DicomDeidentify

MLModule

author	MeVis Medical Solutions AG
package	MeVisLab/Standard
dll	MLDicomDeidentify
definition	MLDicomDeidentify.def
keywords	anonymization, anonymizer, pseudonymization, pseudonymizer, hipaa

Purpose

The module DicomDeidentify performs the anonymization of DICOM data according to DICOM standard PS 3.15 annex E.

Usage

Select the required de-identifying options from the panel in the module, and connect a DICOM source—either an ML image or a pure DICOM tree—to the module (note: only one input will be de-identified). The de-identifying step will be performed immediately; however, depending on the selected options, some tags may require manual inspection (indicated by the Had Unhandled Tags flag). In such cases, the Review button must be clicked to go through the list of unhandled tags.

Tips

The anonymization will not be performed if the tag PatientIdentityRemoved (0012, 0062) is already set in the dataset with a value of “YES.” In this case, the DICOM information is passed through unchanged, and Was Already Deidentified is set.

Windows

Default Panel

Review

Panel for performing a manual inspection of tags for identifying information. The user can either click on the check-mark for a tag to confirm that the tag does not contain any identifying information, or click on the cross to remove all content from that tag, or long-click on the value to edit the value.

If all values have been marked as reviewed (recognizable by the fact that all question marks have vanished), Had Unhandled Tags is unset and the output of this module is updated with the resulting DICOM information.

There is also a context menu on the list to restore the original value of a tag if it has been changed accidentally.

Input Fields

input0

name: input0, type: Image

An image input for images with DICOM information needing anonymization.

inDicom

name: inDicom, type: DicomTree(MLBase)

A Base input for pure DICOM information needing anonymization.

For accessing this object via scripting, see the Scripting Reference: MLABDicomTree.

Output Fields

output0

name: output0, type: Image

This output contains the image with the de-identifying step applied to all DICOM tags of input0. This will be invalid while Had Unhandled Tags is set.

outDicom

name: outDicom, type: DicomTree(MLBase)

This output contains the DICOM tree from inDicom with the de-identifying step applied to all DICOM tags. This will be empty while Had Unhandled Tags is set, or while output0 has a valid image connected (since the anonymization is only performed on one input at a time).

For accessing this object via scripting, see the Scripting Reference: MLABDicomTree.

outReviewDicom (hidden)

name: outReviewDicom, type: MutableDicomTree(MLBase)

Hidden output used in the review step. Contains the DICOM tree from output0 or outReviewDicom in modifiable form.

For accessing this object via scripting, see the Scripting Reference: MLABMutableDicomTree.

Parameter Fields

Field Index

Allow Private Creator On Wrong Level: Bool	Retain Device Identity: Bool	Safe Private Tags: String
Clean Descriptors: Bool	Retain Institution Identity: Bool	salt: String
Had Unhandled Tags: Bool	Retain Longitudinal Temporal Information: Enum	Unhandled Tags: String
Institution Name: String	Retain Patient Characteristics: Bool	Was Already Deidentified: Bool
Patient Id: String	Retain Safe Private Tags: Bool
Patient Identity Handling: Enum	Retain UIDs: Bool
Patients Birth Date: String	retainSexInGeneratedName: Bool
Patients Name: String	Review: Trigger

Visible Fields

Patient Identity Handling

name: patientIdentityHandling, type: Enum, default: PI_CLEAR

Defines how to handle the main patient identity tags PatientsName, PatientsBirthDate, and PatientId.

Values:

Title	Name	Description
​Clear	​PI_CLEAR	​Clear these tags.
​User Defined	​PI_USER_DEFINED	​Set the values provided in the fields Patients Name, Patients Birth Date, and Patient Id.
​Auto Generate	​PI_AUTO_GENERATE	​Replace the patient name with a fantasy name derived from a cryptographic hash value of the original patient name and birth date. Replace birth date with a date in the same decade derived from the same cryptographic hash value. Remove patient ID. Note The result of this algorithm is highly sensitive to even minor changes in the patient’s name or birth date. Small modifications, such as variations in notation, can result in completely different names. See retainSexInGeneratedName if you want the first name to match the actual gender of the patient.

Patients Name

name: patientsName, type: String, default: PATIENT

Sets the patient’s name if Patient Identity Handling is set to user-defined.

Patients Birth Date

name: patientsBirthDate, type: String, default: 19700101

Sets the patient’s birth date if Patient Identity Handling is set to user-defined.

Patient Id

name: patientId, type: String, default: 000001

Sets the patient’s ID if Patient Identity Handling is set to user-defined.

Institution Name

name: institutionName, type: String, default: InstitutionName

Sets a tag that will be used as a value for the InstitutionName tag if Retain Institution Identity is false.

Retain UIDs

name: retainUIDs, type: Bool, default: FALSE

If checked, UIDs that would otherwise be replaced by their hashed counterparts will remain unchanged.

This option directly implements the provision from the DICOM standard.

Retain Device Identity

name: retainDeviceIdentity, type: Bool, default: FALSE

If checked, the identity of the devices used during the acquisition is retained.

This option directly implements the provision from the DICOM standard.

Retain Institution Identity

name: retainInstitutionIdentity, type: Bool, default: FALSE

If checked, the identity of the institution where the acquisition took place is retained.

This option directly implements the provision from the DICOM standard.

Retain Patient Characteristics

name: retainPatientCharacteristics, type: Bool, default: FALSE

If checked, , tags containing patient characteristics, such as medication or allergies, are retained.

If such tags exist, they may require a manual review step to remove identifying information, indicated by the Had Unhandled Tags flag.

This option directly implements the provision from the DICOM standard.

Retain Longitudinal Temporal Information

name: retainLongitudinalTemporalInformation, type: Enum, default: OFF

Defines how to handle certain temporal information in the DICOM dataset.

This option directly implements the option from the DICOM standard.

Values:

Title	Name	Description
​Off	​OFF	​Temporal information tags are removed.
​Full	​FULL	​Temporal information tags are retained.
​Modified	​MODIFIED	​Temporal information tags are retained but offset by a specific number of days (ranging from 1 to 365 days) derived from the cryptographic hash of the patient identity. Note The selected offset is highly sensitive to the formatting of the patient’s name and the exact birth date provided.

Clean Descriptors

name: cleanDescriptors, type: Bool, default: FALSE

If checked, tags containing descriptive information, such as the StudyDescription, are retained.

Since such tags may include free text, they require a manual review step to remove identifying information, indicated by the Had Unhandled Tags flag.

This option directly implements the option from the DICOM standard.

Retain Safe Private Tags

name: retainSafePrivateTags, type: Bool, default: FALSE

If checked, private tags specified in Safe Private Tags are retained.

This option directly implements the option from the DICOM standard.

Safe Private Tags

name: safePrivateTags, type: String

Sets a list of safe private DICOM tags that should be retained.

Each private tag is specified on a separate line using the following format:

GroupID ElementID PrivateCreator\n

GroupID and ElementID are provided as hex strings. Private Creator is the value of the private creator tag and may contain spaces, for example:

0041 0001 MeVis StructuredMF data

Alternatively, the creator string may also be specified on a separate line if prefixed with “CREATOR”; this will be applied to any following line until another creator is specified, or until the creator is specified on the same line:

# This is a comment
CREATOR MeVis StructuredMF data
0041 0001

Comments begin with a #.

Allow Private Creator On Wrong Level

name: allowPrivateCreatorOnWrongLevel, type: Bool, default: FALSE

If checked, private tag creator elements of private tags in a sequence item are permitted to exist at a higher tree level than the private tag itself.

The DICOM standard requires that the creator element be contained in the same sequence item as the private tag itself; however, this is not always the case in the real world. This option allows the de-identification process to revert to creator elements from container items (or the root tree itself) if they are not found in the same sequence item. If this option is not set, private tags with an invalid creator will have an empty creator string and will be dropped.

Note

Since setting this option essentially involves guessing the creator string, there is a possibility that incorrect tags are retained and left unchanged.

Had Unhandled Tags

name: hadUnhandledTags, type: Bool, persistent: no

Shows whether tags encountered during the de-identification step require manual inspection for patient-identifying content. Until this review is completed, the output of the module remains empty.

Once the review has been fully performed, this flag is unset.

Unhandled Tags

name: unhandledTags, type: String, persistent: no

Shows a list of the IDs of tags that need a manual inspection.

Was Already Deidentified

name: wasAlreadyDeidentified, type: Bool, persistent: no

Shows whether the incoming dataset has already been de-identified (as indicated by the PatientIdentityRemoved tag).

Review

name: performReview, type: Trigger

When pressed, a panel opens to inspect the tags indicated by Unhandled Tags.

Hidden Fields

retainSexInGeneratedName

name: retainSexInGeneratedName, type: Bool, default: FALSE

If checked, the first name generated with Patient Identity Handling set to auto-generate will match the gender given in PatientsSex.

Note

If this option is set the first name will change if the value in tag PatientsSex changes.

salt

name: salt, type: String, default: MEVIS

Sets a salt value that is used in cryptographic hash computation to make it harder to pre-generate tables, which could make it easier to get to the previous value.

Changing this to a new value means that the same UIDs and patient identity values will map to a completely different cryptographic hash than before.