Enable a De-ID Profile for a Project, Group, or Site
Introduction
Flywheel has added the ability to enable de-ID profiles for a project, group, or entire Flywheel site. These de-ID profiles help ensure DICOM data is de-identified according to your institution's policies and that PHI is not exposed in your Flywheel environment. This feature also allows admins to have full control of the de-identification process, so users can upload data without having to create a de-ID profile on their own.
Site, group, and project de-ID profiles are available on version 15.3.0 or later. Site Admins can contact Flywheel support for help upgrading your site to the latest version.
Instruction Steps
How does it work?
De-id profiles currently support de-identifying DICOM data. Learn more about what can be de-identified through the de-ID profile.
The de-identification rules set in the profile cascade down to the levels below it in the Flywheel hierarchy. This means that the site de-ID profile applies to all groups and projects, and the group de-ID profile applies to all projects within that group. You can also upload a blank de-ID profile at the project level to exclude it from de-identification.
When you import data, Flywheel first looks at the target project. If a valid de-ID profile exists, the data is de-identified according to that profile. If no profile exists at the project level or it is not a valid profile, Flywheel looks to the group level, and finally the site level. In the event that there is no valid de-identification profile set at any of these levels, the upload is rejected.
Validation
Flywheel evaluates de-ID profiles at each level and verifies that they are:
- A valid YAML file
- A valid Flywheel de-identification profile
If the attached profile fails validation, Flywheel checks the next level as defined above. If there are no valid de-ID profiles at any level, Flywheel rejects the upload. Learn more about creating a valid de-identification profile and supported actions.
Step 1: Enable De-ID Profiles
Enable de-ID profiles at the project, group, or site level.
Project
To add a de-ID profile that applies to a single project:
- Sign in to Flywheel as a project admin or a user with a custom role and the Manage Project Settings permission.
- Select the project to apply de-ID profile
-
Click the options menu in the top menu, and choose Settings
-
Click Upload Profile, and select your de-ID profile.
-
Flywheel validates the profile. An errors appear if the de-ID profile is not valid yaml, or if Flywheel does not recognize a DICOM tag.
For example, the error below shows a misspelled DICOM keyword. Updating the profile to use
PatientName
will make it a valid de-ID profile. -
De-id profiles are now enabled for this project.
In the future, if you wish to change the de-ID profile for the project, you can click Replace, and upload a new version.
See the considerations below for supported data upload methods.
Group
Contact Flywheel support to add a de-ID profile to a group.
Site
Contact Flywheel support to add a de-ID profile to your site.
Step 2: Test Your De-ID Profile
Once you have uploaded your de-ID profile, test it to make sure it de-identifies data as expected.
- Find a dataset that does not include real sensitive information and download it to your computer.
-
In Flywheel, select Upload DICOM from the left menu.
-
From the dropdown menu, choose a project with your de-ID profile enabled.
- Select some DICOMs from the dataset from step 1.
-
Review the upload preview. The de-ID profile has not been applied yet, so these labels are from the original data.
-
Click Upload Data. The de-ID profile is applied.
- Once complete, click Go to Project.
- Review the DICOM tags for an acquisition by selecting the information icon or Selecting View DICOM study and clicking Tags.
Disable De-Identification
Caution
Bypassing the de-identification profiles on your Flywheel site may result in unintended PHI in your Flywheel environment. Proceed with caution.
To avoid using the site or group de-identification profiles, you can attach a valid, blank YAML file to your project.
-
Copy and paste the following profile into a plain text editor (for example: Sublime, TextEdit, or Notepad).
-
Save as
deid_profile.yaml
. - Upload to a project you do not want de-identified.
Considerations
- Data uploaded directly from an imaging machine (using the Flywheel Connector) is de-identified according to the de-ID profile associated with that machine. Project, group, and site de-ID profiles do not apply.
- Uploads will be rejected if de-ID profiles are enabled and there is not a valid profile.
- When you enable de-ID profiles, the profile is only applied to new data. Any data that already exists in Flywheel is not de-identified. You must re-upload the data if you want to apply the de-ID profile.
- When you replace a de-ID profile, the new profile is only applied to new data. Any existing data is not de-identified using the new profile.
- Users with permission to view project settings will be able to see the de-ID profile. You can view permissions for each role on the Roles page in Flywheel.
Data Upload Methods
Supported Upload Methods
- CLI commands:
- DICOM uploader*
- Connectors (note that these have their own de-ID profiles)
* There are additional steps needed to ensure the de-ID profile is applied correctly. See the linked articles for more details.
Unsupported Upload Methods
The following upload methods will NOT apply the site, group, or project de-ID profile, which could lead to PHI in the project.
- CLI commands:
- ingest project
- fw upload
- Attaching files
- Moving sessions or acquisitions between projects