over the last decade , picture archiving and communication systems ( pacs ) evolved from a predominantly radiological service into the fundament of the image management system utilized throughout the entire healthcare enterprise for clinical practice and research [ 14 ] .
it integrates multimedia , information , and communication technologies , providing practically unlimited amounts of data for patient care , research and teaching .
pacs integration with other information systems has made medical image distribution to play an important role in the entire clinical process including the interpretation , processing and analysis of imaging data [ 6 , 7 ] .
distribution of images and information to clinicians in a timely manner is therefore required to facilitate clinical work - up .
although current high - speed networks allow exchange or transfer of data from one node to another at acceptable speed , optimization of the processing of digital images during the distribution is also a prerequisite to meet the clinical and research needs .
the digital imaging and communication in medicine ( dicom ) standard has been widely adopted for recording and sharing of digital medical images . a dicom image consists of a header with patient and exam data firmly connected with the image pixel data in a single file .
the dicom header contains a large amount of information related to the pixel data it belongs to , including identifiable information about the patient , the study , and the institution .
because of this inclusion of possible sensitive data , de - identification of dicom images is often required in data exchange for clinical research [ 9 , 10 ] .
the information embedded in the dicom data should be handled carefully to ensure the security of patients identity , especially when transfers are intended for a clinical trial or research .
the importance of security issue had motivated research in the utilisation of health information within data exchange and the use of information system technology [ 1113 ] .
however , the process of de - identifying the data should be implemented such that it provides ease of use and simple configuration in order to facilitate all users  including in - experienced ones - to adequately fulfil the task of ensuring the patient data protection .
the imaging it infrastructure within an institution may consists of many smaller systems that support each other of these systems , some are often not integrated within the normal workflow but operated as standalone applications thus reducing the ease of use and increasing the risk of errors and mistakes .
therefore , other than just the ease - of - use of the systems introduced to handle a certain task , the ease of integration of those systems have also become an important issue to adequately fulfill the requirements of smooth integration into the daily work processes .
therefore , besides providing an easy to use process , health institutions are also required to develop systems that are ready to be integrated into the normal workflow using current standards . to facilitate data distribution within a hospital environment , a web - based system called radtransceiver was built .
the system was implemented as a fast and easy web - environment , providing an integrated rule - based distribution and optional de - identification of imaging data .
the server side of the radtransceiver runs under the microsoft windows server 2003 operating system .
all radtranceiver services were developed using java , a multi platform general purpose object oriented programming language , with microsoft sql server   to handle the database management system . the graphical user interface ( gui )
was designed using php : hypertext preprocessor ( php ) , a general - purpose scripting language which is especially suitable for web development and which can be embedded into hypertext markup language ( html ) .
web - based system is deployed to enable the broader range of utilisation , the ease of use and understand , with the interfaces that suit the variations in computer literacy .
user rights in accessing radtransceiver are divided into three types : superuser , managerial user and ordinary user .
this category of users contains the administrators who are responsible to manage and supervise the whole system and take actions over unwanted activities or erroneous usage of the system .
managerial users have access to the managerial features of the system to view all image processes and their status .
ordinary users have limited rights , can only view and access their own initiated processes and have no access to the critical features of the system or information which belongs to other users .
superusers and managerial users have the ability to create and make changes of the transfer rules while ordinary users are only able to perform image transfer based on the transfer rules that are related to their login credentials .
first is a direct transfer from source to destination node , for example the transfer to a viewer in the electronic patient record ( epr ) system . with the second type of transfer the images have to pass through a processor before the images
1two kinds of image transfer : a a direct transfers from one node to the destination node ( such as from pacs to viewers ) ; b a transfer through a processor before images reach the destination two kinds of image transfer : a a direct transfers from one node to the destination node ( such as from pacs to viewers ) ; b a transfer through a processor before images reach the destination to perform the processing of the images the services provided by the clinical trial processor ( ctp ) are utilized .
ctp is a stand - alone dicom application entity ( ae ) developed by the radiological society of north america ( rsna ) .
it has the capability of using multiple , independently configured , pipelines for running several processes in parallel . with this flexibility and configurability of pipelines the de - identification of selected patient data
can be performed using a variety of pertinent rules and regulations . in our dicom distribution system
this import service consists of a storage service class provider ( storage scp ) , accepting images from other dicom nodes ( e.g. , pacs or modality ) and putting them in a queue for further process . in our setup ,
2data are transferred using one from three types of ctp pipelines set for the processor : 1 ) a pipeline without de - identification scheme to a local file system ; 2 ) a pipeline with a de - identification process before the images are stored in a specific directory ; 3 ) a pipeline with a de - identification process before the images are sent to another dicom node by the export servicea pipeline without de - identification sending data into a file system.a pipeline with de - identification that exports the images in a specific directory or network attached storage.a pipeline with de - identification sending the dicom images to a dicom node using the dicom export service .
data are transferred using one from three types of ctp pipelines set for the processor : 1 ) a pipeline without de - identification scheme to a local file system ; 2 ) a pipeline with a de - identification process before the images are stored in a specific directory ; 3 ) a pipeline with a de - identification process before the images are sent to another dicom node by the export service a pipeline without de - identification sending data into a file system . a pipeline with de - identification that exports the images in a specific directory or network attached storage . a pipeline with de - identification sending the dicom images to a dicom node using the dicom export service .
in case of transfer without de - identification , the pipeline consists of a storage scp as part of the import service followed by a storage service class user ( storage scu ) as part of the export service .
note that a service class provider ( scp ) is a dicom node or device that provides specific dicom network services such as for instance those offered by the storage class defined by dicom .
a service class user ( scu ) is the client role which makes use of dicom services offered by an scp .
the radtransceiver is an application entity ( ae ) that is an scu as well as an scp for the dicom storage service class .
an ae is a node or an application providing dicom services within the network . in radtransceiver
the storage service class mechanism saves images into specific folders defined in the configuration file .
when required , a pipeline with an anonymizer is configured to de - identify images before they are stored in a dicom node .
the execution of a de - identification task will trigger a service to add a record for each image to be de - identified into a confidential database , registering the identity mapping between original and de - identification i d . a separate service monitors the amount of files being stored .
when the amount of files in one task matches the amount as registered in the database , the service will mark the transfer task as a completed process .
after being logged in into radtransceiver , a user initiates and registers the transfer of dicom data through the web interface by entering a patient i d and selecting the appropriate images to be transferred from the pacs .
dicom transfer of the selected images to another dicom node without de - identification is performed instantly while all other transfers are pushed into a processor service . using the processor ,
images can be transferred from the pacs or modality into the predefined storage destination or sent through a process of image de - identification using a specific profile before they are stored .
the managers of radtransceiver can create one or more user - specific module(s ) related to the type of clinical research study and associate a transfer protocol for that user / study combination .
the transfer protocol destination node defines how it has to be stored ( file system or dicom ) and whether it has to be de - identified or not .
these modules are linked to the user account and thus a user can only execute those modules assigned to his / her user profile .
the result of a patient i d based search from the pacs provides a list of selectable items of available study entities and serie within those entities in dicom files .
date , time and study descriptions are shown for each study entity . the date and time , modality type , series number , series description , number of images , and accession number are shown for each series .
the user then selects the required series by ticking the checkboxes at the beginning of the corresponding row .
the de - identification i d is entered by the user using an input box provided at the bottom of the page .
when no de - identification i d is provided a time - stamp based de - identification i d will be automatically generated .
the search results , study entity selection and entry of identification - id are shown in fig . 
the web interface shows the results of a search for a patient from the pacs based on the patient i d , selection of images ( surrounded by the red rim on the left side ) , and entry of an anonymizationid ( surrounded by the yellow rim ) in the bottom part of the web page web interface .
the web interface shows the results of a search for a patient from the pacs based on the patient i d , selection of images ( surrounded by the red rim on the left side ) , and entry of an anonymizationid ( surrounded by the yellow rim ) in the bottom part of the web page some modules are triggered automatically from the epr and designed to transfer data from pacs directly to the epr without user interaction .
since epr users can send requests of image retrieval through the system , from the image viewing process , the epr itself can be considered as a user that can initiate image transfers from pacs .
users can track the status of their own transfers by accessing the web interface for the associated process showing a list of jobs in  waiting ( fig . 
the status indicates that the images are being processed the web interface shows the selected images are queued and waiting to be processed .
the status indicates that images are in the  waiting  list the web interface shows the selected images are being handled by the system .
the status indicates that the images are being processed radtransceiver also has a priority system that affects the order of processing of the images .
transfer processes with a higher priority always appear in the top rows of the queue and are thus handled right after the current active process has finished . when there is more than one process with the same priority they will be sorted based on their time of requests , following the  first in - first out principle .
the initiation of a de - identification task by the user will generate a mapping of the original , unique , identifier into a de - identification identifier both in the database and the lookup - table .
the update on the database is required to register the transfer itself and to record the amount of images being sent to be matched in the last stage of the process . meanwhile
, the creation of id - mapping on the lookup - table will be used in the de - identification process itself .
the lookup - table is updated continuously and only contains the id - mapping of active transfers .
five pipelines composed of a minimum of one dicom import service and either a dicom storage or export service are defined in the ctp server to provide different dicom nodes with images according to their specific needs . with the dicom export service set in the configuration ,
dicom images received by the ctp were stored at a different dicom node within our institution .
the resulting images were all stored at the correct dicom node without any duplication occurring .
6web based dicom distribution system with ctp integrated as its image processor web based dicom distribution system with ctp integrated as its image processor processes can be monitored by observing the status of the process in the web pages .
when failures occur , the user can restart or remove the tasks using the corresponding buttons on the rightmost sisde of the task - row .
the buttons next to the status are used for restarting or removing the task finished task shown in the web interface . the status ( surrounded by the yellow rim ) , is indicated by  completed  .
the buttons next to the status are used for restarting or removing the task the system has transferred more than 24 millions images during 75  months of stable operation ( october 2006 until december 2012 ) .
more than 2,000,000 images were transferred and de - identified in a proper manner while the rest ( 20,000,000 ) were only moved from one node to another without de - identification . of the data transferred , 10  % was de - identified and thus used for clinical research trials or teaching , the remaining data was transferred for patient care .
the data without de - identification was transferred within our institution to move older imaging data from one system ( the pacs ) to the other ( institutional web browser ) . in fig . 
8 the total number of images which have been transferred within 75  months until december 2012 is shown and fig . 
9 displays the difference regarding images transferred with the identification profiles and without it . by performing multiple transfers using the system , time from request to delivery of the images was computed covering the whole process of transfer , de - identification , and data strore .
the system delivers images at an average rate of four ct images per seconds ( table  1 ) , and mr images at an average rate of eight images per seconds.fig .
8total number of images which have been transferred annually since october 2006 until december 2012fig .
9number of images being transferred with and without de - identification profiletable 1several transfers using ct and mr images , giving a rate of four ct images per second and eight mr images per secondtypenumber of imagessize ( mb)time ( seconds)images per secondct10052225500251120410005052534200010004604mr100131281000108124850006156278 total number of images which have been transferred annually since october 2006 until december 2012 number of images being transferred with and without de - identification profile several transfers using ct and mr images , giving a rate of four ct images per second and eight mr images per second
a dicom data distribution system was developed to provide a fast and easy environment to facilitate the distribution of medical images within an institution .
the use of commonly known web based technologies and the flexible processor make it easy to implement and adapt to specific use .
dicom de - identification covers the security of patient - related data , but data trackback is still possible by retrieving the de - identification entry in the conversion table .
therefore , the access to the clinical research study information system database and conversion table is limited to authorized personnel and can be obtained through an internal network only .
the large number of images transferred without de - identification is caused by the fact that this setup is also used to facilitate the retrieval of image data into an epr .
the dicom web - viewer integrated into our epr is limited to about 1  year of storage . to enable easy access to older data
, epr users can automatically retrieve the historical data from their patient with one click within the epr system .
requests through the epr are considered as high - priority tasks and therefore , the data will immediately be transferred from pacs to the epr . in many institutions
this involves a costly pacs license and blocks the workstation for actual clinical reporting use for the time required for the de - identification .
alternatively , users get the non de - identified dicom data locally and perform the de - identification process manually .
this leads to the possibility of use of a wide variety of not properly managed tools and thus can not ensure patient data and identity safety . using radtransceiver ,
the access is provided through a simple , password - protected , webpage which can be accessed from any pc in a hospital ; the de - identification process is controlled and supervised centrally and is vendor neutral . in some cases trace - back of the actual patient behind the de - identified data is required , for example in the case of incidental findings in scans made for a research study .
therefore , our de - identification method , sometimes referred to as pseudonymization , uses a lookup - table which allows tracing back the original patient information .
this is the reason why ctp is used within our system ; besides transferring and processing the dicom data in proper manner to provide patient data security , integrity and confidentiality , it also provides simple yet flexible and extensive configuration of dicom de - identification profiles .
the lookup - table consist of an id - mapping between the original and the de - identified i d and was used by the system to record and guide the de - identification process . however , besides the replacement of the patient i d as used in the lookup - table a whole set of 50 dicom header tags are de - identified during the de - identification process ( see table  2 ) .
these 50 tags are considered to be the possible cause of data breach when they are exposed to a third party either by the element itself or combination with other elements .
all 50 elements are replaced by the de - identification i d , a blank , or a more general representation .
although this provides a proper de - identification of the dicom header , a more comprehensive de - identification , including blanking of part of the image , should be considered in accordance to the dicom supplement 142 clinical trial de - identification profiles to ensure the full protection of patient s private data .table 2fields in the dicom header defined to be de - identifiedtag idtag nametag idtag name0008,0020studydate0008,1060nameofphysicianreadingstudy0008,0021seriesdate0008,1062physicianreadingstudyidsequence0008,0022acquisitiondate0008,1070operatorsname0008,0023contentdate0010,0010patientsname0008,0024overlaydate0010,0020patientid0008,0025curvedate0010,0021issuerofpatientid0008,002aacquisitiondatetime0010,0030patientsbirthdate0008,0030studytime0010,0032patientsbirthtime0008,0031seriestime0010,0040patientssex0008,0032acquisitiontime0010,1000otherpatientids0008,0033contenttime0010,1001otherpatientnames0008,0034overlaytime0010,1005patientsbirthname0008,0035curvetime0010,1010patientsage0008,0050accessionnumber0010,1040patientsaddress0008,0080institutionname0010,1060patientsmothersbirthname0008,0081institutionaddress0010,2150countryofresidence0008,0090referringphysiciansname0010,2152regionofresidence0008,0092referringphysiciansaddress0010,2154patientstelephonenumbers0008,0094referringphysicianstelephonenumber0020,0010studyid0008,0096referringphysicianidsequence0038,0300currentpatientlocation0008,1040institutionaldepartmentname0038,0400patientsinstitutionresidence0008,1048physicianofrecord0040,a120datetime0008,1049physicianofrecordidsequence0040,a121date0008,1050performingphysiciansname0040,a122time0008,1052performingphysicianidsequence0040,a123personname fields in the dicom header defined to be de - identified the export and store services provided by the processor can also be utilized for image sharing between health enterprises .
de - identified images can be directly uploaded using a dicom or hypertext transfer protocol ( http ) or stored into a specific directory of the system that will transfer images to outside the institution . therefore , this system would be adaptable for the implementation of a large multi - centre clinical trial study .
the interface of the dicom distribution system was built using web technologies , therefore , wider access is possible .
the de - identification profiles will be kept controlled since the transfer will be based on the existing modules in the system . however , going beyond the borders of the own institution would require proper protection of the database and table containing the relation between the de - identification i d and the real patient credentials .
furthermore , the system architecture and security should be considered carefully to ensure the safety of the system in delivering images with embedded patient data .
for those reason , communication within our systems was still limited to one hospital only but currently in further development to enable collaborative studies involving many health institutions . in conclusion ,
we have devised a vendor neutral system that supports data distribution and de - identification tasks in an easy , robust and user friendly way , providing a fast process in an easy setup environment while still being able to maintain a high level of security and stability .
its ability to run different de - identification processes in parallel pipelines accessible through a simple web interface is a major advantage in both clinical practice and clinical research setting .
 to develop and test a fast and easy rule - based web - environment with optional de - identification of imaging data to facilitate data distribution within a hospital environment . 
 a web interface was built using hypertext preprocessor ( php ) , an open source scripting language for web development , and java with sql server to handle the database . 
 the system allows for the selection of patient data and for de - identifying these when necessary . using the services provided by the rsna clinical trial processor ( ctp ) 
 , the selected images were pushed to the appropriate services using a protocol based on the module created for the associated task . 
 five pipelines , each performing a different task , were set up in the server . in a 75  month period , more than 2,000,000 
 images are transferred and de - identified in a proper manner while 20,000,000 images are moved from one node to another without de - identification . 
 while maintaining a high level of security and stability , the proposed system is easy to setup , it integrate well with our clinical and research practice and it provides a fast and accurate vendor - neutral process of transferring , de - identifying , and storing dicom images . 
 its ability to run different de - identification processes in parallel pipelines is a major advantage in both clinical and research setting . 
Introduction
Materials and methods
Results
Discussion