DICOM Redaction

DICOM files can carry identifiers in pixel data and metadata. Agent Mask handles two common PHI surfaces: configured PHI-bearing DICOM metadata tags and text detected by OCR in image pixels, such as labels burned onto ultrasound frames, CT scouts, or mammograms.

Review DICOM output before external release, especially when files contain private tags, vendor-specific tags, unusual sequences, or free-text fields outside the configured PHI tag set.

Quick example

-- DICOM bytes base64-encoded and zlib-compressed.
SELECT app_public.mask(
  '<compressed_base64_dicom>',
  OBJECT_CONSTRUCT(
    'include_redacted_document', TRUE,
    'dicom_metadata_mode', 'strip'
  )
);

What gets redacted

Metadata header

By default, dicom_metadata_mode: "strip" removes Agent Mask’s configured PHI-bearing DICOM tags from the metadata header. Examples include PatientName, PatientBirthDate, PatientID, InstitutionName, ReferringPhysicianName, study and series dates, accession and study identifiers, physician names, comments, descriptions, and selected UIDs.

Metadata redaction also applies to matching PHI tags inside enhanced multi-frame functional group sequences. Coverage is limited for private, vendor-specific, free-text, or non-standard tags.

Pixel data (burned-in text)

OCR runs over each image frame to detect text embedded in pixels, such as patient IDs, dates, or names burned onto fluoroscopy stills. Detected text regions are pixel-masked with the configured fill color. Image content that does not contain detected text is not changed.

dicom_metadata_mode

`"strip"` (default)

Delete configured PHI-bearing DICOM tags entirely. The file remains valid DICOM but loses those identifying metadata fields.

`"anonymize"`

Replace configured PHI tag values with placeholders while preserving tag structure: "REDACTED" for names and text-like values, "19000101" for dates, "000000" for times, and deterministic hash-derived values for UIDs. Use this when downstream systems, such as DICOM pipelines or PACS routing, require specific tags to be present.

OBJECT_CONSTRUCT('dicom_metadata_mode', 'anonymize')

`"none"`

Leave metadata untouched and only redact OCR-detected burned-in pixel text. Use this only when PHI exposure in metadata is managed elsewhere.

OBJECT_CONSTRUCT('dicom_metadata_mode', 'none')

Redaction colors

For the pixel redaction:

OBJECT_CONSTRUCT(
  'include_redacted_document', TRUE,
  'redaction_fill_color', ARRAY_CONSTRUCT(0, 0, 0),   -- black
  'redaction_text_color', ARRAY_CONSTRUCT(255, 255, 255)
)

Redaction metadata

For audit trails, include per-redaction metadata:

OBJECT_CONSTRUCT(
  'include_redacted_document', TRUE,
  'include_redaction_metadata', TRUE
)

Returns a redaction_metadata object with an entities_redacted count and pixel bounding_boxes. Metadata tag scrubbing is controlled by dicom_metadata_mode but is not reported as per-tag redaction metadata.

Multi-frame DICOM

Multi-frame objects (cine loops, dynamic studies) are processed frame-by-frame. OCR runs on each frame independently, so text that moves across frames is redacted per-frame.

When a redacted DICOM is reassembled, overlay planes are removed because DICOM overlays can carry burned-in annotations separately from pixel data.

Review guidance

Use "strip" unless a downstream DICOM system requires PHI-bearing tags to remain present.
Inspect private tags and vendor-specific tags before sharing output outside your controlled environment.
Review free-text and non-standard metadata fields against your local de-identification policy.
Visually inspect representative redacted images, especially low-contrast studies, rotated labels, compressed images, and multi-frame studies.
If your policy treats additional tags as sensitive, remove or transform those tags in your DICOM pipeline before or after Agent Mask processing.

What’s NOT redacted

Clinical image content that does not contain detected text.
Text missed by OCR because of image quality, orientation, contrast, or unusual rendering.
Private, vendor-specific, free-text, or non-standard metadata tags that are not part of the configured PHI tag set.
Metadata tags outside the configured PHI set are preserved to keep the file usable, even if your local policy treats some of them as sensitive.