Systems and methods for de-identifying medical and healthcare data
Inventors
Rosenberg, Michael • BENITZ, MALCOLM • SUTTLES, JASON • WOODLIEF, CHRIS • GOLDSTEIN, BRENT
Assignees
Interested in licensing this patent?
MTEC can help explore whether this patent might be available for licensing for your application.
Publication Number
US-10817622-B2
Publication Date
2020-10-27
Expiration Date
Abstract
The invention relates generally to systems and methods for protecting patient privacy when health care information is shared between various entities and, in particular, to systems and methods that implement a multi-stage sanitizing routine for de-identifying patient data from medical reports and diagnostic images to ensure patient privacy, while preserving the ability for sanitized medical reports and diagnostic images to be re-identified.
Core Innovation
The invention provides a multi-stage de-identification system for medical image records and associated medical report text. A server retrieves at least one medical image record that includes an image and a medical report, determines a modality, and retrieves a de-identification profile for the modality. The de-identification profile specifies at least one area of the diagnostic medical image that contains patient information.
A sanitizing engine coupled to the server applies a blackout zone over the specified area so that patient information within the blackout zone is deleted and prevents the patient information from being visible. After the blackout zone is applied, the sanitizing engine performs an optical character recognition operation in the area and determines if any characters are detected. If no characters are detected, the sanitizing engine detects a boundary for a diagnostic portion region of interest, and then detects whether non-black pixels are present outside of the boundary.
Depending on the detected content, the sanitizing engine converts non-black pixels detected outside the boundary to black pixels or encapsulates the diagnostic medical image into a DICOM format if non-black pixels are not detected. In parallel, the system can sanitize medical report text by extracting text and determining whether patient identifying information exists, then replacing detected identifying information with randomly generated characters or a predetermined character string. The disclosed system also includes optional storage of DICOM header data linked to a re-identification capability via a unique identification string and transmits the sanitized DICOM file to a remote computing system as part of a server and data-provider architecture.
Claims Coverage
The independent claims are clm-00001, clm-00009, and clm-00015. Across these independent claims, the coverage includes modality-specific or previously generated de-identification profiles with blackout zones, OCR-based verification for remaining characters, boundary detection for a diagnostic portion region of interest, pixel conversion outside the boundary, DICOM encapsulation and transmission, and system components including a database, sanitizing engine, and server.
Modality-specific de-identification profile specifying blackout zone areas
Determines a modality associated with the diagnostic medical image and retrieves, by the server, a de-identification profile for the modality, wherein the de-identification profile specifies at least one area of the diagnostic medical image that contains patient information.
Blackout zone deletion of patient information
Applies, by a sanitizing engine coupled to the server, a blackout zone over the area of the diagnostic medical image specified in the de-identification profile, wherein the patient information within the blackout zone is deleted and is prevented from being visible.
OCR verification of remaining characters after blackout
Performs, by the sanitizing engine, an optical character recognition operation in the area after the blackout zone has been applied and determines whether any characters are detected in the area after the blackout zone has been applied.
Diagnostic region boundary detection and pixel conversion outside boundary
Detects, by the sanitizing engine, a boundary for a diagnostic portion region of interest of the diagnostic medical image if no characters are detected, detects whether non-black pixels are present outside of the boundary, and converts any non-black pixels detected outside of the boundary to black pixels or encapsulates the diagnostic medical image into a DICOM format if non-black pixels are not detected.
Pre-stored de-identification profile and gradient boundary conversion
Applies, by a sanitizing engine coupled to the server, a sanitizing process in an area of the diagnostic medical image determined by a pre-stored previously generated de-identification profile, detects if any characters are present after the sanitizing process has been applied, detects a gradient boundary for a diagnostic portion region of interest if no characters are detected, and converts non-black pixels outside of the gradient boundary to black pixels or inverse color.
System architecture with database, sanitizing engine, DICOM encapsulation, and transmission
Provides a database configured to store at least one medical record including a diagnostic medical image and a medical report; a sanitizing engine configured to import the medical record, apply a blackout zone, detect if characters exist in the blackout zone area, detect a gradient boundary for a diagnostic portion region of interest, convert non-white, non-black pixels outside the gradient boundary, and encapsulate the diagnostic medical image into a DICOM file; and a server configured to transmit the DICOM file to a remote computing system.
Across clm-00001, clm-00009, and clm-00015, the independent claim coverage centers on blackout-zone-based deletion of patient information guided by modality or previously generated profiles, OCR-based detection of remaining characters, detection of a diagnostic portion boundary including a gradient boundary, conversion of pixels outside the boundary, and DICOM encapsulation with transmission.
Stated Advantages
Prevents patient information in the blackout zone area from being visible.
Helps determine whether any characters remain after the blackout zone has been applied using optical character recognition.
Supports defining a diagnostic portion region of interest via a detected boundary, including a gradient boundary, when no characters are detected.
Converts non-black or non-white, non-black pixels outside the detected boundary for the diagnostic portion region of interest.
Encapsulates the diagnostic medical image into a DICOM format for transmission to a remote computing system.
Documented Applications
De-identifying medical data that includes diagnostic medical images and associated medical report text for controlled transmission to a remote computing system.
Interested in licensing this patent?