De-identification
Removing identifying information from slides, reports, tables and on-screen chrome — and the several places identifiers hide that a filename rename will not reach.
What it is
De-identification in pathology has to cover four surfaces, and each fails differently. Three are about data at rest; the fourth is about what is visible on a screen, and it is the one that file-oriented controls never reach.
Images. A WSI file carries embedded metadata and, critically, a label image — a photograph of the physical slide label, which typically shows the accession number and sometimes the patient name. Renaming the file leaves this intact. Proper anonymisation strips or overwrites the metadata and label, which requires format-aware tooling.
Reports. Narrative text contains names, dates, accession numbers, and referring-clinician identities scattered through prose rather than in fields.
Tables. The subtle one. Even with names removed, accession numbers are identifying because their sequential and dated structure allows re-linkage. The group’s rule is that research exports use hashed accession IDs exclusively. Dates of service are similarly quasi-identifying and usually need shifting.
On-screen chrome — a fourth surface, and the one nothing here covered. Window titles, tab labels and status bars are not images, reports or tables, and none of the controls above touch them. A PACS or LIS window whose title bar carries a patient name leaks it to anything that can see the screen: a screen-sharing session, a recorded teaching video, a conference demo, a screenshot pasted into a ticket, or an observer study that records the desktop. The exposure is at display time rather than at rest, which is why file-oriented de-identification misses it entirely.
MouseTracks is the concrete example that surfaced this. It reads window titles via GetWindowTextW to identify which application is in focus, prints them to a live console and shows them in a GUI label — and does not persist them to its saved data. So the risk is not a file to clean up; it is text on a screen at the moment someone else is looking. Any instrument that observes the desktop rather than the application inherits this, which is a governance cost of the outside-the-viewer approach described on Reading-Behaviour Capture. The mitigation is on the source application — configuring the viewer to put an accession or study ID in the title bar rather than a name — not on the observing tool.
A design point worth stating: de-identification is not the same as anonymisation. If a lookup table linking hashed IDs back to real cases exists — and it usually must, for follow-up — the data is pseudonymised, and the lookup table itself becomes the sensitive asset requiring its own controls.
That last sentence now has a worked example inside the group’s own work, and it is the most instructive thing on this page. PembeBobrek contains a 74-row spreadsheet whose first column is the hospital accession number and whose second is the anonymised folder name used everywhere downstream. The images were pseudonymised correctly; the key was then committed to the same git repository, in its initial commit. The repository is private and the associated site is access-gated, so this is a governance failure rather than a disclosure — but the key now travels with every clone and every future collaborator, and history rewriting is a heavier remedy than deleting a file.
Two transferable lessons. The failure is in the storage location, not the technique — good pseudonymisation plus a co-located key equals no pseudonymisation, and the co-location is the easy mistake to make because the key is exactly what you need while the work is in progress. And an automated identifier scan will not catch this: that accession format is 7–10 characters, contains letters, and carries no run of six digits, so a regular-expression sweep for identifier-shaped strings passed it cleanly. What caught it was reading the column name. Schema review beats pattern matching for this class of problem.
What it looks like done properly — the first worked example on this page that is not one of our own failures. Every case above is something that went wrong here. Siebers 2026 — The Dutch Nationwide Pathology Databank (Palga) describes the opposite: the Dutch national pathology databank, 92 million records, pseudonymising through an external trusted third party in two steps. A first-order pseudonym is generated at the source department; a separate organisation (ZorgTTP) then converts it centrally into the final pseudonym. The encryption key is held outside the data holder entirely, so nobody inside Palga can re-identify anyone, no link to the original is retained, and the originals are not stored during the process. Researchers receive neither identifiers nor pseudonyms — only randomly assigned study numbers.
Read against the PembeBobrek failure, that is the same rule taken seriously: the mapping key is the sensitive asset, so it is placed where the people holding the data cannot reach it. Ours was committed beside the data it protected. The structural difference is not technique but custody, and custody is a thing an organisation arranges rather than a thing a tool does.
The same source supplies a second control this page has never named: small-cell suppression. Palga’s public aggregate database refuses to return a result for any query yielding 10 or fewer cases, because a sufficiently narrow query over aggregate counts re-identifies by intersection. Anything published here that lets a reader slice counts — a public dashboard, a supplementary frequency table, an atlas browsable by diagnosis and site — needs a threshold of this kind, and none of the group’s outputs currently states one.
The cost of doing it properly is on Record Linkage Under Pseudonymisation: once the real identifier is gone the join is probabilistic, and Palga ships a per-record uncertainty flag rather than pretending otherwise.
And the group already knew the rule — it is written into its own teaching material. The anonymisation wizard shipped with QuPath Atölye Extension states it under a heading titled scope and limits, honest: the generated original-to-pseudonym mapping file “contains original identifiers → it is personal data. Keep it somewhere secure and access-restricted; never share it with the anonymised slides.” That is exactly the rule the sibling repository broke. The conclusion to draw is therefore narrower and more useful than “the group needs to learn this”: the knowledge is documented, taught to workshop participants, and correct. What is missing is any mechanism that applies it at the moment a file is committed — which is why the fix below is a check, not a training item.
Why it matters for my work
This is a hard governance boundary in the repo, stated in several places. The onboarding warning is categorical: never commit patient identifiers, raw DICOM/SVS with embedded labels, or un-hashed accession numbers. Data stays out of git — large images, PHI, and raw exports live on the Memorial share, and only de-identified analysis-ready tables are committed.
Patoloji Bilgi Yönetim Sistemi (LIS) documents that all research pulls pass through the de-identification pipeline before touching a repo. A WSI anonymisation and imagebank preparation SOP exists at version 0.8 draft, owned by the research data governance team, covering file renaming, metadata stripping, lookup-table storage, and controlled sharing. The ecosystem notes list candidate tooling: wsi-anon (EMPAIA), wsianon, anonymize-slide-python3, svs-deidentifier, MedicalImageAnonymizer.
ScanTools is a sixth candidate, added 2026-07-25 and not adopted. It is worth reading even if it is not adopted, for two reasons. First, its deidentify is a derivative of anonymize-slide.py with macro redaction added — so it shows what the shortlisted anonymize-slide-python3 does and where it stops. Redaction is genuine: the label and macro strip bytes are overwritten with zeros, not merely unlinked. Second, it bundles the extraction tools next to the redaction tool, which is the shape the open question below is asking for.
Two cautions carry over to any tool chosen. Redaction that operates in place on the only copy of a clinical scan is a one-way operation on irreplaceable material — the safe order is copy, redact the copy, verify, then replace. scantools’s hashwsi is a usable verifier because it hashes a pyramid level rather than the file, so the hash survives redaction and an unchanged hash is evidence that that level’s pixels were untouched. It cannot see a change confined to a different level, so it fails towards false alarms rather than false reassurance. And any tool that decodes slide-label barcodes produces a CSV of accession numbers — that file is a re-identification key, not an output, and belongs on the share under the same controls as the hashed-ID lookup table, never in git.
Patoloji Atlası adds a publication-side rule: images from signed-out cases require a redaction pass before use, and the atlas is SEO-indexed so its content is public.
How it connects
Whole Slide Imaging — explains why image de-identification needs format-aware tooling rather than file operations.
Patoloji Bilgi Yönetim Sistemi (LIS) — the upstream system where the pipeline runs and where hashed accession IDs are issued.
Memorial WSI Share — the controlled location that exists precisely so identifiable data never needs to enter git.
Pathology Atlas Pipeline — where these rules are actually implemented in code, and the one place in the estate where a whole slide deliberately leaves the share; its anonymisation step is the gate.
DZI Web Publication — why anonymisation has to succeed before tiling rather than after: a published pyramid is static files on a public host, so a mistake is corrected by deleting everything already pushed.
WSI Format Conversion — the cheapest correctly-ordered moment to do this. A converter is already rewriting every byte and deciding which sub-images to keep, so dropping the label and macro and stripping acquisition metadata costs nothing extra there; it reaches all three surfaces above in one pass. The usual caveat holds — an anonymise checkbox is a claim, not a measured outcome.
Record Linkage Under Pseudonymisation — the price of doing this page’s job well: the better the pseudonym hides the person, the less reliably records can be reassembled into one patient, and that trade-off has to be chosen deliberately rather than discovered later.
OncoLens — a failure mode this page did not have a worked example of, from outside the group. Every case above concerns an artefact that exists and is stored in the wrong place: a label image, a mapping spreadsheet, a window title. That tool masks identifiers at render time while the dataframe underneath keeps the real values, with a toggle that turns the masking off. So there is nothing to store wrongly and nothing for a file scan to find — the control simply was never a control, only a display convenience being carried as one. Worth holding beside the fail-open anonymisation on Pathology Atlas Pipeline: both look like protection right up to the moment anyone checks, which is the argument for De-identification Release Gating’s insistence on measuring the released bytes.
Siebers 2026 — The Dutch Nationwide Pathology Databank (Palga) — a national infrastructure that holds the re-identification key outside the organisation holding the data; the reference design for the custody rule this page states in the abstract and the estate keeps breaking in practice.
Open questions
Third-party platform upload is not covered by the SOP. The v0.8 draft covers file renaming, metadata stripping, lookup-table storage, and controlled sharing — but not uploading slides to an external hosted platform. Free cloud WSI platforms exist and are attractive for teaching (see
sources/notes/dapa-digital-anatomic-pathology-academy.md), and “just upload the slide” is precisely the action that leaves the label image and embedded metadata intact. Worth an explicit clause before the situation arises rather than after. Where such a platform hosts its data is a second, separate question.The anonymisation SOP is still a 0.8 draft — what is blocking version 1.0? One clause it visibly needs: where the lookup table lives, and an explicit prohibition on committing it. The PembeBobrek case shows the rule is not currently enforced anywhere, and it is the cheapest possible addition to the draft.
Is there any routine check that a repository does not contain an identifier mapping? The PembeBobrek finding suggests not. A pre-commit hook matching on column names — accession, erişim, protokol, MRN — would be more effective than one matching on value patterns, for the reason given above.
The unifying question, and the one worth acting on first: is any de-identification control anywhere in the group actually verified? Two projects now say no, in different ways. Pathology Atlas Pipeline has anonymisation on by default that fails open — on failure it warns and publishes the original slide with its label image intact — and its test suite covers every part of the pipeline except that path. PembeBobrek pseudonymised the images correctly and committed the key beside them. Neither is a tooling problem, and neither would be caught by choosing a better anonymiser. Both are missing assertions: nothing checks that the label is gone before publishing, and nothing checks that a mapping file never enters a commit. Until that layer exists, every other question on this page is about which lock to buy while the door stands open.
Still unanswered, but it now has a page and a reference design. De-identification Release Gating sets out what the missing layer has to do — fail closed, return a status something reads, emit a tamper-evident artifact, and re-measure the released bytes rather than carry an earlier measurement forward. OpenMed implements three of those four and is worth reading for the shape even though it is not recommended for adoption. Two things transfer directly: it makes leaving any column unclassified a hard error, which is this page’s “schema review beats pattern matching” turned into a mandatory step; and it requires the caller to choose the privacy threshold rather than shipping a regulatory default. It also demonstrates the failure mode to guard against — its own l-diversity and t-closeness parameters do default, to values that can never fail, so they read as controls while asserting nothing. A default that cannot fail is worse than no default.
The ecosystem notes flag a real tension: anonymisation strips the scanner and resolution metadata that the schema wants captured for every model paper. Is that metadata extracted and stored before stripping? If not, it is being lost permanently. A concrete ordering that would fix this — extract label images, scan dates and a pyramid hash to CSV first, redact second, then verify the hash is unchanged — is now available off the shelf in ScanTools. Whether the SOP already does this is still not recorded. [unverified]
Which of the candidate anonymisation tools was actually adopted? Partly answered for the teaching side: Pathology Atlas Pipeline offers wsi-anon (EMPAIA) as its default and a vendored copy of anonymize-slide (the
anonymize-slide-python3lineage) as the fallback, with anonymisation enabled by default. Whether the research imagebank’s v0.8 SOP uses the same tooling or a separate path is still unrecorded.[unverified]The metadata question now has its complementary half answered, and a concrete ordering rule falls out. QuPath Atölye Extension’s anonymisation wizard does the operation
anonymize-slidedoes not: it copies the slide (preserving the pyramid) and redacts PHI keys inside the TIFFImageDescriptionviatifffile. Its redaction list isfilename, title, patient, patientname, name, case, barcode, id, slideid, date, time, scanscope id, user, label— and reading that list settles the tension this page has been circling.MPPandAppMagare not on it, so pixel size and magnification survive, which is what Mitotic Count needs for area-calibrated counting.dateandtimeare on it, which is exactly what ScanTools exists to extract and what Scanner Log Analysis needs. So the ordering is not a preference, it is forced: extract scan date and scanner metadata to a table first, redact second. Run in the other order and the timestamps are gone for good. The wizard is also explicit that it does not remove the label or macro image — it names its own ceiling as Level I plus metadata redaction and points at wsi-anon, tifftools and ImageDePHI for the rest, citing Bisson 2023’s five-level framework. Used alone it is not sufficient; used in the right order alongside a label-stripping tool, the two halves compose. A tool that refuses to overstate itself is worth more than one that claims completeness — the contrast with the fail-open behaviour on Pathology Atlas Pipeline and the destructive in-placedeidentifyin ScanTools is stark, and all three are in the same estate.A five-level framework exists and this page has none. The wizard cites Bisson 2023 for a levelled model of anonymisation completeness, and names which level a copy-and-rename reaches versus a metadata redaction. Adopting an explicit level vocabulary would let every tool on this page be labelled with what it actually achieves instead of being described in prose.
[unverified]— the framework is cited in the wizard’s header and has not been read here.Does anonymisation actually strip metadata, or only the label? Reading the vendored
anonymize-slidesource: it deletes the SVS label directory, the NDPI macro image and the MRXS slide barcode, and touches nothing else —ImageDescriptionand scanner metadata survive. That contradicts the ecosystem notes’ assumption that anonymisation is what destroys the resolution metadata Mitotic Count needs, at least for this path. The EMPAIA library is labelled “comprehensive” in that pipeline’s GUI and was not inspected.[unverified]Worth settling, because the two readings point at opposite conclusions about whether scanner metadata is recoverable. Still open — ScanTools adds a candidate, it does not answer this.