Medical Imaging in TREs: DICOM De-identification Guide
Medical imaging data can be used safely inside a Trusted Research Environment (TRE) when two things happen together: every DICOM file is de-identified against a published profile that covers header tags, pixel data and facial features, and analysis runs where the images already sit rather than on copies shipped to researchers. A federated TRE does both. Images stay at the hospital or biobank, algorithms travel to them, and only reviewed aggregate results come back out.
Why imaging is the hardest data type to share
Imaging is where most health data volume lives. A single CT study can run to hundreds of slices, a whole-slide pathology image can reach several gigabytes, and a research cohort of tens of thousands of participants quickly becomes a petabyte-scale problem. Moving that data between institutions is slow and expensive before a single governance question is asked.
The governance questions are harder still. Digital Imaging and Communications in Medicine (DICOM), the standard format for clinical images, was designed for care, not research. A DICOM file carries a header with hundreds of possible attributes, including patient name, date of birth, accession numbers, referring physician, institution name and device serial numbers. Vendors add private tags whose contents are often undocumented. Some modalities, ultrasound and secondary-capture screenshots in particular, burn text such as names and dates directly into the pixels. And a high-resolution head CT or MRI contains enough information to reconstruct a recognizable face.
US regulation recognizes this directly. The HIPAA Safe Harbor method lists “full-face photographic images and any comparable images” among its 18 identifiers, which is why defacing is standard practice for neuroimaging research. Our guide to HIPAA Expert Determination versus Safe Harbor covers how those two routes differ for complex data like images.
Demand for imaging access is also rising. Large public programs have made imaging a core research asset. UK Biobank has run a multi-modal imaging study covering brain, heart and abdominal scans in a large subset of its participants, and The Cancer Imaging Archive (TCIA) has distributed de-identified oncology imaging to researchers for over a decade. Meanwhile, most of the AI-enabled medical devices on the FDA’s public list are radiology tools, so every developer needs diverse, well-governed training and validation data.
The federated TRE approach to imaging
A centralized research platform asks every hospital to export images to a shared store. That creates a second copy of highly identifiable data, a large transfer bill, and a single location where a mistake exposes every contributing site. A federated Trusted Research Environment reverses the flow. The imaging archive stays inside the custodian’s own infrastructure, the TRE is deployed next to it, and approved code is sent to the data. The principle is simple: data never leaves the source.
De-identification happens inside the custodian’s boundary
Because the pipeline runs at the source, the custodian controls which profile is applied, keeps the mapping between original and research identifiers, and can re-run de-identification when a new vendor tag or modality appears. Nothing identifiable crosses the network.
Analysis runs where the pixels are
Researchers bring containerized workflows, for example a segmentation model or a radiomics feature extractor, into a workspace connected to the imaging store. The workflow reads images locally and writes derived outputs such as volumes, feature tables or model weights. Only those derived outputs are candidates to leave.
Every output passes an airlock
Derived imaging outputs can still leak identity. A thumbnail, an overlay, or a per-participant feature table with rare values can all be disclosive. An automated airlock checks each export against disclosure rules before release, blocking raw images and flagging small cell counts for human review.
A practical DICOM de-identification framework
The DICOM standard itself defines how to de-identify DICOM. Part 15 of the standard (PS3.15, Annex E) sets out the Basic Application Level Confidentiality Profile, which lists attributes that must be removed, emptied or replaced, plus options that modify it. Build on that rather than writing a tag list from scratch.
- Choose the base profile and options. Start with the Basic Profile. Add the options your studies need, such as Retain Longitudinal Temporal Information with modified dates for follow-up studies, or Clean Descriptors to scrub free-text fields like study descriptions.
- Handle private tags explicitly. Remove all private tags by default. Keep only those a vendor documents as safe and that your analysis genuinely requires, such as certain acquisition parameters.
- Remap UIDs consistently. Replace Study, Series and SOP Instance UIDs with new ones, using the same mapping across the dataset so that series and follow-up studies still link together.
- Clean the pixels. Detect and redact burned-in text using modality rules plus optical character recognition, and route ultrasound and secondary captures through manual spot checks.
- Deface head and neck imaging. Apply a validated defacing or skull-stripping tool to CT and MRI of the head, then confirm the brain or target anatomy is intact.
- Verify and log. Scan the output for residual identifiers, sample files for human review, and record the profile version, tool versions and exceptions for each batch.
Many research groups then convert images to analysis-friendly formats such as NIfTI, organized with the Brain Imaging Data Structure (BIDS) for neuroimaging. Linking imaging to clinical data is easier when both are harmonized. OHDSI’s medical imaging working group has proposed an imaging extension to the OMOP Common Data Model (CDM) so that imaging occurrences and derived features can sit alongside conditions, drugs and measurements.
Pathology and other large-object modalities
Digital pathology deserves its own rules. Whole-slide images are increasingly stored as DICOM, but many archives still hold vendor formats, and slide labels photographed at scan time can show names, barcodes and hospital numbers. Strip or mask label and macro images before research use, and treat barcodes as identifiers. Because a single slide can be several gigabytes, pathology is also the clearest case for running tiling and feature extraction at source instead of copying files.
Serving images to analysis tools
Inside the TRE, workflows need a consistent way to find and read studies. DICOMweb, the web services part of the standard, gives three useful interfaces: QIDO-RS to search for studies, WADO-RS to retrieve them, and STOW-RS to store derived objects such as segmentations. Exposing the de-identified archive through DICOMweb means the same pipeline code runs unchanged at every site in a federation, which matters when one model is sent to many hospitals with different picture archiving and communication systems (PACS). It also gives the custodian one audited access point instead of ad hoc file shares.
Centralized imaging repository versus federated imaging TRE
| Dimension | Centralized imaging repository | Federated imaging TRE |
|---|---|---|
| Where images live | Copied into a shared central store | Stay in each custodian’s archive |
| Transfer cost | High, repeated for every new site and refresh | Low, only code and reviewed results move |
| De-identification control | Often applied once, before export, then fixed | Applied and re-applied by the custodian at source |
| Re-identification exposure | One location holds every site’s images | No central pool of pixels to exfiltrate |
| Data freshness | Snapshot at the time of export | Queries run against current local data |
| Output governance | Varies, often manual | Every export checked by an airlock |
| AI model training | Pooled training on the central copy | Federated learning across sites |
What federated imaging looks like in practice
Federated learning on imaging is not theoretical. The Federated Tumor Segmentation (FeTS) initiative, which grew out of the public BraTS brain tumor challenge, trained a glioblastoma boundary detection model across dozens of institutions on several continents without pooling scans, and reported results in peer-reviewed literature. Each site trained locally on its own MRI data and shared only model updates. The consensus model generalized better than models trained on any single site’s data.
The same pattern applies to national programs. A biobank or ministry of health can hold imaging, genomics and clinical records in one federated TRE, and let approved researchers run a radiomics pipeline against imaging while joining results to harmonized phenotypes. Our overview of federated learning on healthcare data explains how model updates are aggregated and protected.
Common pitfalls
Trusting the header alone
Teams that clean every tag but skip pixel review still release names burned into ultrasound frames. Pixel cleaning is not optional for modalities that capture screens.
Destroying the research value
Over-aggressive profiles strip acquisition parameters that radiomics needs, or shift dates inconsistently so longitudinal studies break. Decide which attributes are analytically essential before choosing options.
Forgetting derived outputs
A segmentation mask exported at full resolution for a single participant can carry facial contours. Treat masks, overlays and rendered images as disclosive by default and let the airlock decide.
Moving imaging when you do not need to
Many projects move full archives when the research question only needs features. Running feature extraction at source and exporting a reviewed table is faster, cheaper and safer.
What to do next
Start with an inventory: which modalities you hold, which vendors produced them, and which contain burned-in text or facial anatomy. Adopt PS3.15 Annex E as your baseline, document your chosen options, and test the pipeline on a sample from every vendor. Then decide where analysis should run. If the answer is “where the images already are,” a federated TRE gives you de-identification at source, compute next to the archive, and an airlock on every export. Finally, agree up front who signs off each stage: the custodian owns the profile and the identifier mapping, the data access committee approves projects, and the airlock reviewer owns release.
Frequently asked questions
What is DICOM de-identification?
DICOM de-identification removes or replaces identifying information in medical image files, covering header attributes, private tags, unique identifiers, burned-in pixel text and, for head imaging, facial features. The DICOM standard defines a baseline in PS3.15 Annex E, the Basic Application Level Confidentiality Profile.
Is removing DICOM header tags enough to de-identify an image?
No. Identifying text can be burned into the pixel data, especially in ultrasound and screen captures, and head CT or MRI can be used to reconstruct a face. A complete pipeline cleans headers, pixels and facial anatomy, then verifies the result.
Why run imaging analysis in a federated TRE instead of a central repository?
Imaging files are large and highly identifiable. A federated TRE keeps images in each custodian’s archive, runs approved code next to them, and releases only reviewed derived results, which removes the transfer cost and the central pool of pixels that a repository creates.
Can AI models be trained on medical images without pooling the data?
Yes. Federated learning trains a model locally at each site and shares only model updates for aggregation. Public initiatives such as FeTS have shown this approach works for brain tumor segmentation across many institutions.
How are imaging outputs checked before they leave a TRE?
An airlock inspects every export. It blocks raw images and full-resolution per-participant renders, checks tables for small counts and rare values, and routes borderline outputs to a human reviewer before release.
Can imaging data be linked to clinical records in a TRE?
Yes. Imaging can be linked to harmonized clinical data using consistent pseudonymous identifiers. OHDSI’s proposed imaging extension to the OMOP CDM is designed to hold imaging occurrences and derived features alongside other clinical observations.