Overview
DICOM PS3.15 Annex E defines Attribute Confidentiality Profiles for removing and replacing attributes within DICOM datasets that may leak Individually Identifiable Information (III).
Important Disclaimer from the Standard: > Use of these profiles does NOT guarantee complete de-identification. They should be part of a broader de-identification process that includes determining context, interpreting regulations, and assessing re-identification risk.
De-identification Architecture
┌─────────────────────────────────────────────────────────────────────────┐
│ DICOM De-identification Framework │
├─────────────────────────────────────────────────────────────────────────┤
│ │
│ ┌─────────────────────────────────────────────────────────────────┐ │
│ │ BASIC APPLICATION LEVEL PROFILE │ │
│ │ (Extremely conservative - removes most identifying info) │ │
│ └─────────────────────────────────────────────────────────────────┘ │
│ │ │
│ ┌────────────────────┼────────────────────┐ │
│ ▼ ▼ ▼ │
│ ┌─────────────────┐ ┌─────────────────┐ ┌─────────────────┐ │
│ │ REMOVAL │ │ RETENTION │ │ CLEANING │ │
│ │ OPTIONS │ │ OPTIONS │ │ OPTIONS │ │
│ │ (Add removal) │ │ (Keep info) │ │ (Process info) │ │
│ ├─────────────────┤ ├─────────────────┤ ├─────────────────┤ │
│ │ • Clean Pixel │ │ • Retain UIDs │ │ • Clean Desc. │ │
│ │ Data │ │ • Retain Device │ │ • Clean Struct. │ │
│ │ • Clean Visual │ │ Identity │ │ Content │ │
│ │ Features │ │ • Retain Inst. │ │ │ │
│ │ • Clean │ │ Identity │ │ │ │
│ │ Graphics │ │ • Retain Pat. │ │ │ │
│ │ │ │ Chars. │ │ │ │
│ │ │ │ • Retain Long. │ │ │ │
│ │ │ │ Dates (Full/ │ │ │ │
│ │ │ │ Modified) │ │ │ │
│ │ │ │ • Retain Safe │ │ │ │
│ │ │ │ Private │ │ │ │
│ └─────────────────┘ └─────────────────┘ └─────────────────┘ │
│ │
└─────────────────────────────────────────────────────────────────────────┘
Action Codes Reference
| D |
Replace with Dummy |
Replace with non-zero length dummy value consistent with VR |
| Z |
Zero or Dummy |
Replace with zero length OR dummy value |
| X |
Remove |
Remove attribute entirely (including all sequence items) |
| K |
Keep |
Keep unchanged (for non-sequences); clean sequences recursively |
| C |
Clean |
Replace with values of similar meaning known not to contain identifying info |
| U |
Replace UID |
Replace with new UID, internally consistent within instance set |
| Z/D |
Z or D |
Z unless D required for IOD conformance (Type 2 vs Type 1) |
| X/Z |
X or Z |
X unless Z required for IOD conformance (Type 3 vs Type 2) |
| X/D |
X or D |
X unless D required for IOD conformance (Type 3 vs Type 1) |
| X/Z/D |
X, Z, or D |
Based on IOD conformance requirements (Type 3 vs 2 vs 1) |
| X/Z/U* |
X, Z, or U |
X unless Z or UID replacement needed for IOD conformance |
De-identification Options Summary
Removal Options (Add More Restrictions)
| Clean Pixel Data |
Remove burned-in annotations in pixel data (common in US, XA) |
| Clean Recognizable Visual Features |
Remove/distort pixels allowing facial recognition (CT/MR head) |
| Clean Graphics |
Remove identifying info in overlays, text annotations |
Research Scenario Recommendations
Scenario 1: Teaching Files / Publications
Profile: Basic Application Level Confidentiality Profile
Options: + Clean Pixel Data (if US/XA)
+ Clean Graphics
+ Clean Descriptors
Result: Maximum de-identification, minimal data retained
Scenario 2: Clinical Trials (Cross-sectional)
Profile: Basic Application Level Confidentiality Profile
Options: + Retain Patient Characteristics
+ Retain Device Identity
+ Clean Pixel Data (if US/XA)
Result: Preserve clinical/technical data, new UIDs for linkage
Scenario 3: Longitudinal Research
Profile: Basic Application Level Confidentiality Profile
Options: + Retain UIDs (for linking studies)
+ Retain Patient Characteristics
+ Retain Longitudinal Modified Dates (date shifting)
+ Clean Descriptors
Result: Enable study linking while protecting identity
Scenario 4: AI Training / Multi-Site Research
Profile: Basic Application Level Confidentiality Profile
Options: + Retain Patient Characteristics
+ Retain Device Identity
+ Retain Institution Identity
+ Clean Pixel Data
+ Clean Recognizable Visual Features (if head imaging)
Result: Preserve technical/demographic data, site info for batch effects
Scenario 5: Registry Submission
Profile: Basic Application Level Confidentiality Profile
Options: + Retain Institution Identity
+ Retain Device Identity
+ Retain Longitudinal Full Dates
+ Clean Descriptors
Result: Support quality metrics, dose tracking
Implementation Workflow
┌─────────────────────────────────────────────────────────────────────┐
│ De-identification Workflow │
└─────────────────────────────────────────────────────────────────────┘
│
▼
┌─────────────────────────────────────┐
│ 1. DETERMINE CONTEXT │
│ • Research purpose │
│ • Data recipients │
│ • Applicable regulations │
│ • Re-identification risk │
└─────────────────────────────────────┘
│
▼
┌─────────────────────────────────────┐
│ 2. SELECT PROFILE & OPTIONS │
│ • Basic Profile (mandatory) │
│ • Add removal options │
│ • Add retention options │
└─────────────────────────────────────┘
│
▼
┌─────────────────────────────────────┐
│ 3. PROCESS DICOM DATA │
│ • Apply attribute actions │
│ • Handle sequences recursively │
│ • Maintain UID consistency │
│ • Optional: Encrypt originals │
└─────────────────────────────────────┘
│
▼
┌─────────────────────────────────────┐
│ 4. ADD MARKERS │
│ • Patient Identity Removed=YES │
│ • De-identification Method │
│ • De-identification Method │
│ Code Sequence │
└─────────────────────────────────────┘
│
▼
┌─────────────────────────────────────┐
│ 5. VERIFY & DOCUMENT │
│ • Verify all actions applied │
│ • Document in Conformance Stmt │
│ • Maintain audit trail │
└─────────────────────────────────────┘
References
- DICOM PS3.15 - Security and System Management Profiles
- DICOM PS3.16 - Content Mapping Resource (CID 7050 for de-identification codes)
- NIST Special Publication 800-188: De-Identifying Government Data
- HIPAA Safe Harbor Method (18 identifiers)
- GDPR Article 4(5) - Definition of Pseudonymization