You undergo an MRI or a scan at a radiology office. A few hours later, your primary care physician reviews the images from their computer, sometimes hundreds of kilometers away. Between these two moments, your medical images pass through several technical layers, each with its own protection rules. Understanding this journey helps to measure the security stakes surrounding your health data.
What happens between the examination machine and the doctor’s screen
The journey begins as soon as the image is acquired. A scanner, MRI, or X-ray machine produces a file in DICOM format. This file not only contains the image: it also includes your personal information (name, date of birth, patient ID, date of the examination).
This file is then sent to a server called PACS (Picture Archiving and Communication System). The PACS stores, organizes, and redistributes the images to authorized healthcare professionals. When your doctor opens your file on their workstation, they query this server, which sends back the images via a secure protocol.
You may have noticed that your radiologist sometimes gives you a web link instead of a CD? This is because more and more facilities are using online portals. The image then travels through an encrypted network before reaching your browser or your doctor’s. An article detailing the web.irld.net journey on Santé Net precisely describes the technical steps of this transmission chain.
DICOM format and personal data embedded in your images
Why does the DICOM format deserve your attention? Because it combines image and personal information in a single container. In practice, a DICOM file consists of two distinct blocks.
- Pixel data, which is the image itself (the slice of your knee, the X-ray of your lungs).
- A metadata header that stores your name, patient ID, the name of the prescribing doctor, and clinical notes.
- Technical information about the machine used (model, acquisition parameters, slice thickness).
Each DICOM file is therefore a miniature medical record. If someone accesses the file, they obtain both the image and the patient’s identity. This characteristic explains why the protection of these files is subject to strict regulatory requirements, notably the GDPR in Europe.
Health data hosting and regulatory obligations in France
In France, storing or transmitting medical images on the web cannot be done on just any server. The host must hold HDS certification (Health Data Hosting), granted after a compliance audit focusing on the physical security of the premises, data encryption, and access management.
The GDPR requires that patients be informed about the processing of their data and be able to exercise their rights (access, rectification, deletion). For a radiology office, this means that each image transfer to a web portal or a colleague must comply with a specific framework.
The Ségur program and the DRIM-M project
The Ségur digital health initiative has accelerated the update of radiology software (RIS). In this context, the DRIM-M project aims to create a national network for sharing medical images, through devices called DRIMbox. The goal is to allow a doctor to access a patient’s images taken at another facility, without the images passing through unsecured channels.
This system changes the usual logic: instead of sending the file, a temporary and traceable access is given to the receiving doctor. The image remains on the original certified server.
Cyberattacks targeting medical imaging systems
Radiology centers are not immune to cyberattacks. The European Repository of Cyber Incidents (EuRepoC) has recorded 351 significant cyberattacks against healthcare facilities in Europe between 2022 and 2025, including attacks directly disrupting radiology software and PACS servers.
More than a third of these incidents caused disruptions lasting several days, or even weeks, to operational systems. This means inaccessible examinations, delayed diagnoses, and disorganized care.
Three vulnerabilities exploited by attackers
- DICOM files themselves can serve as a vector. A malicious file, designed to look like a legitimate image, can exploit a vulnerability in the viewing software and execute code on the doctor’s workstation.
- Exposed PACS servers on the internet without sufficient protection allow an attacker to access thousands of images and the associated personal data.
- The human factor remains the primary entry point: a phishing email opened by a staff member is enough to compromise the entire network of an imaging center.
Protecting your medical images as a patient
You do not have control over the technical infrastructure of your radiologist. However, you can adopt a few concrete reflexes.
Check that the online portal where you view your results uses an encrypted connection (the address starts with “https”). If you receive a link by email, make sure it comes from the facility before clicking. Never transmit your images via unencrypted regular messaging: a simple email can be intercepted.
You can also exercise your rights under the GDPR by asking your radiologist what security measures are applied to the storage of your images, and whether the host is indeed HDS certified. This right to information is part of the French regulatory framework.
The transmission chain of your medical images relies on solid technical standards, from the DICOM format to certified HDS servers. Vulnerabilities mainly exist at junctions: when a file changes hands, when a server is misconfigured, when a user clicks too quickly. The technical vigilance of professionals and the daily vigilance of patients form two sides of the same protection.