Settings

The de-identified DICOM store-and-forward target. After a study is de-identified it is C-STORE’d here. Test connection probes the currently-saved downstream (save edits first to test new values).

Every de-identified object is sealed into a durable outbound spool and forwarded asynchronously (off the C-STORE association), so a downstream outage or a restart never loses an instance. These knobs tune the drain loop; the per-attempt retry schedule comes from the Destination retry settings above. A forward whose retry budget is exhausted moves to the dead-letter queue.

Where the PHI-bearing, SYNTHIMG-sealed queues live on disk. Leave blank to use the default under the data directory (outbound / quarantine / deadletter). Set an absolute path to move a store onto a dedicated data volume (off the OS drive). Restart-gated; existing files are not auto-migrated — move them while the service is stopped.

Live-poll cadence for the Dashboard + Outbound Queues pages (0 = off, read-live). The Admin UI bind host + DICOM external address are restart-gated: bind host controls which NIC the web UI listens on (0.0.0.0 = all); the DICOM external address is the host peers should use to reach this node (blank = auto-detect).

Terminate HTTPS at the app for the admin UI/API when deploying on-prem without a reverse proxy (the hosted demo terminates TLS at Cloudflare, so this stays off there). All fields are restart-gated — the listener binds at startup. Provide a PEM certificate + key, or a PFX/P12 bundle + password. If TLS is enabled but the certificate cannot load, the node logs the error and falls back to plain HTTP rather than failing to start.

Need a certificate for the In-App Web TLS or DICOM-TLS paths above? Generate a self-signed one for this host with the standalone Certificate Builder: it writes a PEM .crt / .key and a PKCS#12 .pfx, plus the SHA-256 fingerprint. Point the web-TLS / DICOM-TLS certificate path at the generated .pfx (or the .crt + .key), or drop in your own CA-issued certificate. The private key is written on the server and never leaves it.

How identity tags are replaced. Hash (default) writes a deterministic one-way token (PSN-…). Sequential instead numbers each unique patient Patient1, Patient2… (Name + MRN) and each study Study1, Study2… — the same source patient always gets the same number. The real identifiers are never kept; only an irreversible, encrypted number map is stored on this host. Sequential mode requires the engine to run single-instance.

Optional licensed add-on (deid_cohort_export). When enabled, on each received object — before de-identifying it — the engine harvests standards-coded clinical concepts (SR code triples, BodyPartExamined / anatomic-region / procedure codes) + coarse demographics (sex; age reduced to a decade band) and POSTs a PHI-free batch — keyed only by the same one-way pseudonyms the forwarded image carries — to the VNA Research cohort store. No free-text, no direct identifiers, no pixels. Fail-open: a harvest/ingest error never affects the de-id forward.

An internal-search-only extension of the cohort program. When enabled, the engine retains the de-identified Impression narrative of each report (double-scrubbed here, sealed + belt-scrubbed at the research host) so a cohort author can search the text internally to assemble a study cohort. The text never leaves the research host — a cohort export delivers re-pseudonymized study images only, never text. Higher risk than the coded lane, so it is OFF by default behind a DISTINCT §164.514(b)(1) Expert-Determination attestation.

The NLP lane recognizes controlled-vocabulary concepts in report free text. Load a licensed SNOMED / RadLex / LOINC pack on the host (set term_pack_path) to recognize any concept it names. This card shows the effective vocabulary and lets you test a sentence against it. Vocabulary changes are restart-gated. Use synthetic text — the test never stores or echoes your input, only the matched codes.

Loading vocabulary status…

Beyond the named HIPAA Safe-Harbor identifiers, private / proprietary (odd-group) DICOM elements can carry vendor PHI that the named tag policy and the content gate do not inspect.

Optional MLLP listener that de-identifies inbound ORU^R01 result messages (from an EMR / reporting system) — reusing the SAME per-patient pseudonym + interval-preserving date shift as the DICOM path, so a report lands on its de-identified study's timeline — then forwards them to a downstream HL7 endpoint. Off by default. Enable / port changes apply on restart.

MLLP-over-TLS (secure HL7) — for a cross-network sender. When on, each MLLP connection is wrapped in TLS 1.2/1.3 before the first frame; mutual TLS pins the peer's client-cert thumbprint. Off = plain MLLP (on-prem). Restart-gated.

Optional secure cross-network raw-PHI ingress for the Synthology-hosted / cloud deployment (customers STOW studies to POST /dicom-web/studies). Fail-closed: a caller must present a pinned client certificate (mTLS) and/or a valid ingest token, else 401. Received objects run the SAME de-identify + harvest + forward pipeline as C-STORE. Off by default; on-prem deployments use plain C-STORE and leave this off.

The engine de-identifies DICOM tags. It cannot clean PHI hidden in an encapsulated PDF blob, an SR free-text narrative, or burned-in pixels. Rather than forward those partially cleaned, the gate quarantines them (default) for review. Per category: Quarantine (fail-safe), Forward (accept the residual risk), or Reject (fail the C-STORE). Quarantined objects are sealed on this host — review them on the Quarantine page.

The DICOM C-STORE SCP that receives studies for de-identification. Changes to these fields require a service restart to take effect (the listener binds at startup).

DICOM-TLS (secure DIMSE) — encrypt the whole C-STORE association for a source pushing studies across an untrusted network. When on, the listener presents the server cert (blank cert path reuses the in-app web TLS cert); mutual TLS additionally pins the peer's client-cert thumbprint. Off = plain DIMSE (on-prem). Restart-gated.

The tamper-evident HIPAA audit log is a count-capped ring; a daily pruner archives before it evicts and never prunes below the 6-year retention floor.

The engine keeps a short local window of PHI-free de-id activity events. Aged events are archived to the analytics lake (which SynthInSight reads) before they are pruned locally. This is orthogonal to the HIPAA audit floor above.

Local admin-console sign-in (PBKDF2 users + RBAC). The session and lockout limits below apply to the admin GUI. Changing Enabled takes effect on the next service restart.

Serilog minimum level and output directory for the console + daily-rolling file sinks the shared Logs viewer reads.

Sets the per-host identity the in-process SupportAgent uses to connect to SynthGateway. Stored in …. Changes take effect within one heartbeat (about a minute); the agent re-reads identity.json each supervisor loop — no restart. Leave the Gateway URL blank to keep the agent dormant.

Controls whether Synthology support engineers may open an engineer-initiated remote support session to this system — your consent control, in addition to the license and your signed authorization. Withdrawn blocks new sessions and ends any session in progress within one heartbeat. No restart. Stored in ….

The IANA timezone every timestamp in this console renders in (via the shared SynthTz.fmtTs() formatter). Leave blank to follow the host’s local timezone.

Export this engine’s configuration or import a saved one. Import replaces the full config and requires the confirm phrase REPLACE FULL CONFIG. Editing requires manage_config.

Email notifications (SMTP alerts for operational events) and per-volume free-space monitoring. Watch disk space and alert below a threshold; the same signal feeds /api/health (SynthIQ pool health) and the SynthGateway agent heartbeat.

When the data volume crosses the watermark, reclaim disk by deleting oldest-first from a code-enforced whitelist of PHI-free transient dirs. The PHI queues (outbound / dead-letter / quarantine), the HIPAA audit archive, the analytics op-window, and key material can never be space-purged — even if named below. Leave the auto-purge list empty for telemetry only (the default); usage is still surfaced on the Monitor + SynthGateway.