Karnak: Open-Source DICOM De-identification Gateway

Karnak is a DICOM gateway for data de-identification and DICOM attribute normalization. It is distributed as a containerized and portable application, making it easy to deploy and use across various environments.

Karnak — DICOM gateway Volume imaging, radiography, ultrasound, video, pathology, signal and report objects flow into the Karnak DICOM gateway and come out de-identified, tag-morphed and conformant. DICOM DATA From multiple sources Volume imaging (CT, MRI, PET, SPECT) Radiography (CR, DX, XA, MG) Ultrasound (US, echo, Doppler) Video (endoscopy, surgery) Photography (clinical, dermatology) Pathology (macro / micro) Signal (ECG, EEG waveforms) Reports (SR, dose report) Many other object types Karnak DICOM GATEWAY Between modalities and archives DICOM (C-STORE) Transformed DICOM data (C-STORE, STOW-RS) Karnak DICOM GATEWAY Rules engine profiles in YAML DICOM library dcm4che & standard Scalable with your hardware Integration DICOM & DICOMweb TRANSFORMED DATA De-identified. Normalized. Validated. De-identification Basic confidentiality profile Pseudonyms per project Pixels masked, CT defaced Tag morphing Standard and private tags Normalized and consistent Driven by your conditions Conformance report Checked against the standard Malformed values flagged Report emailed per study FOR RESEARCH Reproducible, shareable datasets De-identification follows DICOM PS3.15 Deterministic UIDs from a project secret Pseudonyms from CSV, DICOM tags or an API Date shifting or reduced date precision Conditional rules inside each profile Portable app for collaborative projects FOR IMAGING IT A standard node in your network C-STORE in, C-STORE or STOW-RS out Single sign-on with OpenID Connect Per-destination filters and transcoding Echo, worklist and DICOMweb diagnostics Virtual destination: validate, don't send Docker or portable deployment FOR PATIENT PRIVACY No identifiers in tags or pixels Automatic annotation removal with OCR CT defacing (experimental) If masking fails, nothing is sent Email summaries of transfers and errors Monitoring: original vs de-identified values Diagnostic value of the image preserved

Open the diagram at full size

Karnak receives studies through a DICOM listener and forwards them to DICOM (C-STORE) or DICOMweb (STOW-RS) destinations.

Get started

New to Karnak? How Karnak works shows a typical deployment with a research repository outside the institution and the pipeline each study goes through.

  1. Install Karnak with Docker Compose on a server, or download the portable distribution to run it on a single machine without installation.
  2. Create a forward node with its sources and destinations.
  3. Create a project and assign it a de-identification profile.

Key Features

  • DICOM Gateway: Acts as a proxy between DICOM modalities/workstations and PACS/Archives.
  • Flexible Connectivity: Supports standard DICOM protocols (C-STORE) and DICOMweb (STOW-RS).
  • De-identification: Based on the DICOM standard, with configurable actions in YAML profiles.
  • Clean pixels: Remove burned-in annotations with hand-defined masks or automatically through OCR service.
  • Pseudonymization: Apply pseudonyms from DICOM fields, by importing CSV, or with external web services.
  • Tag Morphing: Normalizes DICOM attributes to ensure consistency across your workflow.
  • Conditional Processing: Apply de-identification and tag morphing rules based on customizable conditions.
  • Conformance Reports: Validate each study against the DICOM standard and email a conformance report, with optional report-only (virtual) destinations.
  • Monitoring: Follow transfers in a destination, study and series tree, compare original and de-identified values, and export the activity as CSV.
  • Notification System: Email notifications for successful transfers and errors.
  • Diagnostic Tools: Test and probe DICOM nodes and DICOMweb endpoints — echo, capabilities, network and service checks.
  • Project Management: Organize de-identification rules and secrets by project.
  • Single Sign-On: Delegate the web portal login to an OpenID Connect provider such as Keycloak.
  • Web Interface: User-friendly web portal for configuration, profile building and monitoring.
  • Portable Distribution: Run Karnak as a portable application without installation.

Karnak de-identifies and forwards studies; it is not a viewer and not an archive. The companion DICOM viewer from the same project is Weasis, which reads the studies a Karnak destination receives — including from a DICOMweb archive.