Skip to content

Enable a De-ID Profile for a Project, Group, or Site

Introduction

Flywheel has added the ability to enable de-ID profiles for a project, group, or entire Flywheel site. These de-ID profiles help ensure DICOM data is de-identified according to your institution's policies and that PHI is not exposed in your Flywheel environment. This feature also allows admins to have full control of the de-identification process, so users can upload data without having to create a de-ID profile on their own.

Site, group, and project de-ID profiles are available on version 15.3.0 or later. Site Admins can contact Flywheel support for help upgrading your site to the latest version.

Instruction Steps

How does it work?

De-id profiles currently support de-identifying DICOM data. Learn more about what can be de-identified through the de-ID profile.

The de-identification rules set in the profile cascade down to the levels below it in the Flywheel hierarchy. This means that the site de-ID profile applies to all groups and projects, and the group de-ID profile applies to all projects within that group. You can also upload a blank de-ID profile at the project level to exclude it from de-identification.

When you import data, Flywheel first looks at the target project. If a valid de-ID profile exists, the data is de-identified according to that profile. If no profile exists at the project level or it is not a valid profile, Flywheel looks to the group level, and finally the site level. In the event that there is no valid de-identification profile set at any of these levels, the upload is rejected.

de-identification profile hierarchy

Validation

Flywheel evaluates de-ID profiles at each level and verifies that they are:

  • A valid YAML file
  • A valid Flywheel de-identification profile

If the attached profile fails validation, Flywheel checks the next level as defined above. If there are no valid de-ID profiles at any level, Flywheel rejects the upload. Learn more about creating a valid de-identification profile and supported actions.

Step 1: Enable De-ID Profiles

Enable de-ID profiles at the project, group, or site level.

Project

To add a de-ID profile that applies to a single project:

  1. Sign in to Flywheel as a project admin or a user with a custom role and the Manage Project Settings permission.
  2. Select the project to apply de-ID profile

  3. Click the options menu in the top menu, and choose Settings

    ProjectOptionsMenuSettingsh.png

  4. Click Upload Profile, and select your de-ID profile.

    UploadDe-idProfile_projects-Notenabled.png

  5. Flywheel validates the profile. An errors appear if the de-ID profile is not valid yaml, or if Flywheel does not recognize a DICOM tag.

    For example, the error below shows a misspelled DICOM keyword. Updating the profile to use PatientName will make it a valid de-ID profile.

    deid_profileTagError.png

  6. De-id profiles are now enabled for this project.

In the future, if you wish to change the de-ID profile for the project, you can click Replace, and upload a new version.

See the considerations below for supported data upload methods.

Group

Contact Flywheel support to add a de-ID profile to a group.

Site

Contact Flywheel support to add a de-ID profile to your site.

Step 2: Test Your De-ID Profile

Once you have uploaded your de-ID profile, test it to make sure it de-identifies data as expected.

  1. Find a dataset that does not include real sensitive information and download it to your computer.

  2. In Flywheel, select Upload DICOM from the left menu.

    DICOMUploader-export.png

  3. From the dropdown menu, choose a project with your de-ID profile enabled.

  4. Select some DICOMs from the dataset from step 1.

  5. Review the upload preview. The de-ID profile has not been applied yet, so these labels are from the original data.

    ReviewDICOMUploader.png

  6. Click Upload Data. The de-ID profile is applied.

  7. Once complete, click Go to Project.
  8. Review the DICOM tags for an acquisition by selecting the information icon or Selecting View DICOM study and clicking Tags.

Disable De-Identification

Caution

Bypassing the de-identification profiles on your Flywheel site may result in unintended PHI in your Flywheel environment. Proceed with caution.

To avoid using the site or group de-identification profiles, you can attach a valid, blank YAML file to your project.

  1. Copy and paste the following profile into a plain text editor (for example: Sublime, TextEdit, or Notepad).

    1
2
3
4
5
    {  
"dicom": {  
"fields": []  
}  
}

  2. Save as deid_profile.yaml.

  3. Upload to a project you do not want de-identified.

Considerations

  • Data uploaded directly from an imaging machine (using the Flywheel Connector) is de-identified according to the de-ID profile associated with that machine. Project, group, and site de-ID profiles do not apply.
  • Uploads will be rejected if de-ID profiles are enabled and there is not a valid profile.
  • When you enable de-ID profiles, the profile is only applied to new data. Any data that already exists in Flywheel is not de-identified. You must re-upload the data if you want to apply the de-ID profile.
  • When you replace a de-ID profile, the new profile is only applied to new data. Any existing data is not de-identified using the new profile.
  • Users with permission to view project settings will be able to see the de-ID profile. You can view permissions for each role on the Roles page in Flywheel.

Data Upload Methods

Supported Upload Methods

* There are additional steps needed to ensure the de-ID profile is applied correctly. See the linked articles for more details.

Unsupported Upload Methods

The following upload methods will NOT apply the site, group, or project de-ID profile, which could lead to PHI in the project.