- Published
- Updated
A participant code in an image file name does not demonstrate that direct identifiers have been removed. Internal properties, annotations and text embedded in the visible image need different checks before research transfer.
Preserve the meaning of data
Define information needed for the research purpose and information to remove. Review internal fields separately from text embedded in pixels. De-identification should not compromise measurement, chronology or image interpretation. Preserve the authorised relationship between the local original and research copy while avoiding unnecessary direct identifiers in the material sent to the recipient.
Worked example
For example, files are renamed using participant codes, but a hospital patient number remains visible in a corner of each image. The team opens representative images from different devices instead of relying only on automated field removal. After correction, an imaging specialist checks that necessary anatomical and technical information remains usable.
Review checks
- Sample internal file properties and visible image text separately.
- Compare fields needed for measurement and ordering after cleaning.
- Control exceptional device formats before allowing transfer.
Acceptance and boundaries
Acceptance means the research copy avoids unnecessary direct identifiers while retaining its scientific utility. This review does not establish the same legal anonymisation status in every country. Privacy owners should assess the data flow separately. Success with one device should not automatically be extended to every manufacturer; different formats and updates need proportionate reassessment.
Frequently asked questions
- Is renaming the file enough?
- No. Identifiers may remain in internal properties or visible image pixels.
- Should every field be removed?
- Necessary scientific context should remain. Determine retained and removed information according to purpose and authorised access arrangements.