Anonymize DICOM files

How to anonymize

1. Choose the options. With none ticked, the strictest version of the profile is applied.
2. Choose your .dcm files. Select every file of a study together: the new Study, Series and Frame of Reference UIDs are matched between files, so the series still hangs together.
3. Read the preview. Each removed, emptied or replaced attribute is listed with its old and new value. The last section shows everything that is still in the file.
4. Look at the images, tick the box and download a single file or a .zip. Output files are named anonymized-001.dcm and so on, because a file name is often a patient name.

What the Basic Confidentiality Profile does

The profile is Table E.1-1 of DICOM PS3.15 (edition 2026d), built into this page as data. For each attribute it lists, the tool does one of these:

• Remove it: names of physicians and operators, descriptions typed by people, comments, addresses, telephone numbers and similar.
• Empty it: patient name, birth date and accession number are kept as empty fields, because many readers expect them to exist.
• Replace with a dummy value: a harmless placeholder such as ANONYMOUS or 19000101 where the standard needs a value to be present.
• Replace UIDs: Study, Series, SOP Instance, Frame of Reference and the other UIDs are replaced by new random ones. The same old UID always becomes the same new UID within one run, including references inside sequences.

Beyond the table, the tool also:

• removes every private attribute (vendor-specific data in odd-numbered groups), at any depth in a sequence, because their content is unknown;
• removes retired group-length elements, overlay data and overlay comments, and curve data, which can hold text;
• writes a new file header: the 128-byte preamble is zeroed and the File Meta Information is rebuilt, as PS3.15 asks, so that application entity titles and software details do not leak;
• sets Patient Identity Removed (0012,0062) to YES and records the method in De-identification Method (0012,0063);
• copies pixel data, byte for byte, including compressed frames.

Some attributes have a combined code in the standard (for example "remove, or empty, or dummy depending on the IOD"). A file does not say which applies, so the tool picks the action that keeps the file valid in every case: empty for X/Z, dummy for X/D, Z/D and X/Z/D.

What it does not do

• It does not change pixels. Ultrasound, secondary captures, screenshots, some X-ray and endoscopy images carry the patient name or date inside the picture. The check list above warns when the file says so, but it cannot see text in the image. A CT or MR of the head can also be reconstructed into a recognisable face.
• It does not clean embedded documents (PDF, CDA, 3D models). If a file holds one, you get a warning and should not share it.
• It does not rewrite free text it does not know about. Only attributes in the profile are handled. A value in an unlisted attribute stays, which is why the full list of what remains is shown.
• It does not keep a way back. No mapping is stored, so you cannot recover the original UIDs from the output. Keep the originals.
• It does not guarantee compliance with HIPAA, GDPR or your hospital's rules. Those depend on your situation and on who receives the data. Ask your privacy officer if in doubt.
• It refuses a DICOMDIR (the index file of a disc), because its offsets would break and it names the patient in many places. See what a DICOMDIR is.
• Deflated transfer syntax files are not supported yet.

Sources

• DICOM PS3.15 Annex E, Attribute Confidentiality Profiles (Table E.1-1, E.1.1 on file meta information).
• DICOM PS3.5 Annex B, Creating a Privately Defined Unique Identifier (the UUID-derived 2.25 UIDs used for replacements).
• DICOM PS3.10 chapter 7, DICOM File Format (the File Meta Information that is rebuilt).

Related: DICOM tag viewer to see which tags a file holds, and the viewer to look at the images.