example:

http://www-db.stanford.edu/~wangz/project/meditext/AMIA97/

david
--
David A. Clunie mailto:dcl...@idt.net
Director, Medical Imaging Technologies http://idt.net/~dclunie/
Quintiles Intelligent Imaging http://www.i2image.com/
521 Plymouth Rd #115 Work 610-238-0572 Fax -0578
Plymouth Meeting PA 19462 Home 570-897-7123 Fax -5117

[Sébastien Barré]

David Clunie <dcl...@idt.net> wrote:

Hi David

Thanks for the tips :

>I would remove (and replace with dummies for mandatory attributes)
>at the very least:
>
>- everything in group 0x0010 (since in future someone may add
> more patient related attributes and they would probably go
> here, even though there are no semantics attached to group
> numbers any more)

OK.

>- all private attributes (i.e. all odd groups)

All right, it's a bit rude, but who knows :)

>- all overlays and curves

I do agree with overlays ( group 0x60xx ?), but why curves (0x50xx ?) ?

>- all comment fields at study/series/image levels

What do you mean please ? All 0x4000 elements ?

>- all study identifiers, accession numbers etc.

Could you clarify me that please ?

>- generate all new UIDs

I guess that would although be a good thing, but I'm still lost with
UID's.

Furthermore, what do you thing about the 0x4008 group (interpretation) ?

>One still has to examine the image pixel data to be sure
>there is no burned in annotation (as you point out).

True.

>Some people have done work on detecting and removing burned in text.
>See for example:
>
> http://www-db.stanford.edu/~wangz/project/meditext/AMIA97/

I'll download the file.

Thanks a lot

[Brian Matthias]

In my humble opinion, why get rid of the information, why not
replace the original information with some set of default
information. I can envision a default information generator to
make unique entries into the fields that need to be sanitized.

--
Cheers,

Brian Matthias
Field Service Engineer