De-identification
Two modes, declared up front, never blurred together
A study sent to research is either anonymized or pseudonymized. Which one is a property of the profile, not an accident of configuration - and a customer told 'anonymized' is never quietly getting the reversible kind.
The two modes
Mode 1
Anonymize
Irreversible. Retains nothing. An Anonymize profile never writes a crosswalk row and never emits a correlation tag, so there is no artefact anywhere that could be used to walk the mapping backwards.
Use it when the data is leaving for good and nothing has to come back.
Mode 2
Pseudonymize
Reversible, and auditable because of it. Writes a crosswalk row so a result returning from a research or AI destination can be matched back to the original patient.
Use it when the pipeline produces something that has to find its way home.
Coming back
A returning result is matched, or it is held
Matching a result back to a patient is the step where a mistake is a misassociation, so it is the step with the most machinery behind it. Results are resolved by an ordered resolver rather than by a private tag alone: the tag is corroboration, and disagreement with a higher tier is a hard failure, not a tiebreak. Demographics are never used to match.
Anything that does not match at or above the route's confidence floor goes toUnmatched Returns for an operator to review. It does not go to the destination and it does not get a best guess.
That is a deliberate trade: a queue an operator has to work through is a much cheaper problem than a result filed against the wrong patient.
Guarantees
It fails closed
De-identification runs per instance on the way out. If it fails, that instance is not sent. There is no path where a failure results in an un-scrubbed study reaching a destination.
Metadata only
Identifiers are removed or replaced in the DICOM header. Pixel data is not modified - anything burned into an image is out of scope, and we will tell you that before you ask.
Encrypted at rest
Where a mapping is retained, the demographics behind it are encrypted at rest and mappings expire on a retention schedule rather than living forever.
Every lookup is audited
Including the misses. A lookup that found nothing is as interesting to an auditor as one that found something, so both are recorded.
Standing up a research or AI pipeline?
Bring us the data-use agreement and the destination. The profile that satisfies both is a configuration question, not a development project.
Request a demo