Advancing Data Privacy Under GDPR: A Bayesian Approach to Structured Risk Quantification in Medical DICOM Data.

Area of Science:

• Medical Informatics
• Data Privacy
• Radiology

Background:

• Radiology departments collect extensive patient data in DICOM format for care and research.
• This data contains Personally Identifiable Information (PII) and non-PII attributes requiring privacy assessment.
• Current expert-based risk assessment lacks systematic, data-driven methods, leading to inconsistencies.

Purpose of the Study:

• To develop a systematic, data-driven pipeline for quantifying privacy risks in DICOM attributes.
• To address the limitations of traditional, expert-reliant privacy assessment methods.
• To promote consistent and reproducible data protection practices in healthcare.

Main Methods:

• A Bayesian-driven pipeline integrating topic modeling and synthetic data generation.
• Hierarchical Bayesian inference to quantify privacy risk scores for individual DICOM attributes.
• Identification of direct and quasi-identifiers within DICOM data.

Main Results:

• Quantified privacy risk scores for individual DICOM attributes.
• Successfully identified high-risk direct attributes.
• Discovered several quasi-identifiers posing privacy risks.

Conclusions:

• The proposed method offers a structured, evidence-based strategy for privacy risk assessment in DICOM data.
• This approach enhances consistency and reproducibility in data protection practices.
• Facilitates better mitigation of privacy concerns in healthcare data management.