It must be properly de-identified, which requires sufficient QA to ensure data security. Source: https://www.dcmsys.com/patient-data-security/dicom-data-de-identification-and-re-identification/, Information shared above is the personal opinion of the author and not affiliated with the website.

1. Patient Data De-identification and its
Requirements
The utility of de-identified patient data in medical research is hard to overstate, but
ensuring patient privacy must always be at the heart of the operation.
● Quality Assurance - Before protected healthcare information (PHI) is shared
outside of the client hospital’s infrastructure, it must be properly de-identified,
which requires sufficient QA to ensure data security.
● Independent Review - Objective third-party reviewers are required to review the
methodology, code, and de-identification algorithms, to ensure that the integrity
of PHI has not been compromised.
● Adaptive Framework - Because not all healthcare providers have the same
perspective or research requirements, de-identification processes will necessarily
differ. A scalable, adaptive framework is vital to meet the two goals of preserving
patients’ privacy while using imaging data to further medical science.
● Airtight Data Protection - Messages, images, and associated metadata must
be de-identified in a way which will prevent re-identification by anyone, except
the source healthcare provider.
Source: https://www.dcmsys.com/patient-data-security/dicom-data-de-
identification-and-re-identification/, Information shared above is the personal opinion
of the author and not affiliated with the website.