How to De-Identify Medical Imaging Data for AI
If you’ve ever pulled a DICOM header apart looking for stray PHI, you already know that the metadata was never the hard part. The hard part is everything nobody put a name to – the timestamp burned into the corner of an ultrasound frame, the facial contour hiding in a head CT, the referring physician’s name tucked into a private tag some scanner vendor invented in 2009 and never documented.
Every team that touches medical imaging for AI eventually learns this the same way – by finding something they missed. This piece is an attempt to save you that discovery.
Start with what DICOM actually is
A DICOM file isn’t an image with a filename. It’s an image wrapped in a structured record of who acquired it, when, where, on what equipment, and often why. Patient demographics, accession numbers, institution identifiers, acquisition parameters, referring physician, study and series UIDs – all of it rides along in the header, and a meaningful chunk of it counts as protected health information (PHI) under HIPAA or personal data under GDPR the moment it leaves a covered entity’s walls.
That’s the part most engineering teams anticipate. Strip PatientName, PatientID, birth date, institution – done, right?
Not quite. Three things make imaging de-identification harder than de-identifying a spreadsheet of lab values:
Private tags. Every scanner manufacturer, and sometimes hospital IT departments, add proprietary DICOM tags outside the standard dictionary. These aren’t documented consistently, they vary by device generation, and generic de-identification tools frequently don’t know they exist – let alone what they contain. We’ve seen private tags carry everything from technologist initials to full accession-linked scheduling data.
Burned-in pixel data. Ultrasound is the classic offender – patient name and date of birth rendered directly onto the image by the machine itself, as visible pixels, not header fields. Fluoroscopy, endoscopy, and surgical video have the same problem. Deleting metadata does nothing here. You need OCR-grade text detection running against the actual image, and even then, overlay fonts, low contrast, and motion blur break naive detectors constantly.
Anatomical identifiability. A head CT or MRI contains enough surface anatomy to reconstruct a recognizable face. This is not theoretical – 3D facial reconstruction from CT/MRI volumes has been demonstrated repeatedly in the literature, which is why “defacing” (masking or blurring facial structures in cranial volumes) has become a standard step for any imaging dataset intended for broad research or model-training use.
Stack those three together and you get the real shape of the problem: a compliant imaging dataset requires review at the header level, the pixel level, and – for certain modalities – the anatomical level. Missing any one of them doesn’t make the risk smaller. It just makes it invisible.
HIPAA vs. GDPR: two different bars
For US-based teams, HIPAA gives you two routes to de-identification. Safe Harbor requires removing 18 specific categories of identifiers (names, dates more granular than year, geographic subdivisions smaller than state, device identifiers, biometric identifiers, and so on) plus having no actual knowledge that what remains could still identify someone. Expert Determination instead asks a qualified statistician or privacy expert to assess re-identification risk directly and certify it as very small. The HHS guidance on de-identification methods lays out both in detail, and it’s worth reading in full rather than trusting a secondhand summary – the “actual knowledge” clause in particular trips up teams that treat Safe Harbor as a checklist rather than a standard.
GDPR doesn’t recognize this two-track structure at all. It draws a much harder line between anonymized data (out of scope entirely, but genuinely difficult to achieve) and pseudonymized data (still personal data, still fully in scope, re-identification key or not). A dataset that satisfies HIPAA Safe Harbor will often still be pseudonymized rather than anonymized under GDPR. If your pipeline or your customers span both jurisdictions, you’re building to the stricter of the two requirements by default, whether you’ve explicitly decided to or not.
The part that’s easy to get backwards
There’s a failure mode on the other side of this that gets less attention: anonymizing too aggressively. Strip every date and you lose the ability to track disease progression across a longitudinal study. Mask too much of a chest CT trying to be safe around identifiable structures, and you’ve degraded the exact signal a diagnostic model needs to learn from. Over-redaction doesn’t just waste effort – it can quietly make a dataset clinically useless while giving everyone false confidence that “we anonymized it, so we’re fine.”
This is precisely why de-identification for AI training can’t be a purely technical exercise handed to an engineering team in isolation. It needs someone who understands what’s diagnostically load-bearing in a given modality and what isn’t – otherwise you’re guessing at the tradeoff between privacy and clinical utility instead of making it deliberately.
Recent research backs this up directly. A 2026 study in Radiology: Artificial Intelligence makes the case that privacy risk in medical imaging AI doesn’t stop at metadata and pixel-level identifiers – it extends into the trained models themselves, through vulnerabilities like model inversion and gradient-based reconstruction attacks against federated learning setups.
As the senior author on that work, radiologist Michail Klontzas, MD, PhD, put it plainly in an interview about the findings: “The first step is to carefully de-identify imaging data before sharing. This includes removing patient identifiers from DICOM metadata and all potentially identifiable image features.” He also cautioned against treating newer privacy-preserving techniques as a finish line rather than one more layer: “Radiologists would be remiss to see such contemporary techniques as a panacea for privacy protection as they are also vulnerable to attacks that can expose sensitive patient information.”
That’s the honest state of the field right now. De-identification isn’t a single gate you pass through once. It’s a layered practice – header cleaning, pixel-level review, anatomical masking where relevant, and ongoing scrutiny of whatever model you eventually train on the result.
What a workable pipeline actually looks like
In practice, teams that get this right tend to converge on a similar structure, regardless of the specific tooling:
- Rule-based metadata processing against both standard and private DICOM tags, ideally validated against the specific scanner makes and models in your dataset, not a generic template.
- Pixel-level detection, combining OCR and, increasingly, computer-vision models trained specifically to catch burned-in text and identifiable overlays across ultrasound, fluoroscopy, and video-based modalities.
- Selective anatomical defacing, applied only to modalities where facial reconstruction is a genuine risk, and tuned to preserve the anatomy that’s clinically relevant to the study.
- Human QA, from someone with clinical imaging context, spot-checking both for missed identifiers and for over-redaction that’s damaged usability.
- Documentation of the method used (Safe Harbor, Expert Determination, or an equivalent GDPR-compliant process), because auditability matters as much as the technical result when a regulator or an enterprise partner asks how the dataset was prepared.
None of these steps substitutes for the others. Metadata scrubbing without pixel review leaves burned-in PHI sitting in the open. Pixel review without clinical judgment risks destroying the data’s diagnostic value. And skipping documentation means that even a genuinely well-anonymized dataset can’t be defended later if someone asks you to prove it.
We’ve written up how this plays out in an actual dataset preparation project in a case study on metadata and image-level anonymization for a compliance-sensitive imaging dataset, if you want to see the layered approach applied rather than described in the abstract. The same identifiability problem shows up in a related form in video data – surgical footage and endoscopy in particular carry continuous, frame-by-frame exposure rather than a single static risk – which we cover separately in a piece on video anonymization in healthcare.
The bottom line
Medical imaging de-identification for AI is not metadata hygiene with extra steps. It’s a discipline that sits at the intersection of regulatory law, image processing, and clinical judgment, and treating it as purely one of those three is how teams end up either exposed or with a dataset too degraded to train on.
The regulatory bar (HIPAA, GDPR, or both) sets the floor. The pixel-level and anatomical risks set the real ceiling on how careful you actually need to be. And the growing body of research on model-level privacy leakage is a reminder that “de-identified at ingestion” doesn’t mean the privacy conversation is over – it means you’ve cleared the first, most obvious hurdle.
