Files and images in forms

Photos, PDF scans and DICOM studies at a visit: upload, cleaning of personal data, the viewer, the check by the data manager.

The Files and images field takes at a visit what does not fit into numbers: CT and MRI studies, ultrasound loops, an ECG strip, a photo of a foot or of the skin, a PDF scan of a report. The site uploads the files right from the browser, with no program and no discs sent by courier. Every file belongs to a patient, a visit, a form and a field, and only the team of that study sees it.

Adding the field to a form

1. Open the eCRF builder, the form, and in the Files group press Files and images.
2. Name the field the way the site understands it: “Chest CT”, “ECG strip”, “Photo of the lesion”.
3. If the visit is not complete without a file, make the field required: the field's value is the number of uploaded files, so “required” works as usual.

How the site uploads files

A DICOM series shows as one row; a photo on check has “No personal data: release” and “Reject”.

• Under the field in the visit form there are Add files and Add a folder; files can also be dragged in. A folder suits a disc from the hospital: the portal skips the DICOMDIR index and anything else on it (viewers, autorun).
• DICOM, JPEG, PNG and PDF are taken. The type is taken from the contents, not from the file name.
• A file goes in pieces of 4 MB. When the connection drops only one piece is sent again, so a big series gets through even a weak connection at the site.
• After uploading, save the form: the number of files is then written into the field's value. Uploads and withdrawals go to the audit trail at once.
• A wrong file is taken back with Withdraw and a reason. The file is hidden; its record and its audit lines stay.

What the portal does with personal data

• DICOM. Tags are cleaned by the basic profile of DICOM PS3.15 (Annex E) with the options “retain dates” and “retain patient characteristics”. Names, identifiers, the date of birth, the address, doctors, the institution, the device, private tags and overlays go. The patient's name and ID become the study number, UIDs get new values (the same within the study). The study date, age, sex and weight stay: the analysis needs them and the eCRF holds them anyway.
• Photos. JPEG and PNG lose their metadata: the place, the phone model, the author, the time. The picture itself is not re-encoded.
• The original is not kept. The server holds only the cleaned copy; the SHA-256 of the original proves which file the site sent. The file name from the site's computer is not kept either: the portal gives its own, such as 01-0007-EGFILE-001.dcm.
• Text in the picture itself is not read yet. So photos, PDF, ultrasound, screenshots and images marked “burned-in annotation” get the status On check for personal data. Only the site and those who close queries (monitor, data manager, manager) see them. The checker looks at the picture and presses No personal data: release or Reject with a reason the site will see. The contents of a rejected file are deleted from the disk at once; only its record and audit lines stay.

Until the portal is registered as a personal data operator, upload only test or already de-identified files. The hint under the field says so too.

Viewing images

The viewer: the mouse wheel steps through the slices, dragging changes the window and level.

• View opens DICOM right in the browser. The mouse wheel and the arrow keys step through the slices of a series or the frames of an ultrasound loop, dragging changes the window and level, and there are presets “soft tissue”, “lung”, “bone”, “brain”, zoom and pan.
• The browser shows uncompressed DICOM and JPEG Baseline. Compressed files (JPEG 2000, JPEG Lossless) are taken and kept; download them to open in the site's own program.
• The image is marked “Not for diagnosis”: the viewer is for checking completeness and quality, not for a doctor's report.
• Two automatic checks on tags read before cleaning: the study date outside the visit window, and the sex in the file differing from the patient card. The file's card keeps only the result, never the values.

Limits and storage

• The Portal Owner sets in Functions and limits the largest file (256 MB by default), the room for one study (10 GB) and for the whole portal (150 GB). The function can be switched off altogether.
• Files are never kept in the database. The installation setting decides where they lie: by default on a separate volume of the server's disk (the backup keeps them as a separate archive next to the database copy), or in any S3-compatible storage. For an installation in Russia that is a Russian storage (Yandex Object Storage, Selectel, VK Cloud) or a container on the same server: personal data of patients from Russia must be stored in Russia (152-FZ). Each file remembers where it lies, so changing the setting does not lose the old files.
• In demo projects the files are drawn by the portal: an ECG strip (PNG) in the type 2 diabetes study, an ECG in DICOM and, at the large size, an echocardiography loop in the hypertension study. Some files wait for the personal data check, so it can be tried.