store dicom images correctly in a very easy set - up in a fast , secure and stable environmentallows adaptation of the software to perform a certain task based on specific needsallows easy integration into an existing environmentreduce the possibility of inappropriate anonymisation store dicom images correctly in a very easy set - up in a fast , secure and stable environment allows adaptation of the software to perform a certain task based on specific needs allows easy integration into an existing environment reduce the possibility of inappropriate anonymisation
digital imaging and communications in medicine ( dicom )   was developed to standardise medical image data and to easily share medical image data between computer systems .
it is currently the global standard for handling , storing , printing and transmitting information in medical imaging .
the dicom header saves identifying information of patients and images which may include patient information , study information , institution information , etc .
the dicom format is now used by most of the medical imaging community , not only for clinical practice but also for clinical research raising the possibility of data sharing or exchange . however
, sharing sensitive medical image data to a third party demands protection of the data itself to ensure data safety and patient privacy .
.   stated that it is desirable and good clinical practice that patient data are rendered  anonymous  before transferral .
the uk medical research council ( mrc )   described anonymised data as data prepared from personal information , but from which the person can not be identified by the recipient of the information .
this anonymity can contain coded information that could be used to identify people by using external information that is not generally known .
data anonymisation is the simplest but most secure approach to providing privacy and integrity of dicom data .
this method is used to remove confidential entries from dicom files and is generally irreversible .
confidential entries include tags in the standard dicom data dictionary that could in itself or in combination with other entries be used to derive the patient s real identity .
there are numerous tools for anonymising dicom data , both commercially and open source , which employ various approaches to removing patient - related information in a more or less automated way [ 46 ] .
one default scheme in the software may completely remove the inappropriate fields of the dicom headers which might be needed by a specific task , patient s age in months for example in paediatric studies . on the other hand
, it is also possible for the software not to anonymise crucial or confidential information that may lead to the recovery of the patient s identity .
a non - guided anonymisation also will lead to duplication that may consume a lot of space in the storage .
the rsna clinical trial processor ( ctp )   is a highly configurable and extensible stand - alone application that provides processing features such as import services , export services , storage service and processor services for clinical trials .
the processor service also includes a dicom anonymisation stage that can be configured via a script language .
the ctp can anonymise a dicom object based on the script mentioned in the configuration .
the configuration can also refer to a look - up table so that the anonymisation process for certain tags will be done based on the predefined list . besides the image data
this information is usually entered into an information system separate from the image data system .
consequently , anonymisation of information has to be performed twice leading to possible mistakes leading to a mismatch between the image data and the other information . in this paper
, we present an adapted ctp test set - up for receiving , anonymising and saving dicom data into storage through the local intranet and also through the internet for implementation in large , multi - centre , clinical trial studies using external input from the original database of an existing clinical study information system to guide the anonymisation process .
the ctp is a stand - alone program that utilises the processing features of the rsna medical imaging resource center ( mirc )   for clinical trials in a highly configurable and extensible application .
it is developed to satisfy the requirements of trials that need complex processing that can not be handled by mirc .
ctp has some key features such as support for configurable multiple pipelines , pre - defined implementation for key components , and web - based monitoring of the application s status .
it is open source software and can be downloaded for free from the rsna website .
the software is written in java and runs on both linux and microsoft windows operating systems .
some pipelines also need java advance imaging imageio tools   installed on the system used for the ctp software .
the flexibility and configurability in the program s approach to de - identification of selected patient data can handle the variation of pertinent rules and regulations , which can vary from one facility to another .
it can protect and maintain the security of health - related records and fulfil the need in a clinical trial or research study to de - identify patient information .
the processing stages are divided into four types , which are import service , processor , storage service and export service .
a processor performs some kind of processing on an object and passes the result on to the next stage in the pipeline .
an export service provides queued transmission to an external system via a defined protocol ( e.g. http , https or dicom protocol ) .
the pipelines and its stages can each be configured either through a configuration file which is located in the same directory as the program or through the application monitoring web page . in this study ,
one pipeline was defined with three main stages ( import service , anonymiser and storage service ) .
1illustration of the four main stages in the pipeline used for this experiment illustration of the four main stages in the pipeline used for this experiment the dicom anonymiser provided by ctp has a simple scripting language in which each of the dicom elements can have its own replacement script .
the unnecessary patient s protected healthcare information ( phi ) will be removed before being stored .
it minimises the amount of phi of the objects as much as possible depending on the study requirements .
function   which will be used to return a zero - length string for the chosen tags and 
it can be extended to meet specialised requirements by editing the script file . a look - up function in the anonymiser maps values through a local look - up table , which is intended to perform the anonymisation based on the table to meet the pre - defined requirements of the anonymised dicom object .
the look - up table itself is a property file that should be referenced in the anonymisation stage configuration when needed .
it is not queued , and therefore it must be complete before subsequent stages can proceed .
when storing files , the storage service automatically defines subdirectories beneath its root directory and populates them accordingly . in this study ,
a total of 25,000 images from 50 patients are pushed from the picture archiving and communication systems ( pacs ) using the dicom protocol into a machine with adapted ctp installed .
the adapted ctp receives the images , anonymises them and saves the anonymised images into local storage ( fig .  2 ) .
data from 50 patients consisting of a total of 25,000 images were transferred using this method.fig .
2system setting for method 1 . images from the investigation or pacs server sent through a dicom protocol to a clinical trial processor ( ctp ) machine that anonymises and stores them in proper storage system setting for method 1 .
images from the investigation or pacs server sent through a dicom protocol to a clinical trial processor ( ctp ) machine that anonymises and stores them in proper storage the other method is designed to test the ctp data transfer performance using https networking through the internet .
both servers are geographically separated machines where the sender is a server located in the netherlands and the receiver is a server located in the united states . the anonymisation is performed on the server at the sender site before it is transferred to the receiver site .
the ctp machine at site 1 is configured to import images from the local research pacs , to anonymise the images and to export the resulting images to the ctp machine at site 2 using the secure https networking protocol .
the ctp machine at site 2 receives the anonymised images and saves them into local storage ( fig . 
files that do not conform to the dicom standard requirements will be transferred to a quarantine folder.fig .
3system setting for method 2 . a ctp machine from one site exports images received from local pacs into another ctp machine at the other site over secure http networking .
the images received are saved in storage at the receiver site system setting for method 2 . a ctp machine from one site exports images received from local pacs into another ctp machine at the other site over secure http networking .
as the anonymisation process will be integrated into an ongoing study set - up , the anonymisation properties will be inherited from this study .
there are 40 tags defined to be replaced or made blank to omit relevant information from the object .
these include the patient s personal data , studies , and other crucial information that can , in itself or in combination , refer directly to the patient . in table  1
the fields were all blanked except the patient i d and patient name , which must be filled in based on the look - up table constructed from the external study information system .
this look - up table was automatically updated for every image sent from the pacs based on identity mapping with the sql - database server running the database of our clinical study information system .
a function was added to monitor if there were any images sent from the pacs .
this function will query the database to receive the correct pair of the original i d of the dicom images and the anonymisation value and will subsequently write it into the lookup file .
the pairs of values will be removed automatically after the whole set of images is successfully anonymised and stored in the appropriate file system.table 1fields in the dicom header defined to be modified ( m ) or made blanktag idtag name0008,0020studydate0008,0021seriesdate0008,0022acquisitiondate0008,0023contentdate0008,0024overlaydate0008,0025curvedate0008,002aacquisitiondatetime0008,0030studytime0008,0031seriestime0008,0032acquisitiontime0008,0033contenttime0008,0034overlaytime0008,0035curvetime0008,0050accessionnumber0008,0080institutionname0008,0081institutionaddress0008,0090referringphysiciansname0008,0092referringphysiciansaddress0008,0094referringphysicianstelephonenumber0008,0096referringphysicianidsequence0008,1040institutionaldepartmentname0008,1048physicianofrecord0008,1049physicianofrecordidsequence0008,1050performingphysiciansname0008,1052performingphysicianidsequence0008,1060nameofphysicianreadingstudy0008,1062physicianreadingstudyidsequence0008,1070operatorsname0010,0010patientsname ( m)0010,0020patientid ( m)0010,0021issuerofpatientid0010,0030patientsbirthdate0010,0032patientsbirthtime0010,0040patientssex0010,1000otherpatientids0010,1001otherpatientnames0010,1005patientsbirthname0010,1010patientsage0010,1040patientsaddress0010,1060patientsmothersbirthname0010,2150countryofresidence0010,2152regionofresidence0010,2154patientstelephonenumbers0020,0010studyid0038,0300currentpatientlocation0038,0400patientsinstitutionresidence0040,a120datetime0040,a121date0040,a122time0040,a123personname fields in the dicom header defined to be modified ( m ) or made blank the anonymised images are saved in local storage under the file storage service .
it also creates subfolders and groups the images based on the element set in the configuration .
default settings for the file storage allow the service to create more than one copy of an image .
this duplication may occur due to double transfers , intentionally or not , from the pacs server .
similar to the import service , the storage service can be set to accept certain objects . rejected objects
, transfers are initiated by pushing images from pacs into the ctp machine using the dicom protocol .
the dicom images are received by the ctp import service through the defined listener port .
the images are directly stored in a defined file system stated in the system configuration after being anonymised .
these three services are configured together in one machine between the source ( pacs ) and the storage .
the configuration file for the experiment using the local network is shown in fig .  4.fig .
4configuration for the experiment using method 1 configuration for the experiment using method 1 there are two additional stages in the experiment using the second method , which are the http export service with secure transfer configured at site 1 , and the receiver at site 2 . the http export service queues objects and
considering the security of the transfer process , a secure socket layer ( ssl ) is used to initiate the connection . as the receiver has to receive images using the same protocol ,
there is no need for the receiver site to anonymise the images again , therefore at site 2 there are only two main stages to import and then directly save the objects into the file system . configuration from the ctp machines at site 1 and site 2 can be seen in figs .  5 and 6 respectively.fig .
6receiver configuration for experiment using method 2 sender configuration for the experiment using method 2 receiver configuration for experiment using method 2 using the first method , adapted ctp can successfully receive patient image data sent from a pacs server , anonymise and then store them in local storage .
the total time needed to transfer all images is roughly 2 h , which means every second there are on average four images moved from the pacs , anonymised , and then saved in storage .
this time was calculated based on the difference between the first file being received by the dicom import service and the time logged from the last file stored in the file system .
the adapted ctp correctly anonymised all images based on the lookup table and stored them in an appropriate directory .
additionally , several transfers were made with the same original patient i d , none of them resulting in duplication of the data .
the second method also correctly de - identified and stored the anonymised image data in the correct file system .
the average time needed to transfer the images is 10 images per minute or one image every 6 s over a home internet connection with upstream network transfer speed of approximately 0.48 mbps .
the sender is configured using a microsoft windows xp environment and the receiver using a centos linux environment .
the needs of data trackback to its origins raised the consideration of using pseudonymisation instead of anonymisation in some research [ 1214 ] .
while anonymisation removes or blanks the phi from the dicom header , pseudonymisation only replaces the person - related data with unique identifiers .
this will allow both follow - up of the studies and the high level maintenance of patient data .
ctp offers the possibility of pseudonymisation through some of the available functions at its anonymisation stage by using simple data modification or the utilisation of a hash of an element s value . in our system ,
the anonymisation process is done by emptying most of the phi - related fields and using the previously registered pairs of original and anonymised values for patient name and i d from the study information system database .
therefore , the anonymisation will cover the security of patient - related data while data trackback is still possible by querying the data using the anonymisation i d .
the access to the study information system database is limited to authorised personnel and can be obtained through our internal network only , thus securing the access to the trackback information .
the proposed set - up can be easily integrated into existing research set - ups because of the use of the anonymisation database from the existing system thus facilitating easy inclusion of digital image data and decreasing or eliminating the need for data transfer onto physical media ( cd , dvd , etc . ) .
as all dicom data transferred were ct images that have a file size per image of 0.5 mb , a transfer speed of 2 mb per second or 16 mb per second was achieved during the first method . based on our measurements ,
the transfer of 25,000 images over the second method s connection speed would take approximately 41 h to complete .
although this could be acceptable in clinical research studies , it is definitely too time - consuming in clinical practice .
however , faster connections that are in place between enterprises will partly solve this problem . while no significant problems occurred during our tests while the adapted ctp was receiving , anonymising , exporting and storing images , there are some limitations to this application .
for example , gonzales et al .   mentioned that ctp still does not have a standard dicom anonymisation mechanism and also has limitations in adapting to new anonymisation methods .
furthermore , it is stated on the official ctp website   that this application is still under development and some possible improvements are scheduled .
the main issue raised to improve the performance of the ctp is the use of the dcm4che2 library , instead of the currently used dcm4che library , which is claimed to provide faster transfer and system processing .
the experimental results show that ctp can transfer , receive , anonymise and store dicom images correctly in a very easy set - up in a fast , secure and stable environment .
its open source availability allows adaptation of the software to perform a certain task based on specific needs .
our adaptations to the original ctp allow easy integration into environments in which patient data are already included in an information system by using the existing database from this system to guide the anonymisation process .
resulting from this , the mismatch in data that can occur when using two separate databases , is eliminated .
 objectivesto present an adapted clinical trial processor ( ctp ) test set - up for receiving , anonymising and saving digital imaging and communications in medicine ( dicom ) data using external input from the original database of an existing clinical study information system to guide the anonymisation process.methodstwo methods are presented for an adapted ctp test set - up . in the first method , images are pushed from the picture archiving and communication system ( pacs ) using the dicom protocol through a local network . in the second method , 
 images are transferred through the internet using the https protocol.resultsin total 25,000 images from 50 patients were moved from the pacs , anonymised and stored within roughly 2 h using the first method . in the second method , an average of 10 images per minute were transferred and processed over a residential connection . in both methods , no duplicated images were stored when previous images were retransferred . 
 the anonymised images are stored in appropriate directories.conclusionsthe ctp can transfer and process dicom images correctly in a very easy set - up providing a fast , secure and stable environment . 
 the adapted ctp allows easy integration into an environment in which patient data are already included in an existing information system.key pointsstore dicom images correctly in a very easy set - up in a fast , secure and stable environmentallows adaptation of the software to perform a certain task based on specific needsallows easy integration into an existing environmentreduce the possibility of inappropriate anonymisation 
Key Points
Introduction
Materials and methods
Experiment and results
Discussion
Conclusion