Physical Media. (Biggest problem in sharing medical data between institutions is still the legal situation, at least in Germany. You have to sign a lot of contracts, which have to be approved by your company's legal department.)

Hi Peter,

my company developed a web-based case sharing platform, called Case.io. You can share all kind of files, not only images. It was originally developed for the health sector. Therefore security is very important. You can create so-called cases and you decide with whom you will share them. You have the possibility to close a case if you don't want to share it anymore or you can have cases password protected. You can use Case.io as a single user for free. If you need more storage capacity than 100 MB or if you want to create a "Community" with a number of colleagues we will ask you to pay a license fee.

Is that what you are looking for? Give Case.io a try at www.case.io and start today - free of charge.

In respect of images used for research it is best to anonymise them - i.e. replace with a reference number anything that could identify the person to whom they relate. I've developed a software tool that cuts-out parts of a DICOM image containing patient names, but it's not a difficult task. Once you're dealing with anonymised images then the UK Data Protection Act doesn't apply, though clearly any list that relates a reference number to a person would have to be kept secret and secure. I suspect the same applies throughout Europe. This should simplify the legal process in terms of drafting contracts, but of course you will still need ethics approval to use the images and some form of IP agreement to cover things like copyright ownership, use, etc.

Once you're resolved the legal and ethical problems then the issue of transporting images from place to place is relatively easy depending upon the numbers and sizes involved. More challenging is the curation of images and the creation of datasets. I'm working on an open-source project that might prove helpful, but it will not be ready for release before the new year.

The biggest challenge is, without a doubt, is ensuring security of the information (which can apply to data sets as well as images) from one point to another. You also have to bear in mind that any computer that receives the data should also be secure.

To transfer files and data, once anonymised, I've often used freely available encryption software to create secure archives which I then send on to collaborators. They, of course, also require the password – I usually send this to them via means other than email, such as a text message (the theory being that should you email the password to them, an individual with unauthorised access to their system could simply use the password sitting in their inbox).

There's an excellent, free and very secure piece of encryption software called TrueCrypt (www.truecrypt.org) that might be worth having a look at.

Do bear in mind, however, that any data protection measures you use may need to have been specified in your original submission to an ethics committee (or your local equivalent) and would need to satisfy the conditions of local data protection laws!

It is not just a case of using strong cryptography and robust passwords. I fear the biggest danger is the innocent (or not so innocent) copying of images once they have been downloaded onto a collaborator's computer. Whatever technology you seek to employ is easily circumvented. For example, how do you stop someone taking a screenshot with their iPhone? Giving each collaborator a unique watermarked image would at least allow the source of any leaked image to be identified and so focus people's minds on the IP agreement they had signed. Does anyone know of any software that does this?

Regulations vary between countries but the overall goal is to protect patient privacy and medical information. Collaborators in the US have to anonymize any imaging results except in the case of medical treatment. Even with the use of anonymous images a trained radiologist familiar with a case can identify the subject of the images in certain circumstances.

The basics of data sharing, encryption, and transmission are all used to ensure digital security. Using tricks such as water-marking or stenography can be used to identify accidental or malicious release of image data but are only useful as a cleanup measure.

Physical media is only useful in the assumption that the media is in the possession of the proper party. Since the media can be copied and put on a server and usually is at the collaborator's site, the amount of security afforded is minimal. Generally the physical media used are exports from the scanner databases which are intended for medical use and are not equipped with any security measures. The use of physical media as a security measure is therefore only as good as security of possession. Of course, that works for gold bars too.

The real strength of image security and use is in the documentation and agreement between collaborators and institutions, where the proper use and ramifications are spelled out for all to agree. This procedure keeps all concerned mindful of the information that is being used and the purpose for which that information exists.

To summarize -

1) Document proper use and purpose for image data within the collaboration.

2) Anonymize immediately after any individual medical diagnostic use.

3) Store and transmit in a secure and robust fashion. Ad hoc solutions tend to fail due to lack of compliance by all the parties.

4) Follow up on the progress of the data used in the projects. Have a end-of-use date on the data to prevent image use after the collaborative project is finished.

Thanks all, your responses provide a lot of new insights. Currently we are using the CTP software from the RSNA to perform the anonimization. Indeed the transfer between institutions is stil hampered by the lack of proper rules and agreements. Therfore many transfer is done based on SFTP access. I would like hear more from other people how they handle this. XDS could also provide a good way of sharing and partly tackles the problem of the local copies sinces the images remain at the source.

Share anonymised data via web services.

Piórkowski A., Werewka J.: A Concept of eTraining Platform for Cardiology Learning based on SOA Paradigm. Proceedings of ICEIS 2012 - 14th International Conference on Enterprise Information Systems, pp 261-264.

Thanks Adam,

Interesting, could you share a link to the pdf of this proceedings paper?

Here is the paper. Any questions - please.

This issue is the drive of my research. You could see my recent paper about: Critical Knowledge Monitor System Model: Healthcare Context, Tiago Pereira and

Henrique Santos, 180 1488 at ECKM2012 Conference proceedings.

Cheers,

Tiago Pereira

Thanks Tiago,

It's moving more and more into my research area of interest also. Could you please provide a link to the paper you mentioned in your comment?

Regards,

Peter

Http://academic-conferences.org/eckm/eckm2012/eckm12-proceedings.htm

We use the dicom2usb hardware anonymizer quite alot especially for student projects and for preparing data for clinical trials. The typical user have access-right to the PACS clients.

The anonymization is simply achieved by putting a USB jump drive (USB flash drive) into the dicom2usb hardware , and sending the images from the PACS client (through an ordinary DICOM transfer). The default anonymization have rules for more than 200 tags. We typically chose to let the dicom2usb auto-name patients with its built-in counter. For clinical trials, where an identifier is supplied to us, we use the web interface to name aliases.

The simple export and anonymization of scans to a USB device makes the hardware much appreciated. See http://dicom-port.com

Best regards,

Jan

You can anonymize (de-identify) your patient DICOS scans using our software below:

https://www.stratovan.com/products/pro-surgical-3d?utm_source=rgps3d&utm_medium=ans&utm_campaign=anon2