DICOM imaging studies contain protected health information — patient name, date of birth, scan date, and facility information are all embedded in the file metadata. Sending these files via regular email, consumer file-sharing services, or other unsecured methods creates HIPAA compliance exposure. Here is what law firms need to know about secure DICOM transfer.
Why DICOM Files Require Secure Transfer
DICOM files are not ordinary documents. Each file contains embedded metadata that includes the patient's name, date of birth, the date and time of the scan, the imaging facility, and technical parameters. This metadata constitutes protected health information under HIPAA.
Law firms handling medical records — including imaging studies — have obligations around how that information is transmitted. Sending DICOM files via regular email or uploading them to a standard consumer file-sharing service (Dropbox, Google Drive, WeTransfer) does not meet those obligations.
What Not to Do
Do not email DICOM files as attachments via standard email. Do not upload DICOM files to consumer file-sharing services. Do not share DICOM files via text message or messaging apps. Do not post DICOM files to shared drives without appropriate access controls.
These methods are convenient but create real compliance exposure — and they are the methods most commonly used by attorneys who have not thought through the issue.
Secure Transfer Options
Physical media is the most straightforward option: mail the original CD or a copy directly to the recipient. This avoids digital transmission entirely and provides a clear chain of custody.
For digital transfer, options include HIPAA-compliant secure file transfer services, encrypted email with appropriate agreements in place, and working through a litigation imaging service that provides secure transfer as part of their process. A professional imaging service will specify their approved transfer methods and provide instructions after a quote is confirmed.
Sending to Your Expert Witness
The same considerations apply when sending DICOM files to your medical expert witness. Your expert may have their own preferred secure transfer method. If not, physical media is a reliable fallback. A litigation imaging service can also coordinate delivery of the DICOM study to your expert as part of the imaging order.
A Note on Chain of Custody
In litigation, how imaging studies are handled and transferred can become relevant. Using a professional imaging service with documented processes — secure transfer, case identification, controlled access — provides a defensible chain of custody for the imaging materials.
Lightning Medical provides medical image reproduction and litigation-support services. Lightning Medical does not provide medical diagnoses, radiological interpretations, medical opinions, or legal advice.