Development of a defacing algorithm to protect the privacy of head and neck cancer patients in publicly-accessible radiotherapy datasets

TL;DR

This paper presents a novel automated defacing algorithm for head and neck cancer CT scans that effectively anonymizes patient data while preserving critical anatomical structures, facilitating data sharing for AI research.

Contribution

The authors developed and validated a new defacing method that protects patient privacy without compromising the utility of medical imaging data for analysis.

Findings

Face recognition accuracy dropped from 97% to 4% after defacing.

Autocontouring achieved perfect Dice scores for organs below the defaced region.

Most PTVs were unaffected by the defacing process.

Abstract

Introduction: The rise in public medical imaging datasets has raised concerns about patient reidentification from head CT scans. However, existing defacing algorithms often remove or distort Organs at Risk (OARs) and Planning Target Volumes (PTVs) in head and neck cancer (HNC) patients, and ignore DICOM-RT Structure Set and Dose data. Therefore, we developed and validated a novel automated defacing algorithm that preserves these critical structures while removing identifiable features from HNC CTs and DICOM-RT data. Methods: Eye contours were used as landmarks to automate the removal of CT pixels above the inferior-most eye slice and anterior to the eye midpoint. Pixels within PTVs were retained if they intersected with the removed region. The body contour and dose map were reshaped to reflect the defaced image. We validated our approach on 829 HNC CTs from 622 patients. Privacy protection was evaluated by applying the FaceNet512 facial recognition algorithm before and after defacing on 3D-rendered CT pairs from 70 patients. Research utility was assessed by examining the impact of defacing on autocontouring performance using LimbusAI and analyzing PTV locations relative to the defaced regions. Results: Before defacing, FaceNet512 matched 97% of patients' CTs. After defacing, this rate dropped to 4%. LimbusAI effectively autocontoured organs in the defaced CTs, with perfect Dice scores of 1 for OARs below the defaced region, and excellent scores exceeding 0.95 for OARs on the same slices as the crop. We found that 86% of PTVs were entirely below the cropped region, 9.1% were on the same slice as the crop without overlap, and only 4.9% extended into the cropped area. Conclusions: We developed a novel defacing algorithm that anonymizes HNC CT scans and related DICOM-RT data while preserving essential structures, enabling the sharing of HNC imaging datasets for Big Data and AI.