DICOM de-identification & re-identification
Send studies off-site.
Keep the key in-house.
Research collaborations, AI vendors and outside readers all need your imaging. None of them need your patients. Pixel Safe de-identifies studies on the way out, re-identifies the results on the way back, and never lets the linkage leave your network.
Or point it at a folder and get a de-identified set back. Same engine, one direction, nothing to stand up on the far end.
YOUR NETWORK
PACS / archiveidentified studies
Identity vaultthe mapping — never transmittedstored once, reused every study
↓ DE-IDENTIFIEDRESULTS BACK ↑
OFF-SITE
Researcher / vendorno patient identity, ever
Reads, annotates, or trains on the images. Sends findings back under the pseudonym it was given.
The round trip
Most tools only go one way.
De-identifying is the easy half. The hard half is getting the results back and knowing which patient they belong to — without ever having shipped that answer out of the building.
01 OUT
De-identify
Headers rewritten, identifiers replaced with per-project pseudonyms. The same patient maps to the same pseudonym on every future study, so a cohort stays a cohort.
02 AWAY
Work happens off-site
The receiving side gets images and nothing else. There is no identity in the payload to leak, subpoena, or lose.
03 BACK
Re-identify on return
Results come home under the pseudonym. Pixel Safe restores the real identity from a mapping that never left your network, and records every delivery.
HL7
Results often come home as HL7.
The report inside is put right too.
An outside reader or AI vendor usually sends findings back as an HL7 result message, with the report carried inside it as a Base64 file. Putting the real patient back in the message’s fields isn’t enough on its own — the report still prints the stand-in name, MRN and dates it was given.
Pixel Safe takes HL7 result messages over MLLP and works on the whole message: the fields, the file inside, and where the report ends up.
01 THE FIELDS
Every identifier put back
Name, MRN, accession, order numbers and dates go back to the real patient’s, from the mapping that never left your network. A value it can’t put back exactly holds the message. It never guesses.
02 THE FILE
Base64, read by its bytes
The file inside the message is found, put back together when the sender splits it across segments, and recognised by what its bytes are, not the label it came with. A report PDF has the real identity written back inside it, then read again to be sure no stand-in is left.
03 THE STUDY
Filed where it belongs
The corrected message goes on to your system. The report can also be filed into the patient’s own study on your PACS, next to the images it is about. Every message in and out is kept, so you can see what was sent and send it again.
Starting simpler
Most projects don’t need the round trip.
Plenty of work is one direction only: here is a set of studies, give them back clean. Point Pixel Safe at a folder and that’s what happens — no return leg to design, nothing to stand up on the far end.
It is the same engine either way. The same header rules, the same reading of the pixels, the same re-check of the output before a single study is released. The round trip adds a way home for the results; it doesn’t change what happens to the images. Start with the folder, and the return leg is there when a project needs it.
Burned-in PHI
Some PHI never touches the header.
It’s burned into the pixels.
Ultrasound captures, secondary captures, screen grabs from a modality console — a name rendered into the image itself passes every header check ever written, because there is nothing in the header to find.
Pixel Safe reads the picture. Text found in the pixels is located and blanked, and studies it cannot clear are held rather than released. Blanking by modality and station is available where the layout is known and fixed; where it isn’t, the image is read directly.
Before
After
Pixel Safe blanks the scanner’s banner, then reads the image again to make sure nothing readable is left.
Image: The Cancer Imaging Archive, CPTAC-PDA collection (doi.org/10.7937/K9/TCIA.2018.SC20FO18), CC BY 4.0. The patient details are invented.
The report, as written
DEPARTMENT OF RADIOLOGY PATIENT: Sample, Jane Q MRN: 00482913 ACCESSION: SMP0001 DOB: 01/15/1960 EXAM DATE: 08/26/2026 REFERRING PHYSICIAN: Robert Hayes, MD EXAM: US RENAL, LEFT CLINICAL HISTORY: 66-year-old woman with left flank pain. Referred by Dr. Hayes. COMPARISON: Renal ultrasound of 03/14/2025. TECHNIQUE: Grayscale sonographic images of the left kidney. FINDINGS: The left kidney measures 11.2 cm in length, with normal cortical thickness and echogenicity. No hydronephrosis. No calculus or solid mass. A simple cyst in the lower pole measures 1.4 cm, unchanged since 03/14/2025. IMPRESSION: 1. No hydronephrosis. 2. Stable simple cyst, left lower pole. Dictated by Maria Lopez, MD on 08/26/2026 at 10:42 AM. Electronically signed by Maria Lopez, MD.
As Pixel Safe delivers it
DEPARTMENT OF RADIOLOGY PATIENT: Sylvester, RESEARCH21 MRN: 40616962 ACCESSION: PIX63800000001 DOB: 02/21/1960 EXAM DATE: 07/27/2026 REFERRING PHYSICIAN: [PROVIDER], MD EXAM: US RENAL, LEFT CLINICAL HISTORY: 66-year-old woman with left flank pain. Referred by [PROVIDER]. COMPARISON: Renal ultrasound of 02/12/2025. TECHNIQUE: Grayscale sonographic images of the left kidney. FINDINGS: The left kidney measures 11.2 cm in length, with normal cortical thickness and echogenicity. No hydronephrosis. No calculus or solid mass. A simple cyst in the lower pole measures 1.4 cm, unchanged since 02/12/2025. IMPRESSION: 1. No hydronephrosis. 2. Stable simple cyst, left lower pole. Dictated by [PROVIDER], MD on 07/27/2026 at 10:42 AM.
The same study’s report, written for the made-up patient. Pixel Safe replaces the patient’s name and numbers, shifts the dates and takes out other people’s names. The date of birth becomes the same made-up date the images carry, so the report and its images agree. The findings stay as they were.
Verification
It doesn’t trust its own scrubbing.
Scrubbing is table stakes. Going back and re-reading the output is the part that catches what the scrub missed — so that’s what it does, on every study, before anything is released.
364studies in
29,844images read
322released
4held back
Synthetic validation benchmark. The 4 held were single-image studies with burned-in PHI —
the kind that clears every header check. The number worth noticing is not 322. It is 4.
Scope
What it handles.
Stated plainly, so you can tell in a minute whether it fits what you’re trying to do.
HANDLESDICOM studies — headers, private tags, and burned-in pixel text
HANDLESReversible pseudonyms with the mapping held inside your network
HANDLESDICOM objects and report PDFs carried inside HL7 messages as Base64, reassembled and identified by their actual bytes
HANDLESDICOM structured reports — narrative text inside the report is scrubbed, then re-read before release
HANDLESVolume work — hundreds of thousands of studies, across multiple processing nodes
Talk to us
Bring one study. See what comes back.
The fastest way to judge this is on your own data, not a slide deck. Send a note and we’ll work out whether it fits what you’re trying to do.
Or write to info@pixelsafeimaging.com directly.