"We de-identified it" gets said a lot more often than it's actually true. Real de-identification for medical imaging means addressing three distinct layers of PHI — and most tooling only handles one of them well.
Layer one: DICOM header tags
Patient name, ID, birthdate, accession number, referring physician — these live in structured DICOM header fields and are the easiest to strip. Most PACS and de-identification tools handle this layer reasonably well, following profiles like the DICOM PS3.15 de-identification standard.
Layer two: private and vendor-specific tags
Manufacturers frequently stash additional identifying information — device serial numbers, site names, sometimes even patient data — in private tag groups that aren't part of the standard header set. A de-identification process that only clears standard tags can leave this layer completely untouched.
Layer three: burned-in pixel data
This is the layer most tools miss entirely. Ultrasound frames, C-arm captures, dose reports, and scanned requisitions often have patient names, dates, and facility information rendered directly into the image pixels — invisible to header-scrubbing tools because it isn't metadata at all, it's picture content.
What defensible de-identification actually requires
- A documented, repeatable process — not a manual one-off.
- Coverage across all three layers: standard tags, private tags, and pixel data.
- An audit trail proving what was checked and what was found, for every study.
- Human review of anything an automated process flags as uncertain.
If your current process only addresses layer one, it's not fully de-identified — it just looks that way until someone opens the image.