From “send to teaching” to a case your registrars can search
Nine stages. The first six happen without anyone watching; the seventh is the one where a consultant puts their name to it, and nothing reaches the archive without that. Here is each one, in the order it happens, and what it is protecting against.
Stage 1 of 9
The study arrives, and goes somewhere nobody can read
Two ways in. Both land in the same place, and neither skips anything below.
You can upload from a browser — a ZIP of the study, a DICOMDIR, or loose files, with the report pasted in or attached as a PDF. Or, if the gateway is commissioned at your hospital, you do “Send to → TEACHING” from the workstation you already report on, and the study arrives by DICOM C-STORE.
Whichever route it takes, it lands in a quarantine store. That store is not a folder with a warning label on it: the application’s storage credential has no read access to it whatsoever. One process can read it — the de-identification worker — and that is enforced with separate credentials rather than by anyone remembering not to.
A study sent from PACS gets no trusted-source exemption. It enters at the next stage exactly as an upload does.
Stage 2 of 9
It is parsed, and rejected if it is not what it claims to be
Before anything is stripped, the worker establishes what it is holding.
The worker reads the quarantined files, validates that they are DICOM, and builds the study, series and instance tree. Files that are not DICOM, files that are corrupt, and studies with no image instances at all are rejected here with a reason, rather than half-processed.
Stage 3 of 9
The headers are rebuilt from nothing
An allowlist, not a denylist. This distinction is the whole stage.
A denylist says “remove the patient name, the birth date, the address”. It fails the first time a scanner vendor writes a name into a private tag nobody enumerated — and vendors do this constantly.
So the worker starts with an empty output dataset and copies in only what is explicitly permitted, following the DICOM PS3.15 Annex E confidentiality profile. Ages are banded rather than exact. Dates are shifted, consistently within a study, so the interval between two examinations survives while the actual date does not. Instance identifiers are remapped. Private groups and overlay groups are removed outright.
What stays is what teaching needs: modality, body part, the acquisition parameters, the geometry.
Stage 4 of 9
The pixels are read, and what is found is blacked out
This is the stage that is most commonly botched, and the reason the product exists.
Headers are the easy half. The patient banner burned across the top of an ultrasound frame, the institution strip on a screen capture, the accession number a technologist typed into an annotation — none of that is in a tag. It is in the image.
The worker runs optical character recognition across the pixel data, locates text that matches the shapes an identifier takes, and blacks those regions out in the stored pixels. Not an overlay. Not a crop applied at display time that a different viewer would ignore. The pixels that leave this stage no longer contain the text.
Where the worker finds text it cannot confidently classify, it does not guess and it does not silently pass: the instance is routed to a human reviewer with the detection marked. The guarantee here is that nothing gets through unseen — which is a narrower and more honest claim than “the OCR catches everything”.
Stage 5 of 9
The report is rewritten, and still reads like a report
Replace, never delete.
Text is extracted from the PDF, the DOCX or the pasted report, and identifier shapes are found locally — nothing is sent anywhere to do this. Names become [NAME]. Record numbers become [MRN]. National identity numbers, phone numbers, dates, clock times, institution names and accession numbers each get their own placeholder.
The sentence keeps its shape. “Comparison is made with the study of [DATE] performed at [HOSPITAL]” still teaches; a sentence with a hole in it does not, and a sentence that has been deleted teaches nothing at all. It also means a reviewer scanning the redacted text can see exactly where identity used to be.
Every placeholder is upper-case and contains no digits, on purpose: no recogniser can match one, so running an already-redacted report through again is a no-op rather than a nest of brackets.
The honest limit: regular expressions cannot find a name. Name and institution detection rests on the word list collected when your hospital is set up, and that is exactly why stage 7 is not optional.
Stage 6 of 9
The de-identified study is written to the archive
The first moment the application can see any of this.
The de-identified images and report are written to the archive store and the DICOM server. The case status becomes “review pending”. It is not visible to anyone browsing, it is not searchable, and it is not in anyone’s quiz.
The raw upload is still sitting in quarantine at this point, untouched, and its 72-hour clock has been running since it arrived.
Stage 7 of 9
A consultant looks at it and puts their name to it
The gate. There is no version of this product without it.
The reviewer is shown every key image at full resolution, the list of every detection the pixel stage made and the redaction applied to each, and a diff of the report text before and after. They can pass it, draw further redaction boxes, crop an ultrasound banner, or reject the case outright.
To pass it they must explicitly record that no identifiers remain. That record carries their name and the time. There is no automatic pass, no bulk approve, and no way to publish around this screen.
For ultrasound, screen captures, mammography, angiography, fluoroscopy and anything filed under an unspecified modality — the places burned-in text is normal rather than exceptional — the person who uploaded the case may not be the person who passes it. That rule is enforced at the decision and again at publish, so it cannot be routed around.
Stage 8 of 9
It publishes, and the raw copy is destroyed
A hard delete, logged.
On pass, the case becomes visible according to its visibility setting — inside your hospital, and only inside your hospital. The quarantine object is hard-deleted: no versioning, no lifecycle transition to cold storage, nothing to restore. The deletion is written to the audit log, and a database view exists specifically to surface any quarantine object that is still there when it should not be.
If the case is rejected, or if nobody ever gets to it, the raw upload is purged anyway. Seventy-two hours from arrival, regardless of review state. An unreviewed case eventually becomes unrecoverable, and that is the intended behaviour rather than a bug.
Stage 9 of 9
Only now does anything clever run
Enrichment sees de-identified text, or it does not run.
Structured extraction pulls findings and measurements out of the report, and AI classification suggests taxonomy tags. Both run at the end, on the de-identified text, and never on anything else.
A suggested tag is marked as suggested — a dashed outline, an open-diamond mark and the word, so it survives a monochrome screenshot pasted into a teaching slide — and it must carry the passage from the report it was drawn from. Extraction refuses a value it cannot quote. Nothing here is ever phrased as a finding, an impression or a diagnosis.
Afterwards
What the archive is once the pipeline is done with it
A published case is browsable across ten facets with live counts, findable by pointing at a 3D body, readable in a DICOM viewer with the bindings you already have in your hands, collectable into ordered teaching sets, and answerable as a quiz question that a spaced-repetition scheduler brings back when a trainee is about to forget it.
All of that is inside your hospital. There is no shared pool, no cross-hospital visibility, and no route by which a case leaves.