Why Secure DICOM is Poorly Accepted: Understanding the Challenges

Digital Imaging and Communications in Medicine (DICOM) is the international standard for transmitting, storing, retrieving, printing, and displaying medical imaging information. While DICOM ensures interoperability between various medical imaging devices and IT systems (such as a PACS), it traditionally lacked robust security measures, making it vulnerable to data breaches. Secure DICOM (initially introduced in 2000) addresses these shortcomings by incorporating advanced security protocols such as encryption, authentication, and secure data transmission. Despite its clear value provided, support of secure DICOM by imaging/software vendors and implementation of DICOM at the hospital level has been surprisingly limited. This blog explores possible reasons behind the poor acceptance of secure DICOM.

1. Complexity and Cost of Implementation

Implementing secure DICOM requires significant investment in both technology and personnel training. The process involves:

• Integration with Other Systems: Secure DICOM must integrate seamlessly with other healthcare information systems (HIS), electronic health records (EHR), and picture archiving and communication systems (PACS) from different manufacturers. This requirement for seamless integration often regresses to the lowest common denominator in terms of security, namely the system with the weakest security measures, thereby increasing both complexity and cost.
• Complexity: Implementing and maintaining secure DICOM within the highly complex infrastructure of imaging and IT systems is a formidable challenge. These systems often include various components from different manufacturers, each with its own protocols and limitations. This diversity forces healthcare providers to either standardize to the lowest common denominator of security capabilities or risk interoperability issues. Moreover, the involvement of external services, such as imaging centers or cloud-based storage solutions, adds another layer of complexity. Migrating to secure DICOM across these intricate dependencies is a challenge that many healthcare providers may be hesitant to undertake.
• Upgrading Existing Systems: Many healthcare facilities operate on legacy imaging systems, such as older PACS and medical imaging devices, that are incompatible with the latest security protocols. Upgrading these systems to support secure DICOM is both time-consuming and expensive. Additionally, these facilities often lack manufacturer support for such upgrades. In a mixed environment with new and legacy systems, unfortunately, the level of security across the entire ecosystem often becomes a “lowest common denominator” issue, meaning the least secure system dictates the security realized by the larger network.
• Responsibility in the Value Chain: Implementing and maintaining DICOM, including secure DICOM, involves multiple stakeholders in the healthcare value chain. This includes device manufacturers, software vendors, IT departments, clinical engineering, and clinical staff. Each party must coordinate to ensure secure integration and operation of imaging technologies, which adds complexity and potential for miscommunication or misalignment of responsibilities.
• Training Staff: Training staff, including IT professionals and healthcare providers, to use secure DICOM protocols presents significant logistical challenges for healthcare facilities. The complexity of learning and adapting to new workflows is inherent to healthcare IT systems, which often involve integrating secure DICOM protocols with existing systems, adopting new software tools, or implementing DICOM gateways. Ensuring compatibility across various medical imaging devices adds another layer of difficulty, requiring comprehensive training and coordination among all stakeholders to maintain the integrity and efficiency of medical imaging workflows (i.e., DICOM Modality Worklist).

2. Lack of Awareness and Understanding

Many healthcare providers are not fully aware of the security vulnerabilities associated with traditional DICOM protocols. This lack of awareness leads to a general underestimation of the risks and a reluctance to invest in secure alternatives. Additionally, the technical nature of DICOM security can be daunting, causing decision-makers to shy away from adopting these measures.

3. Interoperability Issues

One of the core benefits of DICOM is its ability to facilitate communication between diverse medical imaging devices and systems. However, introducing security features can sometimes create compatibility issues:

• Vendor-Specific Implementations: Manufacturers often customize their implementations of secure DICOM protocols, leading to variations that can hinder interoperability. These discrepancies can result in exchanging data between devices from different vendors, potentially affecting the reliability and efficiency of medical imaging workflows.
• Legacy Systems: Many older systems are not equipped to support the latest secure DICOM standards, creating significant barriers to full interoperability. Healthcare providers are often forced to choose between costly, disruptive system upgrades or or maintaining less secure configurations that may leave vulnerabilities. However, the challenge extends beyond just legacy systems. As new systems and technologies such as those based on HL7 FHIR R6 currently in development, are being designed, ensuring that secure DICOM is considered from the outset is critical. Failure to do so could perpetuate the same interoperability issues that plague legacy systems, making it imperative to integrate security considerations into the design of both existing and future healthcare IT infrastructures.
• Standards Evolution: As secure DICOM standards evolve to address emerging security threats, the pace of these changes can hinder the ability of existing systems to keep up. This can lead to situations where newer systems are compatible with the latest security protocols, while older systems lag behind, further complicating interoperability.
• Data Exchange Complexity: The addition of security layers to DICOM can increase the complexity of data exchanges and can result in perceived or actual impact on clinical workflows, such as image sharing or results distribution. Secure DICOM implementations may require additional encryption and authentication processes, which can introduce delays, inefficient workarounds, or technical issues in the transmission of medical images across different systems.

4. Perceived Trade-Offs Between Security and Performance

There is a widespread perception that enhancing security in medical imaging systems will come at the expense of performance. Secure DICOM protocols, such as encryption and secure transmission, can introduce latency and increase processing times, which is a critical concern in clinical environments where rapid access to medical images is essential for timely diagnosis and treatment. This latency can disrupt clinical workflows, particularly in high-pressure situations like emergency care, where delays in accessing images can directly impact patient outcomes. Additionally, the complexity of secure DICOM implementations can require changes to established clinical operation protocols, further complicating adoption. These perceived trade-offs make healthcare providers hesitant to transition to secure DICOM, fearing that the potential security benefits may not outweigh the operational risks and inefficiencies introduced.

5. Regulatory and Compliance Challenges

Regulatory and compliance challenges around DICOM imaging often revolve around ensuring that systems meet specific standards and regulations for data security, privacy, and interoperability.

• Data Privacy and Security Regulations: In the United States, Health Insurance Portability and Accountability Act (HIPAA) mandates requirements for protecting patient data. DICOM images, which contain sensitive health information, must be managed in compliance with HIPAA’s privacy and security rules, including encryption, access controls, and audit trails. Compliance with DICOM standards cover data formats, communication protocols, and image storage. Variation or deviations from established standards can lead to compatibility issues and regulatory scrutiny.
• Medical Device Regulations: Medical imaging systems must comply with specific regulations set out by the FDA (in the U.S.) and MDR/IVDR in Europe, which must meet performance and safety standards, including requirements for security.

Healthcare organizations and imaging vendors must stay informed about regulatory changes and implement robust compliance strategies to ensure the secure and effective use of DICOM imaging systems.

6. Economic Considerations

For many healthcare institutions, especially smaller clinics and hospitals, the financial burden of transitioning to secure DICOM is a significant deterrent. Budget constraints often lead to prioritizing immediate clinical needs over long-term security investments. Yet, at the same time concerns about data breaches and the potential for fines, revenue loss, or reputational damage should motivate healthcare providers to develop plans to transition to more secure implementations.

Conclusion

The poor acceptance of secure DICOM is a multifaceted issue, rooted in complexity, cost, lack of awareness, interoperability issues, performance concerns, and regulatory challenges. Overcoming these barriers will require concerted efforts from all stakeholders, including healthcare providers, technology vendors, and regulatory bodies. By addressing these challenges, the healthcare industry can move towards a more secure and reliable future for medical imaging.

Navigating the FDA submission process doesn’t have to be a daunting task. With Medcrypt’s experienced team by your side, you can streamline your submission preparation, prioritize cybersecurity remediation, and achieve program maturity. Our unique approach, coupled with a deep understanding of FDA expectations, ensures your medical devices are compliant and secure in an ever-evolving threat landscape. Trust Medcrypt to be your partner in achieving FDA cybersecurity readiness and ensuring the safety of your innovations.

Don’t know where to start? Start by taking our complimentary FDA Cybersecurity Filing Readiness Survey.

‍