How to de-identify DICOM scans in the browser before upload

A DICOM study can carry patient identifiers alongside the image pixels. That is useful inside a clinical record system and risky when a scan is sent to a web service for another purpose. A browser-side de-identification step addresses part of that risk: it removes selected identifiers on the user’s device before the scan is uploaded.

Read Your Scan says it strips patient names, patient IDs and dates in the browser before anything is uploaded. The service accepts DICOM folders, among other scan formats, and can analyze an uploaded scan with a radiologist’s report. Here is how to think through that workflow—and what the browser step does not settle.

Start with the right source files

Use the DICOM files from the exam, such as the folder from a hospital CD. A DICOM study is more than a stack of pictures: its files can include tags describing the patient, study and acquisition. If you only have a phone photo of an X-ray, it is a different input and does not retain the coverage or image information of a full DICOM exam. The distinction matters when deciding what can be reviewed; the difference between a photo and a DICOM study is worth keeping in mind.

Before selecting files, check that you are working with the intended exam and have permission to process and share it. Do not treat de-identification as a substitute for consent, authorization or your organization’s handling rules.

Let the browser remove identifiers before upload

With Read Your Scan, the stated process strips patient name, patient ID and dates in the browser before the scan is uploaded. In practical terms, the browser handles that step locally, before the data reaches network storage. That is the key boundary: identifiers are removed before transmission, rather than being sent first and cleaned up later.

Upload the DICOM study through the service’s scan workflow. Read Your Scan also accepts NIfTI files, X-ray images and report PDFs, but those are different file types and should not be assumed to pass through the same DICOM-tag process. If the service is being used to understand a radiologist’s findings, the report can be added separately as text or a PDF.

Do not confuse de-identification with complete anonymity

Removing names, IDs and dates lowers direct identification risk. It does not prove that every identifying detail has been removed from every part of a study. Other DICOM tags may contain information that could identify someone, and identifiers can also be burned into image pixels. A scan may be recognizable from its clinical details or from information held elsewhere.

That is why “remove PHI from DICOM” is not a single checkbox question. A browser step that removes named fields is useful, but it is not the same as a complete audit of every tag, image and accompanying document. Read Your Scan’s description identifies the fields it strips; it does not establish that every possible identifier or unusual private tag is removed.

Pay separate attention to the report. A PDF or pasted report may contain a patient name, date of birth, facility details or other identifiers in its text or document properties. Do not assume that a DICOM-specific browser process also sanitizes a separate report. Follow the applicable authorization and data-handling policy before adding one.

Review the result as a clinical aid, not a clearance certificate

After upload, Read Your Scan provides an AI-assisted explanation of findings, scores them by severity and maps them onto images. Its stated workflow can also compare an AI reading of the scan with the radiologist’s report. Use that output to understand what the report says and prepare questions for the clinician; it is not a diagnosis or proof that the study is safe to disclose.

For practice teams, record which files were sent, who authorized the transfer and what retention or deletion rules apply. Read Your Scan says data is encrypted in transit and at rest, and that users control deletion. Those are relevant safeguards, but they do not replace an organization’s own review of its legal basis, vendor terms, access controls and retention obligations.

What this means for a GDPR-compliant workflow

Browser-side DICOM de-identification can reduce exposure by keeping selected identifiers from reaching the upload step. GDPR compliance, however, depends on the whole processing activity: the purpose, lawful basis, data minimization, access, retention, processor arrangements and any applicable safeguards. A de-identified scan may still be personal data if re-identification remains possible.

So use the browser step as one control, not the whole privacy program. Confirm what information is removed, consider identifiers in pixels and separate files, and apply your organization’s review before sharing patient imaging online. That is the practical route to a safer upload—and a more honest account of what “anonymized” can mean.