Images that follow the radiologist: DICOM over encrypted links between fourteen imaging centers
A radiology group with 14 imaging centers and 3 hospital reading rooms, a leader in its segment.
- Scale
- 17 sites, ~1.2 million studies a year, 1 Gb/s circuits, 10 Gb/s at the data centers, 2-site VNA
- Engagement
- Design, phased migration and operation over 12 months
The challenge
Radiologists read from wherever the work is. A CT study of several hundred megabytes was taking minutes to open across the WAN, modalities sent images in clear text, and many of those machines ran operating systems that could no longer be patched. Each center kept its own archive, so a lost disk meant a lost study.
Radiology reads are a logistics problem. A CT study can run to several hundred megabytes and a breast tomosynthesis study to a gigabyte or more, and the radiologist who should read it may be in another city. This group had 14 imaging centers and three hospital reading rooms. Studies were taking minutes to open over the WAN, modalities sent images in clear text, many of those machines ran operating systems that could no longer be patched, and each center kept its own archive. A lost disk meant a lost study.
DICOM was designed for trusted local networks, so we put the trust back in the network. Every modality (CT, MR, digital radiography, mammography) sits on a dedicated VLAN per center. A firewall allows each one to talk only to named PACS application entity (AE) titles, addresses and ports, and nothing to the internet. Between sites and the archive we use DICOM secure transport per PS3.15, with TLS 1.2 or later and mutual certificates. Where an old modality cannot speak TLS, a local gateway terminates the connection and forwards it inside a protected tunnel, which contains the machine rather than forcing a replacement.
Speed came from changing how images travel. The diagnostic viewer uses DICOMweb (STOW-RS, QIDO-RS and WADO-RS over HTTPS), so images stream progressively and the first slices are on screen in about two seconds, rather than a whole study being copied first. Routing rules prefetch a study to the reading radiologist's site before they open it. IPsec tunnels (IKEv2, AES-GCM) run over redundant circuits, and QoS puts interactive viewing ahead of bulk transfers. Orders and results use HL7 v2 over MLLP inside TLS, and the referring-physician portal uses FHIR R4 resources such as ImagingStudy and DiagnosticReport.
The vendor-neutral archive (VNA) is what ended the lost-disk problem. It stores studies in native DICOM in two datacenters: flash for recent studies, object storage for older ones, and an immutable second copy at the other site. Because the archive is vendor neutral, the group can change viewer or PACS software without migrating the images themselves. Replication is monitored, and a restore of a random study is tested every month.
Access follows the same rules as the rest of the design. Radiologists and staff sign in with MFA, break-glass accounts are separate and alarmed, and every study opened is logged with who, when and from where, which supports the audit-control and transmission-security expectations of the HIPAA Security Rule, 45 CFR 164.312. Compliance is a program the group runs; the network supplies the evidence. Typical CT studies now open in seconds, every link is encrypted, and a failed disk or a failed site no longer costs a read. Our HIPAA Security Rule checklist covers the wider program.
What our team delivered
- Modalities (CT, MR, digital radiography, mammography) on a dedicated VLAN per center, with a firewall that allows only named application entity (AE) titles, IP addresses and ports to the PACS, and nothing to the internet
- DICOM secure transport per PS3.15, using TLS 1.2 or later with mutual certificate authentication between modalities, gateways and the archive; where an old modality cannot speak TLS, a local gateway terminates it and forwards inside a protected tunnel
- DICOMweb (STOW-RS, QIDO-RS, WADO-RS) over HTTPS for the diagnostic viewer, so images stream progressively instead of copying whole studies, with the first images on screen in about two seconds
- HL7 v2 over MLLP inside TLS for orders and results, and FHIR R4 resources (ImagingStudy, DiagnosticReport) for the referring-physician portal
- A vendor-neutral archive (VNA) in two datacenters that stores studies in native DICOM, with hot flash for recent studies, object storage for older ones and an immutable second copy at the other site
- IPsec (IKEv2, AES-GCM) between sites on redundant circuits, QoS that puts interactive viewing ahead of bulk prefetch, and routing rules that move a study to the reading radiologist's site before they open it
- Role-based access with MFA, break-glass accounts and audit logging of every study opened, aligned with HIPAA 45 CFR 164.312
Result
Typical CT studies open in seconds rather than minutes, images are encrypted on every link, old modalities are contained rather than replaced, and every study exists in two places, so a failed disk or a failed site does not lose a read.
Backup tiers: data lost versus time to recover
Recovery point objective (RPO) is how much recent data a restore loses; recovery time objective (RTO) is how long the restore takes. Faster tiers sit close to the production system and share its fate; slower tiers survive ransomware and site loss. The scale is logarithmic. Illustrative figures.
Separate by region and by business unit
Each business unit lives in its own VRF and VLAN in every region, so a problem in retail cannot reach finance. Traffic between units has to pass a firewall that denies by default and allows only what is written down.
Defense in depth, on a loop
Every device on your network sits behind a monitored firewall with two internet circuits, so attacks are stopped at the door and a provider outage does not stop the business.
Every sign-in, verified
Staff sign in once, but behind the scenes the device, the identity, a phone approval and your access policy are all checked before any app opens, and strangers are turned away.
Facing something similar?
Tell us about your environment. We will tell you plainly what we would do and what it would take.