Five things it does, in the order you meet them
Getting cases in, taking the patient out, having a human confirm it, finding what you put in, and running the whole thing. The de-identification is the part that is hard, so it is the part described in the most detail.
01 · Getting cases in
Two entry points, one pipeline
- Upload a whole study
- A ZIP or RAR of a study, a DICOMDIR, or loose .dcm files, with the report as pasted text, a PDF or a DOCX, plus any attachments. Uploads are resumable, because a study is hundreds of megabytes and hospital wifi is what it is.
- Straight from the workstation
- A DICOM gateway accepts C-STORE, so a radiologist does “Send to → TEACHING” from the machine they already report on. Received studies enter the identical pipeline — there is no trusted-source shortcut. The gateway ships switched off and is commissioned per hospital.
- Compressed transfer syntaxes
- JPEG, JPEG 2000, JPEG-LS and RLE, so a real PACS export ingests without a conversion step first.
- The file name is thrown away
- Study exports are routinely called things like CT_HEAD_SMITH_JOHN_MRN123.zip. RadBase never stores the name you uploaded; it stores a synthetic one.
- The browser writes straight to quarantine
- The upload does not pass through the application on its way in. It goes to the quarantine store directly, under a short-lived credential, and the application cannot read it back.
02 · De-identification
Three places a patient hides, and all three are searched
- Headers — an allowlist, never a denylist
- The output dataset starts empty and only explicitly permitted tags are copied in, following the DICOM PS3.15 Annex E confidentiality profile. Ages are banded, dates are shifted consistently, UIDs are remapped, and private and overlay groups are removed outright. A denylist fails the moment a vendor writes a name into a private tag, which vendors do constantly.
- Pixels — found by OCR, then actually blacked out
- Burned-in patient banners, institution strips and accession numbers are located by optical character recognition and redacted in the stored pixels. Not an overlay, not a crop-on-display: the pixels that leave the pipeline no longer contain the text. Ultrasound banners can also be cropped as a region.
- Report text — replaced, never deleted
- Names become [NAME], record numbers [MRN], national identity numbers [CNIC], phone numbers [PHONE], dates [DATE], clock times [TIME], institutions [HOSPITAL] and accession numbers [ACCESSION]. The sentence keeps its shape, so the report still reads as a report and still teaches. Every placeholder is upper-case and digit-free, so redacting an already-redacted report is a no-op rather than nested brackets.
- Nothing silently passes
- An instance carrying a suspected identifier that could not be redacted with confidence is routed to a reviewer rather than published. The corpus tests that routing, not only the redaction — the guarantee is that nothing escapes unseen, which is a different and more honest claim than “OCR catches everything”.
03 · Review and publishing
The gate a person has to open
- Every detection is shown
- The reviewer sees each key image at full resolution, the list of detections and the redactions applied to them, and a diff of the report text before and after.
- Draw more, or crop
- A consultant who sees something the software missed draws further redaction boxes, or crops an ultrasound banner, and the pixels are rewritten before anything is published.
- A named person says it is clean
- Publishing requires an explicit “no identifiers remain”, recorded against the person who clicked it. There is no automatic pass and no bulk approve.
- A second pair of eyes where it matters
- For ultrasound, screen captures, mammography, angiography, fluoroscopy and anything recorded as an unspecified modality — the modalities where burned-in text is normal — the person who uploaded a case may not be the person who passes it.
- The reviewer’s own note is checked
- The one free-text field written by the person looking at residual identifiers is scanned for identifier shapes before it is saved. “MRN 998877 still visible top-left” is the natural thing to type, and the note lands in an append-only log where it could never be corrected.
- The raw copy goes
- On publish the quarantine object is hard-deleted and the deletion is logged. Whatever the reviewer decides — pass, reject, or nothing at all — the raw upload is purged within 72 hours of arrival. No decision extends or shortens that.
04 · Finding and learning
What the archive is for once it exists
- Browse with facets
- Ten axes with live counts — modality, body region, system, pathology, difficulty, teaching value and more — as a dense table rather than a card grid, because a case list is scanned and compared.
- The anatomical navigator
- A 3D body that orbits, with skeleton, viscera and region layers, for finding cases by pointing at where the problem is. Built from the Z-Anatomy model under CC BY-SA, with attribution printed under it.
- The case reader
- A DICOM viewer with the bindings radiologists already have in their hands: left drag for window/level, middle to pan, right to zoom, wheel to scroll the stack, and 1–4 for window presets. Series rail on the left, report and reference passages on the right. Window presets are CT-only by design.
- Collections
- Ordered teaching sets, so a session is a sequence someone assembled rather than a search someone has to repeat.
- Quiz with spaced repetition
- Cases become questions and the scheduler is FSRS, so a trainee sees a case again when they are about to forget it rather than on a fixed interval.
- Full-text search across reports and tags
- Over de-identified text only. Semantic search across the reference library is designed but not yet built; the library search is lexical today.
05 · Administration
Who may do what, and what was done
- Sign-in and invitations
- An open-source identity server ships with the installation. An admin invites someone by email address and hands them a join link, which grants exactly the role on the invitation. Invitations expire and can be revoked. No mail server is needed to issue one.
- Six ranked roles
- Viewer, resident, consultant, org admin, owner, and a vendor engineer role that confers nothing outside the one organisation. The last owner can be neither demoted nor removed.
- An append-only audit log
- Every state change is recorded and nothing can edit or delete a row — including the raw-upload deletion, which is what makes the 72-hour promise auditable rather than merely asserted. The audit log is complete today; the org-admin screen for reading it is in progress.
- AI assistance, and it must show its working
- Classification suggests taxonomy tags and must quote the passage in the report it drew each one from; structured extraction refuses a value it cannot quote. A suggested tag is always marked as unconfirmed and is never phrased as a finding, an impression or a diagnosis. AI runs against a self-hosted model on-premise.
- Usage and limits you can see
- Users, cases and storage are counted rather than estimated, and the hospital sees its own subscription and limits.
Not built
Designed, not present
- Sharing between hospitals
- The schema anticipates a shared teaching pool. Nothing implements it. Your archive is yours alone.
- Similar-case suggestions
- Specified, not built.
- Hybrid semantic search
- The reference library searches lexically today; embedding-based retrieval is designed and not yet configured.
- Hanging protocols and prior comparison
- Deliberately out of scope. They are the affordances of a reporting workstation, and RadBase should not be mistaken for one.