Medical Imaging Cybersecurity

Inventory the modality, acquisition console, PACS or VNA, diagnostic workstation, worklist broker, cloud viewer, remote service channel, and update infrastructure. Trace a study from patient scheduling to acquisition, storage, retrieval, and interpretation. Record software versions, owners, trust boundaries, supported connections, and the clinical consequences of losing each service. Deliverable: an architecture and asset map, not just a list of scanner IP addresses.

Maintain a per-release SBOM for the device and its supplied imaging software, including operating systems, DICOM libraries, codecs, web viewers, and remote-service agents. Reconcile supplier advisories and vulnerability feeds against deployed versions and configurations. CISA's INFINITT PACS advisory is a product-specific example of why archive management services belong in scope; it does not imply every PACS is affected. Deliverable: a version-linked finding and affected-installation register.

Use technical severity such as CVSS alongside a clinical-risk assessment. Consider delayed emergency imaging, loss of prior studies, wrong-patient association, altered pixel data or metadata, and exposure of patient information. Document attacker access, vulnerable code reachability, existing controls, and whether a failure could affect multiple patients. An illustrative scenario is an archive outage that delays urgent interpretation; assess it against the actual intended use rather than assuming a universal severity. Deliverable: a justified risk decision for each finding.

DICOM PS3.15 defines security and system management profiles, but DICOM conformance is not a security guarantee. Check the implementation's conformance statement and validate supported secure transport, certificate handling, audit events, and local access controls. An AE Title or allowed IP address is not a substitute for cryptographic peer authentication. For DICOMweb and viewers, verify user authorization on study search, retrieval, export, and administration. Deliverable: a tested configuration baseline with documented legacy exceptions.

On an isolated representative system, use synthetic or appropriately de-identified studies to test malformed DICOM objects, parser errors, oversized requests, unauthorized study changes, patient/study mismatch, and unexpected import behavior. The CISA DICOM alert illustrates a specific file-handling concern, not evidence that all DICOM files are malware. Define acceptance criteria for pixel data, metadata, and study association after storage, transfer, and retrieval. Do not run disruptive fuzzing or stress tests against equipment serving patients. Deliverable: reproducible test results and risk-linked remediation evidence.

For a device submission, connect each imaging threat to its security requirement, architecture control, verification result, and residual-risk rationale. Include the supplied system's SBOM, update approach, vulnerability-management plan, and security information needed by the healthcare delivery organization. FDA guidance describes agency recommendations; Section 524B obligations depend on whether the product is a cyber device. Assess PACS, viewers, accessories, and connected services individually rather than treating all hospital infrastructure as the same regulated product. Deliverable: an indexed evidence map for regulatory review.

Use the same coordinated vulnerability disclosure and PSIRT workflow as the vulnerability-management guide. Ask reporters for product and software versions, affected interfaces, reproduction details, and potential clinical effects, without requesting identifiable patient studies. Assign engineering, clinical, quality, and regulatory owners; coordinate with suppliers and affected hospitals. Publish your own acknowledgment and response commitments rather than presenting a sample service target as a statutory deadline. Deliverable: an intake record, ownership decision, and communication plan.

Agree on permitted flows between modalities, archives, viewers, and integration services. Restrict remote service access, apply least privilege, and monitor unexpected exports or administrative activity. When patching is delayed, validate compensating controls with clinical engineering and radiology; an overly broad firewall change can block worklists or study transfer. Segmentation reduces exposure but does not repair vulnerable code. Deliverable: a time-bounded mitigation plan with clinical approval, limitations, and a reassessment owner.

Verify the vulnerability fix, then regression-test acquisition, image quality, worklist selection, patient and study identity, archive transfer, retrieval, diagnostic viewing, and required integrations. Exercise certificate rotation, interrupted installation, and a supported rollback or recovery path. Test representative supported modality/archive combinations rather than one happy-path transfer. Record the software build and test-study identifiers so the evidence can be reproduced. Deliverable: a security-fix retest and signed release decision with clinical verification evidence.

Provide affected-version information, installation prerequisites, supported maintenance windows, compensating controls, and post-installation checks. Update the released SBOM and exploitability statements while retaining prior version records for hospitals that have not upgraded. Separate manufacturer responsibilities from hospital deployment responsibilities and confirm who verifies completion. Deliverable: a release advisory, version-specific evidence, and deployment status rather than a raw CVE count.

Rehearse loss of the archive, viewer, modality network, and remote reporting service with radiology and clinical engineering. Test restoration of images, configuration, access controls, and audit records from protected backups. Check how locally queued studies, corrected patient identifiers, and duplicate or missing transfers are reconciled after recovery. Validate restored studies before relying on them for diagnosis. Deliverable: a tested downtime and recovery runbook with locally agreed clinical recovery objectives.

Feed findings and incidents back into the threat model, SPDF, supplier requirements, and verification plan. Track response and deployment performance alongside unresolved clinical risk. For unsupported equipment, document the limits of compensating controls and agree on replacement or retirement criteria. During decommissioning, address stored studies, credentials, certificates, removable media, and retained clinical records. Deliverable: an updated risk file and an owned support or retirement decision.