Student Research Raises Questions About Patient Privacy on 3D Printing Platforms

A student researcher at Indiana University Indianapolis has uncovered what she believes is a significant patient privacy issue involving medical anatomy files shared on public 3D printing websites.

Salma Kherallah, a junior studying at the School of Health and Human Sciences, recently won first place at the university’s Undergraduate Research Conference after examining thousands of anatomy-related files posted online for download and 3D printing. Her project, “The Availability of Potentially Unethically Sourced 3D Anatomy Models on Peer-to-Peer Websites,” was selected among 200 others.

Working with Andrew Cale, an assistant professor at the university’s Department of Anatomy, Cell Biology and Physiology, Kherallah reviewed roughly 3,000 files from peer-to-peer 3D printing platforms. The goal was to determine whether some of the models were derived from real patient scans.

According to the university, the researchers found examples that appeared to originate from medical imaging data, including MRI scans. Some of the files depicted human anatomy, including bones and organs, and could be downloaded by anyone with access to the platforms.

“We were investigating whether people were uploading patient scans or patient bones or human remains up to these websites to be printed, which has a lot of ethical concerns and HIPAA [Health Insurance Portability and Accountability Act] violations,” Kherallah explained in a statement released by the university. “We think that by doing this research and proving that this is out there, maybe stricter regulation could possibly be enforced in the future.”

The project began after Kherallah noticed anatomy models circulating online and wondered where they had come from. Using her anatomy training, she worked with Cale to evaluate the files and identify signs that they may have been generated from actual patient scans. The researchers say some of the files could contain patient information that was shared without permission.

Kherallah’s work was praised by Indiana University Indianapolis Chancellor Latha Ramchand, who described Kherallah as an “incredible changemaker” and said the project highlighted how undergraduate research can help address real-world challenges involving patient privacy.

“Her work advocates for patients by identifying real MRI scans published on 3D printing websites,” noted Ramchand.

Many medical 3D printing applications begin with patient scans. Hospitals and researchers use CT and MRI scans to create 3D models that can help doctors prepare for surgery, teach students about anatomy, or develop new medical devices. But patient information is usually protected, and personal details are removed before the actual files are shared for research or education. But once a file is uploaded to a public website, other people can download it, copy it, and share it again.

“My biggest takeaway from this experience is that technology is allowing people to do whatever they want,” she said, posing the question, “How far are we allowing this to go? How are we regulating this type of technology to regulate the ethics and morals of society’s standards on patient privacy?”

Kherallah’s project looked at whether patient scans, bones, or other anatomy models were being uploaded to public 3D printing websites without permission. The researchers said their findings show that questions around privacy and consent should get more attention as medical 3D printing continues to grow.