DICOM and PACS on MAX4: Pictures Before Patients

Anonymizing a scan in a standard imaging server keeps the original and leaves names burned into the pixels. A trial on invented patients found both before a real one could. Medical images are a large part of a patient's record, and MARA, the clinical assistant the Collective is designing, will need to read them. Before she does, the imaging plumbing was tried on MAX4, a machine that holds no patient data, using three invented patients and 24 synthetic CT slices. The trial used Orthanc, an open-source imaging server, and pydicom, a Python library for reading and writing medical image files. Strangers were refused: a request with no login got an error, and a sender the server did not know stored nothing. Studies arrived by both of the standard routes, were found by search, and every anonymized copy was checked against its original. Two results matter most, and both are defaults. Anonymizing a study makes a new copy and keeps the original, so after the run the server held six studies where three went in. And anonymizing cleans the file's labels while leaving the picture alone, so a name drawn into the image survives while the file claims the patient's identity was removed. So MARA's design changes in three ways. Identified and de-identified images never share a store. An image that carries text in its pixels, or might, goes to quarantine until a person clears it. And a malformed file is refused rather than read. Two outside limits remain. De-identification under US health privacy law is a legal standard that a file setting cannot meet on its own, and software that processes or interprets images to support clinicians' decisions can be a regulated medical device, where software that only stores or displays them may not be. None of this used real patient data, and none of it is a medical device. Article ART-HLC-021. Originally published at https://www.maxresearchcollective.com/articles/dicom-and-pacs-on-max4.html