De-identification before your firewall
EchoReview AI can strip Protected Health Information from echocardiograms inside the browser, before a single byte crosses the hospital firewall. No identifiable data leaves your network unless you choose to share it under a signed BAA.
Client-side DICOM parsing
DICOM files are parsed entirely in the browser using dicom-parser. The raw byte array never leaves the workstation. Image frames are extracted locally and converted to a standard JPEG.
Zero-PHI upload mode
When "De-identified upload" is enabled, patient name, MRN, DOB, and DICOM tags are discarded. Only the pixel image and a hospital-controlled local reference ID are transmitted.
TLS 1.3 in transit
Any data that does leave the browser is encrypted in transit with TLS 1.3. Weak cipher suites and deprecated protocols are disabled at the edge.
How de-identification works
Step-by-step flow from the ultrasound machine to the EchoReview AI cloud workspace.
DICOM export from modality
The sonographer exports the echo study from the ultrasound machine or PACS as an uncompressed or compressed DICOM file. This file contains pixel data plus HIPAA identifiers (Patient Name, MRN, DOB, Accession Number, etc.).
Browser parses the file locally
The technician drags the .dcm file into EchoReview AI. The browser reads the file into a Uint8Array and parses it with dicom-parser — entirely in JavaScript on the local CPU. No server round-trip is needed for parsing.
De-identification toggle
If 'De-identified upload' is selected, the parser skips all PHI tags (0010, 0012, 0032, 0008, 0020 series). Only image dimensions, modality, and frame count are retained for preview. The technician enters a local reference ID (e.g., 'Study-482') instead of the MRN.
Pixel data → JPEG conversion
The raw pixel frame is drawn to an HTML5 Canvas, window-leveled for display, and exported as a JPEG. This JPEG contains no DICOM headers, no embedded metadata, and no patient identifiers. It is a plain image file.
Upload to isolated workspace
The JPEG and the user-supplied local reference ID are uploaded over TLS 1.3 to the hospital's isolated organization workspace. If de-identified mode was used, no PHI ever crossed the firewall.
Audit trail of the upload event
An immutable audit log records the upload (user ID, timestamp, IP, user agent) but never stores the original DICOM or the PHI that was stripped. The hospital retains the original DICOM and the local mapping table.
What stays inside the hospital
- Original DICOM file with full header
- Patient Name, MRN, DOB, SSN, Accession Number
- Local reference ID → real patient mapping table
- Institutional PACS / EMR identifiers
- The mapping key (kept by hospital IT)
What may leave (if BAA signed)
- De-identified JPEG image (pixel data only)
- Hospital-local study reference ID (e.g., PT-00482)
- De-identified age range and sex (optional)
- Technician notes (free text, user-controlled)
- AI impression and cardiologist sign-off text
Identified data requires a signed BAA
If your workflow requires identifiable PHI to be uploaded (for example, patient name or MRN must be visible in the cloud workspace), EchoReview AI is ready to execute a HIPAA Business Associate Agreement (BAA) before any PHI is transmitted. The BAA template is available for review by hospital counsel at /legal/baa.
Ready to start a privacy-first pilot?
De-identified uploads let you evaluate AI-assisted echo triage without exposing PHI. When you are ready for identified data, a BAA can be executed in 48 hours.