Flywheel has added the ability to enable de-id profiles for a project, group, or your entire Flywheel site. These de-id profiles help ensure DICOM data is de-identified according to your institution's policies and that PHI is not exposed in your Flywheel environment. This feature also allows admins to have full control of the de-identification process, so users can upload data without having to create a de-id profile on their own.
This article:
Site, group, and project de-id profiles are available on version 15.3.0 or later. Site Admins can contact Flywheel support for help upgrading your site to the latest version.
De-id profiles currently support de-identifying DICOM data. See our de-id profile article for details on what can be de-identified through the de-id profile.
The de-identification rules set in the profile cascade down to the levels below it in the Flywheel hierarchy. This mean that the site de-id profile applies to all groups and projects, and the group de-id profile applies to all projects within a group. However, it is also possible to upload a blank de-id profile at the project level to exclude it from de-identification.
When you import data, Flywheel first looks at the target project. If a valid de-id profile exists, the data is de-identified according to that profile. If no profile exists at the project level or it is not a valid profile, Flywheel then looks to the group level and finally the site level. In the event that there is no valid de-identification profile set at any of these levels, the upload is rejected.
In addition to checking for the existence of a profile, Flywheel also evaluates profiles attached at each level and verifies that they are:
-
A valid YAML file
-
A valid Flywheel de-identification profile
If the attached profile fails validation, Flywheel checks the next level as defined above. If there are no valid de-id profiles at any level, Flywheel rejects the upload. See our documentation for information on creating a valid de-identification profile and supported actions.
Enable de-id profiles at the project, group, or site level.
To add a de-id profile that applies to a single project:
-
Sign in to Flywheel as a project admin or a user with a custom role and the Manage Project Settings permission.
-
Select the project the de-id profile applies to
-
Click the options menu in the top menu, and choose Settings
-
Click Upload Profile, and select your de-id profile.
-
Flywheel validates the profile. An errors appear if the de-id profile is not valid yaml, or if Flywheel does not recognize the DICOM tag.
For example, the error below shows a misspelled DICOM keyword. Updating the profile to use
PatientNamewill make it a valid de-id profile.
-
De-id profiles are now enabled for this project!
In the future, if you wish to change the de-id profile for the project, you can click Replace, and upload a new version.
See the considerations below for supported data upload methods.
Contact Flywheel support to add a de-id profile to a group.
Contact Flywheel support to add a de-id profile to your site.
Once you have uploaded your de-id profile, you should test it to make sure it de-identifies data as expected.
-
Find a dataset that does not include sensitive information and download it to your computer.
-
In Flywheel, select Upload DICOM from the left menu.
-
From the dropdown menu, choose a project with de-id profiles enabled.
-
Select a handful of DICOMs from the dataset you downloaded in step 1.
-
Review the upload preview. The de-id profile has not been applied yet, so these labels are from the original data.
-
Click Upload Data.
The de-id profile is applied once you select Upload Data
-
Once complete, click Go to Project.
-
Review the DICOM tags for an acquisition by selecting the information icon
or Selecting View DICOM study and clicking Tags.
Warning
Bypassing the de-identification profiles on your Flywheel site may result in unintended PHI in your Flywheel environment. Proceed with caution.
To avoid using the site or group de-identification profiles, you can attach a valid, blank YAML file to your project:
-
Copy and paste the following profile into a plain text editor (for example, Sublime, TextEdit, or Notepad)
{
"dicom": {
"fields": []
}
} -
Save as
deid_profile.yaml. -
Upload to a project you do not want de-identified.
-
Data uploaded directly from an imaging machine (using the Flywheel Connector) is de-identified according to the de-id profile associated with that machine. Project, group, and site de-id profiles do not apply.
-
Uploads will be rejected if de-id profiles are enabled and there is not a valid profile.
-
When you enable de-id profiles, the profile is only applied to new data. Any data that already exists in Flywheel is not de-identified. You must re-upload the data if you want to apply the de-id profile.
-
When you replace a de-id profile, the new profile is only applied to new data. Any existing data is not de-identified using the new profile.
-
Users with permission to view project settings will be able to see the de-id profile. You can view permissions for each role on the Roles page in Flywheel.
Table 1. Supported data upload methods
|
Supported |
Unsupported |
|---|---|
|
The following upload methods will NOT apply the site, group, or project de-id profile, which could lead to PHI in the project.
|