Abstract: A system for creating de-identification programs for de-identifying DICOM image files containing DICOM images and metadata. The system provides a user interface that allows users to create de-identification programs. Each program has redaction rules specifying redaction regions in normalized coordinates defining a region of a DICOM image to be redacted to obfuscate content in the redaction region, and metadata substitution rules specifying metadata elements to be substituted with pseudonyms. The user may modify the redaction rules and metadata substitution rules, and preview the effect of the de-identification program by applying the de-identification program to DICOM images and associated metadata and displaying the resulting modified DICOM image and associated metadata. The system maintains a pseudonym memory to determine if a pseudonym has been stored for each metadata element specified by the substitution rule so that the same pseudonym is consistently used for the same element values.