AWS Architecture Blog·August 19, 2026Designing a PHI/PII Detection and De-identification System for DICOM Images on AWS
This article details Clario's solution for automatically detecting and de-identifying Protected Health Information (PHI) and Personally Identifiable Information (PII) within DICOM medical images. The architecture leverages AWS services like Amazon Bedrock and Amazon Textract for scalable and compliant processing, addressing critical data privacy and regulatory requirements in clinical trials. Key design decisions involve using EKS for long-running, memory-intensive workloads and RDS for audit trail consistency.
Read original on AWS Architecture BlogClario developed a robust system to automate the detection and de-identification of PHI and PII in thousands of DICOM image slices, crucial for clinical trials. This process is essential not only for compliance with regulations like HIPAA and GDPR but also for maintaining data quality and auditability across globally distributed trial sites. The system handles sensitive information potentially hidden in metadata tags, custom vendor fields, or burned directly into image pixels.
Architectural Overview
The solution is built entirely on AWS, designed for efficiency, accuracy, and security. It is exposed via Amazon API Gateway, providing a secure, authorized, and rate-limited endpoint for upstream systems. DICOM images are stored in Amazon S3, initiating a detection workflow that processes each file through a pipeline, logging every step for compliance.
Key Design Decisions
The Clario AI team made critical design choices early on: Amazon EKS was selected for the backend due to the long-running, memory-intensive nature of processing thousands of DICOM slices. Amazon RDS for PostgreSQL was chosen for persisting processing metadata, ensuring relational queries and strong consistency for audit trails. Amazon API Gateway handles authentication, API key management, and rate limiting at the edge, offloading these concerns from the core detection service.
Core Components and Technologies
- Amazon S3: Used for storing raw DICOM images uploaded by clinical trial sites.
- Amazon API Gateway: Acts as the secure entry point for the detection workflow, handling TLS encryption, IAM authorization, and rate limiting.
- Amazon EKS: Hosts the detection backend, providing a scalable and resilient environment for memory-intensive image processing tasks.
- Amazon Bedrock: Provides access to managed foundation models (e.g., Anthropic's Claude Sonnet) for intelligent PHI/PII detection without requiring model management.
- Amazon Textract: Utilized for purpose-built OCR and intelligent document processing, improving accuracy in extracting text, tables, and key-value pairs from complex DICOM files and images.
- Amazon RDS for PostgreSQL: Stores processing metadata and audit trails, supporting complex relational queries for compliance reporting and strong consistency.
- Amazon CloudWatch & AWS CloudTrail: Provide end-to-end observability for logs, metrics, traces, governance, and auditing.
The architecture prioritizes scalability and compliance. Amazon Bedrock and Textract abstract away infrastructure management for AI models and OCR, allowing the team to focus on features. Security is paramount, with processing occurring within a hardened AWS environment utilizing IAM, VPC controls, and encryption, aligning with strict healthcare data residency and compliance requirements.