Item 11 — De-identification methods.

Describe the methods used to de-identify data and how protected health information has been removed to meet U.S. (HIPAA), EU (AI Act, EU Health Data Space, GDPR), or other relevant regulations.

Explanation and Elaboration: Authors must detail their approach to handling complex de-identification scenarios, such as burned-in annotations on ultrasound images or embedded text in radiographs, including specific tools used. When the manuscript describes a dataset that is publicly released, more comprehensive deidentification may be required including defacing or skull-stripping for head imaging and addressing indirect identifiers that could potentially be used for re-identification. For public datasets, authors should also describe their process for ensuring the effectiveness of their de-identification and any quality control measures implemented.

Examples
The acquired DICOM images contained PHI which required removal for conformance with HIPAA. PHI was removed from both the DICOM meta-data and the pixel values. DICOM meta-data is organized into a finite set of data elements; each element is uniquely identified by a numerical tag and stores a fixed concept. The DICOM standard (Table E.1-1, PS 3.15) describes a number of de-identification profiles, each of which outlining data elements which must be removed or modified in order to anonymize patient data…. We followed the Basic Application Level Confidentiality Profile with the Clean Descriptors Option, Retain Longitudinal Temporal Information Modified Dates, Clean Pixel Data, and Clean Graphics options. The De-identification Method Code Sequence (0012,0064) was set to a length five sequence codifying the aforementioned profile choices, and Patient Identity Removed (0012, 0062) was set to “YES” for all images. Broadly, this de-identification strategy represents our intent to fully remove individual patient information while retaining useful parameters stored in descriptive attributes and preserving the chronology of radiographs for a single patient. [Methods (29), CC BY 4.0]
Contributing sites were responsible for de-identifying imaging examinations and associated clinical information for inclusion in RICORD with expectations for use as a public research and educational database (noncommercial use). Although all sites followed their institutional policies and procedures, adhering to locally applicable regulations and best practices, there was a need to homogenize the de-identification approach as a way to mitigate problematic heterogeneity in de-identification methodologies. Unique pseudonymous identifiers are created for each patient such that subsequent imaging studies for the same patient could be assigned to the same anonymous patient identification number. A customized, free, open-source DICOM de-identification software solution named DICOM Anonymizer was created by experienced DICOM experts at the RSNA based on recognized standards and best practices implementing the RICORD Data De-identification Protocol. The anonymizer generates a unique numeric site identification parameter, or SITEID, as a way to distinguish data sets contributed by different sites without exposing the actual identity of the contributing site. [Methods (30), © RSNA 2021]