DICOM gives you security mechanisms, not a security policy

DICOM, the standard behind medical imaging exchange, supplies optional security mechanisms such as mutual authentication, tamper detection and encryption in transit. It does not define access control policy or key management. Each site decides what to turn on and who may see which studies, so imaging security is mostly work you add around the standard.

What the standard says it covers

The security part of the standard, PS3.15, states plainly that it does not address security policies. It describes mechanisms that let two application entities authenticate each other, detect tampering with messages and protect confidentiality in transit. It points to external protocols such as TLS for that work.

Use of these mechanisms is optional. An application entity may apply them according to how far it trusts the channel between itself and its peer. If nobody turns them on, a scanner and an archive can still talk happily with no protection at all.

What the standard leaves to you

PS3.15 lists several things it does not handle. Access control policy is not considered. How a patient's or an institution's authorizations are passed between systems is not addressed. Key management is assumed to exist but is outside its scope. The standard also assumes each system secures its own environment first and can identify its local users and their roles.

Read that as a to-do list:

• Write the access policy: who may query, retrieve, send and delete studies.
• Run a certificate process, including issuance, expiry and revocation.
• Harden the hosts that run the archive, viewer and gateway.
• Map local user accounts to roles before you expect any audit trail to mean something.

A practical order of work

Start with an inventory. List every device that sends or receives images, its network address, the ports it exposes and the owner. Unknown modalities are the usual gap.

Next, decide which links must use authenticated, encrypted transport and which are contained inside a segment you can defend. Document the reasoning, because HIPAA style risk analysis expects a written decision rather than a silent default.

Then add the controls the standard will not: segmentation between imaging, clinical and guest networks, no direct internet exposure for archive or gateway ports, patching windows agreed with the device vendor, and log forwarding from the archive.

Finally, test restore. An imaging archive is large, and recovery time is often the surprise.

Common mistakes

• Assuming a standards compliant device is a secure device. Conformance describes interoperability, and security features are optional.
• Leaving default accounts and ports on viewers and gateways.
• Treating the archive as a database with no audit trail of who retrieved which study.
• Allowing broad lateral access from any workstation to the archive.

Where Safeguard fits

Safeguard can help with the software around your imaging stack: asset discovery to find unmanaged hosts, SBOM and dependency scanning for the viewers and gateways you build or run, and policies and gates in your pipelines. It does not secure the modalities themselves. You can try a free scan at https://gold.safeguard.sh/scan.

Quick check

Sources

• DICOM PS3.15, Scope and Field of Application
• DICOM PS3.15, Appendix B Secure Transport Connection Profiles

Last reviewed: 19 October 2026.