Cybersecurity threats in medical imaging and patient care

A compromised imaging system can threaten both patient information and the reliability of diagnostic services. Cybersecurity threats in medical imaging include attacks on PACS, connected devices, and the systems that move images and data; according to the American Hospital Association, 74% of hospitals experienced direct patient care impacts from the Change Healthcare cyberattack. In the United States, HIPAA sets national standards for protecting patient health information, including images, according to the U.S. Department of Health and Human Services.

It’s easy to think of cybersecurity threats in medical imaging as an IT issue, but a disruption can reach the reading room and affect care. Knowing where imaging systems are exposed helps teams protect patient confidentiality, image integrity, and access to diagnostic tools.

This article explains how legacy PACS, unsecured image exchanges, and connected medical devices can create risk, and how encryption, access controls, and staff training can help reduce it. It also covers the potential effects of attacks on diagnostic services and patient care.

Legacy imaging systems and encryption challenges

Older PACS and modality software may leave image archives, interfaces, and network pathways exposed if they cannot support current safeguards. During an incident, isolate affected systems, preserve logs, activate clinical downtime and response plans, then assess image access, integrity, and potential exposure before reconnecting services.

Encryption for Stored and Transmitted Images

Encryption at rest protects images stored on PACS servers, modality storage, and backup archives; encryption in transit protects images moving between systems. AES-256 is recommended for stored images. These safeguards make exposed files harder to read, including if an archive or backup is accessed without authorization.

Legacy equipment can complicate security because it may not support modern encryption or may rely on older interfaces. Map where each image is created, stored, backed up, and transmitted. Identify which systems can encrypt data directly and where a secure gateway may be needed. Protect encryption keys and limit access to staff who need them.

PACS emerged in the 1980s, while DICOM was standardized in the 1990s. Those foundations support image exchange, but older implementations may lack protections expected of current network environments. Review each connection, including modality-to-PACS transfers and archive-to-backup traffic, rather than treating the central server as the only security boundary.

Network Segmentation and Interface Encryption

Network segmentation separates imaging systems into controlled zones, while interface encryption protects data in transit. Together, these measures can limit an intruder’s path from a compromised workstation to PACS or modality systems. Protect data moving between imaging devices, archives, and connected healthcare systems.

Secure DICOM communications with Transport Layer Security (TLS 1.3), where supported. Document the systems and interfaces involved before implementation, then test image transfer and clinical workflows. Segmentation rules should permit necessary diagnostic traffic while restricting unrelated access. That balance helps preserve routine image exchange without leaving every connected system open to the same network paths.

• Separate imaging equipment, PACS, and general-purpose workstations into controlled network zones.
• Allow only required connections between zones, and review those rules when systems change.
• Test encrypted transfers to confirm images remain accessible to authorized clinical users.

In the United States, healthcare data breaches involving 500 or more patients are publicly reported by the responsible organizations, according to the U.S. Department of Health and Human Services. Clear network maps, preserved logs, and documented encryption controls can help teams assess an incident’s scope and identify affected image pathways.

Medical imaging organizations are advised to apply encryption throughout interface and data pathways, carrying this protection across all points rather than only selected connections.

Security risks from interconnected medical devices

Connected imaging devices can expose patient data and create pathways into hospital networks. In the United States, HIPAA sets national standards for protecting patient health information, including images, according to the U.S. Department of Health and Human Services.

DICOM and Patient Information Security

DICOM is the standard used to format and exchange medical images, along with information that can identify a patient. Its security depends on how hospitals configure the protocol, connected systems, and network access. Aplite researchers reported that legacy DICOM exposed around 60 million medical imaging records over the past few decades.

Protect the entire image pathway, not only the PACS archive. Secure DICOM communications with Transport Layer Security (TLS 1.3), restrict which systems can connect, and limit access to patient records by role. These controls reduce exposure as images move between scanners, workstations, and storage.

Security and Clinical Workflow

Clinical security means protecting systems without blocking the image access staff need to provide care. Controls that disrupt image transfers or prevent radiologists from opening studies can impede routine work. Map essential clinical connections first, then allow necessary traffic while restricting unrelated access between network segments.

Test security changes with clinical teams before implementation. For example, verify that authorized staff can retrieve studies and that connected systems still exchange images. Medical imaging organizations must balance cybersecurity measures with the ability to perform their work. Documenting approved access paths helps teams respond to changes without disrupting clinical workflows.

Medical Device and Vendor Security

Connected devices expand the hospital network, and cloud computing, analytics, and enterprise imaging add further connections. The number of medical devices per patient bed increased by 62 percent between 1995 and 2010. Hospitals had an average of 13 medical devices per patient bed at the time of the report.

Vendor involvement matters because device setup and maintenance affect security. Conduct acceptance testing with the device vendor to assess possible vulnerabilities. Review remote connections, account permissions, and how updates are handled. In 2021, a network-connected ultrasound machine in the United States was compromised through default manufacturer credentials and became a pivot point for exploring the hospital network.

Imaging Device Vulnerabilities

MRI, CT, ultrasound, and X-ray systems can face risks from outdated software, exposed network interfaces, weak credentials, or insecure image transfers. These are potential weaknesses across connected equipment, not a claim that every device has each flaw. Legacy operating systems and unsupported components can also make security updates harder to implement.

Assess each device’s software, network connections, and data flows with its vendor. Replace outdated devices as a cybersecurity measure when they cannot support necessary protections. Frameworks such as IEC 62443 are increasingly applied to healthcare networks, while IEC 60601 addresses IT security requirements for medical electrical equipment. Acceptance testing helps identify device-specific issues before clinical use.

Zero-trust access, firewalls, and employee training

Protect PACS, imaging devices, and cloud-based imaging with authenticated access, network firewalls, controlled connections, and employee training. These safeguards can help limit unauthorized entry while keeping approved clinical workflows available.

Zero-Trust Access and Firewalls

Zero-trust access verifies each user and connection instead of automatically trusting traffic from inside a hospital network. This approach can help contain an attack by limiting access to the systems and patient information needed for each person’s role.

Authenticate users before they reach PACS, imaging workstations, or remote access points. Assign permissions by job function and remove access when responsibilities change. Firewalls can restrict traffic between network zones, allowing only connections needed for image transfer or clinical applications. For example, a general workstation should not automatically reach every imaging device.

Review firewall rules as systems and workflows change. A rule created for an older scanner or vendor connection may leave an unnecessary pathway open after that connection is retired. Record the purpose and owner of each permitted connection, then remove rules that no longer support clinical work.

Controls for PACS, Devices, and Cloud Imaging

Layered controls protect image storage, connected devices, and cloud-based services by managing identity, network access, and data movement. This matters because a weak account or exposed connection can give an intruder a route into other systems.

For PACS, restrict administrative access and separate it from ordinary user access. For imaging devices, limit connections to the systems needed for their clinical function. For cloud imaging, apply the same access discipline to users, interfaces, and transfers. Track which parties can access or support each system, including manufacturers and other authorized vendors.

Cybersecurity training for all employees is recommended for medical imaging organizations. Training should address practical examples, such as recognizing suspicious messages, protecting credentials, and reporting unexpected access prompts. A 2015 phishing attack on UC Davis Health may have compromised the personal health information of 15,000 patients. That example shows why staff awareness belongs alongside technical safeguards.

Make reporting straightforward. Employees should know how to alert the security team when a message seems suspicious or a workstation behaves unexpectedly. Share relevant threat intelligence with responsible internal teams and authorized parties, then use it to update access rules and staff guidance. Strategic planning and a strong cybersecurity culture make these controls part of routine operations, not just a response after an attack.

Strategic planning and a strong cybersecurity culture are essential to protecting healthcare organizations. Treat security as an ongoing priority that reinforces access controls, firewall practices, and employee training. When it is part of organizational planning and everyday workplace culture, technical safeguards and staff awareness support a shared effort.

Cyberattacks’ impact on diagnostic services and patient care

A cyberattack can interrupt image access, delay diagnosis, expose sensitive records, or undermine confidence in scan integrity. Teams can assess effects by tracking care disruptions, affected patients, recovery time, and changes to diagnostic decisions. These measures connect technical incidents with operational and clinical consequences.

The American Hospital Association reported that 74% of hospitals experienced direct patient care impacts from the Change Healthcare cyberattack. It also reported that 40% of hospitals said patients had difficulty accessing care because of attack-related delays. These findings show how a connected healthcare disruption can affect patients beyond the systems initially compromised, including access to services that rely on timely information exchange.

Radiology workflows rely on connected systems for scheduling, image retrieval, interpretation, and report distribution. If one part becomes unavailable, staff may need to coordinate manually, prioritize urgent cases, and track studies awaiting review. An imaging archive disruption can therefore create work beyond restoring the archive, especially when clinicians need to reconcile pending studies and reports.

Image integrity matters as much as availability. A study of malicious lung CT-image manipulation used 30 authentic scans. In a blind trial, radiologists assessed 80 complete lung CT scans without knowing the experiment’s purpose or that some scans had been altered. They diagnosed 99% of patients with injected cancer as having malignant cancer, while 94% of patients whose cancer had been removed were diagnosed as healthy.

Researchers then told radiologists about the attack and asked them to identify fake, real, and removed nodules in 20 CT scans. Even with that warning, radiologists misdiagnosed 60% of patients whose scans had cancer injected and 87% of patients whose scans had cancer removed. The findings emphasize the need to assess image provenance and clinical review, not only system availability.

Data exposure creates a separate burden for patients and healthcare teams. A national specialty radiology practice notified over 500,000 individuals about a breach. In the United States, responsible organizations publicly report healthcare data breaches involving 500 or more patients, according to the U.S. Department of Health and Human Services.

During an incident, response teams should coordinate security and clinical decisions. Preserve logs and affected images, identify studies that may be unavailable or altered, and establish a reliable route for authorized access. Clinical leaders can prioritize urgent cases and document decisions while technical teams contain the intrusion and restore systems. The response depends on the attackers’ actions, affected systems, and image integrity.

PACS vulnerabilities and unsecured medical images

PACS exposure can arise from unpatched software, weak access controls, or image stores reachable through unsecured networks. These cybersecurity threats in medical imaging can affect access to images and confidence in their integrity. Reviewing the deployment design helps teams identify where safeguards should focus.

PACS Deployment Security Risks

PACS deployment security means assessing how on-premises, cloud, and vendor-managed systems store images, control access, and connect to other networks. Each arrangement shifts responsibilities and exposure points.

On-premises PACS places storage and network configuration within the healthcare organization’s environment, making local access rules, patching, backups, and network exposure central concerns. Cloud imaging relies on secure connections, identity controls, and clearly managed data flows between the organization and hosted systems. Vendor-managed environments also need defined responsibilities for access, maintenance, and incident coordination.

No deployment model removes the need to review vulnerabilities across interfaces and users. Map where images are stored, who can access them, and how data moves between scanners, PACS, workstations, and external services. Keep an inventory of software versions and apply security updates through a documented process. Unpatched software remains a cybersecurity threat in medical imaging.

PACS security gaps have been associated with over 275 million unsecured medical images across 130 health systems. A review covers five cyber-attack scenarios affecting PACS and medical imaging networks. These findings underline why a detailed assessment should include storage, interfaces, remote access, and backup pathways, not just the main archive.

Image Tampering and AI-Related Attacks

Image tampering changes diagnostic content or associated information, while AI-related attacks can target image data or the systems that process it. These cybersecurity threats in medical imaging matter because clinicians rely on image integrity to interpret studies and make decisions.

A manipulated scan may introduce or remove a finding, or alter patient and study details. Deepfake-style alteration can make an image appear authentic while changing what it depicts. A compromised AI workflow could also affect input images or clinical outputs. The risk is not limited to stolen files: inaccurate data can mislead interpretation.

Use security measures that maintain a detailed record of image origin, transfers, and changes. Restrict editing privileges, protect accounts that manage imaging systems, and retain audit logs for review. If a study’s integrity is questioned, compare it with the original acquisition and associated records before relying on a modified copy.

Hospitals reviewing PACS exposure can review PACS security needs as part of a broader imaging workflow assessment.

SMAART Medical Systems: SMAART-PACS

SMAART Medical Systems, Inc. offers SMAART-PACS to hospitals and clinics evaluating radiology management software. It is designed to integrate with existing EMR and HIS platforms and supports radiology workflows with a diagnostic zero-footprint viewer. Cybersecurity also depends on the wider environment, configuration, and operational practices.

If you’re evaluating PACS or modernizing an imaging workflow, consider how the platform fits your current systems and security approach. SMAART-RIS supports radiology information management, while SMAART-SHARE provides cloud-based medical image sharing.

Contact SMAART Medical Systems, Inc. or visit smaart.net to explore whether SMAART-PACS fits your imaging workflow.

Build security into your next imaging decision

Make cybersecurity part of how you plan and evolve imaging operations, not a separate task deferred until a disruption occurs. Addressing cybersecurity threats in medical imaging means aligning technology decisions with clinical workflows, system integration, and the robust legal and regulatory frameworks your organization needs to maintain control of sensitive information. A practical next step is to review how your imaging software fits your existing EMR or HIS environment and how it supports the workflows your teams depend on.

SMAART Medical Systems, Inc. offers SMAART-PACS, SMAART-RIS, and SMAART-SHARE. These offerings support radiology management and image sharing needs, giving hospitals and clinics options to consider as they evaluate their imaging environment. The right discussion starts with your current systems, priorities, and plans for modernization.

Contact SMAART Medical Systems, Inc. to discuss your imaging needs and take a considered next step toward a more integrated workflow.

Frequently Asked Questions

What are the most common cybersecurity threats to medical imaging systems such as PACS and DICOM?

Common threats include ransomware, stolen credentials, unpatched software, exposed interfaces, and unauthorized changes to image data. An attacker might block access to studies, view patient information, or alter records used during interpretation. For example, a compromised staff account could expose multiple imaging applications if its permissions are too broad. Mapping threats by confidentiality, availability, and integrity helps teams identify the safeguards each workflow needs.

How do ransomware attacks disrupt radiology departments and medical imaging workflows?

Ransomware can make image archives, workstations, or supporting systems unavailable, interrupting the path from imaging order to completed report. Staff may need to match studies with orders, manage pending reads, and reconcile records after systems return. A downtime plan should explain how urgent cases are prioritized and decisions documented. Recovery should also confirm that restored studies match the correct patient records.

How can attackers exploit DICOM, HL7, and imaging network protocols?

Attackers may target weakly controlled protocol connections to access systems or interfere with data exchange. DICOM carries images and study details; HL7 messages can carry clinical and administrative information between applications. If a connection accepts unauthorized traffic or fails to validate messages, data could be exposed, misrouted, or changed. Restricting permitted systems, monitoring unexpected message patterns, and testing interfaces helps identify misuse without blocking legitimate clinical exchanges.

What are the costs and patient safety consequences of medical imaging cybersecurity breaches?

Costs can include investigation, system recovery, workflow downtime, data restoration, and required breach response. The impact depends on which systems and records are affected, how long services are disrupted, and what is needed to restore trusted data. Patient safety may be affected if clinicians cannot access a study, receive incorrect information, or face delays in interpretation. Response plans should track operational recovery and whether affected images remain reliable for care decisions.

What are the HIPAA requirements for securing medical images and radiology systems in the United States?

HIPAA sets national standards for protecting patient health information, including medical images. The article recommends safeguards such as authenticated, role-based access, encryption, and restricted network connections to protect imaging systems.