Unmasking a Privacy Concern: Potential Identification of Patients in an Immobilization Mask from 3-Dimensional...

Previous studies have demonstrated that patients can be identified from 3-dimensional (3D) reconstructions of computed tomography (CT) or magnetic resonance imaging data of the brain or head and neck. This presents a privacy and security concern for scan data released to public data sets. It is unknown whether thermoplastic immobilization masks used for treatment planning in radiation therapy are sufficient to prevent facial recognition. Our study sought to evaluate whether patients with an immobilization mask could be identified on 3D reconstructions of scan data. Our study reconstructed 3D images from simulation CT (SIM-CT) scans of 35 patients and compared these to original patient photographs to test if the thermoplastic mask obfuscated facial features. Blind review from 4 facial recognition algorithms and a human (radiation oncologist) was evaluated for the ability to match 3D reconstructions of patients scans to patient images. The matching procedure was repeated against an expanded testing data set of the 35 patient photographs plus 13,233 facial photographs from the "Labeled Faces in the Wild" data set (13,268 photographs in total). Facial recognition algorithms were able to match a maximum of 83% (range, 60%-83%) of patients to the corresponding images. Radiation Oncologist blinded review correctly matched 80% of patients to the corresponding images. Ethnicity and facial hair were the most common reasons for patient mismatch. In the expanded testing data set, algorithms were also able to match a maximum of 83% (range, 57%-83%) of patients. The majority of patients were able to be identified through computer algorithm or human review even under a SIM-CT mask. These results suggest there is a potential privacy and security concern when SIM-CT data are released to publicly available data sets.