Cybersecurity & PHI
- Protected health information (PHI) is any health data tied to a person — names, dates, medical record numbers, and yes, the images and metadata too.
- Imaging is uniquely leaky: a CT or MRI file carries patient identifiers baked right into its header, and a face can be reconstructed from a head scan.
- HIPAA's three big buckets are the Privacy Rule (who may see PHI), the Security Rule (how you protect electronic PHI), and the Breach Notification Rule (what you do when it leaks).
- "Minimum necessary," strong authentication, encryption, and audit logs are the everyday tools — most breaches are boring human mistakes, not master hackers.
- De-identification isn't just deleting a name; pixels and metadata both have to be scrubbed, and a head scan needs the face removed too.
Here's an uncomfortable truth about radiology: you spend years learning to read the picture, and then one day you realize the picture has been quietly reading you back. Every image you generate is wrapped in a layer of personal information, stored on networked computers, and shuttled around a hospital like a very expensive interoffice memo. Keeping all of that from leaking is its own discipline, and it has surprisingly little to do with looking at scans.
Think of PHI like a wallet you can never put down. You can hand it to people who need it, you can lock it in a drawer, but the second you leave it on a coffee shop table, it's a problem — and in healthcare, "the coffee shop table" is usually an unencrypted laptop or a misconfigured server.
What counts as PHI (it's more than the name)
Protected health information (PHI) is health data that can be linked back to an individual. The catch is how many things count as a link. HIPAA — the Health Insurance Portability and Accountability Act — lists eighteen identifier categories, and they go well past the obvious. Names, sure. But also dates (birth, admission, even the study date), full-face photos, biometric identifiers, device serial numbers, and any unique number that points at one human, like a medical record number or accession number.
For radiology this is sneaky, because the identifiers live in two places at once: the pixels (the actual image) and the metadata (the DICOM header riding along with it). You can scrub the visible name off a screenshot and still be handing over a file whose header proudly announces the patient's name, date of birth, and referring physician. If DICOM headers are new territory, the DICOM deep dive is worth a detour — that header is exactly where the identifiers hide.
A head or facial CT/MRI can be used to reconstruct a recognizable face. So "I removed the name from the header" is not the same as "this is anonymous." For brain and face imaging, true de-identification usually means defacing or skull-stripping the pixels too.
HIPAA in three buckets
HIPAA is enormous, but for our purposes it breaks into three rules that are easy to keep straight.
| Rule | The one-line job | Radiology example |
|---|---|---|
| Privacy Rule | Governs who may use or disclose PHI, in any form. | Not pulling up your neighbor's scan out of curiosity. |
| Security Rule | Governs how you protect electronic PHI (ePHI). | Encryption, passwords, audit logs on PACS. |
| Breach Notification Rule | Governs what to do when PHI is exposed. | Reporting a lost, unencrypted hard drive. |
The Security Rule is the one that touches your daily clicking. It's organized into administrative, physical, and technical safeguards — fancy words for "have policies and train people," "lock the doors and the server room," and "make the computers behave."
The single most useful phrase in the Privacy Rule is "minimum necessary." Access only the PHI you actually need for the task in front of you. Browsing charts you have no clinical reason to open is the classic violation — and the audit log remembers.
The everyday technical safeguards
Most of cybersecurity in practice is unglamorous hygiene. Authentication proves you are who you say (passwords, and increasingly multi-factor — a password plus a code or token, so a stolen password alone isn't a skeleton key). Encryption scrambles data so a stolen drive or intercepted transmission is gibberish without the key — both "at rest" (sitting on a disk) and "in transit" (moving across the network). Audit logging records who touched which record and when, which is how snooping gets caught after the fact.
A helpful mental model: authentication is the lock, encryption is writing your diary in cipher, and the audit log is the security camera. You generally want all three, because each fails in a different way.
Shared logins and "doc-in-a-box" workstations left logged in are a perennial weak spot. If everyone signs in as the same generic account, the audit trail can't tell who did what — which defeats the entire point of having one.
When it goes wrong: breaches
A breach is an unauthorized exposure of PHI. The dramatic version is a ransomware attack that freezes the PACS and holds imaging hostage — genuinely dangerous, because a hospital that can't access scans can't safely treat patients. But the far more common version is mundane: a lost laptop, an email to the wrong address, a thumb drive left in a rental car. The Breach Notification Rule sets out the duty to notify affected individuals and the authorities, with the size of the breach changing the deadlines and how loudly you have to announce it — a large breach (the rule's threshold is 500 or more people in a jurisdiction) triggers prompt reporting and even media notice, while smaller ones can be logged and reported annually.
Don't assume "I only emailed it to a colleague" makes it safe. PHI sent over an unencrypted channel, or to anyone without a legitimate need, can still count as an impermissible disclosure. The fix is sending through approved, secured systems — not hoping nobody was looking.
De-identification, done right
Research, teaching files, and AI training all want imaging data without the patient attached. De-identification is the formal process of stripping identifiers so the data is no longer PHI. Under HIPAA this is usually done by Safe Harbor (remove all eighteen identifier categories) or the Expert Determination method (a qualified expert certifies the re-identification risk is very small).
For images specifically, doing it properly means cleaning the DICOM header, checking the pixels for burned-in annotations (text scorched directly into the image, common on ultrasound), and defacing 3-D head data. Skip a step and your "anonymous" teaching case still names a real person. This matters enormously for the data feeding machine-learning models — see AI validation and pitfalls for why dirty data poisons everything downstream.
If you remember one thing, make it this: in radiology the identifiers hide in two layers — the picture and its header — and protecting patients means guarding both, every single time you click "export."