Using MIRC as a Research Data Collector

1. Using MIRC as a Research Data Collector Lawrence Tarbox, Ph.D. Electronic Radiology Lab Mallinckrodt Institute of Radiology Washington University in St. Louis School of Medicine

2. Requisite Financial Disclosure • The author receives financial support from RSNA for work in IHE testing tools and connectathon management. • The author consults with Siemens Medical Solutions on standardization issues (DICOM). • The author’s retirement fund currently includes a small amount of Siemens, AG stock. None of the above impacts today’s topic.

3. Research Dataset Acquisition From John Perry’s Presentation: • MIRC feature developed with Mallinckrodt Institute of Radiology • Allows internal researchers to acquire DICOM images from modalities, store and manage them without using the clinical PACS • Bridges internal networks • Tracks access of PHI for HIPAA compliance

4. Problem Statement • Clinical scanners are often used for research purposes • Researcher-directed acquisitions • Clinical cases of research interest • Not all researchers have access to the clinical PACS • Research computer systems and networks often are outside of the HIPAA protected environment

5. Current Solution • Whenever possible, techs are asked to enter the researcher’s name as the “referring physician” • Techs asked to not put PHI in study/series descriptions • Scanners are configured with a MIRC server as a DICOM destination, making it easy for techs to send research data to the MIRC server • MIRC server remains in the HIPAA protected environment • Researchers are given controlled access to the MIRC server to pick up their data

6. Hospital Network Medical School Network Retrieve de-identified images Images containing PHI Retrieve de-identified images via VPN Open Network Research Dataflow

7. MIRC Setup • On receipt, DICOM data is stored both • as received (potentially with PHI) • deidentified/anonymized (no PHI) • Research data is not published automatically (i.e., is not available to other MIRC servers) • Protected Health Information (PHI) is not shown in query results list • User login required to access data • Potential access to PHI is logged for audit purposes, as required by HIPAA

8. HIPAA Audit Logs • No audit log entry for queries, since no PHI is shown in list returned • Patient data accessed audit log entry when user clicks on a query list entry • Patient data export audit log entry if user downloads non-deidentified data • Logs both • stored locally on the MIRC server, and • optionally transmitted via http to a log collection service (RFC 3881 format)

9. Most Researchers just click here Queries are allowed, but are limited

10. Title includes modality and date XML template specifies content of entries Author is referring physician “Accessed” audit record generated when title is clicked, logon required

11. XML template specifies layout and content “Export” audit record generated when zip file of DICOM objects is downloaded

12. XML template specifies layout and content

13. Audit Log Examples 2005-01-13T18:25:04 - Access by MIRCuser @10.39.168.180 SIUID: 1.2.124.113532.128.252.220.117.20030306.133901.10766096 Pt ID: 05-10786-9 Name: PATIENT^NAME 2005-01-13T18:26:14 - Export by MIRCuser @10.39.168.180 SIUID: 1.2.124.113532.128.252.220.117.20030306.133901.10766096 Pt ID: 05-10786-8 Name: PATIENT^NAME

14. Discussion • Over 90 GB of data have gone through the collector • 10 to 20 studies a week • Expanding to include raw data (sinograms) from scanners