DICOM De-Identification for Clinical Trial Submission

Why Clinical Trial DICOM De-Identification Is a Different Problem

De-identifying a handful of DICOM studies for an internal research dataset is one thing. Preparing imaging for a regulated clinical trial submission is another discipline entirely. When a sponsor transfers imaging from investigator sites to an imaging core laboratory, and ultimately into a submission package reviewed by the FDA or EMA, the de-identification process becomes part of the trial's quality system. It must be reproducible, documented, validated, and defensible during an inspection.

The central tension is that clinical trials cannot simply strip everything. Unlike a public teaching dataset, a trial needs to preserve longitudinal linkage across visits, maintain relative timing between scans for response assessment (RECIST 1.1, for example, depends on knowing the interval between baseline and follow-up), and retain technical attributes that the core lab requires to read images consistently. A naive "delete all dates" profile destroys the very data the endpoint depends on. This article is a working sponsor checklist that balances privacy obligations against the scientific integrity the submission requires.

Throughout, we reference the authoritative source for DICOM confidentiality: DICOM PS3.15 (Security and System Management Profiles), specifically Annex E, the Attribute Confidentiality Profiles — the modern home of what many still call "Supplement 142." You can apply these principles in your browser with our free online DICOM de-identifier and verify the result with the DICOM Tag Viewer.

Choosing the Right PS3.15 Profile and Options

PS3.15 does not define a single de-identification recipe. It defines a Basic Application Level Confidentiality Profile plus a set of options that you layer on top depending on what your protocol needs to keep. For clinical trials, the option choices are the most important decisions you will make.

The Baseline Profile

The Basic Profile defines, per attribute, an action code from the full PS3.15 Table E.1-1 set — D (replace with a non-zero-length dummy value), Z (replace with a zero-length value, or a non-zero-length value that may be a dummy), X (remove), K (keep — retain the value unchanged), C (clean — remove identifying information but keep a meaningful value of the same type), and U (replace UID with a consistent new UID), plus conditional combinations such as Z/D, X/Z, X/D, X/Z/D, and X/Z/U*. Tag (0010,0010) Patient's Name and (0010,0020) Patient ID are replaced, (0008,0050) Accession Number takes action Z (zero-length or dummy), and the cross-referenceable UIDs are remapped. Applying only the baseline, however, removes attributes a trial often needs.

Options That Trials Almost Always Enable

• Retain Longitudinal Temporal Information Options — the single most relevant choice for trials. PS3.15 §E.3.6 defines two distinct named options, not one: the Retain Longitudinal Temporal Information With Full Dates Option (keep dates exactly as acquired) and the Retain Longitudinal Temporal Information With Modified Dates Option (apply a consistent date shift). Most sponsors choose the Modified Dates option so that the relative interval between baseline and follow-up survives while the absolute calendar date is hidden. When you cite the choice in an imaging charter, use the exact option name a reviewer can look up.
• Retain Patient Characteristics Option — keeps clinically meaningful attributes such as (0010,1010) Patient's Age, (0010,0040) Patient's Sex, (0010,1020) Patient's Size, and (0010,1030) Patient's Weight, which are required for dosimetry, SUV calculation in PET, and many imaging biomarkers.
• Retain Device Identity Option — keeps scanner make/model and software version so the core lab can account for cross-vendor variability. Note this is distinct from facility identity, which you still remove.
• Retain UIDs Option vs. Remapping — most trials remap UIDs (action U) with a consistent mapping table so internal hierarchy and cross-references stay intact while original PACS UIDs cannot be used to re-query source images.

Whatever combination you select must be recorded as a named profile and frozen for the trial. PS3.15 requires that you describe the de-identification method in (0012,0063) De-identification Method and the coded options in (0012,0064) De-identification Method Code Sequence, and that you set (0012,0062) Patient Identity Removed to YES. These attributes are themselves part of the audit trail and inspectors will look for them.

The Trial Subject Identifier — Replace, Don't Just Remove

A research dataset can leave the patient blank. A trial cannot. The de-identification step is also the moment you stamp the blinded subject identifier into the file so the core lab can reconcile images against the EDC. DICOM provides dedicated clinical-trial attributes in group (0012,xxxx) for exactly this purpose:

• (0012,0020) Clinical Trial Protocol ID and (0012,0021) Clinical Trial Protocol Name.
• (0012,0030) Clinical Trial Site ID — the blinded site code, never the hospital name.
• (0012,0040) Clinical Trial Subject ID or (0012,0042) Clinical Trial Subject Reading ID — the randomization or screening number.
• (0012,0050) Clinical Trial Time Point ID — e.g., "C1D1", "Screening", "Week 12", which lets the reader place a scan in the visit schedule without an absolute date.

Populate (0010,0020) Patient ID with the subject ID and clear the original MRN. Critically, the mapping between subject ID and real identity is the trial's key code; it is held by the site or an unblinded statistician, never travels with the imaging, and is governed by the same access controls as the randomization list.

Pixel Data — The Failure Mode Inspectors Find

Tag scrubbing is necessary but not sufficient. Burned-in annotations live in the pixel data and survive any tag-level profile. In oncology and cardiology trials, ultrasound, secondary capture, and screen-captured derived series routinely carry patient names, dates of birth, and facility logos rendered into the image. PS3.15 addresses this with the Clean Pixel Data Option and the related Clean Recognizable Visual Features Option, but the standard cannot tell you where the text is — that requires either modality-specific masking templates, OCR-based detection, or human review.

Check (0028,0301) Burned In Annotation, but never trust it as authoritative; many systems leave it absent or set it to NO incorrectly. For trials, the safest practice is a defined image-review step on a sampled basis per modality, with masking rules documented in the imaging charter. For 3D and reconstructed series, also inspect presentation states and overlay planes ((60xx,xxxx) groups), which can re-render text on top of pixels at display time.

Date Shifting Done Correctly

Date shifting is where well-intentioned teams quietly corrupt their data. The rule is simple to state and easy to violate: apply one consistent offset per subject across every study, series, and acquisition. If baseline is shifted by minus 137 days, every subsequent visit for that subject must be shifted by exactly minus 137 days, so the 84-day interval the protocol specifies between visits is preserved.

Common mistakes that break endpoints:

• Randomizing the offset per file instead of per subject — destroys inter-visit timing and makes RECIST or PERCIST timing impossible.
• Shifting (0008,0020) Study Date but forgetting (0008,0021) Series Date, (0008,0022) Acquisition Date, (0008,0023) Content Date, and the matching time attributes — produces internally inconsistent timestamps.
• Ignoring date-time pairs in sequences such as Radiopharmaceutical Information Sequence in PET, where injection time relative to acquisition drives the SUV calculation.
• Failing to record the offset method in the de-identification log. The offset value itself is sensitive (it can re-identify when combined with the key code) and must be stored with the trial master file controls, not shipped with the images.

UID Remapping and Referential Integrity

Every Study, Series, and SOP Instance UID must be replaced with a freshly generated, valid UID rooted under a registered organizational root (per ISO/IEC 8824/8825 OID assignment and the DICOM UID format in PS3.5). Two requirements matter for trials. First, the remapping must be deterministic and consistent: the same source UID maps to the same target UID across the whole submission, so a Structured Report or Key Object Selection that references an image still resolves. Second, every Referenced SOP Instance UID, Frame of Reference UID, and source image reference inside sequences must be updated with the same mapping — a single missed reference inside a presentation state or RT structure set breaks the study and triggers core-lab query failures. Verify referential integrity after remapping, not just the top-level UIDs.

Private Tags and Free-Text Sweeps

Odd-numbered group tags (e.g., 0009, 0019, 0029) are vendor private elements and are a notorious PHI hiding place — some vendors duplicate the patient name or operator ID there. The defensible default for trials is to remove all private tags unless a specific element is whitelisted because the core lab needs it (for instance, certain diffusion or perfusion parameters). Equally important are free-text fields that the baseline profile only "cleans": (0008,1030) Study Description, (0008,103E) Series Description, (0020,4000) Image Comments, and (0040,0254) Performed Procedure Step Description frequently contain a typed patient name or an "rule out John Doe" note. Structured Reporting content sequences ((0040,A730) and nested items) can embed identifiers deep inside the tree and must be traversed recursively.

ALCOA+ and the Submission Audit Trail

Regulated trials operate under FDA 21 CFR Part 11 and EMA Annex 11 for electronic records, and against ICH E6(R3) Good Clinical Practice. Imaging de-identification must satisfy the ALCOA+ data-integrity principles: data must be Attributable, Legible, Contemporaneous, Original, and Accurate, plus Complete, Consistent, Enduring, and Available. In practice this means your de-identification run produces a record showing who ran it, when, against which version of which named profile, how many studies were processed, the sampled QC results, and any exceptions. The (0012,0064) method code sequence inside each file is the file-level evidence; the run log is the process-level evidence. Both should reconcile.

Regulatory guidance also shapes scope. FDA's guidance "Clinical Trial Imaging Endpoint Process Standards" expects a documented imaging charter covering acquisition, transfer, and de-identification, and the FDA's electronic submission expectations (eCTD) treat imaging as part of the same controlled record set. Align your de-identification SOP with the imaging charter so the two never contradict each other.

The Sponsor Checklist

Use this as a gate before any imaging leaves a site or moves into the submission package:

• Profile selected and frozen — Basic Profile plus named options (Retain Longitudinal Temporal Information With Modified Dates Option, Retain Patient Characteristics, Retain Device Identity), version-controlled in the imaging charter.
• Subject identity stamped — (0012,0020/0021/0030/0040/0050) populated with blinded protocol, site, subject, and time-point codes; original MRN cleared.
• Provenance flags set — (0012,0062) Patient Identity Removed = YES; (0012,0063) and (0012,0064) describe the method and coded options.
• Dates handled — single per-subject offset applied to all date and time attributes, including those nested in sequences; offset stored under TMF controls, not shipped.
• UIDs remapped consistently — Study/Series/SOP plus all referenced UIDs and Frame of Reference; referential integrity re-verified.
• Pixel data cleaned — modality-specific masking or OCR plus sampled human review for burned-in text; overlays and presentation states inspected.
• Private tags removed — except explicitly whitelisted technical elements.
• Free-text swept — descriptions, comments, and SR content recursively checked.
• QC sample audited — minimum 30 studies or 5–10% per site/modality, with results logged.
• Audit record produced — ALCOA+ run log reconciling to file-level method codes.

For the practical mechanics behind several of these items, see our companion guide on GDPR vs HIPAA for international DICOM research when your sites span the US and EU, and the PACS migration checklist for validating DICOM data integrity for verification techniques that transfer directly to submission QC.

Verify Before You Submit

De-identification is only complete when it is proven. After running your profile with the DICOM de-identifier, open representative output in the DICOM Tag Viewer and walk the tree: confirm direct identifiers are gone, the (0012,xxxx) trial attributes are correct, the (0012,0062/0063/0064) provenance is set, dates are shifted consistently, UIDs differ from source, no private tags remain, and the rendered pixels are free of burned-in text. Because both tools run entirely in your browser with no upload, you can validate even on a clinical network where transmitting patient images to a third-party server would itself be a compliance breach. The goal is not a checkbox — it is a submission package that survives an inspection and protects the subjects whose images make the trial possible.